Cisco Catalyst 2928 User manual

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Catalyst 2928 Switch
Software Configuration Guide
Cisco IOS Release 12.2(55)EZ
November 2010
Text Part Number: OL-23389-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the
document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1005R)
Catalyst 2928 Switch Software Configuration Guide
©2010 Cisco Systems, Inc. All rights reserved.

iii
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
CONTENTS
Preface xxvii
Audience xxvii
Purpose xxvii
Conventions xxvii
Related Publications xxviii
Obtaining Documentation, Obtaining Support, and Security Guidelines xxix
CHAPTER 1Overview 1-1
Features 1-1
Ease-of-Deployment and Ease-of-Use Features 1-1
Performance Features 1-2
Management Options 1-3
Manageability Features 1-4
Availability and Redundancy Features 1-5
VLAN Features 1-5
Security Features 1-6
QoS and CoS Features 1-7
Power over Ethernet Features (WS-C2928-24LT-C only) 1-7
Monitoring Features 1-8
Default Settings After Initial Switch Configuration 1-8
Network Configuration Examples 1-11
Design Concepts for Using the Switch 1-11
Small to Medium-Sized Network Using Catalyst 2928 Switches 1-14
Campus Network Using Catalyst 2928 Switches 1-15
Where to Go Next 1-16
CHAPTER 2Using the Command-Line Interface 2-1
Understanding Command Modes 2-1
Understanding the Help System 2-3
Understanding Abbreviated Commands 2-3
Understanding no and default Forms of Commands 2-4
Understanding CLI Error Messages 2-4
Using Configuration Logging 2-4

Contents
iv
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Using Command History 2-5
Changing the Command History Buffer Size 2-5
Recalling Commands 2-6
Disabling the Command History Feature 2-6
Using Editing Features 2-6
Enabling and Disabling Editing Features 2-6
Editing Commands through Keystrokes 2-7
Editing Command Lines that Wrap 2-8
Searching and Filtering Output of show and more Commands 2-9
Accessing the CLI 2-9
Accessing the CLI through a Console Connection or through Telnet 2-9
CHAPTER 3Assigning the Switch IP Address and Default Gateway 3-1
Understanding the Boot Process 3-1
Assigning Switch Information 3-2
Default Switch Information 3-3
Understanding DHCP-Based Autoconfiguration 3-3
DHCP Client Request Process 3-4
Understanding DHCP-based Autoconfiguration and Image Update 3-4
DHCP Autoconfiguration 3-5
DHCP Auto-Image Update 3-5
Limitations and Restrictions 3-5
Configuring DHCP-Based Autoconfiguration 3-6
DHCP Server Configuration Guidelines 3-6
Configuring the TFTP Server 3-7
Configuring the DNS 3-7
Configuring the Relay Device 3-7
Obtaining Configuration Files 3-8
Example Configuration 3-9
Configuring the DHCP Auto Configuration and Image Update Features 3-11
Configuring DHCP Autoconfiguration (Only Configuration File) 3-11
Configuring DHCP Auto-Image Update (Configuration File and Image) 3-12
Configuring the Client 3-13
Manually Assigning IP Information 3-14
Checking and Saving the Running Configuration 3-14
Modifying the Startup Configuration 3-15
Default Boot Configuration 3-16
Automatically Downloading a Configuration File 3-16
Specifying the Filename to Read and Write the System Configuration 3-16

