Symbol EX-3524, EX-3548 Reference Manual

EX-3524/EX-3548
Layer 2 Gigabit Ethernet PoE/PoE+ Switch

CLI Reference Guide

www.edge-core.com

Zebra and the Zebra head graphic are registered trademarks of ZIH Corp. The Symbol logo is a
registered trademark of Symbol Technologies, Inc., a Zebra Technologies company.

© 2015 Symbol Technologies, Inc.

– 2 –

How to Use This Guide

This guide includes detailed information on the switch software, including how to
operate and use the management functions of the switch. To deploy this switch
effectively and ensure trouble-free operation, you should first read the relevant
sections in this guide so that you are familiar with all of its software features.

Who Should

Read this Guide?

How this Guide

is Organized

Related

Documentation

This guide is for network administrators who are responsible for operating and
maintaining network equipment. The guide assumes a basic working knowledge of
LANs (Local Area Networks), the Internet Protocol (IP), and Simple Network
Management Protocol (SNMP).

This guide describes the switch’s command line interface (CLI). For more detailed
information on the switch’s key features refer to the System Reference Guide.

The guide includes these sections:

◆ Section I “Getting Started” — Includes information on initial configuration.

◆ Section II “Command Line Interface” — Includes all management options

available through the CLI.

◆ Section III “App endices” — Includes information on troubleshooting switch

management access.

This guide focuses on switch software configuration through the CLI.

For information on how to manage the switch through the Web management
interface, see the following guide:

System Reference Guide

For information on how to install the switch, see the following guide:

Installation Guide

For all safety information and regulatory statements, see the following documents:

Quick Start Guide
Safety and Regulatory Information

– 3 –

How to Use This Guide

Conventions The following conventions are used throughout this guide to show information:

Note:

Emphasizes important information or calls your attention to related features

or instructions.

Caution:

Alerts you to a potential hazard that could cause loss of data, or damage

the system or equipment.

War ning:

Alerts you to a potential hazard that could cause personal injury.

Revision History This section summarizes the changes in each revision of this guide.

December 2014 Revision

This is the third version of this guide. This guide is valid for software release
v5.0.0.0-07D. This release includes a major change in the underlying software
platform. It contains the following changes:

◆ Updated data displayed by the commands "show access-list tcam-utilization"

on page 99, "show memory" on page 100, and "show process cpu" on page 100

◆ Updated syntax for "show running-config" on page 101.

◆ Added the command "show tech-support" on page 104.

◆ Updated display output for the command "show version" on page 106.

◆ Added the commands "show watchdog" on page 107 and "watchdog software"

on page 107.

◆ Updated syntax for the command "copy" on page 110.

◆ Updated syntax for the command "delete" on page 113.

◆ Added the command "upgrade opcode reload" on page 118

◆ Added the section "TFTP Configuration Commands" on page 118.

◆ Removed the “auto” option from the command "speed" on page 127.

◆ Added the command "terminal" on page 129.

◆ Updated display output for the command "show line" on page 130.

– 4 –

How to Use This Guide

◆ Updated syntax for the commands "logging host" on page 133 and "logging

sendmail host" on page 138.

◆ Added the section "NTP Commands" on page 145.

◆ Added the commands "clock summer-time (predefined)" on page 150 and

"clock summer-time (recurring)" on page 151.

◆ Removed the command “clock timezone-predefined” from the section "Manual

Configuration Commands" on page 149.

◆ Added the section "Adopt Device" on page 164.

◆ Updated syntax for the command "snmp-server enable traps" on page 176.

◆ Added the commands "snmp-server enable port-traps mac-notification" on

page 179 and "show snmp-server enable port-traps" on page 180.

◆ Added the section "Additional Trap Commands" on page 192.

◆ Updated description of “level” parameter for the command "enable password"

on page 204.

◆ Updated description of “access level” parameter for the command "username"

on page 205.

◆ Added the commands "privilege" on page 207 and "show privilege" on

page 207.

◆ Updated syntax for the command "tacacs-server host" on page 215.

◆ Added the commands "tacacs-server retransmit" on page 216 and "tacacs-

server timeout" on page 217.

◆ Added the commands "aaa accounting commands" on page 219 and

"accounting commands" on page 225.

◆ Updated syntax for the command "show accounting" on page 228.

◆ Added the command "dot1x max-reauth-req" on page 248.

◆ Added the section "PPPoE Intermediate Agent" on page 262.

◆ Added the command "mac-learning" on page 272.

◆ Added the command "show port security" on page 275.

◆ Updated syntax for the command "ip dhcp snooping information option" on

page 299.

– 5 –

How to Use This Guide

◆ Added the commands "ip dhcp snooping information option encode no-

subtype" on page 300, "ip dhcp snooping information option remote-id" on
page 301, "ip dhcp snooping limit rate" on page 303, and "ip dhcp snooping
information option circuit-id" on page 305.

◆ Updated display output for the command "show ip dhcp snooping" on

page 308.

◆ Added the section "DHCPv6 Snooping" on page 309.

◆ Updated syntax for the commands "ip source-guard binding" on page 319 and

"ip source-guard max-binding" on page 323.

◆ Added the command "clear ip source-guard binding blocked" on page 323.

◆ Added the command "ip source-guard mode" on page 324.

◆ Updated syntax for the command "show ip source-guard binding" on

page 325.

◆ Added the section "IPv6 Source Guard" on page 326.

◆ Added “allow-zeros” parameter to the command "ip arp inspection validate" on

page 335.

◆ Updated command in the section "Denial of Service Protection" on page 340.

◆ Updated command in the section "Port-based Traffic Segmentation" on

page 346.

◆ Removed “redirect-to” interface options from all permit and deny commands in

the chapter "Access Control Lists" on page 351.

◆ Removed “tos” parameter from the command "permit, deny (Extended IPv4

ACL)" on page 354.

◆ Added “counter” parameter to the commands "ip access-group" on page 356,

"ipv6 access-group" on page 362 and "mac access-group" on page 369.

◆ Updated syntax for the command "permit, deny(MAC ACL)" on page 365.

◆ Added “log” parameter to the command "permit, deny (ARPACL)" on page 371.

◆ Added the command "clear access-list hardware counters" on page 373, and

added “hardware counters” parameter to the command "show access-list" on

page 374.

◆ Removed the “symmetric” parameter from the command "capabilities" on

page 379.

– 6 –

How to Use This Guide

◆ Added the command "media-type" on page 382.

◆ Removed the command “giga-phy-mode” from the chapter "Interface

Commands" on page 377.

◆ Updated display output for the command "show interfaces status" on

page 388.

◆ Added the section "Transceiver Threshold Configuration" on page 390.

◆ Added the command "port-channel load-balance" on page 404, "lacp timeout"

on page 411, and "show port-channel load-balance" on page 415.

◆ Added the commands "power mainpower maximum allocation" on page 418

and "show power mainpower" on page 424.

◆ Removed the command “show power poe” from the chapter "Power over

Ethernet Commands" on page 417.

◆ Updated syntax for the command "port monitor" on page 425.

◆ Reduced the maximum number of mirror sessions from two to one for all

relevant local mirror and remote mirror commands in the chapter "Port

Mirroring Commands" on page 425.

◆ Addedthe chapter "Loopback Detection Commands" on page 453.

◆ Added the command "spanning-tree system-bpdu-flooding" on page 472.

◆ Updated syntax for the command "spanning-tree bpdu-guard" on page 478.

◆ Updated syntax for the command "spanning-tree loopback-detection action"

on page 482.

◆ Added the command "spanning-tree port-bpdu-flooding" on page 486.

◆ Added the command "spanning-tree tc-prop-stop" on page 488.

◆ Updated syntax for the command "show spanning-tree" on page 490.

◆ Added the command "switchport dot1q-tunnel service match cvid" on

page 518.

◆ Updated syntax and display output for the command "show dot1q-tunnel" on

page 520.

◆ Added the section "Configuring L2CP Tunneling" on page 521.

◆ Added the “priority” parameter to the command "protocol-vlan protocol-group

(Configuring Interfaces)" on page 527.

– 7 –

How to Use This Guide

◆ Added the “mask” parameter to the command "mac-vlan" on page 532.

◆ Added the “match-all” option to the command "class-map" on page 554.

◆ Updated syntax for the command "match" on page 556.

◆ Updated range for "Quality of Service Commands" on page 553.

◆ Added the command "ip igmp snooping priority" on page 574.

◆ Added the commands "clear ip igmp snooping groups dynamic" on page 588

and "clear ip igmp snooping statistics" on page 589.

◆ Updated syntax for the command "show ip igmp snooping" on page 589 and

"show ip igmp snooping group" on page 590.

◆ Added the commands "ip igmp authentication" on page 599, "ip igmp query-

drop" on page 603, "ip multicast-data-drop" on page 603, "show ip igmp
authentication" on page 604, "show ip igmp query-drop" on page 606, and
"show ip multicast-data-drop" on page 607.

◆ Added the sections "MLD Snooping" on page 608 and "MLD Filtering and

Throttling" on page 621.

◆ Replaced command set for "Multicast VLAN Registration for IPv4" on page 630.

◆ Added the section "Multicast VLAN Registration for IPv6" on page 654.

◆ Added the command "lldp dot3-tlv mac-phy" on page 684.

◆ Removed the command “ipv6 dhcp client rapid-commit vlan” from the section

"DHCP for IPv6" on page 716.

◆ Updated syntax for the command "ip address" on page 724.

◆ Added the command "traceroute6" on page 752.

◆ Added the command "ipv6 nd raguard" on page 757 and "show ipv6 nd

raguard" on page 759.

◆ Added the section "ND Snooping" on page 761.

◆ Added the command "ip sw-route" on page 772.

September 2014 Revision

This is the second version of this guide. This guide is valid for software release
v4.0.1.0-04R. It contains the following changes:

◆ Updated syntax description for the command "snmp-server user" on page 183.

– 8 –

How to Use This Guide

◆ Added the command "clear ip dhcp snooping binding" on page 307.

◆ Updated description for the command "spanning-tree bpdu-filter" on

page 477.

◆ Updated usage information for the command "spanning-tree port-priority" on

page 486.

◆ Updated syntax for the command "switchport trunk allowed vlan" on page 509.

◆ Updated syntax for the command "switchport trunk native vlan" on page 510.

◆ Added the commands "switchport trunk allowed vlan" on page 509 and

"switchport trunk native vlan" on page 510.

◆ Updated configuration procedure for protocol-based VLANs. See "Configuring

Protocol-based VLANs" on page 525.

◆ Updated command usage for "subnet-vlan" on page 530.

◆ Updated command usage for "mac-vlan" on page 532.

◆ Updated usage information for the command "voice vlan aging" on page 535.

◆ Updated usage information for the command "show voice vlan" on page 539.

◆ Added the command "show lldp neighbors" on page 696.

◆ Updated display text for the command “show cdp neighbors detail” on

page 703.

◆ Changed default setting for the command "ip dhcp client class-id" on page 714.

◆ Removed the command “show ip dhcp client-identifier” on page 542.

◆ Updated output display for the command "show ip interface" on page 727.

March 2014 Revision

This is the first version of this guide. This guide is valid for software release
v4.0.0.0-02R.

