Cisco HWIC-4ESW - EtherSwitch HWIC Switch User manual

Americas Headquarters:
Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA
Cisco HWIC-4ESW and HWIC-D-9ESW
EtherSwitch Interface Cards
First Published: May 17, 2005
Last Updated: July 28, 2010
This document provides configuration tasks for the 4-port Cisco HWIC-4ESW and the 9-port
Cisco HWIC-D-9ESW EtherSwitch high-speed WAN interface cards (HWICs) hardware feature
supported on Cisco 1800 (modular), Cisco 2800, and Cisco 3800 series integrated services routers.
Cisco EtherSwitch HWICs are 10/100BASE-T Layer 2 Ethernet switches with Layer 3 routing
capability. (Layer 3 routing is forwarded to the host and is not actually performed at the switch.) Traffic
between different VLANs on a switch is routed through the router platform. Any one port on a
Cisco EtherSwitch HWIC may be configured as a stacking port to link to another Cisco EtherSwitch
HWIC or EtherSwitch network module in the same system. An optional power module can also be added
to provide inline power for IP telephones. The HWIC-D-9ESW HWIC requires a double-wide card slot.
This hardware feature does not introduce any new or modified Cisco IOS commands.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature
information and caveats, see the release notes for your platform and software release. To find information
about the features documented in this module, and to see a list of the releases in which each feature is
supported, see the “Feature Information for the Cisco HWIC-4ESW and the Cisco HWIC-D-9ESW
EtherSwitch Cards” section on page 104.
Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS
software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An
account on Cisco.com is not required.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards
Contents
2
Contents
The following sections provide information about the Cisco EtherSwitch HWICs.
•Prerequisites for EtherSwitch HWICs, page 2
•Restrictions for EtherSwitch HWICs, page 2
•Information About EtherSwitch HWICs, page 3
•How to Configure EtherSwitch HWICs, page 5
•Configuration Examples for EtherSwitch HWICs, page 91
•Additional References, page 102
Prerequisites for EtherSwitch HWICs
The following are prerequisites to configuring EtherSwitch HWICs:
•Configuration of IP routing. See the Cisco IOS IP Routing: Protocol-Independent Configuration
Guide for the Cisco IOS Release you are using.
•Use of the Cisco IOS T release, beginning with Release 12.3(8)T4 or later for Cisco HWIC-4ESW
and Cisco HWIC-D-9ESW support. (See the Cisco IOS documentation.)
Restrictions for EtherSwitch HWICs
The following restrictions apply to the Cisco HWIC-4ESW and the Cisco HWIC-D-9ESW EtherSwitch
HWICs:
•No more than two Ethernet Switch HWICs or network modules may be installed in a host router.
Multiple Ethernet Switch HWICs or network modules installed in a host router will not act
independently of each other. They must be stacked, as they will not work at all otherwise.
•The ports of a Cisco EtherSwitch HWIC must NOT be connected to the Fast Ethernet/Gigabit
onboard ports of the router.
•There is no inline power on the ninth port (port 8) of the HWIC-D-9ESW card.
•There is no Auto MDIX support on the ninth port (port 8) of the HWIC-D-9ESW card when either
speed or duplex is not set to auto.
•There is no support for online insertion/removal (OIR) of the EtherSwitch HWICs.
•When Ethernet Switches have been installed and configured in a host router, OIR of the
CompactFlash memory card in the router must not occur. OIR of the CompactFlash memory card
will compromise the configuration of the Ethernet Switches.
•VTP pruning is not supported.
•There is a limit of 200 secure MAC addresses per module that can be supported by an EtherSwitch
HWIC.
•Maximum traffic for a secure MAC address is 8 Mb/s.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards
Prerequisites for Installing Two Ethernet Switch Network Modules in a Single Chassis
3
Prerequisites for Installing Two Ethernet Switch Network
Modules in a Single Chassis
A maximum of two Ethernet switch network modules can be installed in a single chassis. If two Ethernet
switch network modules of any type are installed in the same chassis, the following configuration
requirements must be met:
•Both Ethernet switch network modules must have an optional Gigabit Ethernet expansion board
installed.
•An Ethernet crossover cable must be connected to the two Ethernet switch network modules using
the optional Gigabit Ethernet expansion board ports.
•Intrachassis stacking for the optional Gigabit Ethernet expansion board ports must be configured.
For information about intrachassis stacking configuration, see the 16- and 36-Port Ethernet Switch
Module for Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series module.
Note Without this configuration and connection, duplications will occur in the VLAN databases, and
unexpected packet handling may occur.