Contents
v
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Booting Manually 3-17
Booting a Specific Software Image 3-18
Controlling Environment Variables 3-18
Scheduling a Reload of the Software Image 3-20
Configuring a Scheduled Reload 3-20
Displaying Scheduled Reload Information 3-21
CHAPTER 4Configuring Cisco IOS CNS Agents 4-1
Understanding Cisco Configuration Engine Software 4-1
Configuration Service 4-2
Event Service 4-3
NameSpace Mapper 4-3
What You Should Know About the CNS IDs and Device Hostnames 4-3
ConfigID 4-3
DeviceID 4-4
Hostname and DeviceID 4-4
Using Hostname, DeviceID, and ConfigID 4-4
Understanding Cisco IOS Agents 4-5
Initial Configuration 4-5
Incremental (Partial) Configuration 4-6
Synchronized Configuration 4-6
Configuring Cisco IOS Agents 4-6
Enabling Automated CNS Configuration 4-6
Enabling the CNS Event Agent 4-7
Enabling the Cisco IOS CNS Agent 4-8
Enabling an Initial Configuration 4-9
Enabling a Partial Configuration 4-11
Displaying CNS Configuration 4-12
CHAPTER 5Clustering Switches 5-1
Understanding Switch Clusters 5-1
Cluster Command Switch Characteristics 5-2
Standby Cluster Command Switch Characteristics 5-3
Candidate Switch and Cluster Member Switch Characteristics 5-3
Planning a Switch Cluster 5-4
Automatic Discovery of Cluster Candidates and Members 5-4
Discovery Through CDP Hops 5-4
Discovery Through Non-CDP-Capable and Noncluster-Capable Devices 5-5
Discovery Through Different VLANs 5-6

Contents
vi
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Discovery Through Different Management VLANs 5-7
Discovery of Newly Installed Switches 5-8
HSRP and Standby Cluster Command Switches 5-9
Virtual IP Addresses 5-10
Other Considerations for Cluster Standby Groups 5-10
Automatic Recovery of Cluster Configuration 5-11
IP Addresses 5-12
Hostnames 5-12
Passwords 5-12
SNMP Community Strings 5-13
TACACS+ and RADIUS 5-13
LRE Profiles 5-13
Using the CLI to Manage Switch Clusters 5-13
Catalyst 1900 and Catalyst 2820 CLI Considerations 5-14
Using SNMP to Manage Switch Clusters 5-14
CHAPTER 6Configuring SDM Templates 6-1
Understanding the SDM Templates 6-1
Configuring the Switch SDM Template 6-2
Default SDM Template 6-2
SDM Template Configuration Guidelines 6-2
Displaying the SDM Templates 6-3
CHAPTER 7Administering the Switch 7-1
Managing the System Time and Date 7-1
Understanding the System Clock 7-1
Understanding Network Time Protocol 7-2
Configuring NTP 7-4
Default NTP Configuration 7-4
Configuring NTP Authentication 7-4
Configuring NTP Associations 7-5
Configuring NTP Broadcast Service 7-6
Configuring NTP Access Restrictions 7-8
Configuring the Source IP Address for NTP Packets 7-10
Displaying the NTP Configuration 7-11
Configuring Time and Date Manually 7-11
Setting the System Clock 7-11
Displaying the Time and Date Configuration 7-12

Contents
vii
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Configuring the Time Zone 7-12
Configuring Summer Time (Daylight Saving Time) 7-13
Configuring a System Name and Prompt 7-14
Default System Name and Prompt Configuration 7-15
Configuring a System Name 7-15
Understanding DNS 7-15
Default DNS Configuration 7-16
Setting Up DNS 7-16
Displaying the DNS Configuration 7-17
Creating a Banner 7-17
Default Banner Configuration 7-17
Configuring a Message-of-the-Day Login Banner 7-17
Configuring a Login Banner 7-18
Managing the MAC Address Table 7-19
Building the Address Table 7-20
MAC Addresses and VLANs 7-20
Default MAC Address Table Configuration 7-20
Changing the Address Aging Time 7-20
Removing Dynamic Address Entries 7-21
Configuring MAC Address Notification Traps 7-21
Adding and Removing Static Address Entries 7-23
Configuring Unicast MAC Address Filtering 7-24
Displaying Address Table Entries 7-26
Managing the ARP Table 7-26
CHAPTER 8Configuring Switch-Based Authentication 8-1
Preventing Unauthorized Access to Your Switch 8-1
Protecting Access to Privileged EXEC Commands 8-2
Default Password and Privilege Level Configuration 8-2
Setting or Changing a Static Enable Password 8-3
Protecting Enable and Enable Secret Passwords with Encryption 8-3
Disabling Password Recovery 8-5
Setting a Telnet Password for a Terminal Line 8-6
Configuring Username and Password Pairs 8-6
Configuring Multiple Privilege Levels 8-7
Setting the Privilege Level for a Command 8-8
Changing the Default Privilege Level for Lines 8-9
Logging into and Exiting a Privilege Level 8-9