– 9 –

How to Use This Guide

– 10 –

Contents

How to Use This Guide 3

Contents 11

Figures 41

Tables 43

Section I Getting Started 49

1 Initial Switch Configuration 51

Connecting to the Switch 51

Configuration Options 51

Connecting to the Console Port 52

Logging Onto the Command Line Interface 53

Setting Passwords 53

Remote Connections 54

Configuring the Switch for Remote Management 55

Using the Network Interface 55

Setting an IP Address 55

Enabling SNMP Management Access 61

Managing System Files 63

Upgrading the Operation Code 64

Saving or Restoring Configuration Settings 65

Automatic Installation of Operation Code and Configuration Settings 66

Downloading Operation Code from a File Server 66

Specifying a DHCP Client Identifier 69

Downloading a Configuration File Referenced by a DHCP Server 69

Setting the System Clock 71

Setting the Time Manually 72

Configuring SNTP 72

– 11 –

Contents

Configuring NTP 73

Section II Command Line Interface 75

2 Using the Command Line Interface 77

Accessing the CLI 77

Console Connection 77

Telnet Connection 78

Entering Commands 79

Keywords and Arguments 79

Minimum Abbreviation 79

Command Completion 79

Getting Help on Commands 80

Partial Keyword Lookup 82

Negating the Effect of Commands 82

Using Command History 82

Understanding Command Modes 82

Exec Commands 83

Configuration Commands 83

Command Line Processing 85

CLI Command Groups 86

3 General Commands 89

prompt 89

reload (Global Configuration) 90

enable 91

quit 92

show history 92

configure 93

disable 94

reload (Privileged Exec) 94

show reload 95

end 95

exit 95

– 12 –

Contents

4 System Management Commands 97

Device Designation 97

hostname 98

System Status 98

show access-list tcam-utilization 99

show memory 100

show process cpu 100

show running-config 101

show startup-config 102

show system 103

show tech-support 104

show users 105

show version 106

show watchdog 107

watchdog software 107

Frame Size 107

jumbo frame 107

File Management 108

General Commands 109

boot system 109

copy 110

delete 113

dir 114

whichboot 115

Automatic Code Upgrade Commands 115

upgrade opcode auto 115

upgrade opcode path 117

upgrade opcode reload 118

show upgrade 118

TFTP Configuration Commands 118

Line 120

ip tftp retry 118

ip tftp timeout 119

show ip tftp 119

line 121

– 13 –

Contents

databits 121

exec-timeout 122

login 123

parity 124

password 124

password-thresh 125

silent-time 126

speed 127

stopbits 127

timeout login response 128

disconnect 129

terminal 129

show line 130

Event Logging 131

logging facility 131

logging history 132

logging host 133

logging on 133

logging trap 134

clear log 135

show log 135

show logging 136

SMTP Alerts 138

logging sendmail 138

logging sendmail host 138

logging sendmail level 139

logging sendmail destination-email 140

logging sendmail source-email 140

show logging sendmail 141

Time 141

SNTP Commands 142

sntp client 142

sntp poll 143

sntp server 144

show sntp 144

– 14 –

Contents

NTP Commands 145

ntp authenticate 145

ntp authentication-key 146

ntp client 147

ntp server 147

show ntp 148

Manual Configuration Commands 149

clock summer-time (date) 149

clock summer-time (predefined) 150

clock summer-time (recurring) 151

clock timezone 153

calendar set 153

show calendar 154

Time Range 155

time-range 155

absolute 156

periodic 157

show time-range 158

Switch Clustering 158

cluster 159

cluster commander 160

cluster ip-pool 161

cluster member 161

rcommand 162

show cluster 163

show cluster members 163

show cluster candidates 163

Adopt Device 164

controller hello-interval adjacency-hold-time 166

controller host ip address 166

adoptd upgrade 167

debug adoption 168

no adoption 168

show adoption debug 168

show adoption history 169

– 15 –

Contents

show adoption status 170

5 SNMP Commands 171

General SNMP Commands 173

snmp-server 173

snmp-server community 173

snmp-server contact 174

snmp-server location 175

show snmp 175

SNMP Target Host Commands 176

snmp-server enable traps 176

snmp-server host 177

snmp-server enable port-traps mac-notification 179

show snmp-server enable port-traps 180

SNMPv3 Commands 181

snmp-server engine-id 181

snmp-server group 182

snmp-server user 183

snmp-server view 185

show snmp engine-id 186

show snmp group 186

show snmp user 187

show snmp view 188

Notification Log Commands 189

nlm 189

snmp-server notify-filter 190

show nlm oper-status 191

show snmp notify-filter 191

Additional Trap Commands 192

memory 192

6 Remote Monitoring Commands 195

process cpu 192

rmon alarm 196

rmon event 197

rmon collection history 198

– 16 –

Contents

rmon collection rmon1 199

show rmon alarms 200

show rmon events 200

show rmon history 200

show rmon statistics 201

7 Authentication Commands 203

User Accounts and Privilege Levels 204

enable password 204

username 205

privilege 207

show privilege 207

Authentication Sequence 208

authentication enable 208

authentication login 209

RADIUS Client 210

radius-server acct-port 210

radius-server auth-port 211

radius-server host 211

radius-server key 212

radius-server retransmit 213

radius-server timeout 213

show radius-server 214

TACACS+ Client 214

tacacs-server host 215

tacacs-server key 215

tacacs-server port 216

tacacs-server retransmit 216

tacacs-server timeout 217

show tacacs-server 217

AAA 218

aaa accounting commands 219

aaa accounting dot1x 220

aaa accounting exec 220

aaa accounting update 221

– 17 –

Contents

aaa authorization commands 222

aaa authorization exec 223

aaa group server 224

server 224

accounting dot1x 225

accounting commands 225

accounting exec 226

authorization commands 227

authorization exec 227

show accounting 228

Web Server 229

ip http port 229

ip http server 230

ip http secure-port 230

ip http secure-server 231

Telnet Server 232

ip telnet max-sessions 233

ip telnet port 233

ip telnet server 234

show ip telnet 234

Secure Shell 234

ip ssh authentication-retries 237

ip ssh server 238

ip ssh server-key size 239

ip ssh timeout 239

delete public-key 240

ip ssh crypto host-key generate 240

ip ssh crypto zeroize 241

ip ssh save host-key 242

802.1X Port Authentication 244

General Commands 245

show ip ssh 242

show public-key 243

show ssh 244

dot1x default 245

– 18 –

Contents

dot1x eapol-pass-through 246

dot1x system-auth-control 247

Authenticator Commands 247

dot1x intrusion-action 247

dot1x max-reauth-req 248

dot1x max-req 248

dot1x operation-mode 249

dot1x port-control 250

dot1x re-authentication 250

dot1x timeout quiet-period 251

dot1x timeout re-authperiod 251

dot1x timeout supp-timeout 252

dot1x timeout tx-period 252

dot1x re-authenticate 253

Supplicant Commands 254

dot1x identity profile 254

dot1x max-start 254

dot1x pae supplicant 255

dot1x timeout auth-period 256

dot1x timeout held-period 256

dot1x timeout start-period 257

Information Display Commands 257

show dot1x 257

Management IP Filter 260

management 260

show management 261

PPPoE Intermediate Agent 262

pppoe intermediate-agent 263

pppoe intermediate-agent format-type 263

pppoe intermediate-agent port-enable 264

pppoe intermediate-agent port-format-type 265

pppoe intermediate-agent port-format-type remote-id-delimiter 266

pppoe intermediate-agent trust 266

pppoe intermediate-agent vendor-tag strip 267

clear pppoe intermediate-agent statistics 267

– 19 –

Contents

show pppoe intermediate-agent info 268

show pppoe intermediate-agent statistics 269

8 General Security Measures 271

Port Security 272

mac-learning 272

port security 273

show port security 275

Network Access (MAC Address Authentication) 277

network-access aging 278

network-access mac-filter 278

mac-authentication reauth-time 279

network-access dynamic-qos 280

network-access dynamic-vlan 281

network-access guest-vlan 282

network-access link-detection 282

network-access link-detection link-down 283

network-access link-detection link-up 283

network-access link-detection link-up-down 284

network-access max-mac-count 284

network-access mode mac-authentication 285

network-access port-mac-filter 286

mac-authentication intrusion-action 287

mac-authentication max-mac-count 287

clear network-access 288

show network-access 288

show network-access mac-address-table 289

show network-access mac-filter 290

Web Authentication 290

web-auth login-attempts 291

web-auth quiet-period 292

web-auth session-timeout 292

web-auth system-auth-control 293

web-auth 293

web-auth re-authenticate (Port) 294

– 20 –

Contents

web-auth re-authenticate (IP) 294

show web-auth 295

show web-auth interface 295

show web-auth summary 296

DHCPv4 Snooping 296

ip dhcp snooping 297

ip dhcp snooping information option 299

ip dhcp snooping information option encode no-subtype 300

ip dhcp snooping information option remote-id 301

ip dhcp snooping information policy 302

ip dhcp snooping limit rate 303

ip dhcp snooping verify mac-address 303

ip dhcp snooping vlan 304

ip dhcp snooping information option circuit-id 305

ip dhcp snooping trust 306

clear ip dhcp snooping binding 307

clear ip dhcp snooping database flash 307

ip dhcp snooping database flash 308

show ip dhcp snooping 308

show ip dhcp snooping binding 309

DHCPv6 Snooping 309

ipv6 dhcp snooping 310

ipv6 dhcp snooping option remote-id 312

ipv6 dhcp snooping option remote-id policy 313

ipv6 dhcp snooping vlan 314

ipv6 dhcp snooping max-binding 315

ipv6 dhcp snooping trust 315

clear ipv6 dhcp snooping binding 316

clear ipv6 dhcp snooping statistics 317

IPv4 Source Guard 319

show ipv6 dhcp snooping 317

show ipv6 dhcp snooping binding 318

show ipv6 dhcp snooping statistics 318

ip source-guard binding 319

ip source-guard 321

– 21 –

Contents

ip source-guard max-binding 323

clear ip source-guard binding blocked 323

ip source-guard mode 324

show ip source-guard 325

show ip source-guard binding 325

IPv6 Source Guard 326

ipv6 source-guard binding 326

ipv6 source-guard 328

ipv6 source-guard max-binding 329

show ipv6 source-guard 330

show ipv6 source-guard binding 331

ARP Inspection 331

ip arp inspection 332

ip arp inspection filter 333

ip arp inspection log-buffer logs 334

ip arp inspection validate 335

ip arp inspection vlan 336

ip arp inspection limit 337

ip arp inspection trust 337

show ip arp inspection configuration 338

show ip arp inspection interface 338

show ip arp inspection log 339

show ip arp inspection statistics 339

show ip arp inspection vlan 340

Denial of Service Protection 340

dos-protection echo-chargen 341

dos-protection smurf 341

dos-protection tcp-flooding 342

dos-protection tcp-null-scan 342

dos-protection tcp-syn-fin-scan 343

dos-protection tcp-udp-port-zero 343

dos-protection tcp-xmas-scan 344

dos-protection udp-flooding 344

dos-protection win-nuke 345

show dos-protection 345

– 22 –

Contents

Port-based Traffic Segmentation 346

traffic-segmentation 346

traffic-segmentation session 347

traffic-segmentation uplink/downlink 348

traffic-segmentation uplink-to-uplink 349

show traffic-segmentation 350

9 Access Control Lists 351

IPv4 ACLs 351

access-list ip 352

permit, deny (Standard IP ACL) 353

permit, deny (Extended IPv4 ACL) 354

ip access-group 356

show ip access-group 357

show ip access-list 357

IPv6 ACLs 358

access-list ipv6 358

permit, deny (Standard IPv6 ACL) 359

permit, deny (Extended IPv6 ACL) 360

ipv6 access-group 362

show ipv6 access-group 363

show ipv6 access-list 363

MAC ACLs 364

access-list mac 364

permit, deny(MAC ACL) 365

mac access-group 369

show mac access-group 369

show mac access-list 370

ARP ACLs 370

access-list arp 370

ACL Information 373

permit, deny (ARP ACL) 371

show access-list arp 372

show arp access-list 373

clear access-list hardware counters 373

– 23 –

Contents

show access-group 374

show access-list 374

10 Interface Commands 377

Interface Configuration 378

interface 378

alias 379

capabilities 379

description 381

flowcontrol 381

media-type 382

negotiation 383

shutdown 383

speed-duplex 384

clear counters 385

show interfaces brief 386

show interfaces counters 386

show interfaces status 388

show interfaces switchport 389

Transceiver Threshold Configuration 390

transceiver-monitor 390

transceiver-threshold-auto 391

transceiver-threshold current 391

transceiver-threshold rx-power 393

transceiver-threshold temperature 394

transceiver-threshold tx-power 395

transceiver-threshold voltage 396

show interfaces transceiver 397

show interfaces transceiver-threshold 398

Cable Diagnostics 399

Power Savings 401

test cable-diagnostics 399

show cable-diagnostics 400

power-save 401

show power-save 402

– 24 –

Contents

11 Link Aggregation Commands 403

Manual Configuration Commands 404

port-channel load-balance 404

channel-group 406

Dynamic Configuration Commands 406

lacp 406

lacp admin-key (Ethernet Interface) 408

lacp port-priority 409

lacp system-priority 410

lacp admin-key (Port Channel) 410

lacp timeout 411

Trunk Status Display Commands 412

show lacp 412

show port-channel load-balance 415

12 Power over Ethernet Commands 417

power inline compatible 417

power mainpower maximum allocation 418

power inline 419

power inline maximum allocation 420

power inline priority 421

power inline time-range 422

show power inline status 423

show power inline time-range 424

show power mainpower 424

13 Port Mirroring Commands 425

Local Port Mirroring Commands 425

port monitor 425

show port monitor 428

RSPAN Mirroring Commands 428

rspan source 430

rspan destination 431

rspan remote vlan 432

no rspan session 433

show rspan 434

– 25 –

Contents

14 Congestion Control Commands 435

Rate Limit Commands 435

rate-limit 436

Storm Control Commands 437

switchport packet-rate 437

Automatic Traffic Control Commands 438

Threshold Commands 441

auto-traffic-control apply-timer 441

auto-traffic-control release-timer 442

auto-traffic-control 443

auto-traffic-control action 443

auto-traffic-control alarm-clear-threshold 444

auto-traffic-control alarm-fire-threshold 445

auto-traffic-control auto-control-release 446

auto-traffic-control control-release 447

SNMP Trap Commands 447

snmp-server enable port-traps atc broadcast-alarm-clear 447

snmp-server enable port-traps atc broadcast-alarm-fire 448

snmp-server enable port-traps atc broadcast-control-apply 448

snmp-server enable port-traps atc broadcast-control-release 449

snmp-server enable port-traps atc multicast-alarm-clear 449

snmp-server enable port-traps atc multicast-alarm-fire 450

snmp-server enable port-traps atc multicast-control-apply 450

snmp-server enable port-traps atc multicast-control-release 451

ATC Display Commands 451

show auto-traffic-control 451

show auto-traffic-control interface 452

15 Loopback Detection Commands 453

loopback-detection 454

loopback-detection action 454

loopback-detection recover-time 455

loopback-detection transmit-interval 456

loopback detection trap 456

loopback-detection release 457

– 26 –

Contents

show loopback-detection 458

16 Address Table Commands 459

mac-address-table aging-time 459

mac-address-table static 460

clear mac-address-table dynamic 461

show mac-address-table 461

show mac-address-table aging-time 462

show mac-address-table count 462

17 Spanning Tree Commands 465

spanning-tree 466

spanning-tree cisco-prestandard 467

spanning-tree forward-time 467

spanning-tree hello-time 468

spanning-tree max-age 469

spanning-tree mode 469

spanning-tree pathcost method 471

spanning-tree priority 471

spanning-tree mst configuration 472

spanning-tree system-bpdu-flooding 472

spanning-tree transmission-limit 473

max-hops 474

mst priority 474

mst vlan 475

name 476

revision 476

spanning-tree bpdu-filter 477

spanning-tree bpdu-guard 478

spanning-tree cost 479

spanning-tree edge-port 480

spanning-tree link-type 481

spanning-tree loopback-detection 481

spanning-tree loopback-detection action 482

spanning-tree loopback-detection release-mode 483

spanning-tree loopback-detection trap 484

– 27 –

Contents

spanning-tree mst cost 484

spanning-tree mst port-priority 485

spanning-tree port-bpdu-flooding 486

spanning-tree port-priority 486

spanning-tree root-guard 487

spanning-tree spanning-disabled 488

spanning-tree tc-prop-stop 488

spanning-tree loopback-detection release 489

spanning-tree protocol-migration 490

show spanning-tree 490

show spanning-tree mst configuration 493

18 VLAN Commands 495

GVRP and Bridge Extension Commands 496

bridge-ext gvrp 496

garp timer 497

switchport forbidden vlan 498

switchport gvrp 499

show bridge-ext 499

show garp timer 500

show gvrp configuration 501

Editing VLAN Groups 501

vlan database 502

vlan 502

Configuring VLAN Interfaces 503

interface vlan 504

switchport acceptable-frame-types 505

switchport allowed vlan 506

switchport ingress-filtering 507

switchport mode 508

Displaying VLAN Information 513

switchport native vlan 509

switchport trunk allowed vlan 509

switchport trunk native vlan 510

vlan-trunking 511

– 28 –

Contents

show vlan 513

Configuring IEEE 802.1Q Tunneling 514

dot1q-tunnel system-tunnel-control 515

dot1q-tunnel tpid 516

