Cisco Catalyst 2960 Series User manual

IN-1
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
OL-26520-01
INDEX
A
abbreviating commands 2-3
AC (command switch) 6-9
access-class command 31-18
access control entries
See ACEs
access control entry (ACE) 37-3
access-denied response, VMPS 13-24
access groups
Layer 3 31-19
access groups, applying IPv4 ACLs to interfaces 31-19
accessing
clusters, switch 6-12
command switches 6-10
member switches 6-12
switch clusters 6-12
accessing stack members 7-22
access lists
See ACLs
access ports
in switch clusters 6-8
access ports, defined 12-3
accounting
with 802.1x 10-51
with IEEE 802.1x 10-16
with RADIUS 9-35
with TACACS+ 9-11, 9-17
ACEs
and QoS 33-8
defined 31-2
Ethernet 31-2
IP 31-2
ACLs
ACEs 31-2
any keyword 31-10
applying
time ranges to 31-15
to an interface 31-18, 37-7
to IPv6 interfaces 37-7
to QoS 33-8
classifying traffic for QoS 33-50
comments in 31-17
compiling 31-21
defined 31-1, 31-7
examples of 31-21, 33-50
extended IP, configuring for QoS classification 33-51
extended IPv4
creating 31-9
matching criteria 31-7
hardware and software handling 31-20
host keyword 31-11
IP
creating 31-7
fragments and QoS guidelines 33-40
implicit deny 31-9, 31-13, 31-14
implicit masks 31-9
matching criteria 31-7
undefined 31-19
IPv4
applying to interfaces 31-18
creating 31-7
matching criteria 31-7
named 31-13
numbers 31-7
terminal lines, setting on 31-18

Index
IN-2
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
OL-26520-01
unsupported features 31-6
IPv6
applying to interfaces 37-7
configuring 37-3, 37-4
displaying 37-8
interactions with other features 37-4
limitations 37-2, 37-3
matching criteria 37-3
named 37-2
precedence of 37-2
supported 37-2
unsupported features 37-3
MAC extended 31-23, 33-52
matching 31-7, 31-19, 37-3
monitoring 31-26, 37-8
named, IPv4 31-13
named, IPv6 37-2
names 37-4
number per QoS class map 33-40
port 31-2, 37-1
precedence of 31-2
QoS 33-8, 33-50
resequencing entries 31-13
router 31-2, 37-1
standard IP, configuring for QoS classification 33-50
standard IPv4
creating 31-8
matching criteria 31-7
support for 1-10
support in hardware 31-20
time ranges 31-15
types supported 31-2
unsupported features, IPv4 31-6
unsupported features, IPv6 37-3
active link 19-4, 19-5, 19-6
active links 19-2
active traffic monitoring, IP SLAs 32-1
address aliasing 21-2
addresses
displaying the MAC address table 5-24
dynamic
accelerated aging 16-9
changing the aging time 5-15
default aging 16-9
defined 5-13
learning 5-14
removing 5-16
IPv6 35-2
MAC, discovering 5-24
multicast, STP address management 16-9
static
adding and removing 5-20
defined 5-13
address resolution 5-24
Address Resolution Protocol
See ARP
advertisements
CDP 25-1
LLDP 26-2
VTP 13-15, 14-3, 14-4
aggregatable global unicast addresses 35-3
aggregated ports
See EtherChannel
aggregate policers 33-60
aggregate policing 1-14
aging, accelerating 16-9
aging time
accelerated
for MSTP 17-24
for STP 16-9, 16-23
MAC address table 5-15
maximum
for MSTP 17-25
for STP 16-23, 16-24
alarms, RMON 28-4
allowed-VLAN list 13-17
ARP
defined 1-6, 5-24

Index
IN-3
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
OL-26520-01
table
address resolution 5-24
managing 5-24
attributes, RADIUS
vendor-proprietary 9-38
vendor-specific 9-37
attribute-value pairs 10-13, 10-16, 10-21, 10-22
authentication
local mode with AAA 9-41
open1x 10-31
RADIUS
key 9-27
login 9-30
TACACS+
defined 9-11
key 9-13
login 9-14
See also port-based authentication
authentication compatibility with Catalyst 6000
switches 10-8
authentication failed VLAN
See restricted VLAN
authentication manager
CLI commands 10-9
compatibility with older 802.1x CLI
commands 10-9 to ??
overview 10-7
authoritative time source, described 5-3
authorization
with RADIUS 9-34
with TACACS+ 9-11, 9-16
authorized ports with IEEE 802.1x 10-10
autoconfiguration 3-3
auto enablement 10-32
automatic advise (auto-advise) in switch stacks 7-11
automatic copy (auto-copy) in switch stacks 7-11
automatic discovery
considerations
beyond a noncandidate device 6-8
brand new switches 6-8
connectivity 6-5
different VLANs 6-7
management VLANs 6-7
non-CDP-capable devices 6-6
noncluster-capable devices 6-6
in switch clusters 6-5
See also CDP
automatic extraction (auto-extract) in switch stacks 7-11
automatic QoS
See QoS
automatic recovery, clusters 6-9
See also HSRP
automatic upgrades (auto-upgrade) in switch stacks 7-11
auto-MDIX
configuring 12-30
described 12-30
autonegotiation
duplex mode 1-4
interface configuration guidelines 12-27
mismatches 39-12
Auto-QoS video devices 1-14
autosensing, port speed 1-4
auxiliary VLAN
See voice VLAN
availability, features 1-8
B
BackboneFast
described 18-7
disabling 18-17
enabling 18-17
support for 1-8
backup interfaces
See Flex Links
backup links 19-2
banners
configuring