Contents
viii
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Controlling Switch Access with TACACS+ 8-10
Understanding TACACS+ 8-10
TACACS+ Operation 8-12
Configuring TACACS+ 8-12
Default TACACS+ Configuration 8-13
Identifying the TACACS+ Server Host and Setting the Authentication Key 8-13
Configuring TACACS+ Login Authentication 8-14
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 8-16
Starting TACACS+ Accounting 8-17
Displaying the TACACS+ Configuration 8-17
Controlling Switch Access with RADIUS 8-17
Understanding RADIUS 8-18
RADIUS Operation 8-19
Configuring RADIUS 8-20
Default RADIUS Configuration 8-20
Identifying the RADIUS Server Host 8-20
Configuring RADIUS Login Authentication 8-23
Defining AAA Server Groups 8-25
Configuring RADIUS Authorization for User Privileged Access and Network Services 8-27
Starting RADIUS Accounting 8-28
Configuring Settings for All RADIUS Servers 8-29
Configuring the Switch to Use Vendor-Specific RADIUS Attributes 8-29
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 8-31
Displaying the RADIUS Configuration 8-31
Configuring the Switch for Local Authentication and Authorization 8-32
Configuring the Switch for Secure Shell 8-33
Understanding SSH 8-33
SSH Servers, Integrated Clients, and Supported Versions 8-33
Limitations 8-34
Configuring SSH 8-34
Configuration Guidelines 8-34
Setting Up the Switch to Run SSH 8-35
Configuring the SSH Server 8-36
Displaying the SSH Configuration and Status 8-36
Configuring the Switch for Secure Socket Layer HTTP 8-37
Understanding Secure HTTP Servers and Clients 8-37
Certificate Authority Trustpoints 8-37
CipherSuites 8-39

Contents
ix
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Configuring Secure HTTP Servers and Clients 8-39
Default SSL Configuration 8-39
SSL Configuration Guidelines 8-40
Configuring a CA Trustpoint 8-40
Configuring the Secure HTTP Server 8-41
Configuring the Secure HTTP Client 8-42
Displaying Secure HTTP Server and Client Status 8-43
Configuring the Switch for Secure Copy Protocol 8-43
Information About Secure Copy 8-44
CHAPTER 9Configuring IEEE 802.1x Port-Based Authentication 9-1
Understanding IEEE 802.1x Port-Based Authentication 9-1
Device Roles 9-2
Authentication Process 9-3
Authentication Initiation and Message Exchange 9-5
Ports in Authorized and Unauthorized States 9-7
IEEE 802.1x Host Mode 9-7
IEEE 802.1x Accounting 9-8
IEEE 802.1x Accounting Attribute-Value Pairs 9-8
Using IEEE 802.1x Authentication with VLAN Assignment 9-9
Using IEEE 802.1x Authentication with Guest VLAN 9-11
Using IEEE 802.1x Authentication with Restricted VLAN 9-12
Using IEEE 802.1x Authentication with Voice VLAN Ports 9-13
Using IEEE 802.1x Authentication with Port Security 9-13
Using IEEE 802.1x Authentication with MAC Authentication Bypass 9-14
802.1x Authentication with Restricted VLAN 9-15
Common Session ID 9-16
Configuring IEEE 802.1x Authentication 9-17
Default IEEE 802.1x Authentication Configuration 9-17
IEEE 802.1x Authentication Configuration Guidelines 9-19
IEEE 802.1x Authentication 9-19
VLAN Assignment and Guest VLAN 9-20
MAC Authentication Bypass 9-20
Upgrading from a Previous Software Release 9-20
Configuring IEEE 802.1x Authentication 9-20
Configuring the Switch-to-RADIUS-Server Communication 9-22
Configuring the Host Mode 9-23
Configuring Periodic Re-Authentication 9-24
Manually Re-Authenticating a Client Connected to a Port 9-24