switchport dot1q-tunnel mode 517

switchport dot1q-tunnel service match cvid 518

show dot1q-tunnel 520

Configuring L2CP Tunneling 521

l2protocol-tunnel tunnel-dmac 521

switchport l2protocol-tunnel 524

show l2protocol-tunnel 525

Configuring Protocol-based VLANs 525

protocol-vlan protocol-group (Configuring Groups) 526

protocol-vlan protocol-group (Configuring Interfaces) 527

show protocol-vlan protocol-group 528

show interfaces protocol-vlan protocol-group 528

Configuring IP Subnet VLANs 529

subnet-vlan 530

show subnet-vlan 531

Configuring MAC Based VLANs 531

mac-vlan 532

show mac-vlan 533

Configuring Voice VLANs 533

voice vlan 534

voice vlan aging 535

voice vlan mac-address 536

switchport voice vlan 537

switchport voice vlan priority 537

switchport voice vlan rule 538

19 Class of Service Commands 541

Priority Commands (Layer 2) 541

switchport voice vlan security 539

show voice vlan 539

queue mode 542

– 29 –

Contents

queue weight 543

switchport priority default 544

show queue mode 545

show queue weight 545

Priority Commands (Layer 3 and 4) 546

qos map cos-dscp 546

qos map dscp-mutation 548

qos map phb-queue 549

qos map trust-mode 550

show qos map cos-dscp 551

show qos map dscp-mutation 551

show qos map phb-queue 552

show qos map trust-mode 552

20 Quality of Service Commands 553

class-map 554

description 555

match 556

rename 557

policy-map 557

class 558

police flow 559

police srtcm-color 561

police trtcm-color 563

set cos 565

set ip dscp 566

set phb 567

service-policy 568

show class-map 569

show policy-map 569

21 Multicast Filtering Commands 571

IGMP Snooping 572

show policy-map interface 570

ip igmp snooping 573

ip igmp snooping priority 574

– 30 –

Contents

ip igmp snooping proxy-reporting 574

ip igmp snooping querier 575

ip igmp snooping router-alert-option-check 576

ip igmp snooping router-port-expire-time 576

ip igmp snooping tcn-flood 577

ip igmp snooping tcn-query-solicit 578

ip igmp snooping unregistered-data-flood 579

ip igmp snooping unsolicited-report-interval 579

ip igmp snooping version 580

ip igmp snooping version-exclusive 581

ip igmp snooping vlan general-query-suppression 581

ip igmp snooping vlan immediate-leave 582

ip igmp snooping vlan last-memb-query-count 583

ip igmp snooping vlan last-memb-query-intvl 583

ip igmp snooping vlan mrd 584

ip igmp snooping vlan proxy-address 585

ip igmp snooping vlan query-interval 586

ip igmp snooping vlan query-resp-intvl 587

ip igmp snooping vlan static 588

clear ip igmp snooping groups dynamic 588

clear ip igmp snooping statistics 589

show ip igmp snooping 589

show ip igmp snooping group 590

show ip igmp snooping mrouter 591

show ip igmp snooping statistics 592

Static Multicast Routing 595

ip igmp snooping vlan mrouter 595

IGMP Filtering and Throttling 596

ip igmp filter (Global Configuration) 597

ip igmp profile 597

permit, deny 598

range 598

ip igmp authentication 599

ip igmp filter (Interface Configuration) 601

ip igmp max-groups 601

– 31 –

Contents

ip igmp max-groups action 602

ip igmp query-drop 603

ip multicast-data-drop 603

show ip igmp authentication 604

show ip igmp filter 604

show ip igmp profile 605

show ip igmp query-drop 606

show ip igmp throttle interface 606

show ip multicast-data-drop 607

MLD Snooping 608

ipv6 mld snooping 609

ipv6 mld snooping querier 609

ipv6 mld snooping query-interval 610

ipv6 mld snooping query-max-response-time 611

ipv6 mld snooping proxy-reporting 611

ipv6 mld snooping robustness 612

ipv6 mld snooping router-port-expire-time 612

ipv6 mld snooping unknown-multicast mode 613

ipv6 mld snooping unsolicited-report-interval 613

ipv6 mld snooping version 614

ipv6 mld snooping vlan immediate-leave 615

ipv6 mld snooping vlan mrouter 615

ipv6 mld snooping vlan static 616

clear ipv6 mld snooping groups dynamic 617

clear ipv6 mld snooping statistics 617

show ipv6 mld snooping 618

show ipv6 mld snooping group 618

show ipv6 mld snooping group source-list 619

show ipv6 mld snooping mrouter 620

MLD Filtering and Throttling 621

show ipv6 mld snooping statistics 620

ipv6 mld filter (Global Configuration) 622

ipv6 mld profile 622

permit, deny 623

range 623

– 32 –

Contents

ipv6 mld filter (Interface Configuration) 624

ipv6 mld max-groups 625

ipv6 mld max-groups action 626

ipv6 mld query-drop 626

ipv6 multicast-data-drop 627

show ipv6 mld filter 627

show ipv6 mld profile 628

show ipv6 mld query-drop 628

show ipv6 mld throttle interface 629

Multicast VLAN Registration for IPv4 630

mvr 631

mvr associated-profile 631

mvr domain 632

mvr group 633

mvr priority 633

mvr profile 634

mvr proxy-query-interval 635

mvr proxy-switching 636

mvr robustness-value 637

mvr source-port-mode dynamic 637

mvr upstream-source-ip 638

mvr vlan 639

mvr immediate-leave 640

mvr type 641

mvr vlan group 642

clear mvr groups dynamic 643

clear mvr statistics 643

show mvr 644

show mvr associated-profile 645

Multicast VLAN Registration for IPv6 654

show mvr interface 645

show mvr members 646

show mvr profile 648

show mvr statistics 648

mvr6 associated-profile 655

– 33 –

Contents

mvr6 domain 655

mvr6 priority 656

mvr6 profile 657

mvr6 proxy-query-interval 658

mvr6 proxy-switching 658

mvr6 robustness-value 659

mvr6 source-port-mode dynamic 660

mvr6 upstream-source-ip 661

mvr6 vlan 661

mvr6 immediate-leave 662

mvr6 type 663

mvr6 vlan group 664

clear mvr6 groups dynamic 665

clear mvr6 statistics 666

show mvr6 666

show mvr6 associated-profile 667

show mvr6 interface 668

show mvr6 members 669

show mvr6 profile 670

show mvr6 statistics 671

22 LLDP Commands 673

lldp 675

lldp holdtime-multiplier 675

lldp med-fast-start-count 676

lldp notification-interval 676

lldp refresh-interval 677

lldp reinit-delay 677

lldp tx-delay 678

lldp admin-status 679

lldp basic-tlv management-ip-address 679

lldp basic-tlv port-description 680

lldp basic-tlv system-capabilities 680

lldp basic-tlv system-description 681

lldp basic-tlv system-name 681

– 34 –

Contents

lldp dot1-tlv proto-ident 682

lldp dot1-tlv proto-vid 682

lldp dot1-tlv pvid 683

lldp dot1-tlv vlan-name 683

lldp dot3-tlv link-agg 684

lldp dot3-tlv mac-phy 684

lldp dot3-tlv max-frame 685

lldp dot3-tlv poe 685

lldp med-location civic-addr 686

lldp med-notification 688

lldp med-tlv ext-poe 688

lldp med-tlv inventory 689

lldp med-tlv location 689

lldp med-tlv med-cap 690

lldp med-tlv network-policy 690

lldp notification 691

show lldp config 692

show lldp info local-device 693

show lldp info remote-device 694

show lldp info statistics 695

show lldp neighbors 696

23 CDP Commands 699

cdp (Global Configuration) 700

cdp hold-time 700

cdp transmit-interval 701

cdp version 701

cdp (Interface Configuration) 702

clear cdp table 702

24 Domain Name Service Commands 705

show cdp 702

show cdp interface 703

show cdp neighbors 703

ip domain-list 705

ip domain-lookup 706

– 35 –

Contents

ip domain-name 707

ip host 708

ip name-server 708

ipv6 host 709

clear dns cache 710

clear host 710

show dns 711

show dns cache 711

show hosts 712

25 DHCP Commands 713

DHCP Client 713

DHCP for IPv4 714

ip dhcp client class-id 714

ip dhcp restart client 715

DHCP for IPv6 716

ipv6 dhcp client rapid-commit vlan 716

ipv6 dhcp restart client vlan 717

show ipv6 dhcp duid 718

show ipv6 dhcp vlan 719

DHCP Relay 719

ip dhcp relay server 720

ip dhcp restart relay 721

26 IP Interface Commands 723

IPv4 Interface 723

Basic IPv4 Configuration 724

ip address 724

ip default-gateway 726

show ip interface 727

ARP Configuration 731

show ip traffic 727

traceroute 728

ping 730

arp 731

ip proxy-arp 732

– 36 –

Contents

clear arp-cache 733

show arp 733

IPv6 Interface 734

Interface Address Configuration and Utilities 735

ipv6 default-gateway 735

ipv6 address 736

ipv6 address autoconfig 737

ipv6 address eui-64 739

ipv6 address link-local 741

ipv6 enable 742

ipv6 mtu 743

show ipv6 default-gateway 744

show ipv6 interface 745

show ipv6 mtu 747

show ipv6 traffic 747

traceroute6 752

clear ipv6 traffic 753

ping6 753

Neighbor Discovery 755

ipv6 nd dad attempts 755

ipv6 nd ns-interval 756

ipv6 nd raguard 757

ipv6 nd reachable-time 758

clear ipv6 neighbors 759

show ipv6 nd raguard 759

show ipv6 neighbors 760

ND Snooping 761

ipv6 nd snooping 762

ipv6 nd snooping auto-detect 764

ipv6 nd snooping auto-detect retransmit count 764

ipv6 nd snooping auto-detect retransmit interval 765

ipv6 nd snooping prefix timeout 766

ipv6 nd snooping max-binding 766

ipv6 nd snooping trust 767

clear ipv6 nd snooping binding 767

– 37 –

Contents

clear ipv6 nd snooping prefix 768

show ipv6 nd snooping 768

show ipv6 nd snooping binding 769

show ipv6 nd snooping prefix 769

26 IP Routing Commands 771

Global Routing Configuration 771

IPv4 Commands 772

ip route 772

ip sw-route 772

show ip route 773

show ip route database 774

show ip route summary 775

Section III Appendices 777

A Troubleshooting 779

Problems Accessing the Management Interface 779

Using System Logs 780

B License Information 781

The GNU General Public License 781

GNU Lesser General Public License, version 3.0 784

The BSD License 786

Open Source Software Used 787

ISC License 787

C Customer Support 793

Zebra Support 793

Customer Support Web Site 793

Manuals 793

Glossary 795

Index of CLI Commands 803

Index 811

– 38 –

Figures

Figure 1: Storm Control by Limiting the Traffic Rate 440

Figure 2: Storm Control by Shutting Down a Port 441

Figure 3: Configuring VLAN Trunking 512

Figure 4: Mapping QinQ Service VLAN to Customer VLAN 519

– 41 –

Figures

– 42 –

Tables

Table 1: Options 60, 66 and 67 Statements 70

Table 2: Options 55 and 124 Statements 70

Table 3: General Command Modes 82

Table 4: Configuration Command Modes 84

Table 5: Keystroke Commands 85

Table 6: Command Group Index 86

Table 7: General Commands 89

Table 8: System Management Commands 97

Table 9: Device Designation Commands 97

Table 10: System Status Commands 98

Table 11: show system – display description 103

Table 12: show version – display description 106

Table 13: Frame Size Commands 107

Table 14: Flash/File Commands 109

Table 15: File Directory Information 114

Table 16: Line Commands 120

Table 17: Event Logging Commands 131

Table 18: Logging Levels 132

Table 19: show logging flash/ram - display description 137

Table 20: show logging trap - display description 137

Table 21: Event Logging Commands 138

Table 22: Time Commands 141

Table 23: Predefined Summer-Time Parameters 151

Table 24: Time Range Commands 155

Table 25: Switch Cluster Commands 158

Table 26: Switch Cluster Commands 165

Table 27: SNMP Commands 171

Table 28: show snmp engine-id - display description 186

Table 29: show snmp group - display description 187

– 43 –

Tab le s

Table 30: show snmp user - display description 188

Table 31: show snmp view - display description 189

Table 32: RMON Commands 195

Table 33: Authentication Commands 203

Table 34: User Access Commands 204

Table 35: Default Login Settings 206

Table 36: Authentication Sequence Commands 208

Table 37: RADIUS Client Commands 210

Table 38: TACACS+ Client Commands 214

Table 39: AAA Commands 218

Table 40: Web Server Commands 229

Table 41: HTTPS System Support 231

Table 42: Telnet Server Commands 232

Table 43: Secure Shell Commands 235

Table 44: show ssh - display description 244

Table 45: 802.1X Port Authentication Commands 244

Table 46: Management IP Filter Commands 260

Table 47: PPPoE Intermediate Agent Commands 262

Table 48: show pppoe intermediate-agent statistics - display description 269

Table 49: General Security Commands 271

Table 50: Management IP Filter Commands 272

Table 51: show port security - display description 275

Table 52: Network Access Commands 277

Table 53: Dynamic QoS Profiles 280

Table 54: Web Authentication 291

Table 55: DHCP Snooping Commands 296

Table 56: Option 82 information 305

Table 57: DHCP Snooping Commands 309

Table 58: IP Source Guard Commands 319

Table 59: IPv6 Source Guard Commands 326

Table 60: ARP Inspection Commands 332

Table 61: DoS Protection Commands 340

Table 62: Commands for Configuring Traffic Segmentation 346

Table 63: Traffic Segmentation Forwarding 347

Table 64: Access Control List Commands 351

– 44 –

Tab le s

Table 65: IPv4 ACL Commands 351

Table 66: IPv6 ACL Commands 358

Table 67: MAC ACL Commands 364

Table 68: ARP ACL Commands 370

Table 69: ACL Information Commands 373

Table 70: Interface Commands 377

Table 71: show interfaces switchport - display description 390

Table 72: Link Aggregation Commands 403

Table 73: show lacp counters - display description 413

Table 74: show lacp internal - display description 413

Table 75: show lacp neighbors - display description 414

Table 76: show lacp sysid - display description 415

Table 77: PoE Commands 417

Table 78: Maximum Number of Ports Providing Simultaneous Power 420

Table 79: PoE Shut Down Sequence 422

Table 80: show power inline status - display description 423

Table 81: Port Mirroring Commands 425

Table 82: Mirror Port Commands 425

Table 83: RSPAN Commands 428

Table 84: Congestion Control Commands 435

Table 85: Rate Limit Commands 435

Table 86: Rate Limit Commands 437

Table 87: ATC Commands 438

Table 88: Loopback Detection Commands 453

Table 89: Address Table Commands 459

Table 90: Spanning Tree Commands 465

Table 91: Recommended STA Path Cost Range 479

Table 92: Default STA Path Costs 479

Table 93: VLAN Commands 495

Table 94: GVRP and Bridge Extension Commands 496

Table 95: show bridge-ext - display description 500

Table 96: Commands for Editing VLAN Groups 501

Table 97: Commands for Configuring VLAN Interfaces 503

Table 98: Commands for Displaying VLAN Information 513

Table 99: 802.1Q Tunneling Commands 514

– 45 –

Tab le s

Table 100: L2 Protocol Tunnel Commands 521

Table 101: Protocol-based VLAN Commands 525

Table 102: IP Subnet VLAN Commands 529

Table 103: MAC Based VLAN Commands 531

Table 104: Voice VLAN Commands 533

Table 105: Priority Commands 541

Table 106: Priority Commands (Layer 2) 541

Table 107: Priority Commands (Layer 3 and 4) 546

Table 108: Default Mapping of CoS/CFI to Internal PHB/Drop Precedence 547

Table 109: Default Mapping of DSCP Values to Internal PHB/Drop Values 548

Table 110: Mapping Internal Per-hop Behavior to Hardware Queues 549

Table 111: Quality of Service Commands 553

Table 112: Multicast Filtering Commands 571

Table 113: IGMP Snooping Commands 572

Table 114: show ip igmp snooping statistics input - display description 593

Table 115: show ip igmp snooping statistics output - display description 593

Table 116: show ip igmp snooping statistics vlan query - display description 594

Table 117: Static Multicast Interface Commands 595

Table 118: IGMP Filtering and Throttling Commands 596

Table 119: IGMP Authentication RADIUS Attribute Value Pairs 600

Table 120: MLD Snooping Commands 608

Table 121: MLD Filtering and Throttling Commands 621

Table 122: Multicast VLAN Registration for IPv4 Commands 630

Table 123: show mvr - display description 644

Table 124: show mvr interface - display description 646

Table 125: show mvr members - display description 648

Table 126: show mvr statistics input - display description 649

Table 127: show mvr statistics output - display description 650

Table 128: show mvr statistics query - display description 651

Table 129: show mvr statistics summary interface - display description 651

Table 130: show mvr statistics summary interface mvr vlan - description 653

Table 131: Multicast VLAN Registration for IPv6 Commands 654

Table 132: show mvr6 - display description 667

Table 133: show mvr6 interface - display description 668

Table 134: show mvr6 members - display description 670

– 46 –

Tab le s

Table 135: show mvr6 statistics input - display description 671

Table 136: show mvr6 statistics output - display description 672

Table 137: LLDP Commands 673

Table 138: LLDP MED Location CA Types 687

Table 139: CDP Commands 699

Table 140: show cdp neighbors - display description 704

Table 141: Address Table Commands 705

Table 142: show dns cache - display description 711

Table 143: show hosts - display description 712

Table 144: DHCP Commands 713

Table 145: DHCP Client Commands 713

Table 146: Options 60, 66 and 67 Statements 714

Table 147: Options 55 and 124 Statements 715

Table 148: DHCP Relay Option 82 Commands 719

Table 149: IP Interface Commands 723

Table 150: IPv4 Interface Commands 723

Table 151: Basic IP Configuration Commands 724

Table 152: Address Resolution Protocol Commands 731

Table 153: IPv6 Configuration Commands 734

Table 154: show ipv6 interface - display description 746

Table 155: show ipv6 mtu - display description 747

Table 156: show ipv6 traffic - display description 749

Table 157: show ipv6 neighbors - display description 760

Table 158: ND Snooping Commands 762

Table 203: IP Routing Commands 771

Table 204: Global Routing Configuration Commands 771

Table 205: Troubleshooting Chart 779

– 47 –

Tab le s

– 48 –

Section I

Getting Started

This section describes how to configure the switch for management access through
the web interface or SNMP.