Information About EtherSwitch HWICs
•VLANs, page 3
•Inline Power for Cisco IP Phones, page 4
•Layer 2 Ethernet Switching, page 4
•802.1x Authentication, page 4
•Spanning Tree Protocol, page 4
•Cisco Discovery Protocol, page 4
•Switched Port Analyzer, page 4
•IGMP Snooping, page 4
•Storm Control, page 4
•Intrachassis Stacking, page 5
•Fallback Bridging, page 5
•Default 802.1x Configuration, page 5
VLANs
For conceptual information about VLANs, see the “VLANs” section of the EtherSwitch Network
Module.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards
Information About EtherSwitch HWICs
4
Inline Power for Cisco IP Phones
For conceptual information about inline power for Cisco IP phones, see the “Inline Power for Cisco IP
Phones” section of the EtherSwitch Network Module.
Layer 2 Ethernet Switching
For conceptual information about Layer 2 Ethernet switching, see the “Layer 2 Ethernet Switching”
section of the EtherSwitch Network Module.
802.1x Authentication
For conceptual information about 802.1x authentication, see the “802.1x Authentication” section of the
EtherSwitch Network Module.
Spanning Tree Protocol
For conceptual information about Spanning Tree Protocol, see the “Using the Spanning Tree Protocol
with the EtherSwitch Network Module” section of the EtherSwitch Network Module.
Cisco Discovery Protocol
For conceptual information about Cisco Discovery Protocol, see the “Cisco Discovery Protocol” section
of the EtherSwitch Network Module.
Switched Port Analyzer
For conceptual information about a switched port analyzer, see the “Switched Port Analyzer” section of
the EtherSwitch Network Module.
IGMP Snooping
For conceptual information about IGMP snooping, see the “IGMP Snooping” section of the EtherSwitch
Network Module.
Storm Control
For conceptual information about storm control, see the “Storm Control” section of the EtherSwitch
Network Module.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards
Information About EtherSwitch HWICs
5
Intrachassis Stacking
For conceptual information about intrachassis stacking, see the ‘Intrachassis Stacking” section of the
EtherSwitch Network Module.
Fallback Bridging
For conceptual information about fallback bridging, see the “Fallback Bridging” section of the
EtherSwitch Network Module.
Default 802.1x Configuration
Table 1 shows the default 802.1x configuration.
Table 1 Default 802.1x Configuration
Feature Default Setting
Authentication, authorization, and
accounting (AAA)
Disabled.
RADIUS server
•IP address
•UDP authentication port
•Key
•None specified.
•1645.
•None specified.
Per-interface 802.1x enable state Disabled (force-authorized).
The port transmits and receives normal traffic without
802.1x-based authentication of the client.
Periodic reauthentication Disabled.
Number of seconds between
reauthentication attempts
3600 seconds.
Quiet period 60 seconds (number of seconds that the switch remains in
the quiet state following a failed authentication exchange
with the client).
Retransmission time 30 seconds (number of seconds that the switch should
wait for a response to an EAP request/identity frame
from the client before retransmitting the request).
Maximum retransmission number 2 times (number of times that the switch will send an
EAP-request/identity frame before restarting the
authentication process).
Multiple host support Disabled.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards
How to Configure EtherSwitch HWICs
6
802.1x Configuration Guidelines
These are the 802.1x authentication configuration guidelines:
•When the 802.1x protocol is enabled, ports are authenticated before any other Layer 2 feature is
enabled.
•The 802.1x protocol is supported on Layer 2 static-access ports, but it is not supported on these port
types:
– Trunk port—If you try to enable 802.1x on a trunk port, an error message appears, and 802.1x
is not enabled. If you try to change the mode of an 802.1x-enabled port to trunk, the port mode
is not changed.
– Switch Port Analyzer (SPAN) destination port—You can enable 802.1x on a port that is a SPAN
destination port; however, 802.1x is disabled until the port is removed as a SPAN destination.
You can enable 802.1x on a SPAN source port.
How to Configure EtherSwitch HWICs
•Configuring VLANs, page 5
•Configuring VLAN Trunking Protocol, page 7
•Configuring Layer 2 Interfaces, page 10
•Configuring 802.1x Authentication, page 18
•Configuring Spanning Tree, page 30
•Configuring MAC Table Manipulation, page 39
•Configuring Cisco Discovery Protocol, page 41
•Configuring the Switched Port Analyzer (SPAN), page 44
•Configuring Power Management on the Interface, page 46
•Configuring IP Multicast Layer 3 Switching, page 47
•Configuring IGMP Snooping, page 51
•Configuring Per-Port Storm Control, page 56
•Configuring Stacking, page 59
•Configuring Fallback Bridging, page 61
•Configuring Separate Voice and Data Subnets, page 76
Client timeout period 30 seconds (when relaying a request from the
authentication server to the client, the amount of time the
switch waits for a response before retransmitting the
request to the client). This setting is not configurable.
Authentication server timeout period 30 seconds (when relaying a response from the client to
the authentication server, the amount of time the switch
waits for a reply before retransmitting the response to the
server). This setting is not configurable.
Table 1 Default 802.1x Configuration (continued)
Feature Default Setting

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards
How to Configure EtherSwitch HWICs
7
•Managing the EtherSwitch HWIC, page 78
Configuring VLANs
This section describes how to configure VLANs on the switch and contains the following sections:
•Adding a VLAN Instance, page 6
•Deleting a VLAN Instance from the Database, page 6
Adding a VLAN Instance
A total of 15 VLANs can be supported by an EtherSwitch HWIC.