Contents
x
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Changing the Quiet Period 9-25
Changing the Switch-to-Client Retransmission Time 9-25
Setting the Switch-to-Client Frame-Retransmission Number 9-26
Setting the Re-Authentication Number 9-27
Configuring IEEE 802.1x Accounting 9-27
Configuring a Guest VLAN 9-28
Configuring a Restricted VLAN 9-29
Configuring MAC Authentication Bypass 9-31
Disabling IEEE 802.1x Authentication on the Port 9-31
Resetting the IEEE 802.1x Authentication Configuration to the Default Values 9-32
Displaying IEEE 802.1x Statistics and Status 9-32
CHAPTER 10 Configuring Web-Based Authentication 10-1
Understanding Web-Based Authentication 10-1
Device Roles 10-2
Host Detection 10-2
Session Creation 10-3
Authentication Process 10-3
Local Web Authentication Banner 10-4
Web Authentication Customizable Web Pages 10-6
Guidelines 10-6
Web-based Authentication Interactions with Other Features 10-7
Port Security 10-7
LAN Port IP 10-8
Gateway IP 10-8
ACLs 10-8
Context-Based Access Control 10-8
802.1x Authentication 10-8
EtherChannel 10-8
Configuring Web-Based Authentication 10-9
Default Web-Based Authentication Configuration 10-9
Web-Based Authentication Configuration Guidelines and Restrictions 10-9
Web-Based Authentication Configuration Task List 10-10
Configuring the Authentication Rule and Interfaces 10-10
Configuring AAA Authentication 10-11
Configuring Switch-to-RADIUS-Server Communication 10-11
Configuring the HTTP Server 10-13
Customizing the Authentication Proxy Web Pages 10-13
Specifying a Redirection URL for Successful Login 10-15

Contents
xi
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Configuring an AAA Fail Policy 10-15
Configuring the Web-Based Authentication Parameters 10-16
Configuring a Web Authentication Local Banner 10-16
Removing Web-Based Authentication Cache Entries 10-17
Displaying Web-Based Authentication Status 10-17
CHAPTER 11 Configuring Portal-Based Authentication 11-1
Understanding Portal-Based Authentication 11-1
Configuring Portal-Based Authentication 11-2
Default Portal-Based Authentication Configuration 11-2
Enabling Portal-Based Authentication on the Switch 11-3
Enabling Portal-Based Authentication on an Interface 11-4
Configuring the Switch-to-RADIUS-Server Communication 11-4
Monitoring Portal-Based Authentication 11-6
CHAPTER 12 Configuring Interface Characteristics 12-1
Understanding Interface Types 12-1
Port-Based VLANs 12-2
Switch Ports 12-2
Access Ports 12-2
Trunk Ports 12-3
Power over Ethernet (PoE) Ports (WS-C2928-24LT-C only) 12-4
Supported Protocols and Standards 12-4
Powered-Device Detection and Initial Power Allocation 12-5
Power Management Modes 12-5
Power Monitoring and Power Policing 12-6
Connecting Interfaces 12-9
Using Interface Configuration Mode 12-9
Procedures for Configuring Interfaces 12-10
Configuring a Range of Interfaces 12-10
Configuring and Using Interface Range Macros 12-12
Configuring Ethernet Interfaces 12-14
Default Ethernet Interface Configuration 12-14
Setting the Type of a Dual-Purpose Uplink Port 12-15
Configuring Interface Speed and Duplex Mode 12-17
Speed and Duplex Configuration Guidelines 12-17
Setting the Interface Speed and Duplex Parameters 12-18
Configuring IEEE 802.3x Flow Control 12-19
Configuring Auto-MDIX on an Interface 12-20