This section includes these chapters:

◆ "Initial Switch Configuration" on page 51

– 49 –

Section I

| Getting Started

– 50 –

1 Initial Switch Configuration

This chapter includes information on connecting to the switch and basic
configuration procedures.

Connecting to the Switch

The switch includes a built-in network management agent. The agent offers a
variety of management options, including SNMP, RMON and a web-based interface.
A PC may also be connected directly to the switch for configuration and monitoring
via a command line interface (CLI).

Note:

An IPv4 address for this switch is obtained via DHCP by default. To change

this address, see “Setting an IP Address” on page 55.

Configuration Options The switch’s HTTP web agent allows you to configure switch parameters, monitor

port connections, and display statistics using a standard web browser such as
Internet Explorer 6, Mozilla Firefox 4, or Google Chrome 29, or more recent versions.
The switch’s web management interface can be accessed from any computer
attached to the network.

The CLI program can be accessed by a direct connection to the RS-232 serial
console port on the switch, or remotely by a Telnet connection over the network.

The switch’s management agent also supports SNMP (Simple Network
Management Protocol). This SNMP agent permits the switch to be managed from
any system in the network using network management software.

The switch’s web interface, console interface, and SNMP agent allow you to
perform the following management functions:

◆ Set user names and passwords

◆ Set an IP interface for any VLAN

◆ Configure SNMP parameters

◆ Enable/disable any port

◆ Set the speed/duplex mode for any port

◆ Configure the bandwidth of any port by limiting input or output rates

◆ Control port access through IEEE 802.1X security or static address filtering

– 51 –

Chapter 1

| Initial Switch Configuration

Connecting to the Switch

◆ Filter packets using Access Control Lists (ACLs)

◆ Configure up to 256 IEEE 802.1Q VLANs

◆ Enable GVRP automatic VLAN registration

◆ Configure IP routing for unicast traffic

◆ Configure IGMP multicast filtering

◆ Upload and download system firmware or configuration files via HTTP (using

the web interface) or FTP/TFTP (using the command line or web interface)

◆ Configure Spanning Tree parameters

◆ Configure Class of Service (CoS) priority queuing

◆ Configure static or LACP trunks (up to 12)

◆ Enable port mirroring

◆ Set storm control on any port for excessive broadcast, multicast, or unknown

unicast traffic

◆ Display system information and statistics

Connecting to the

Console Port

The switch provides an RS-232 serial port that enables a connection to a PC or
terminal for monitoring and configuring the switch. A null-modem console cable is
provided with the switch.

Attach a VT100-compatible terminal, or a PC running a terminal emulation program
to the switch. You can use the console cable provided with this package, or use a
null-modem cable that complies with the wiring assignments shown in the
Installation Guide.

To connect a terminal to the console port, complete the following steps:

1. Connect the console cable to the serial port on a terminal, or a PC running

terminal emulation software, and tighten the captive retaining screws on the
DB-9 connector.

2. Connect the other end of the cable to the RS-45 serial port on the switch.

3. Make sure the terminal emulation software is set as follows:

■

Select the appropriate serial port (COM port 1 or COM port 2).

■

Set the baud rate to 115200 bps.

■

Set the data format to 8 data bits, 1 stop bit, and no parity.

■

■

■

Set flow control to none.

Set the emulation mode to VT100.

When using HyperTerminal, select Terminal keys, not Windows keys.

– 52 –

Chapter 1

| Initial Switch Configuration

Connecting to the Switch

4. Power on the switch.

After the system completes the boot cycle, the logon screen appears.

For a description of how to use the CLI, see “Using the Command Line Interface” on

page 77. For a list of all the CLI commands and detailed information on using the

CLI, refer to “CLI Command Groups” on page 86.

Logging Onto the

Command Line

Interface

The CLI program provides two different command levels — normal access level
(Normal Exec) and privileged access level (Privileged Exec). The commands
available at the Normal Exec level are a limited subset of those available at the
Privileged Exec level and allow you to only display information and use basic
utilities. To fully configure the switch parameters, you must access the CLI at the
Privileged Exec level.

Access to both CLI levels are controlled by user names and passwords. The switch
has a default user name and password for each level. To log into the CLI at the
Privileged Exec level using the default user name and password, perform these
steps:

1. To initiate your console connection, press <Enter>. The “User Access

Verification” procedure starts.

2. At the User name prompt, enter “admin.”

3. At the Password prompt, enter “admin123.” (The password characters are not

displayed on the console screen.)

4. The session is opened and the CLI displays the “Console#” prompt indicating

you have access at the Privileged Exec level.

Setting Passwords If this is your first time to log into the CLI program, you should define new

passwords for both default user names using the “username” command, record
them and put them in a safe place.

Passwords can consist of up to 32 alphanumeric characters and are case sensitive.
To prevent unauthorized access to the switch, set the passwords as follows:

1. Open the console interface with the default user name “admin” and password

“admin123” to access the Privileged Exec level.

2. Type “configure” and press <Enter>.

3. Type “username guest password 0 password,” for the Normal Exec level, where

password is your new password. Press <Enter>.

– 53 –

Chapter 1

Connecting to the Switch

| Initial Switch Configuration

4. Type “username admin password 0 password,” for the Privileged Exec level,

where password is your new password. Press <Enter>.

Username: admin
Password:

CLI session with the EX-3524* is opened.
To end the CLI session, enter [Exit].

Console#configure
Console(config)#username guest password 0 [password]
Console(config)#username admin password 0 [password]
Console(config)#

* This manual covers both the EX-3524 and EX-3548 Gigabit Ethernet PoE/PoE+

switches. Other than the difference in the number of ports, there are no other
significant differences. Therefore nearly all of the screen display examples are
based on the EX-3524.

Remote Connections Prior to accessing the switch’s onboard agent via a network connection, you must

first configure it with a valid IPv4 or IPv6 address.

The default network interface is VLAN 1 which includes ports 1-28/52. When
configuring the network interface, the IP address, subnet mask, and default
gateway may all be set using a console connection, or DHCP protocol as described
in the following sections.

An IPv4 address for the switch is obtained via DHCP by default. To manually
configure this address or enable dynamic address assignment via DHCP, see

“Setting an IP Address” on page 55.

After configuring the switch’s IP parameters, you can access the onboard
configuration program from anywhere within the attached network. The onboard
configuration program can be accessed using Telnet or SSH from any computer
attached to the network. The switch can also be managed by any computer using a
web browser (Internet Explorer 6, Mozilla Firefox 4, or Google Chrome 29, or more
recent versions), or from a network computer using SNMP network management
software.

Note:

This switch supports eight Telnet sessions or SSH sessions.

Note:

Any VLAN group can be assigned an IP interface address (page 72) for

managing the switch.

The onboard program only provides access to basic configuration functions. To
access the full range of SNMP management functions, you must use SNMP-based
network management software.

– 54 –

Configuring the Switch for Remote Management

Chapter 1

Configuring the Switch for Remote Management

| Initial Switch Configuration

Using the Network

Interface

The switch can be managed through the operational network, known as in-band
management. Because in-band management traffic is mixed in with operational
network traffic, it is subject to all of the filtering rules usually applied to a standard
network ports such as ACLs and VLAN tagging. In-band network management can
be accessed via a connection to any network port (1-28/52).

Setting an IP Address You must establish IP address information for the switch to obtain management

access through the network. This can be done in either of the following ways:

◆ Manual — You have to input the information, including IP address and subnet

mask. If your management station is not in the same IP subnet as the switch,
you will also need to specify the default gateway router.

◆ Dynamic — The switch can send IPv4 configuration requests to BOOTP or

DHCP address allocation servers on the network, or automatically generate a
unique IPv6 host address based on the local subnet address prefix received in
router advertisement messages. An IPv6 link local address for use in a local
network can also be dynamically generated as described in “Obtaining an IPv6

Address” on page 59.

The current software supports DHCP for IPv6, so an IPv6 global unicast address
for use in a network containing more than one subnet can be obtained through
the DHCPv6 server, or manually configured as described in “Assigning an IPv6

Address” on page 56.

Manual Configuration

You can manually assign an IP address to the switch. You may also need to specify a
default gateway that resides between this device and management stations that
exist on another network segment. Valid IPv4 addresses consist of four decimal
numbers, 0 to 255, separated by periods. Anything outside this format will not be
accepted by the CLI program.

Note:

The IPv4 address for VLAN 1 is obtained via DHCP by default.

Assigning an IPv4 Address

Before you can assign an IP address to the switch, you must obtain the following
information from your network administrator:

◆ IP address for the switch

◆ Network mask for this network

◆ Default gateway for the network

– 55 –

Chapter 1

Configuring the Switch for Remote Management

| Initial Switch Configuration

To assign an IPv4 address to the switch, complete the following steps

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. Type “ip address ip-address netmask,” where “ip-address” is the switch IP

address and “netmask” is the network mask for the network. Press <Enter>.

3. Type “exit” to return to the global configuration mode prompt. Press <Enter>.

4. To set the IP address of the default gateway for the network to which the switch

belongs, type “ip default-gateway gateway,” where “gateway” is the IP address
of the default gateway. Press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ip address 192.168.1.5 255.255.255.0
Console(config-if)#exit
Console(config)#ip default-gateway 192.168.1.254

Assigning an IPv6 Address

This section describes how to configure a “link local” address for connectivity
within the local subnet only, and also how to configure a “global unicast” address,
including a network prefix for use on a multi-segment network and the host
portion of the address.

An IPv6 prefix or address must be formatted according to RFC 2373 “IPv6
Addressing Architecture,” using 8 colon-separated 16-bit hexadecimal values. One
double colon may be used to indicate the appropriate number of zeros required to
fill the undefined fields. For detailed information on the other ways to assign IPv6
addresses, see “IPv6 Interface” on page 734.

Link Local Address — All link-local addresses must be configured with a prefix in
the range of FE80~FEBF. Remember that this address type makes the switch
accessible over IPv6 for all devices attached to the same local subnet only. Also, if
the switch detects that the address you configured conflicts with that in use by
another device on the subnet, it will stop using the address in question, and
automatically generate a link local address that does not conflict with any other
devices on the local subnet.

To configure an IPv6 link local address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. Type “ipv6 address” followed by up to 8 colon-separated 16-bit hexadecimal

values for the ipv6-address similar to that shown in the example, followed by
the “link-local” command parameter. Then press <Enter>.

– 56 –

Chapter 1

| Initial Switch Configuration

Configuring the Switch for Remote Management

Console(config)#interface vlan 1
Console(config-if)#ipv6 address FE80::260:3EFF:FE11:6700 link-local
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::260:3eff:fe11:6700%1/64
Global unicast address(es):
(None)
Joined group address(es):
ff02::1:ff11:6700
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds

Console#

Address for Multi-segment Network — Before you can assign an IPv6 address to the
switch that will be used to connect to a multi-segment network, you must obtain
the following information from your network administrator:

◆ Prefix for this network

◆ IP address for the switch

◆ Default gateway for the network

For networks that encompass several different subnets, you must define the full
address, including a network prefix and the host address for the switch. You can
specify either the full IPv6 address, or the IPv6 address and prefix length. The prefix
length for an IPv6 network is the number of bits (from the left) of the prefix that
form the network address, and is expressed as a decimal number. For example, all
IPv6 addresses that start with the first byte of 73 (hexadecimal) could be expressed
as 73:0:0:0:0:0:0:0/8 or 73::/8.

To generate an IPv6 global unicast address for the switch, complete the following
steps:

1. From the global configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. From the interface prompt, type “ipv6 address ipv6-address” or “ipv6 address

ipv6-address/prefix-length,” where “prefix-length” indicates the address bits

used to form the network portion of the address. (The network address starts
from the left of the prefix and should encompass some of the ipv6-address
bits.) The remaining bits are assigned to the host interface. Press <Enter>.

3. Type “exit” to return to the global configuration mode prompt. Press <Enter>.

– 57 –

Chapter 1

| Initial Switch Configuration

Configuring the Switch for Remote Management

4. To set the IP address of the IPv6 default gateway for the network to which the

switch belongs, type “ipv6 default-gateway gateway,” where “gateway” is the
IPv6 address of the default gateway. Press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ipv6 address 2001:DB8:2222:7272::66/64
Console(config-if)#exit
Console(config)#ipv6 default-gateway 2001:DB8:2222:7272::254
Console(config)end
Console#show ipv6 interface
Link-local address:
fe80::260:3eff:fe11:6700%1/64
Global unicast address(es):
2001:db8:2222:7272::66/64, subnet is 2001:db8:2222:7272::/64
Joined group address(es):
ff02::1:ff00:66
ff02::1:ff11:6700
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds

Console#show ipv6 default-gateway
IPv6 default gateway 2001:db8:2222:7272::254
Console#

Dynamic Configuration

Obtaining an IPv4 Address

If you select the “bootp” or “dhcp” option, the system will immediately start
broadcasting service requests. IP will be enabled but will not function until a
BOOTP or DHCP reply has been received. Requests are broadcast every few minutes
using exponential backoff until IP configuration information is obtained from a
BOOTP or DHCP server. BOOTP and DHCP values can include the IP address, subnet
mask, and default gateway. If the DHCP/BOOTP server is slow to respond, you may
need to use the “ip dhcp restart client” command to re-start broadcasting service
requests.

Note that the “ip dhcp restart client” command can also be used to start
broadcasting service requests for all VLANs configured to obtain address
assignments through BOOTP or DHCP. It may be necessary to use this command
when DHCP is configured on a VLAN, and the member ports which were previously
shut down are now enabled.

If the “bootp” or “dhcp” option is saved to the startup-config file (step 6), then the
switch will start broadcasting service requests as soon as it is powered on.

– 58 –

Chapter 1

| Initial Switch Configuration

Configuring the Switch for Remote Management

To automatically configure the switch by communicating with BOOTP or DHCP
address allocation servers on the network, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. At the interface-configuration mode prompt, use one of the following

commands:

■

To obtain IP settings via DHCP, type “ip address dhcp” and press <Enter>.

■

To obtain IP settings via BOOTP, type “ip address bootp” and press <Enter>.

3. Type “end” to return to the Privileged Exec mode. Press <Enter>.

4. Wait a few minutes, and then check the IP configuration settings by typing the

“show ip interface” command. Press <Enter>.