Follow the steps below to configure a Fast Ethernet interface as Layer 2 access.
SUMMARY STEPS
1. enable
2. vlan database
3. vlan vlan-id
4. exit
DETAILED STEPS
Deleting a VLAN Instance from the Database
You cannot delete the default VLANs for the different media types: Ethernet VLAN 1 and FDDI or
Token Ring VLANs 1002 to 1005.
Command or Action Purpose
Step 1 enable
Example:
Router> enable
Enables privileged EXEC mode.
•Enter your password if prompted.
Step 2 vlan database
Example:
Router# vlan database
Enters VLAN configuration mode.
Step 3 vlan vlan-id
Example:
Router(vlan)# vlan 1
Adds an Ethernet VLAN.
•Enter the VLAN number.
Step 4 exit
Example:
Router(vlan)# exit
Updates the VLAN database, propagates it throughout the
administrative domain, and returns to privileged EXEC mode.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards
How to Configure EtherSwitch HWICs
8
Follow the steps below to delete a VLAN from the database.
SUMMARY STEPS
1. enable
2. vlan database
3. no vlan vlan-id
4. exit
DETAILED STEPS
Configuring VLAN Trunking Protocol
This section describes how to configure the VLAN Trunking Protocol (VTP) on an EtherSwitch HWIC,
and contains the following tasks:
•Configuring a VTP Server, page 7
•Configuring a VTP Client, page 8
•Disabling VTP (VTP Transparent Mode), page 9
Note VTP pruning is not supported by EtherSwitch HWICs.
Configuring a VTP Server
When a switch is in VTP server mode, you can change the VLAN configuration and have it propagate
throughout the network.
Follow the steps below to configure the switch as a VTP server.
Command or Action Purpose
Step 1 enable
Example:
Router> enable
Enables privileged EXEC mode.
•Enter your password if prompted.
Step 2 vlan database
Example:
Router# vlan database
Enters VLAN configuration mode.
Step 3 no vlan vlan-id
Example:
Router(vlan)# no vlan 1
Deletes an Ethernet VLAN.
•Enter the VLAN number.
Step 4 exit
Example:
Router(vlan)# exit
Updates the VLAN database, propagates it throughout the
administrative domain, and returns to privileged EXEC mode.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards
How to Configure EtherSwitch HWICs
9
SUMMARY STEPS
1. enable
2. vlan database
3. vtp server
4. vtp domain domain-name
5. vtp password password-value
6. exit
DETAILED STEPS
Configuring a VTP Client
When a switch is in VTP client mode, you cannot change the VLAN configuration on the switch. The
client switch receives VTP updates from a VTP server in the management domain and modifies its
configuration accordingly.
Follow the steps below to configure the switch as a VTP client.
Command or Action Purpose
Step 1 enable
Example:
Router> enable
Enables privileged EXEC mode.
•Enter your password if prompted.
Step 2 vlan database
Example:
Router# vlan database
Enters VLAN configuration mode.
Step 3 vtp server
Example:
Router(vlan)# vtp server
Configures the switch as a VTP server.
Step 4 vtp domain domain-name
Example:
Router(vlan)# vtp domain distantusers
Defines the VTP domain name.
•Enter the VTP domain name. Domain names can be a
maximum of 32 characters.
Step 5 vtp password password-value
Example:
Router(vlan)# vtp password philadelphia
(Optional) Sets a VTP domain password
•Enter a password. Passwords can be from 8 to 64 characters.
Step 6 exit
Example:
Router(vlan)# exit
Updates the VLAN database, propagates it throughout the
administrative domain, exits VLAN configuration mode, and
returns to privileged EXEC mode.

Cisco HWIC-4ESW and HWIC-D-9ESW EtherSwitch Interface Cards
How to Configure EtherSwitch HWICs
10
SUMMARY STEPS
1. enable
2. vlan database
3. vtp client
4. exit
DETAILED STEPS
Disabling VTP (VTP Transparent Mode)
When you configure the switch as VTP transparent, you disable VTP on the switch. A VTP transparent
switch does not send VTP updates and does not act on VTP updates received from other switches.
Follow the steps below to disable VTP on the switch.
SUMMARY STEPS
1. enable
2. vlan database
3. vtp transparent
4. exit
Command or Action Purpose
Step 1 enable
Example:
Router> enable
Enables privileged EXEC mode.
•Enter your password if prompted.
Step 2 vlan database
Example:
Router# vlan database
Enters VLAN configuration mode.
Step 3 vtp client
Example:
Router(vlan)# vtp client
Configures the switch as a VTP client.
Step 4 exit
Example:
Router(vlan)# exit
Updates the VLAN database, propagates it throughout the
administrative domain, exits VLAN configuration mode and
returns to privileged EXEC mode.