Contents
xii
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Configuring a Power Management Mode on a PoE Port 12-21
Budgeting Power for Devices Connected to a PoE Port 12-22
Configuring Power Policing 12-24
Adding a Description for an Interface 12-25
Configuring the System MTU 12-26
Monitoring and Maintaining the Interfaces 12-27
Monitoring Interface Status 12-28
Clearing and Resetting Interfaces and Counters 12-28
Shutting Down and Restarting the Interface 12-29
CHAPTER 13 Configuring VLANs 13-1
Understanding VLANs 13-1
Supported VLANs 13-2
VLAN Port Membership Modes 13-3
Configuring Normal-Range VLANs 13-4
Token Ring VLANs 13-5
Normal-Range VLAN Configuration Guidelines 13-5
Saving VLAN Configuration 13-6
Default Ethernet VLAN Configuration 13-6
Creating or Modifying an Ethernet VLAN 13-7
Deleting a VLAN 13-8
Assigning Static-Access Ports to a VLAN 13-9
Configuring Extended-Range VLANs 13-10
Default VLAN Configuration 13-10
Extended-Range VLAN Configuration Guidelines 13-10
Creating an Extended-Range VLAN 13-11
Displaying VLANs 13-12
Configuring VLAN Trunks 13-12
Trunking Overview 13-12
IEEE 802.1Q Configuration Considerations 13-13
Default Layer 2 Ethernet Interface VLAN Configuration 13-14
Configuring an Ethernet Interface as a Trunk Port 13-14
Interaction with Other Features 13-14
Configuring a Trunk Port 13-15
Defining the Allowed VLANs on a Trunk 13-16
Changing the Pruning-Eligible List 13-17
Configuring the Native VLAN for Untagged Traffic 13-17

Contents
xiii
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Configuring Trunk Ports for Load Sharing 13-18
Load Sharing Using STP Port Priorities 13-18
Load Sharing Using STP Path Cost 13-20
Configuring VMPS 13-21
Understanding VMPS 13-22
Dynamic-Access Port VLAN Membership 13-22
Default VMPS Client Configuration 13-23
VMPS Configuration Guidelines 13-23
Configuring the VMPS Client 13-24
Entering the IP Address of the VMPS 13-24
Configuring Dynamic-Access Ports on VMPS Clients 13-24
Reconfirming VLAN Memberships 13-25
Changing the Reconfirmation Interval 13-25
Changing the Retry Count 13-26
Monitoring the VMPS 13-26
Troubleshooting Dynamic-Access Port VLAN Membership 13-27
VMPS Configuration Example 13-27
CHAPTER 14 Configuring VTP 14-1
Understanding VTP 14-1
The VTP Domain 14-2
VTP Modes 14-3
VTP Advertisements 14-3
VTP Version 2 14-4
VTP Pruning 14-4
Configuring VTP 14-6
Default VTP Configuration 14-6
VTP Configuration Guidelines 14-7
Domain Names 14-7
Passwords 14-7
VTP Version 14-8
Configuration Requirements 14-8
Configuring a VTP Server 14-8
Configuring a VTP Client 14-9
Disabling VTP (VTP Transparent Mode) 14-10
Enabling VTP Version 2 14-11
Enabling VTP Pruning 14-12
Adding a VTP Client Switch to a VTP Domain 14-12
Monitoring VTP 14-14