5. Then save your configuration changes by typing “copy running-config startup-

config.” Enter the startup file name and press <Enter>.

Console(config)#interface vlan 1
Console(config-if)#ip address dhcp
Console(config-if)#end
Console#show ip interface
VLAN 1 is Administrative Up - Link Up
Address is 00-E0-0C-00-00-FD
Index: 1001, MTU: 1500
Address Mode is DHCP
IP Address: 192.168.0.4 Mask: 255.255.255.0
Proxy ARP is disabled
DHCP Client Vendor Class ID (text): EX-3548
DHCP Relay Server: 0.0.0.0
Console#copy running-config startup-config
Startup configuration file name []: startup
\Write to FLASH Programming.

\Write to FLASH finish.
Success.

Obtaining an IPv6 Address

Link Local Address — There are several ways to configure IPv6 addresses. The
simplest method is to automatically generate a “link local” address (identified by an
address prefix in the range of FE80~FEBF). This address type makes the switch
accessible over IPv6 for all devices attached to the same local subnet.

To generate an IPv6 link local address for the switch, complete the following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. Type “ipv6 enable” and press <Enter>.

– 59 –

Chapter 1

| Initial Switch Configuration

Configuring the Switch for Remote Management

Console(config)#interface vlan 1
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::2e0:cff:fe00:fd%1/64
Global unicast address(es):
(None)
Joined group address(es):
ff02::1:ff00:fd
ff02::1
IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds

Console#

Address for Multi-segment Network — To generate an IPv6 address that can be
used in a network containing more than one subnet, the switch can be configured
to automatically generate a unique host address based on the local subnet address
prefix received in router advertisement messages. (DHCP for IPv6 can also be used
to obtain a unique IPv6 host address.)

To dynamically generate an IPv6 host address for the switch, complete the
following steps:

1. From the Global Configuration mode prompt, type “interface vlan 1” to access

the interface-configuration mode. Press <Enter>.

2. From the interface prompt, type “ipv6 address autoconfig” and press <Enter>.

3. Type “ipv6 enable” and press <Enter> to enable IPv6 on an interface that has

not been configured with an explicit IPv6 address.

Console(config)#interface vlan 1
Console(config-if)#ipv6 address autoconfig
Console(config-if)#ipv6 enable
Console(config-if)#end
Console#show ipv6 interface
VLAN 1 is up
IPv6 is enabled.
Link-local address:
fe80::2e0:cff:fe00:fd%1/64
Global unicast address(es):
2001:db8:2222:7272:2E0:cff:fe00:fd/64, subnet is 2001:db8:2222:7272::/

64[AUTOCONFIG]
valid lifetime 2591978 preferred lifetime 604778
Joined group address(es):
ff02::1:ff00:fd
ff02::1:ff11:6700
ff02::1

– 60 –

IPv6 link MTU is 1500 bytes
ND DAD is enabled, number of DAD attempts: 3.
ND retransmit interval is 1000 milliseconds
ND advertised retransmit interval is 0 milliseconds
ND reachable time is 30000 milliseconds
ND advertised reachable time is 0 milliseconds
ND advertised router lifetime is 1800 seconds

Console#

Enabling SNMP Management Access

The switch can be configured to accept management commands from Simple
Network Management Protocol (SNMP) applications. You can configure the switch
to respond to SNMP requests or generate SNMP traps.

When SNMP management stations send requests to the switch (either to return
information or to set a parameter), the switch provides the requested data or sets
the specified parameter. The switch can also be configured to send information to
SNMP managers (without being requested by the managers) through trap
messages, which inform the manager that certain events have occurred.

Chapter 1

| Initial Switch Configuration

Enabling SNMP Management Access

The switch includes an SNMP agent that supports SNMP version 1, 2c, and 3 clients.
To provide management access for version 1 or 2c clients, you must specify a
community string. The switch provides a default MIB View (i.e., an SNMPv3
construct) for the default “public” community string that provides read access to
the entire MIB tree, and a default view for the “private” community string that
provides read/write access to the entire MIB tree. However, you may assign new
views to version 1 or 2c community strings that suit your specific security
requirements (see snmp-server view command).

Community Strings (for SNMP version 1 and 2c clients)

Community strings are used to control management access to SNMP version 1 and
2c stations, as well as to authorize SNMP stations to receive trap messages from the
switch. You therefore need to assign community strings to specified users, and set
the access level.

The default strings are:

◆ public - with read-only access. Authorized management stations are only able

to retrieve MIB objects.

◆ private - with read/write access. Authorized management stations are able to

both retrieve and modify MIB objects.

To prevent unauthorized access to the switch from SNMP version 1 or 2c clients, it is
recommended that you change the default community strings.

– 61 –

Chapter 1

Enabling SNMP Management Access

| Initial Switch Configuration

To configure a community string, complete the following steps:

1. From the Privileged Exec level global configuration mode prompt, type “snmp-

server community string mode,” where “string” is the community access string

and “mode” is rw (read/write) or ro (read only). Press <Enter>. (Note that the

default mode is read only.)

2. To remove an existing string, simply type “no snmp-server community string,”

where “string” is the community access string to remove. Press <Enter>.

Console(config)#snmp-server community admin rw
Console(config)#snmp-server community private
Console(config)#

Note:

recommend that you delete both of the default community strings. If there are no
community strings, then SNMP management access from SNMP v1 and v2c clients
is disabled.

If you do not intend to support access to SNMP version 1 and 2c clients, we

Trap Receivers

You can also specify SNMP stations that are to receive traps from the switch. To
configure a trap receiver, use the “snmp-server host” command. From the
Privileged Exec level global configuration mode prompt, type:

“snmp-server host host-address community-string [version {1 | 2c | 3 {auth |

noauth | priv}}]”

where “host-address” is the IP address for the trap receiver, “community-string”
specifies access rights for a version 1/2c host, or is the user name of a version 3 host,
“version” indicates the SNMP client version, and “auth | noauth | priv” means that
authentication, no authentication, or authentication and privacy is used for v3
clients. Then press <Enter>. For a more detailed description of these parameters,
see the snmp-server host command. The following example creates a trap host for
each type of SNMP client.

Console(config)#snmp-server host 10.1.19.23 batman
Console(config)#snmp-server host 10.1.19.98 robin version 2c
Console(config)#snmp-server host 10.1.19.34 barbie version 3 auth
Console(config)#

– 62 –

Chapter 1

| Initial Switch Configuration

Managing System Files

Configuring Access for SNMP Version 3 Clients

To configure management access for SNMPv3 clients, you need to first create a
view that defines the portions of MIB that the client can read or write, assign the
view to a group, and then assign the user to a group. The following example creates
one view called “mib-2” that includes the entire MIB-2 tree branch, and then
another view that includes the IEEE 802.1d bridge MIB. It assigns these respective
read and read/write views to a group call “r&d” and specifies group authentication
via MD5 or SHA. In the last step, it assigns a v3 user to this group, indicating that
MD5 will be used for authentication, provides the password “greenpeace” for
authentication, and the password “einstien” for encryption.

Console(config)#snmp-server view mib-2 1.3.6.1.2.1 included
Console(config)#snmp-server view 802.1d 1.3.6.1.2.1.17 included
Console(config)#snmp-server group r&d v3 auth read mib-2 write 802.1d
Console(config)#snmp-server user steve group r&d v3 auth md5 greenpeace priv

des56 einstien
Console(config)#

For a more detailed explanation on how to configure the switch for access from
SNMP v3 clients, refer to “Simple Network Management Protocol” in the System
Reference Guide, or refer to the specific CLI commands for SNMP starting on

page 171 in this guide.

Managing System Files

The switch’s flash memory supports three types of system files that can be
managed by the CLI program, the web interface, or SNMP. The switch’s file system
allows files to be uploaded and downloaded, copied, deleted, and set as a start-up
file.

The types of files are:

◆ Configuration — This file type stores system configuration information and is

◆ Operation Code — System software that is executed after boot-up, also

created when configuration settings are saved. Saved configuration files can be

selected as a system start-up file or can be uploaded via FTP/TFTP to a server

for backup. The file named “Factory_Default_Config.cfg” contains all the system

default settings and cannot be deleted from the system. If the system is booted

with the factory default settings, the switch will also create a file named

“startup1.cfg” that contains system settings for switch initialization, including

information about the unit identifier, and MAC address for the switch. The

configuration settings from the factory defaults configuration file are copied to

this file, which is then used to boot the switch. See “Saving or Restoring

Configuration Settings” on page 65 for more information.

known as run-time code. This code runs the switch operations and provides the

CLI and web management interfaces.

– 63 –

Chapter 1

| Initial Switch Configuration

Managing System Files

◆ Diagnostic Code — Software that is run during system boot-up, also known as

POST (Power On Self-Test).

Note:

The Boot ROM and Loader cannot be uploaded or downloaded from the
FTP/TFTP server. You must follow the instructions in the release notes for new
firmware, or contact your distributor for help.

Due to the size limit of the flash memory, the switch supports only two operation
code files. However, you can have as many diagnostic code files and configuration
files as available flash memory space allows. The switch has a total of 32 Mbytes of
flash memory for system files.

In the system flash memory, one file of each type must be set as the start-up file.
During a system boot, the diagnostic and operation code files set as the start-up file
are run, and then the start-up configuration file is loaded.

Note that configuration files should be downloaded using a file name that reflects
the contents or usage of the file settings. If you download directly to the running­config, the system will reboot, and the settings will have to be copied from the
running-config to a permanent file.

Upgrading the

Operation Code

The following example shows how to download new firmware to the switch and
activate it. The TFTP server could be any standards-compliant server running on
Windows or Linux. When downloading from an FTP server, the logon interface will
prompt for a user name and password configured on the remote server. Note that
“anonymous” is set as the default user name.

File names on the switch are case-sensitive. The destination file name should not
contain slashes (\ or /), and the maximum length for file names is 32 characters for
files on the switch or 128 characters for files on the server. (Valid characters: A-Z,
a-z, 0-9, “.”, “-”)

Console#copy tftp file
TFTP server ip address: 10.1.0.19
Choose file type:

1. config: 2. opcode: 2
Source file name: m360.bix
Destination file name: m360.bix
\Write to FLASH Programming.

-Write to FLASH finish.
Success.
Console#config
Console(config)#boot system opcode: m360.bix
Console(config)#exit
Console#dir

File Name Type Startup Modify Time Size(bytes)

-------------------------- -------------- ------- ------------------- ---------­ Unit 1:

m360.bix OpCode Y 2013-02-25 15:41:04 25812529
m355.bix OpCode N 2012-12-04 13:23:59 25783857

Factory_Default_Config.cfg Config N 2012-12-04 13:18:37 455
startup1.cfg Config Y 2013-03-21 05:39:15 3463

– 64 –

Chapter 1

----------------------------------------------------------------------------­ Free space for compressed user config files:1593241600

Console#

| Initial Switch Configuration

Managing System Files

Saving or Restoring

Configuration Settings

Configuration commands only modify the running configuration file and are not
saved when the switch is rebooted. To save all your configuration changes in
nonvolatile storage, you must copy the running configuration file to the start-up
configuration file using the “copy” command.

New startup configuration files must have a name specified. File names on the
switch are case-sensitive, can be from 1 to 31 characters, must not contain slashes
(\ or /), and the leading letter of the file name must not be a period (.). (Valid
characters: A-Z, a-z, 0-9, “.”, “-”, “_”)

There can be more than one user-defined configuration file saved in the switch’s
flash memory, but only one is designated as the “startup” file that is loaded when
the switch boots. The copy running-config startup-config command always sets
the new file as the startup file. To select a previously saved configuration file, use
the boot system config:<filename> command.

The maximum number of saved configuration files depends on available flash
memory. The amount of available flash memory can be checked by using the dir
command.

To save the current configuration settings, enter the following command:

1. From the Privileged Exec mode prompt, type “copy running-config startup-

config” and press <Enter>.

2. Enter the name of the start-up file. Press <Enter>.

Console#copy running-config startup-config
Startup configuration file name []: startup
\Write to FLASH Programming.

\Write to FLASH finish.
Success.

Console#

To restore configuration settings from a backup server, enter the following
command:

1. From the Privileged Exec mode prompt, type “copy tftp startup-config” and

press <Enter>.

2. Enter the address of the TFTP server. Press <Enter>.

3. Enter the name of the startup file stored on the server. Press <Enter>.

– 65 –

Chapter 1

Automatic Installation of Operation Code and Configuration Settings

| Initial Switch Configuration

4. Enter the name for the startup file on the switch. Press <Enter>.

Console#copy file startup-config
Console#copy tftp startup-config
TFTP server IP address: 192.168.0.4
Source configuration file name: startup-rd.cfg
Startup configuration file name [startup1.cfg]:

Success.
Console#

Automatic Installation of Operation Code and Configuration Settings

Downloading

Operation Code

from a File Server

Automatic Operation Code Upgrade can automatically download an operation
code file when a file newer than the currently installed one is discovered on the file
server. After the file is transferred from the server and successfully written to the file
system, it is automatically set as the startup file, and the switch is rebooted.

Usage Guidelines

◆ If this feature is enabled, the switch searches the defined URL once during the

bootup sequence.

◆ FTP (port 21) and TFTP (port 69) are both supported. Note that the TCP/UDP

port bindings cannot be modified to support servers listening on non-standard
ports.

◆ The host portion of the upgrade file location URL must be a valid IPv4 IP

address. DNS host names are not recognized. Valid IP addresses consist of four
numbers, 0 to 255, separated by periods.

◆ The path to the directory must also be defined. If the file is stored in the root

directory for the FTP/TFTP service, then use the “/” to indicate this (e.g.,
ftp://192.168.0.1/).

◆ The file name must not be included in the upgrade file location URL. The file

name of the code stored on the remote server must be ECS4620-28T.bix (using
lower case letters as indicated).

◆ The FTP connection is made with PASV mode enabled. PASV mode is needed to

traverse some fire walls, even if FTP traffic is not blocked. PASV mode cannot be
disabled.

◆ The switch-based search function is case-insensitive in that it will accept a file

name in upper or lower case (i.e., the switch will accept EX3524_Op.BIX from the
server even though EX3524_Op.bix was requested). However, keep in mind that
the file systems of many operating systems such as Unix and most Unix-like
systems (FreeBSD, NetBSD, OpenBSD, and most Linux distributions, etc.) are

– 66 –

Chapter 1

Automatic Installation of Operation Code and Configuration Settings

| Initial Switch Configuration

case-sensitive, meaning that two files in the same directory, ex3524_op.bix and
EX3524_Op.BIX are considered to be unique files. Thus, if the upgrade file is
stored as EX3524_Op.BIX (or even Ex3524_Op.bix) on a case-sensitive server,
then the switch (requesting EX3524_Op.BIX) will not be upgraded because the
server does not recognize the requested file name and the stored file name as
being equal. A notable exception in the list of case-sensitive Unix-like operating
systems is Mac OS X, which by default is case-insensitive. Please check the
documentation for your server’s operating system if you are unsure of its file
system’s behavior.

◆ Note that the switch itself does not distinguish between upper and lower-case

file names, and only checks to see if the file stored on the server is more recent
than the current runtime image.

◆ If two operation code image files are already stored on the switch’s file system,

then the non-startup image is deleted before the upgrade image is transferred.

◆ The automatic upgrade process will take place in the background without

impeding normal operations (data switching, etc.) of the switch.