Index
IN-4
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
OL-26520-01
login 5-13
message-of-the-day login 5-12
default configuration 5-11
when displayed 5-11
Berkeley r-tools replacement 9-52
binding database
DHCP snooping
See DHCP snooping binding database
bindings
DHCP snooping database 20-6
IP source guard 20-13
binding table, DHCP snooping
See DHCP snooping binding database
blocking packets 23-7
booting
boot loader, function of 3-1
boot process 3-1
manually 3-19
specific image 3-20
boot loader
accessing 3-21
described 3-1
environment variables 3-21
prompt 3-21
trap-door mechanism 3-2
BPDU
error-disabled state 18-2
filtering 18-3
RSTP format 17-12
BPDU filtering
described 18-3
disabling 18-15
enabling 18-14
support for 1-8
BPDU guard
described 18-2
disabling 18-14
enabling 18-13
support for 1-8
bridge protocol data unit
See BPDU
broadcast storm-control command 23-4
broadcast storms 23-1
C
cables, monitoring for unidirectional links 24-1
candidate switch
automatic discovery 6-5
defined 6-4
requirements 6-4
See also command switch, cluster standby group, and
member switch
Catalyst 6000 switches
authentication compatibility 10-8
CA trustpoint
configuring 9-49
defined 9-47
CDP
and trusted boundary 33-45
automatic discovery in switch clusters 6-5
configuring 25-2
default configuration 25-2
defined with LLDP 26-1
described 25-1
disabling for routing device 25-4
enabling and disabling
on an interface 25-4
on a switch 25-4
monitoring 25-5
overview 25-1
power negotiation extensions 12-5
support for 1-6
switch stack considerations 25-2
transmission timer and holdtime, setting 25-3
updates 25-3
CGMP
as IGMP snooping learning method 21-9

Index
IN-5
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
OL-26520-01
joining multicast group 21-3
CipherSuites 9-48
Cisco 7960 IP Phone 15-1
Cisco Discovery Protocol
See CDP
Cisco intelligent power management 12-5
Cisco IOS File System
See IFS
Cisco IOS IP SLAs 32-1
Cisco Secure ACS
attribute-value pairs for downloadable ACLs 10-22
attribute-value pairs for redirect URL 10-21
Cisco Secure ACS configuration guide 10-61
CiscoWorks 2000 1-5, 30-5
CISP 10-32
CIST regional root
See MSTP
CIST root
See MSTP
civic location 26-3
class maps for QoS
configuring 33-53
described 33-8
displaying 33-81
class of service
See CoS
clearing interfaces 12-41
CLI
abbreviating commands 2-3
command modes 2-1
configuration logging 2-4
described 1-5
editing features
enabling and disabling 2-6
keystroke editing 2-7
wrapped lines 2-8
error messages 2-4
filtering command output 2-9
getting help 2-3
history
changing the buffer size 2-5
described 2-5
disabling 2-6
recalling commands 2-6
managing clusters 6-15
no and default forms of commands 2-4
Client Information Signalling Protocol
See CISP
client mode, VTP 14-3
clock
See system clock
clusters, switch
accessing 6-12
automatic discovery 6-5
automatic recovery 6-9
benefits 1-1
compatibility 6-4
described 6-1
LRE profile considerations 6-15
managing
through CLI 6-15
through SNMP 6-16
planning 6-4
planning considerations
automatic discovery 6-5
automatic recovery 6-9
CLI 6-15
host names 6-12
IP addresses 6-12
LRE profiles 6-15
passwords 6-13
RADIUS 6-15
SNMP 6-13, 6-16
switch stacks 6-13
TACACS+ 6-15
See also candidate switch, command switch, cluster
standby group, member switch, and standby command
switch