Contents
xiv
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
CHAPTER 15 Configuring Voice VLAN 15-1
Understanding Voice VLAN 15-1
Cisco IP Phone Voice Traffic 15-2
Cisco IP Phone Data Traffic 15-2
Configuring Voice VLAN 15-3
Default Voice VLAN Configuration 15-3
Voice VLAN Configuration Guidelines 15-3
Configuring a Port Connected to a Cisco 7960 IP Phone 15-4
Configuring Cisco IP Phone Voice Traffic 15-5
Displaying Voice VLAN 15-6
CHAPTER 16 Configuring STP 16-1
Understanding Spanning-Tree Features 16-1
STP Overview 16-2
Spanning-Tree Topology and BPDUs 16-2
Bridge ID, Switch Priority, and Extended System ID 16-3
Spanning-Tree Interface States 16-4
Blocking State 16-5
Listening State 16-6
Learning State 16-6
Forwarding State 16-6
Disabled State 16-6
How a Switch or Port Becomes the Root Switch or Root Port 16-7
Spanning Tree and Redundant Connectivity 16-7
Spanning-Tree Address Management 16-8
Accelerated Aging to Retain Connectivity 16-8
Spanning-Tree Modes and Protocols 16-9
Supported Spanning-Tree Instances 16-9
Spanning-Tree Interoperability and Backward Compatibility 16-10
STP and IEEE 802.1Q Trunks 16-10
Configuring Spanning-Tree Features 16-10
Default Spanning-Tree Configuration 16-11
Spanning-Tree Configuration Guidelines 16-12
Changing the Spanning-Tree Mode. 16-13
Disabling Spanning Tree 16-14
Configuring the Root Switch 16-14
Configuring a Secondary Root Switch 16-16
Configuring Port Priority 16-16
Configuring Path Cost 16-18

Contents
xv
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Configuring the Switch Priority of a VLAN 16-19
Configuring Spanning-Tree Timers 16-20
Configuring the Hello Time 16-20
Configuring the Forwarding-Delay Time for a VLAN 16-21
Configuring the Maximum-Aging Time for a VLAN 16-21
Configuring the Transmit Hold-Count 16-22
Displaying the Spanning-Tree Status 16-22
CHAPTER 17 Configuring MSTP 17-1
Understanding MSTP 17-2
Multiple Spanning-Tree Regions 17-2
IST, CIST, and CST 17-2
Operations Within an MST Region 17-3
Operations Between MST Regions 17-3
IEEE 802.1s Terminology 17-5
Hop Count 17-5
Boundary Ports 17-6
IEEE 802.1s Implementation 17-6
Port Role Naming Change 17-6
Interoperation Between Legacy and Standard Switches 17-7
Detecting Unidirectional Link Failure 17-7
Interoperability with IEEE 802.1D STP 17-8
Understanding RSTP 17-8
Port Roles and the Active Topology 17-9
Rapid Convergence 17-9
Synchronization of Port Roles 17-11
Bridge Protocol Data Unit Format and Processing 17-12
Processing Superior BPDU Information 17-12
Processing Inferior BPDU Information 17-13
Topology Changes 17-13
Configuring MSTP Features 17-13
Default MSTP Configuration 17-14
MSTP Configuration Guidelines 17-14
Specifying the MST Region Configuration and Enabling MSTP 17-15
Configuring the Root Switch 17-17
Configuring a Secondary Root Switch 17-18
Configuring Port Priority 17-19
Configuring Path Cost 17-20
Configuring the Switch Priority 17-21