◆ During the automatic search and transfer process, the administrator cannot

transfer or update another operation code image, configuration file, public key,
or HTTPS certificate (i.e., no other concurrent file management operations are
possible).

◆ The upgrade operation code image is set as the startup image after it has been

successfully written to the file system.

◆ The switch will send an SNMP trap and make a log entry upon all upgrade

successes and failures.

◆ The switch will immediately restart after the upgrade file is successfully written

to the file system and set as the startup image.

To enable automatic upgrade, enter the following commands:

1. Specify the TFTP or FTP server to check for new operation code.

■

When specifying a TFTP server, the following syntax must be used, where
filedir indicates the path to the directory containing the new image:

tftp://192.168.0.1[/filedir]/

■

When specifying an FTP server, the following syntax must be used, where
filedir indicates the path to the directory containing the new image:

ftp://[username[:password@]]192.168.0.1[/filedir]/

If the user name is omitted, “anonymous” will be used for the connection. If
the password is omitted a null string (“”) will be used for the connection.

– 67 –

Chapter 1

| Initial Switch Configuration

Automatic Installation of Operation Code and Configuration Settings

This shows how to specify a TFTP server where new code is stored.

Console(config)#upgrade opcode path tftp://192.168.0.1/sm24/
Console(config)#

This shows how to specify an FTP server where new code is stored.

Console(config)#upgrade opcode path ftp://zebra:billy@192.168.0.1/sm24/
Console(config)#

2. Set the switch to automatically reboot and load the new code after the opcode

upgrade is completed.

Console(config)#upgrade opcode reload
Console(config)#

3. Set the switch to automatically upgrade the current operational code when a

new version is detected on the server. When the switch starts up and automatic
image upgrade is enabled by this command, the switch will follow these steps
when it boots up:

a. It will search for a new version of the image at the location specified by

upgrade opcode path command. The name for the new image stored on

the TFTP server must be EX3524_Op.bix. If the switch detects a code
version newer than the one currently in use, it will download the new
image. If two code images are already stored in the switch, the image not
set to start up the system will be overwritten by the new version.

b. After the image has been downloaded, the switch will send a trap message

to log whether or not the upgrade operation was successful.

c. It sets the new version as the startup image.

d. It then restarts the system to start using the new image.

Console(config)#upgrade opcode auto
Console(config)#

4. Display the automatic upgrade settings.

Console#show upgrade
Auto Image Upgrade Global Settings:
Status : Enabled
Reload Status : Enabled
Path :
File Name : EX3524_Op.bix
Console#

– 68 –

Chapter 1

Automatic Installation of Operation Code and Configuration Settings

| Initial Switch Configuration

Specifying a DHCP

Client Identifier

DHCP servers index their database of address bindings using the client’s Media
Access Control (MAC) Address or a unique client identifier. The client identifier is
used to identify the vendor class and configuration of the switch to the DHCP
server, which then uses this information to decide on how to service the client or
the type of information to return.

DHCP client Identifier (Option 60) is used by DHCP clients to specify their unique
identifier. The client identifier is optional and can be specified while configuring
DHCP on the primary network interface. DHCP Option 60 is disabled by default.

The general framework for this DHCP option is set out in RFC 2132 (Option 60). This
information is used to convey configuration settings or other identification
information about a client, but the specific string to use should be supplied by your
service provider or network administrator. Options 60 (vendor-class-identifier), 66
(tftp-server-name) and 67 (bootfile-name) statements can be added to the server
daemon’s configuration file as described in the following section.

If the DHCP server has an index entry for a switch requesting service, it should reply
with the TFTP server name and boot file name. Note that the vendor class identifier
can be formatted in either text or hexadecimal, but the format used by both the
client and server must be the same.

Downloading a

Configuration File

Referenced by a

DHCP Server

Console(config)#interface vlan 2
Console(config-if)#ip dhcp client class-id hex 0000e8666572
Console(config-if)#

Information passed on to the switch from a DHCP server may also include a
configuration file to be downloaded and the TFTP servers where that file can be
accessed. If the Factory Default Configuration file is used to provision the switch at
startup, in addition to requesting IP configuration settings from the DHCP server, it
will also ask for the name of a bootup configuration file and TFTP servers where
that file is stored.

If the switch receives information that allows it to download the remote bootup file,
it will save this file to a local buffer, and then restart the provision process.

Note the following DHCP client behavior:

◆ The bootup configuration file received from a TFTP server is stored on the

switch with the original file name. If this file name already exists in the switch,
the file is overwritten.

◆ If the name of the bootup configuration file is the same as the Factory Default

Configuration file, the download procedure will be terminated, and the switch
will not send any further DHCP client requests.

– 69 –

Chapter 1

Automatic Installation of Operation Code and Configuration Settings

| Initial Switch Configuration

◆ If the switch fails to download the bootup configuration file based on

information passed by the DHCP server, it will not send any further DHCP client
requests.

◆ If the switch does not receive a DHCP response prior to completing the bootup

process, it will continue to send a DHCP client request once a minute. These
requests will only be terminated if the switch’s address is manually configured,
but will resume if the address mode is set back to DHCP.

To successfully transmit a bootup configuration file to the switch, the DHCP
daemon (using a Linux based system for this example) must be configured with the
following information:

◆ Options 60, 66 and 67 statements can be added to the daemon’s configuration

file.

Table 1: Options 60, 66 and 67 Statements

Option

Keyword Parameter

60 vendor-class-identifier a string indicating the vendor class identifier

66 tftp-server-name a string indicating the tftp server name

67 bootfile-name a string indicating the bootfile name

◆ By default, DHCP option 66/67 parameters are not carried in a DHCP server

Statement

reply. To ask for a DHCP reply with option 66/67 information, the DHCP client
request sent by this switch includes a “parameter request list” asking for this
information. Besides these items, the client request also includes a “vendor
class identifier” that allows the DHCP server to identify the device, and select
the appropriate configuration file for download. This information is included in
Option 55 and 124.

Table 2: Options 55 and 124 Statements

Option

Keyword Parameter

55 dhcp-parameter-request-list a list of parameters, separated by a comma ','

124 vendor-class-identifier a string indicating the vendor class identifier

Statement

The following configuration example is provided for a Linux-based DHCP daemon
(dhcpd.conf file). In the “Vendor class” section, the server will always send Option
66 and 67 to tell the switch to download the “test” configuration file from server

192.168.255.101.

ddns-update-style ad-hoc;

default-lease-time 600;
max-lease-time 7200;

– 70 –

Chapter 1

log-facility local7;

server-name "Server1";
Server-identifier 192.168.255.250;
#option 66, 67
option space dynamicProvision code width 1 length 1 hash size 2;
option dynamicProvision.tftp-server-name code 66 = text;
option dynamicProvision.bootfile-name code 67 = text;

subnet 192.168.255.0 netmask 255.255.255.0 {
range 192.168.255.160 192.168.255.200;
option routers 192.168.255.101;
option tftp-server-name "192.168.255.100"; #Default Option 66
option bootfile-name "bootfile"; #Default Option 67
}

class "Option66,67_1" { #DHCP Option 60 Vendor class two
match if option vendor-class-identifier = "EX3524_Op.cfg";
option tftp-server-name "192.168.255.101";
option bootfile-name "test";
}

| Initial Switch Configuration

Setting the System Clock

Note:

Setting the System Clock

Simple Network Time Protocol (SNTP) or Network Time Protocol (NTP) can be used
to set the switch’s internal clock based on periodic updates from a time server.
Maintaining an accurate time on the switch enables the system log to record
meaningful dates and times for event entries. You can also manually set the clock. If
the clock is not set manually or via SNTP or NTP, the switch will only record the time
from the factory default set at the last bootup.

When the SNTP client is enabled, the switch periodically sends a request for a time
update to a configured time server. You can configure up to three time server IP
addresses. The switch will attempt to poll each server in the configured sequence.

The switch also supports the following time settings:

◆ Time Zone – You can specify the offset from Coordinated Universal Time (UTC),

Use “EX3524_Op.cfg” for the vendor-class-identifier in the dhcpd.conf file.

also known as Greenwich Mean Time (GMT).

◆ Summer Time/Daylight Saving Time (DST) – In some regions, the time shifts by

one hour in the fall and spring. The switch supports manual entry for one-time
or recurring clock shifts.

– 71 –

Chapter 1

| Initial Switch Configuration

Setting the System Clock

Setting the

Time Manually

To manually set the clock to 14:11:36, April 1st, 2013, enter this command.

Console#calendar set 14 11 36 1 April 2013
Console#

To set the time zone, enter a command similar to the following.

Console(config)#clock timezone Japan hours 8 after-UTC
Console(config)#

To set the time shift for summer time, enter a command similar to the following.

Console(config)#clock summer-time SUMMER date 2 april 2013 0 0 30 june 2013 0

0

Console(config)#

To display the clock configuration settings, enter the following command.

Console#show calendar
Current Time : Apr 2 15:56:12 2013
Time Zone : UTC, 08:00
Summer Time : SUMMER, offset 60 minutes
Apr 2 2013 00:00 to Jun 30 2013 00:00
Summer Time in Effect : Yes
Console#

Configuring SNTP Setting the clock based on an SNTP server can provide more accurate clock

synchronization across network switches than manually-configured time. To
configure SNTP, set the switch as an SNTP client, and then set the polling interval,
and specify a time server as shown in the following example.

Console(config)#sntp client
Console(config)#sntp poll 60
Console(config)#sntp server 10.1.0.19
Console(config)#exit
Console#show sntp
Current Time : Apr 2 16:06:07 2013
Poll Interval : 60 seconds
Current Mode : Unicast
SNTP Status : Enabled
SNTP Server : 10.1.0.19
Current Server : 10.1.0.19
Console#

– 72 –

Chapter 1

| Initial Switch Configuration

Setting the System Clock

Configuring NTP Requesting the time from a an NTP server is the most secure method. You can

enable NTP authentication to ensure that reliable updates are received from only
authorized NTP servers. The authentication keys and their associated key number
must be centrally managed and manually distributed to NTP servers and clients.
The key numbers and key values must match on both the server and client.

When more than one time server is configured, the client will poll all of the time
servers, and compare the responses to determine the most reliable and accurate
time update for the switch.

To configure NTP time synchronization, enter commands similar to the following.

Console(config)#ntp client
Console(config)#ntp authentication-key 45 md5 thisiskey45
Console(config)#ntp authenticate
Console(config)#ntp server 192.168.3.20
Console(config)#ntp server 192.168.3.21
Console(config)#ntp server 192.168.5.23 key 19
Console(config)#exit
Console#show ntp
Current Time : Apr 29 13:57:32 2011
Polling : 1024 seconds
Current Mode : unicast
NTP Status : Enabled
NTP Authenticate Status : Enabled
Last Update NTP Server : 192.168.0.88 Port: 123
Last Update Time : Mar 12 02:41:01 2013 UTC
NTP Server 192.168.0.88 version 3
NTP Server 192.168.3.21 version 3
NTP Server 192.168.4.22 version 3 key 19
NTP Authentication Key 19 md5 42V68751663T6K11P2J307210R885

Current Time : Apr 2 16:28:34 2013
Polling : 1024 seconds
Current Mode : unicast
NTP Status : Enabled
NTP Authenticate Status : Enabled
Last Update NTP Server : 192.168.5.23 Port: 0
Last Update Time : Apr 2 16:00:00 2013 UTC
NTP Server 192.168.3.20 version 3
NTP Server 192.168.3.21 version 3
NTP Server 192.168.5.23 version 3 key 19
NTP Authentication Key 45 md5 2662T75S5658RU5424180034777
Console#

– 73 –

Chapter 1

| Initial Switch Configuration

Setting the System Clock

– 74 –

Section II

Command Line Interface

This section provides a detailed description of the Command Line Interface, along
with examples for all of the commands.

This section includes these chapters:

◆ “General Commands” on page 89

◆ “System Management Commands” on page 97

◆ “SNMP Commands” on page 171

◆ “Remote Monitoring Commands” on page 195

◆ “Authentication Commands” on page 203

◆ “General Security Measures” on page 271

◆ “Access Control Lists” on page 351

◆ “Interface Commands” on page 377

◆ “Link Aggregation Commands” on page 403

◆ “Power over Ethernet Commands” on page 417

◆ “Port Mirroring Commands” on page 425

◆ “Congestion Control Commands” on page 435

◆ “Loopback Detection Commands” on page 453

◆ “Address Table Commands” on page 459

◆ “Spanning Tree Commands” on page 465

◆ “VLAN Commands” on page 495

– 75 –

Section II

| Command Line Interface

◆ “Class of Service Commands” on page 541

◆ “Quality of Service Commands” on page 553

◆ “Multicast Filtering Commands” on page 571

◆ “LLDP Commands” on page 673

◆ “CDP Commands” on page 699

◆ “Domain Name Service Commands” on page 705

◆ “DHCP Commands” on page 713

◆ “IP Interface Commands” on page 723

◆ “IP Routing Commands” on page 771

– 76 –

2 Using the Command Line

Interface

This chapter describes how to use the Command Line Interface (CLI).

Accessing the CLI

When accessing the management interface for the switch over a direct connection
to the server’s console port, or via a Telnet or Secure Shell connection (SSH), the
switch can be managed by entering command keywords and parameters at the
prompt. Using the switch's command-line interface (CLI) is very similar to entering
commands on a UNIX system.

Console Connection To access the switch through the console port, perform these steps:

1. At the console prompt, enter the user name and password. (The default user

names are “admin” and “guest” with corresponding passwords of “admin” and
“guest.”) When the administrator user name and password is entered, the CLI
displays the “Console#” prompt and enters privileged access mode
(i.e., Privileged Exec). But when the guest user name and password is entered,
the CLI displays the “Console>” prompt and enters normal access mode
(i.e., Normal Exec).

2. Enter the necessary commands to complete your desired tasks.

3. When finished, exit the session with the “quit” or “exit” command.

After connecting to the system through the console port, the login screen displays:

User Access Verification
Username: admin
Password:

CLI session with the EX-3524 is opened.
To end the CLI session, enter [Exit].

Console#

– 77 –

Chapter 2

Accessing the CLI

| Using the Command Line Interface

Telnet Connection Telnet operates over the IP transport protocol. In this environment, your

management station and any network device you want to manage over the
network must have a valid IP address. Valid IP addresses consist of four numbers, 0
to 255, separated by periods. Each address consists of a network portion and host
portion. For example, the IP address assigned to this switch, 10.1.0.1, consists of a
network portion (10.1.0) and a host portion (1).

Note:

The IP address for this switch is obtained via DHCP by default.

To access the switch through a Telnet session, you must first set the IP address for
the Master unit, and set the default gateway if you are managing the switch from a
different IP subnet. For example,

Console(config)#interface vlan 1
Console(config-if)#ip address 10.1.0.4 255.255.255.0
Console(config-if)#exit
Console(config)#ip default-gateway 10.1.0.254
Console(config)#

If your corporate network is connected to another network outside your office or to
the Internet, you need to apply for a registered IP address. However, if you are
attached to an isolated network, then you can use any IP address that matches the
network segment to which you are attached.

After you configure the switch with an IP address, you can open a Telnet session by
performing these steps:

1. From the remote host, enter the Telnet command and the IP address of the

device you want to access.