Index
IN-6
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
OL-26520-01
cluster standby group
automatic recovery 6-11
considerations 6-10
defined 6-2
requirements 6-3
virtual IP address 6-10
See also HSRP
CNS 1-6
Configuration Engine
configID, deviceID, hostname 4-3
configuration service 4-2
described 4-1
event service 4-3
embedded agents
described 4-5
enabling automated configuration 4-6
enabling configuration agent 4-9
enabling event agent 4-7
management functions 1-6
CoA Request Commands 9-23
Coarse Wave Division Multiplexer
See CWDM SFPs
command-line interface
See CLI
command modes 2-1
commands
abbreviating 2-3
no and default 2-4
commands, setting privilege levels 9-8
command switch
accessing 6-10
active (AC) 6-9
configuration conflicts 39-12
defined 6-2
passive (PC) 6-9
password privilege levels 6-16
priority 6-9
recovery
from command-switch failure 6-9, 39-8
from lost member connectivity 39-12
redundant 6-9
replacing
with another switch 39-11
with cluster member 39-9
requirements 6-3
standby (SC) 6-9
See also candidate switch, cluster standby group,
member switch, and standby command switch
community strings
configuring 6-13, 30-8
for cluster switches 30-4
in clusters 6-13
overview 30-4
SNMP 6-13
compatibility, feature 23-12
compatibility, software
See stacks, switch
config.text 3-18
configurable leave timer, IGMP 21-6
configuration, initial
defaults 1-16
Express Setup 1-1
configuration changes, logging 29-11
configuration conflicts, recovering from lost member
connectivity 39-12
configuration examples, network 1-18
configuration files
archiving A-20
clearing the startup configuration A-19
creating using a text editor A-10
default name 3-18
deleting a stored configuration A-19
described A-8
downloading
automatically 3-18
preparing A-11, A-13, A-16
reasons for A-8
using FTP A-13

Index
IN-7
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
OL-26520-01
using RCP A-17
using TFTP A-11
guidelines for creating and using A-9
guidelines for replacing and rolling back A-21
invalid combinations when copying A-5
limiting TFTP server access 30-17
obtaining with DHCP 3-8
password recovery disable considerations 9-5
replacing a running configuration A-19, A-20
rolling back a running configuration A-19, A-21
specifying the filename 3-18
system contact and location information 30-17
types and location A-10
uploading
preparing A-11, A-13, A-16
reasons for A-9
using FTP A-15
using RCP A-18
using TFTP A-12
configuration logger 29-11
configuration logging 2-4
configuration replacement A-19
configuration rollback A-19, A-20
configuration settings, saving 3-15
configure terminal command 12-17
configuring 802.1x user distribution 10-57
configuring port-based authentication violation
modes 10-41
configuring small-frame arrival rate 23-5
conflicts, configuration 39-12
connections, secure remote 9-42
connectivity problems 39-14, 39-15, 39-17
consistency checks in VTP Version 2 14-5
console port, connecting to 2-10
control protocol, IP SLAs 32-4
corrupted software, recovery steps with Xmodem 39-2
CoS
in Layer 2 frames 33-2
override priority 15-6
trust priority 15-6
CoS input queue threshold map for QoS 33-16
CoS output queue threshold map for QoS 33-19
CoS-to-DSCP map for QoS 33-63
counters, clearing interface 12-41
CPU utilization, troubleshooting 39-28
crashinfo file 39-23
critical authentication, IEEE 802.1x 10-54
critical VLAN 10-24
critical voice VLAN
configuring 10-54
cross-stack EtherChannel
configuration guidelines 38-13
described 38-3
illustration 38-4
support for 1-8
cross-stack UplinkFast, STP
described 18-5
disabling 18-16
enabling 18-16
fast-convergence events 18-7
Fast Uplink Transition Protocol 18-6
normal-convergence events 18-7
support for 1-8
cryptographic software image
SSH 9-42
SSL 9-46
switch stack considerations 7-15
customjzeable web pages, web-based authentication 11-6
CWDM SFPs 1-24
D
DACL
See downloadable ACL
daylight saving time 5-7
debugging
enabling all system diagnostics 39-21
enabling for a specific feature 39-20