Contents
xvi
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Configuring the Hello Time 17-22
Configuring the Forwarding-Delay Time 17-23
Configuring the Maximum-Aging Time 17-23
Configuring the Maximum-Hop Count 17-24
Specifying the Link Type to Ensure Rapid Transitions 17-24
Designating the Neighbor Type 17-25
Restarting the Protocol Migration Process 17-25
Displaying the MST Configuration and Status 17-26
CHAPTER 18 Configuring Optional Spanning-Tree Features 18-1
Understanding Optional Spanning-Tree Features 18-1
Understanding Port Fast 18-2
Understanding BPDU Guard 18-2
Understanding BPDU Filtering 18-3
Understanding UplinkFast 18-3
Understanding BackboneFast 18-5
Understanding EtherChannel Guard 18-7
Understanding Root Guard 18-8
Understanding Loop Guard 18-9
Configuring Optional Spanning-Tree Features 18-9
Default Optional Spanning-Tree Configuration 18-9
Optional Spanning-Tree Configuration Guidelines 18-10
Enabling Port Fast 18-10
Enabling BPDU Guard 18-11
Enabling BPDU Filtering 18-12
Enabling UplinkFast for Use with Redundant Links 18-13
Enabling BackboneFast 18-13
Enabling EtherChannel Guard 18-14
Enabling Root Guard 18-15
Enabling Loop Guard 18-15
Displaying the Spanning-Tree Status 18-16
CHAPTER 19 Configuring DHCP Features and IP Source Guard Features 19-1
Understanding DHCP Snooping 19-1
DHCP Server 19-2
DHCP Relay Agent 19-2
DHCP Snooping 19-2
Option-82 Data Insertion 19-4
DHCP Snooping Binding Database 19-7

Contents
xvii
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Configuring DHCP Snooping 19-8
Default DHCP Snooping Configuration 19-8
DHCP Snooping Configuration Guidelines 19-9
Configuring the DHCP Relay Agent 19-10
Enabling DHCP Snooping and Option 82 19-11
Enabling the DHCP Snooping Binding Database Agent 19-12
Displaying DHCP Snooping Information 19-13
Understanding IP Source Guard 19-13
Source IP Address Filtering 19-14
Source IP and MAC Address Filtering 19-14
IP Source Guard for Static Hosts 19-15
Configuring IP Source Guard 19-15
Default IP Source Guard Configuration 19-16
IP Source Guard Configuration Guidelines 19-16
Enabling IP Source Guard 19-16
Configuring IP Source Guard for Static Hosts on a Layer 2 Access Port 19-18
Displaying IP Source Guard Information 19-21
Understanding DHCP Server Port-Based Address Allocation 19-21
Configuring DHCP Server Port-Based Address Allocation 19-22
Default Port-Based Address Allocation Configuration 19-22
Port-Based Address Allocation Configuration Guidelines 19-22
Enabling DHCP Server Port-Based Address Allocation 19-23
Displaying DHCP Server Port-Based Address Allocation 19-25
CHAPTER 20 Configuring Dynamic ARP Inspection 20-1
Understanding Dynamic ARP Inspection 20-1
Interface Trust States and Network Security 20-3
Rate Limiting of ARP Packets 20-4
Relative Priority of ARP ACLs and DHCP Snooping Entries 20-4
Logging of Dropped Packets 20-4
Configuring Dynamic ARP Inspection 20-5
Default Dynamic ARP Inspection Configuration 20-5
Dynamic ARP Inspection Configuration Guidelines 20-6
Configuring Dynamic ARP Inspection in DHCP Environments 20-7
Configuring ARP ACLs for Non-DHCP Environments 20-8
Limiting the Rate of Incoming ARP Packets 20-10
Performing Validation Checks 20-11
Configuring the Log Buffer 20-12

Contents
xviii
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Displaying Dynamic ARP Inspection Information 20-14
CHAPTER 21 Configuring IGMP Snooping 21-1
Understanding IGMP Snooping 21-1
IGMP Versions 21-2
Joining a Multicast Group 21-3
Leaving a Multicast Group 21-4
Immediate Leave 21-5
IGMP Configurable-Leave Timer 21-5
IGMP Report Suppression 21-5
Configuring IGMP Snooping 21-6
Default IGMP Snooping Configuration 21-6
Enabling or Disabling IGMP Snooping 21-6
Setting the Snooping Method 21-7
Configuring a Multicast Router Port 21-8
Configuring a Host Statically to Join a Group 21-9
Enabling IGMP Immediate Leave 21-9
Configuring the IGMP Leave Timer 21-10
Configuring TCN-Related Commands 21-11
Controlling the Multicast Flooding Time After a TCN Event 21-11
Recovering from Flood Mode 21-12
Disabling Multicast Flooding During a TCN Event 21-12
Configuring the IGMP Snooping Querier 21-13
Disabling IGMP Report Suppression 21-14
Displaying IGMP Snooping Information 21-14
Configuring IGMP Filtering and Throttling 21-16
Default IGMP Filtering and Throttling Configuration 21-16
Configuring IGMP Profiles 21-17
Applying IGMP Profiles 21-18
Setting the Maximum Number of IGMP Groups 21-19
Configuring the IGMP Throttling Action 21-19
Displaying IGMP Filtering and Throttling Configuration 21-20
CHAPTER 22 Configuring Port-Based Traffic Control 22-1
Configuring Storm Control 22-1
Understanding Storm Control 22-1
Default Storm Control Configuration 22-3
Configuring Storm Control and Threshold Levels 22-3
Configuring Small-Frame Arrival Rate 22-5