2. At the prompt, enter the user name and system password. The CLI will display

the “Vty-n#” prompt for the administrator to show that you are using privileged
access mode (i.e., Privileged Exec), or “Vty-n>” for the guest to show that you
are using normal access mode (i.e., Normal Exec), where n indicates the number
of the current Telnet session.

3. Enter the necessary commands to complete your desired tasks.

4. When finished, exit the session with the “quit” or “exit” command.

After entering the Telnet command, the login screen displays:

Username: admin
Password:

CLI session with the EX-3524 is opened.
To end the CLI session, enter [Exit].

Vty-1#

– 78 –

Entering Commands

Chapter 2

Note:

You can open up to eight sessions to the device via Telnet or SSH.

| Using the Command Line Interface

This section describes how to enter CLI commands.

Entering Commands

Keywords and

Arguments

A CLI command is a series of keywords and arguments. Keywords identify a
command, and arguments specify configuration parameters. For example, in the
command “show interfaces status ethernet 1/5,” show interfaces and status are
keywords, ethernet is an argument that specifies the interface type, and 1/5
specifies the unit/port.

You can enter commands as follows:

◆ To enter a simple command, enter the command keyword.

◆ To enter multiple commands, enter each command in the required order. For

example, to enable Privileged Exec command mode, and display the startup
configuration, enter the following commands. The default password “super” is
used to change from Normal Exec to Privileged Exec mode.

Console>enable
Password:
Console#show startup-config

◆ To enter commands that require parameters, enter the required parameters

after the command keyword. For example, to set a password for the
administrator, enter:

Console(config)#username admin password 0 smith

Minimum

Abbreviation

The CLI will accept a minimum number of characters that uniquely identify a
command. For example, the command “configure” can be entered as con. If an
entry is ambiguous, the system will prompt for further input.

Command Completion If you terminate input with a Tab key, the CLI will print the remaining characters of a

partial keyword up to the point of ambiguity. In the “logging history” example,
typing log followed by a tab will result in printing the command up to “logging.”

– 79 –

Chapter 2

| Using the Command Line Interface

Entering Commands

Getting Help on

Commands

You can display a brief description of the help system by entering the help
command. You can also display command syntax by using the “?” character to list
keywords or parameters.

Showing Commands

If you enter a “?” at the command prompt, the system will display the first level of
keywords or command groups. You can also display a list of valid keywords for a
specific command. For example, the command “show ?” displays a list of possible
show commands:

Console#show ?
access-group Access groups
access-list Access lists
accounting Uses the specified accounting list
adoption Adoption related information
arp Information of ARP cache
authorization Enables EXEC accounting
auto-traffic-control Auto traffic control information
bridge-ext Bridge extension information
cable-diagnostics Shows the information of cable diagnostics
calendar Date and time information
cdp CDP
class-map Displays class maps
cluster Display cluster
collision-mac-address-table Show collision mac address
debug State of each debugging option
dns DNS information
dos-protection Shows the system dos-protection summary
information
dot1q-tunnel dot1q-tunnel
dot1x 802.1X content
garp GARP properties
gvrp GVRP interface information
history Shows history information
hosts Host information
interfaces Shows interface information
ip IP information
ipv6 IPv6 information
l2protocol-tunnel Layer 2 protocol tunneling configuration
lacp LACP statistics
line TTY line information
lldp LLDP
log Log records
logging Logging setting
loop Shows the information of loopback
loopback-detection Shows loopback detection information
mac MAC access list
mac-address-table Configuration of the address table
mac-vlan MAC-based VLAN information
management Shows management information
memory Memory utilization
mvr multicast VLAN registration
mvr6 IPv6 Multicast VLAN registration
neighbors Shows LLDP neighbors information
network-access Shows the entries of the secure port.
nlm Show notification log
ntp Network Time Protocol configuration
policy-map Displays policy maps
port Port characteristics
port-channel Port channel information

– 80 –

Chapter 2

| Using the Command Line Interface

Entering Commands

power Shows power
power-save Shows the power saving information
pppoe Displays PPPoE configuration
privilege Shows current privilege level
process Device process
protocol-vlan Protocol-VLAN information
public-key Public key information
qos Quality of Service
queue Priority queue information
radius-server RADIUS server information
reload Shows the reload settings
rmon Remote monitoring information
rspan Display status of the current RSPAN
configuration
running-config Information on the running configuration
snmp Simple Network Management Protocol

configuration and statistics
snmp-server Displays SNMP server configuration
sntp Simple Network Time Protocol configuration
spanning-tree Spanning-tree configuration
ssh Secure shell server connections
startup-config Startup system configuration
subnet-vlan IP subnet-based VLAN information
system System information
tacacs-server TACACS server information
tech-support Technical information
time-range Time range
traffic-segmentation Traffic segmentation information
upgrade Shows upgrade information
users Information about users logged in
version System hardware and software versions
vlan Shows virtual LAN settings
voice Shows the voice VLAN information
watchdog Displays watchdog status
web-auth Shows web authentication configuration
Console#show

The command “show interfaces ?” will display the following information:

Console#show interfaces ?
brief Shows brief interface description
counters Interface counters information
protocol-vlan Protocol-VLAN information
status Shows interface status
switchport Shows interface switchport information
transceiver Interface of transceiver information
transceiver-threshold Interface of transceiver-threshold information
Console#

Show commands which display more than one page of information (e.g., show
running-config) pause and require you to press the [Space] bar to continue

displaying one more page, the [Enter] key to display one more line, or the [a] key to
display the rest of the information without stopping. You can press any other key to
terminate the display.

– 81 –

Chapter 2

Entering Commands

| Using the Command Line Interface

Partial Keyword

Lookup

Negating the Effect of

Commands

Using Command

History

If you terminate a partial keyword with a question mark, alternatives that match the
initial letters are provided. (Remember not to leave a space between the command
and question mark.) For example “s?” shows all the keywords starting with “s.”

Console#show s?
snmp snmp-server sntp spanning-tree ssh
startup-config subnet-vlan system
Console#show s

For many configuration commands you can enter the prefix keyword “no” to cancel
the effect of a command or reset the configuration to the default value. For
example, the logging command will log system messages to a host server. To
disable logging, specify the no logging command. This guide describes the
negation effect for all applicable commands.

The CLI maintains a history of commands that have been entered. You can scroll
back through the history of commands by pressing the up arrow key. Any
command displayed in the history list can be executed again, or first modified and
then executed.

Understanding

Command Modes

Using the show history command displays a longer list of recently executed
commands.

The command set is divided into Exec and Configuration classes. Exec commands
generally display information on system status or clear statistical counters.
Configuration commands, on the other hand, modify interface parameters or
enable certain switching functions. These classes are further divided into different
modes. Available commands depend on the selected mode. You can always enter a
question mark “?” at the prompt to display a list of the commands available for the
current mode. The command classes and associated modes are displayed in the
following table:

Table 3: General Command Modes

Class Mode

Exec Normal

Privileged

Configuration

Global

*

Access Control List
Class Map
IGMP Profile
Interface
Line
Multiple Spanning Tree
Policy Map
Time Range
VLAN Database

* You must be in Privileged Exec mode to access the Global configuration mode.

You must be in Global Configuration mode to access any of the other configuration modes.

– 82 –

Chapter 2

| Using the Command Line Interface

Entering Commands

Exec Commands When you open a new console session on the switch with the user name and

password “guest,” the system enters the Normal Exec command mode (or guest
mode), displaying the “Console>” command prompt. Only a limited number of the
commands are available in this mode. You can access all commands only from the
Privileged Exec command mode (or administrator mode). To access Privilege Exec
mode, open a new console session with the user name “admin” and password
“admin123.” The system will now display the “Console#” command prompt. You can
also enter Privileged Exec mode from within Normal Exec mode, by entering the

enable command, followed by the privileged level password “super.”

To enter Privileged Exec mode, enter the following user names and passwords:

Username: admin
Password: [admin login password]

CLI session with the EX-3524 is opened.
To end the CLI session, enter [Exit].

Console#

Configuration

Commands

Username: guest
Password: [guest login password]

CLI session with the EX-3524 is opened.
To end the CLI session, enter [Exit].

Console>enable
Password: [privileged level password]
Console#

Configuration commands are privileged level commands used to modify switch
settings. These commands modify the running configuration only and are not
saved when the switch is rebooted. To store the running configuration in non­volatile storage, use the copy running-config startup-config command.

The configuration commands are organized into different modes:

◆ Global Configuration - These commands modify the system level configuration,

and include commands such as hostname and snmp-server community.

◆ Access Control List Configuration - These commands are used for packet

filtering.

◆ Class Map Configuration - Creates a DiffServ class map for a specified traffic

type.

◆ IGMP Profile - Sets a profile group and enters IGMP filter profile configuration

mode.

– 83 –

Chapter 2

| Using the Command Line Interface

Entering Commands

◆ Interface Configuration - These commands modify the port configuration such

as speed-duplex and negotiation.

◆ Line Configuration - These commands modify the console port and Telnet

configuration, and include command such as parity and databits.

◆ Multiple Spanning Tree Configuration - These commands configure settings for

the selected multiple spanning tree instance.

◆ Policy Map Configuration - Creates a DiffServ policy map for multiple interfaces.

◆ Time Range - Sets a time range for use by other functions, such as Access

Control Lists.

◆ VLAN Configuration - Includes the command to create VLAN groups.

To enter the Global Configuration mode, enter the command configure in
Privileged Exec mode. The system prompt will change to “Console(config)#” which
gives you access privilege to all Global Configuration commands.

Console#configure
Console(config)#

To enter the other modes, at the configuration prompt type one of the following
commands. Use the exit or end command to return to the Privileged Exec mode.

Table 4: Configuration Command Modes

Mode Command Prompt Page

Access Control
List

Class Map class-map Console(config-cmap) 554

Interface interface {ethernet port |

Line line {console | vty} Console(config-line-console)

MSTP spanning-tree mst-configuration Console(config-mstp) 472

Policy Map policy-map Console(config-pmap) 557

access-list ip standard
access-list ip extended
access-list ipv6 standard
access-list ipv6 extended
access-list mac

port-channel id| vlan id}

Console(config-std-acl)
Console(config-ext-acl)
Console(config-std-ipv6-acl)
Console(config-ext-ipv6-acl)
Console(config-mac-acl)

Console(config-if) 378

Console(config-line-vty)

352
352
359
360
364

121
121

Time Range time-range Console(config-time-range) 155

VLAN vlan database Console(config-vlan) 502

– 84 –

Chapter 2

| Using the Command Line Interface

Entering Commands

For example, you can use the following commands to enter interface configuration
mode, and then return to Privileged Exec mode.

Console(config)#interface ethernet 1/5
.
.
.

Console(config-if)#exit
Console(config)#

Command Line

Processing

Commands are not case sensitive. You can abbreviate commands and parameters
as long as they contain enough letters to differentiate them from any other
currently available commands or parameters. You can use the Tab key to complete
partial commands, or enter a partial command followed by the “?” character to
display a list of possible matches. You can also use the following editing keystrokes
for command-line processing:

Table 5: Keystroke Commands

Keystroke Func tion

Ctrl-A Shifts cursor to start of command line.

Ctrl-B Shifts cursor to the left one character.

Ctrl-C Terminates the current task and displays the command prompt.

Ctrl-E Shifts cursor to end of command line.

Ctrl-F Shifts cursor to the right one character.

Ctrl-K Deletes all characters from the cursor to the end of the line.

Ctrl-L Repeats current command line on a new line.

Ctrl-N Enters the next command line in the history buffer.

Ctrl-P Enters the last command.

Ctrl-R Repeats current command line on a new line.

Ctrl-U Deletes from the cursor to the beginning of the line.

Ctrl-W Deletes the last word typed.

Esc-B Moves the cursor back one word.

Esc-D Deletes from the cursor to the end of the word.

Esc-F Moves the cursor forward one word.

Delete key or
backspace key

Erases a mistake when entering a command.

– 85 –

Chapter 2

| Using the Command Line Interface

CLI Command Groups

CLI Command Groups

The system commands can be broken down into the functional groups shown
below

Table 6: Command Group Index

Command Group Description Page

.

General Basic commands for entering privileged access mode,

System Management Display and setting of system information, basic modes of

Simple Network
Management Protocol

Remote Monitoring Supports statistics, history, alarm and event groups 195

User Authentication Configures user names and passwords, logon access using

General Security Measures Segregates traffic for clients attached to common data ports;

Access Control List Provides filtering for IPv4 frames (based on address, protocol,

Interface Configures the connection parameters for all Ethernet ports,

restarting the system, or quitting the CLI

operation, maximum frame size, file management, console
port and telnet settings, system logs, SMTP alerts, the system
clock, and switch clustering

Activates authentication failure traps; configures community
access strings, and trap receivers

local or remote authentication, management access through
the web server, Telnet server and Secure Shell; as well as port
security, IEEE 802.1X port access control, and restricted access
based on specified IP addresses

and prevents unauthorized access by configuring valid static
or dynamic addresses, web authentication, MAC address
authentication, filtering DHCP requests and replies, and
discarding invalid ARP responses

TCP/UDP port number or TCP control code), IPv6 frames
(based on address or DSCP traffic class), or non-IP frames
(based on MAC address or Ethernet type)

aggregated links, and VLANs

89

97

171

203

271

351

377

Link Aggregation Statically groups multiple ports into a single logical trunk;

Power over Ethernet Configures power output for connected devices 417

Mirror Port Mirrors data to another port for analysis without affecting the

Congestion Control Sets the input/output rate limits, traffic storm thresholds, and

Loopback Detection Detects general loopback conditions caused by hardware

Address Table Configures the address table for filtering specified addresses,

Spanning Tree Configures Spanning Tree settings for the switch 465

VLANs Configures VLAN settings, and defines port membership for

configures Link Aggregation Control Protocol for port trunks

403

425

data passing through or the performance of the monitored
port

435

thresholds for broadcast and multicast storms which can be
used to trigger configured rate limits or to shut down a port.

453

problems or faulty protocol settings

459

displays current entries, clears the table, or sets the aging time

495

VLAN groups; also enables or configures private VLANs,
protocol VLANs, voice VLANs, and QinQ tunneling

– 86 –

Chapter 2

| Using the Command Line Interface

CLI Command Groups

Table 6: Command Group Index (Continued)

Command Group Description Page

Class of Service Sets port priority for untagged frames, selects strict priority or

Quality of Service Configures Differentiated Services 553

Multicast Filtering Configures IGMP multicast filtering, query, profile, and proxy

Link Layer Discovery
Protocol

Cisco Discovery Protocol Configures CDP settings to enable information discovery

Domain Name Service Configures DNS services. 705

Dynamic Host
Configuration Protocol

IP Interface Configures IP address for the switch interfaces; also

IP Routing Configures static unicast routing 771

weighted round robin, relative weight for each priority queue,
also sets priority for DSCP

parameters; sp ecifies ports attached to a mu lticast router; also
configures multicast VLAN registration

Configures LLDP settings to enable information discovery
about neighbor devices

about neighbor devices

Configures DHCP client functions 713

configures ARP parameters and static entries

541

571

673

699

723

The access mode shown in the following tables is indicated by these abbreviations:

ACL (Access Control List Configuration)
CM (Class Map Configuration)
GC (Global Configuration)
IC (Interface Configuration)
IPC (IGMP Profile Configuration)
LC (Line Configuration)
MST (Multiple Spanning Tree)
NE (Normal Exec)
PE (Privileged Exec)
PM (Policy Map Configuration)
VC (VLAN Database Configuration)

– 87 –

Chapter 2

| Using the Command Line Interface

CLI Command Groups

– 88 –

3 General Commands

The general commands are used to control the command access mode,
configuration mode, and other basic functions.

Table 7: General Commands

Command Function Mode

prompt Customizes the CLI prompt GC

reload Restarts the system at a specified time, after a specified delay, or at a

periodic interval

enable Activates privileged mode NE

quit Exits a CLI session NE, PE

show history Shows the command history buffer NE, PE

configure Activates global configuration mode PE

disable Returns to normal mode from privileged mode PE

reload Restarts the system immediately PE

show reload Displays the current reload settings, and the time at which next

scheduled reload will take place

end Returns to Privileged Exec mode any config.

exit Returns to the previous configuration mode, or exits the CLI any mode

help Shows how to use help any mode

? Shows options for command completion (context sensitive) any mode

GC

PE

mode

prompt This command customizes the CLI prompt. Use the no form to restore the default

prompt.

Syntax

prompt string

no prompt

Default Setting

Console

string - Any alphanumeric string to use for the CLI prompt.
(Maximum length: 32 characters)

– 89 –

Chapter 3

| General Commands

Command Mode

Global Configuration

Command Usage

This command and the hostname command can be used to set the command line
prompt as shown in the example below. Using the no form of either command will
restore the default command line prompt.

Example

Console(config)#prompt RD2
RD2(config)#

reload

(Global Configuration)

This command restarts the system at a specified time, after a specified delay, or at a
periodic interval. You can reboot the system immediately, or you can configure the
switch to reset after a specified amount of time. Use the cancel option to remove a
configured setting.

Syntax

reload {at hour minute [{month day | day month} [year]] |

in {hour hours | minute minutes | hour hours minute minutes} |
regularity hour minute [period {daily

of-week

}] |

cancel [at | in | regularity]}

|

monthly day-of-month

|

weekly day-

reload at - A specified time at which to reload the switch.

hour - The hour at which to reload. (Range: 0-23)

minute - The minute at which to reload. (Range: 0-59)

month - The month at which to reload. (january ... december)

day - The day of the month at which to reload. (Range: 1-31)

year - The year at which to reload. (Range: 1970-2037)

reload in - An interval after which to reload the switch.

hours - The number of hours, combined with the minutes, before the
switch resets. (Range: 0-576)

minutes - The number of minutes, combined with the hours, before the
switch resets. (Range: 0-34560)

reload

regularity

- A periodic interval at which to reload the switch.

hour - The hour at which to reload. (Range: 0-23)

minute - The minute at which to reload. (Range: 0-59)

day-of-month

- Day of the month at which to reload. (Range: 1-31)

day-of-week - Day of the week at which to reload.
(Range: monday ... saturday)

reload cancel - Cancels the specified reload option.

– 90 –

Chapter 3

| General Commands

Default Setting

None

Command Mode

Global Configuration

Command Usage

◆ This command resets the entire system.

◆ Any combination of reload options may be specified. If the same option is re-

specified, the previous setting will be overwritten.

◆ When the system is restarted, it will always run the Power-On Self-Test. It will

also retain all configuration information stored in non-volatile memory by the

copy running-config startup-config command (See “copy” on page 110).

Example

This example shows how to reset the switch after 30 minutes:

Console(config)#reload in minute 30
***
*** --- Rebooting at January 1 02:10:43 2007 --­***

Are you sure to reboot the system at the specified time? <y/n>

enable This command activates Privileged Exec mode. In privileged mode, additional

commands are available, and certain commands display additional information.
See “Understanding Command Modes” on page 82.

Syntax

enable [level]

level - Privilege level to log into the device.

The device has two predefined privilege levels: 0: Normal Exec,
15: Privileged Exec. Enter level 15 to access Privileged Exec mode.

Default Setting

Level 15

Command Mode

Normal Exec

Command Usage

◆ “super” is the default password required to change the command mode from

Normal Exec to Privileged Exec. (To set this password, see the enable password
command.)

– 91 –

Chapter 3

| General Commands

◆ The “#” character is appended to the end of the prompt to indicate that the

system is in privileged access mode.

Example

Console>enable
Password: [privileged level password]
Console#

Related Commands

disable (94)
enable password (204)

quit This command exits the configuration program.

Default Setting

None

Command Mode

Normal Exec, Privileged Exec

Command Usage

The quit and exit commands can both exit the configuration program.

Example

This example shows how to quit a CLI session:

Console#quit

% CLI exit session

Press ENTER to start session

show history This command shows the contents of the command history buffer.

Default Setting

None

Command Mode

Normal Exec, Privileged Exec

Command Usage

The history buffer size is fixed at 10 Execution commands and 10 Configuration
commands.

– 92 –

Chapter 3

| General Commands

Example

In this example, the show history command lists the contents of the command
history buffer:

Console#show history
Execution command history:
2 config
1 show history

Configuration command history:
4 interface vlan 1
3 exit
2 interface vlan 1
1 end

Console#

The ! command repeats commands from the Execution command history buffer
when you are in Normal Exec or Privileged Exec Mode, and commands from the
Configuration command history buffer when you are in any of the configuration
modes. In this example, the !2 command repeats the second command in the
Execution history buffer (config).

Console#!2
Console#config
Console(config)#

configure This command activates Global Configuration mode. You must enter this mode to

modify any settings on the switch. You must also enter Global Configuration mode
prior to enabling some of the other configuration modes, such as Interface
Configuration, Line Configuration, and VLAN Database Configuration. See

“Understanding Command Modes” on page 82.

Default Setting

None

Command Mode

Privileged Exec

Example

Console#configure
Console(config)#

Related Commands

end (95)

– 93 –

Chapter 3

| General Commands

disable This command returns to Normal Exec mode from privileged mode. In normal

access mode, you can only display basic information on the switch's configuration
or Ethernet statistics. To gain access to all commands, you must use the privileged
mode. See “Understanding Command Modes” on page 82.

Default Setting

None

Command Mode

Privileged Exec

Command Usage

The “>” character is appended to the end of the prompt to indicate that the system
is in normal access mode.

Example

Console#disable
Console>

Related Commands

enable (91)

reload (Privileged Exec) This command restarts the system.

Note:

When the system is restarted, it will always run the Power-On Self-Test. It will
also retain all configuration information stored in non-volatile memory by the copy
running-config startup-config command.

Default Setting

None

Command Mode

Privileged Exec

Command Usage

This command resets the entire system.

Example

This example shows how to reset the switch:

Console#reload
System will be restarted, continue <y/n>? y

– 94 –

Chapter 3

| General Commands

show reload This command displays the current reload settings, and the time at which next

scheduled reload will take place.

Command Mode

Privileged Exec

Example

Console#show reload
Reloading switch in time: 0 hours 29 minutes.

The switch will be rebooted at January 1 02:11:50 2001.
Remaining Time: 0 days, 0 hours, 29 minutes, 52 seconds.
Console#

end This command returns to Privileged Exec mode.

Default Setting

None

Command Mode

Global Configuration, Interface Configuration, Line Configuration, VLAN Database
Configuration, and Multiple Spanning Tree Configuration.

Example

This example shows how to return to the Privileged Exec mode from the Interface
Configuration mode:

Console(config-if)#end
Console#

exit This command returns to the previous configuration mode or exits the

configuration program.

Default Setting

None

Command Mode

Any

– 95 –

Chapter 3

| General Commands

Example

This example shows how to return to the Privileged Exec mode from the Global
Configuration mode, and then quit the CLI session:

Console(config)#exit
% CLI exit session

Press ENTER to start session

– 96 –

4 System Management

Commands

The system management commands are used to control system logs, passwords,
user names, management options, and display or configure a variety of other
system information.

Table 8: System Management Commands

Command Group Function

Device Designation Configures information that uniquely identifies this switch

Device Designation

System Status Displays system configuration, active managers, and version

information

Frame Size Enables support for jumbo frames

File Management Manages code image or switch configuration files

Line Sets communication parameters for the serial port, including baud rate

and console time-out

Event Logging Controls logging of error messages

SMTP Alerts Configures SMTP email alerts

Time (System Clock) Sets the system clock automatically via NTP/SNTP server or manually

Time Range Set s a t ime ran ge fo r us e by oth er f unc tio ns, such a s Acce ss Con trol L ist s

Switch Clustering Configures management of multiple devices via a single IP address

Adopt Device Configures switch to submit request to be adopted for centralized

management by “Controller” software

This section describes commands used to configure information that uniquely
identifies the switch.

Table 9: Device Designation Commands

Command Function Mode

hostname Specifies the host name for the switch GC

snmp-server contact Sets the system contact string GC

snmp-server location Sets the system location string GC

– 97 –

Chapter 4

System Status

| System Management Commands

hostname This command specifies or modifies the host name for this device. Use the no form

to restore the default host name.

Syntax

hostname name

no hostname

name - The name of this host. (Maximum length: 255 characters)

Default Setting

None

Command Mode

Global Configuration

Command Usage

◆ The host name specified by this command is displayed by the show system

command and on the Show > System web page.

System Status

◆ This command and the prompt command can be used to set the command line

prompt as shown in the example below. Using the no form of either command
will restore the default command line prompt.

Example

Console(config)#hostname RD#1
RD#1(config)#

This section describes commands used to display system information.

Table 10: System Status Commands

Command Function Mode

show access-list
tcam-utilization

show memory Shows memory utilization parameters NE, PE

show process cpu Shows CPU utilization parameters NE, PE

Shows utilization parameters for TCAM PE

show running-config Displays the configuration data currently in use PE

show startup-config Displays the contents of the configuration file (stored in

show system Displays system information NE, PE

show tech-support Displays a detailed list of system settings designed to help

flash memory) that is used to start up the system

PE

PE
technical support resolve configuration or functional
problems

– 98 –

Chapter 4

| System Management Commands

System Status

Table 10: System Status Commands (Continued)

Command Function Mode

show access-list

tcam-utilization

show users Shows all active console and Telnet sessions, including user

name, idle time, and IP address of Telnet clients

show version Displays version information for the system NE, PE

NE, PE

This command shows utilization parameters for TCAM (Ternary Content
Addressable Memory), including the number policy control entries in use, the
number of free entries.

Command Mode

Privileged Exec

Command Usage

Policy control entries (PCEs) are used by various system functions which rely on
rule-based searches, including Access Control Lists (ACLs), IP Source Guard filter
rules, Quality of Service (QoS) processes, or traps.

For example, when binding an ACL to a port, each rule in an ACL will use two PCEs;
and when setting an IP Source Guard filter rule for a port, the system will also use
two PCEs.

Example

Console#show access-list tcam-utilization
Pool capability code:
ALL - All supported function, AM - MAC ACL, A4 - IPv4 ACL,
A6S - IPv6 Standard ACL, A6E - IPv6 extended ACL, DM - MAC DiffServ,
D4 - IPv4 DiffServ, D6S - IPv6 standard DiffServ,
D6E - IPv6 extended DiffServ, AEM - Egress MAC ACL,
AE4 - Egress IPv4 ACL, AE6S - Egress IPv6 standard ACL,
AE6E - Egress IPv6 extended ACL, DEM - Egress MAC DiffServ,
DE4 - Egress IPv4 DiffServ, DE6S - Egress IPv6 standard DiffServ,
DE6E - Egress IPv6 extended DiffServ, W - Web authentication,
I - IP source guard, I6- IPv6 source guard, C - CPU interface,
R - Rate limit, L - Link local, Reserved - Reserved

Unit Device Pool Total Used Free Pool Capability

---- ------ ---- ----- ----- ----- ---------------------------------------­ 1 0 0 372 196 176 ALL
1 1 0 372 196 176 ALL
Console#

– 99 –

Chapter 4

System Status

show memory This command shows memory utilization parameters.

| System Management Commands

Command Mode

Normal Exec, Privileged Exec

Command Usage

This command shows the amount of memory currently free for use, the amount of
memory allocated to active processes, the total amount of system memory, and the
alarm thresholds.

Example

Console#show memory
Status Bytes %

------ ---------- --­ Free 19951616 14
Used 114266112 86
Total 134217728

Alarm Configuration
Rising Threshold : 95%
Falling Threshold : 90%

Console#

Related Commands

memory (192)

show process cpu This command shows the CPU utilization parameters, alarm status, and alarm

thresholds.

Command Mode

Normal Exec, Privileged Exec

Example

Console#show process cpu
CPU Utilization in the past 5 seconds : 22%

CPU Utilization in the past 60 seconds
Average Utilization : 27%
Maximum Utilization : 39%

Alarm Status
Current Alarm Status : Off
Last Alarm Start Time :
Last Alarm Duration Time : 44 seconds

Alarm Configuration
Rising Threshold : 90%
Falling Threshold : 70%

Console#

– 100 –

Chapter 4

| System Management Commands

Related Commands

process cpu (192)

show running-config This command displays the configuration information currently in use.

Syntax

show running-config [interface interface]

interface

ethernet unit/port

unit - Unit identifier. (Range: Always 1)

port - Port number. (Range: 1-28/52)

port-channel channel-id (Range: 1-16)

vlan vlan-id (Range: 1-4094)

System Status

Command Mode

Privileged Exec

Command Usage

◆ Use the interface keyword to display configuration data for the specified

interface.

◆ Use this command in conjunction with the show startup-config command to

compare the information in running memory to the information stored in non­volatile memory.

◆ This command displays settings for key command modes. Each mode group is

separated by “!” symbols, and includes the configuration mode command, and
corresponding commands. This command displays the following information:

■

MAC address for the switch

■

SNMP community strings

■

Users (names, access levels, and encrypted passwords)

■

VLAN database (VLAN ID, name and state)

■

VLAN configuration settings for each interface

■

Multiple spanning tree instances (name and interfaces)

■

IP address configured for management VLAN

■

Spanning tree settings

■

Interface settings

■

Any configured settings for the console port and Telnet

Example

Console#show running-config
Building running configuration. Please wait...
!<stackingDB>00</stackingDB>
!<stackingMac>01_00-e0-0c-00-00-fd_03</stackingMac>
!

– 101 –

Chapter 4

System Status

| System Management Commands

snmp-server community public ro
snmp-server community private rw
!
snmp-server enable traps authentication
!
username admin access-level 15
username admin password 7 21232f297a57a5a743894a0e4a801fc3
enable password level 15 7 1b3231655cebb7a1f783eddf27d254ca
!
vlan database
vlan 1 name DefaultVlan media ethernet state active
!
spanning-tree mst configuration
!
interface ethernet 1/1
!
interface ethernet 1/1
ip address dhcp
.

.
.

radius-server acct-port 1813
.

.
.

interface vlan 1
ip address 192.168.1.10 255.255.255.0
!
line console
!
line vty
!
end
!
Console#

Related Commands

show startup-config (102)

show startup-config This command displays the configuration file stored in non-volatile memory that is

used to start up the system.

Command Mode

Privileged Exec

Command Usage

◆ Use this command in conjunction with the show running-config command to

compare the information in running memory to the information stored in non­volatile memory.

◆ This command displays settings for key command modes. Each mode group is

separated by “!” symbols, and includes the configuration mode command, and
corresponding commands. This command displays the following information:

■

MAC address for the switch

■

SNMP community strings

■

SNMP trap authentication

■

Users (names and access levels)

■

VLAN database (VLAN ID, name and state)

– 102 –