Contents
xix
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
Configuring Protected Ports 22-6
Default Protected Port Configuration 22-6
Protected Port Configuration Guidelines 22-6
Configuring a Protected Port 22-7
Configuring Port Blocking 22-7
Default Port Blocking Configuration 22-7
Blocking Flooded Traffic on an Interface 22-7
Configuring Port Security 22-8
Understanding Port Security 22-9
Secure MAC Addresses 22-9
Security Violations 22-10
Default Port Security Configuration 22-11
Port Security Configuration Guidelines 22-11
Enabling and Configuring Port Security 22-12
Enabling and Configuring Port Security Aging 22-17
Displaying Port-Based Traffic Control Settings 22-18
CHAPTER 23 Configuring CDP 23-1
Understanding CDP 23-1
Configuring CDP 23-2
Default CDP Configuration 23-2
Configuring the CDP Characteristics 23-2
Disabling and Enabling CDP 23-3
Disabling and Enabling CDP on an Interface 23-4
Monitoring and Maintaining CDP 23-5
CHAPTER 24 Configuring LLDP and LLDP-MED 24-1
Understanding LLDP and LLDP-MED 24-1
LLDP 24-1
LLDP-MED 24-2
Configuring LLDP and LLDP-MED 24-3
Default LLDP Configuration 24-3
Configuration Guidelines 24-3
Enabling LLDP 24-4
Configuring LLDP Characteristics 24-4
Configuring LLDP-MED TLVs 24-5
Configuring Network-Policy TLV 24-6
Monitoring and Maintaining LLDP and LLDP-MED 24-8

Contents
xx
Catalyst 2928 Switch Software Configuration Guide
OL-23389-01
CHAPTER 25 Configuring UDLD 25-1
Understanding UDLD 25-1
Modes of Operation 25-1
Methods to Detect Unidirectional Links 25-2
Configuring UDLD 25-3
Default UDLD Configuration 25-4
Configuration Guidelines 25-4
Enabling UDLD Globally 25-5
Enabling UDLD on an Interface 25-5
Resetting an Interface Disabled by UDLD 25-6
Displaying UDLD Status 25-6
CHAPTER 26 Configuring SPAN 26-1
Understanding SPAN 26-1
Local SPAN 26-2
SPAN Concepts and Terminology 26-2
SPAN Sessions 26-2
Monitored Traffic 26-3
Source Ports 26-4
Source VLANs 26-4
VLAN Filtering 26-5
Destination Port 26-5
SPAN Interaction with Other Features 26-6
Configuring SPAN 26-7
Default SPAN Configuration 26-7
Configuring Local SPAN 26-7
SPAN Configuration Guidelines 26-7
Creating a Local SPAN Session 26-8
Creating a Local SPAN Session and Configuring Incoming Traffic 26-11
Specifying VLANs to Filter 26-12
Displaying SPAN Status 26-13
CHAPTER 27 Configuring RMON 27-1
Understanding RMON 27-1
Configuring RMON 27-2
Default RMON Configuration 27-3
Configuring RMON Alarms and Events 27-3