Index
IN-8
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
OL-26520-01
redirecting error message output 39-21
using commands 39-20
default commands 2-4
default configuration
802.1x 10-35
auto-QoS 33-22
banners 5-11
CDP 25-2
DHCP 20-8
DHCP option 82 20-8
DHCP snooping 20-8
DHCP snooping binding database 20-8
DNS 5-10
dynamic ARP inspection 22-5
EtherChannel 38-11
Ethernet interfaces 12-24
Flex Links 19-8
IGMP filtering 21-25
IGMP snooping 21-7, 36-6
IGMP throttling 21-25
initial switch information 3-3
IP SLAs 32-5
IP source guard 20-15
IPv6 35-7
Layer 2 interfaces 12-24
LLDP 26-5
MAC address table 5-15
MAC address-table move update 19-8
MSTP 17-14
MVR 21-20
optional spanning-tree configuration 18-12
password and privilege level 9-2
RADIUS 9-27
RMON 28-3
RSPAN 27-10
SDM template 8-4
SNMP 30-7
SPAN 27-10
SSL 9-49
standard QoS 33-38
STP 16-13
switch stacks 7-17
system message logging 29-4
system name and prompt 5-9
TACACS+ 9-13
UDLD 24-4
VLAN, Layer 2 Ethernet interfaces 13-15
VLANs 13-7
VMPS 13-25
voice VLAN 15-3
VTP 14-9
default gateway 3-14
default web-based authentication configuration
802.1X 11-9
deleting VLANs 13-9
denial-of-service attack 23-1
description command 12-37
designing your network, examples 1-18
destination addresses
in IPv4 ACLs 31-10
in IPv6 ACLs 37-5
destination-IP address-based forwarding,
EtherChannel 38-9
destination-MAC address forwarding, EtherChannel 38-9
detecting indirect link failures, STP 18-8
device A-24
device discovery protocol 25-1, 26-1
device manager
benefits 1-1
described 1-2, 1-5
in-band management 1-7
upgrading a switch A-24
DHCP
enabling
relay agent 20-9
DHCP-based autoconfiguration
client request message exchange 3-4
configuring

Index
IN-9
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
OL-26520-01
client side 3-3
DNS 3-7
relay device 3-7
server side 3-6
TFTP server 3-7
example 3-9
lease options
for IP address information 3-6
for receiving the configuration file 3-6
overview 3-3
relationship to BOOTP 3-3
relay support 1-6
support for 1-6
DHCP-based autoconfiguration and image update
configuring 3-11 to 3-14
understanding 3-5
DHCP binding database
See DHCP snooping binding database
DHCP binding table
See DHCP snooping binding database
DHCP option 82
circuit ID suboption 20-5
configuration guidelines 20-8
default configuration 20-8
displaying 20-12
overview 20-3
packet format, suboption
circuit ID 20-5
remote ID 20-5
remote ID suboption 20-5
DHCP server port-based address allocation
configuration guidelines 20-21
default configuration 20-21
described 20-21
displaying 20-24
enabling 20-21
reserved addresses 20-22
DHCP server port-based address assignment
support for 1-6
DHCP snooping
accepting untrusted packets form edge switch 20-3,
20-10
binding database
See DHCP snooping binding database
configuration guidelines 20-8
default configuration 20-8
displaying binding tables 20-12
message exchange process 20-4
option 82 data insertion 20-3
trusted interface 20-2
untrusted interface 20-2
untrusted messages 20-2
DHCP snooping binding database
adding bindings 20-11
binding entries, displaying 20-12
binding file
format 20-6
location 20-6
bindings 20-6
clearing agent statistics 20-12
configuration guidelines 20-9
configuring 20-11
default configuration 20-8
deleting
binding file 20-12
bindings 20-12
database agent 20-12
described 20-6
displaying 20-12
displaying status and statistics 20-12
enabling 20-11
entry 20-6
renewing database 20-12
resetting
delay value 20-12
timeout value 20-12
DHCP snooping binding table
See DHCP snooping binding database

Index
IN-10
Catalyst 2960 and 2960-S Switches Software Configuration Guide, Release 15.0(1)SE
OL-26520-01
Differentiated Services architecture, QoS 33-2
Differentiated Services Code Point 33-2
directed unicast requests 1-6
directories
changing A-4
creating and removing A-4
displaying the working A-4
discovery, clusters
See automatic discovery
DNS
and DHCP-based autoconfiguration 3-7
default configuration 5-10
displaying the configuration 5-11
in IPv6 35-3
overview 5-9
setting up 5-10
support for 1-6
domain names
DNS 5-9
VTP 14-10
Domain Name System
See DNS
downloadable ACL 10-20, 10-22, 10-61
downloading
configuration files
preparing A-11, A-13, A-16
reasons for A-8
using FTP A-13
using RCP A-17
using TFTP A-11
image files
deleting old image A-28
preparing A-26, A-30, A-34
reasons for A-24
using CMS 1-2
using FTP A-31
using HTTP 1-2, A-24
using RCP A-35
using TFTP A-27
using the device manager or Network
Assistant A-24
DRP
support for 1-15
DSCP 1-13, 33-2
DSCP input queue threshold map for QoS 33-16
DSCP output queue threshold map for QoS 33-19
DSCP-to-CoS map for QoS 33-66
DSCP-to-DSCP-mutation map for QoS 33-67
DSCP transparency 33-46
DTP 1-9, 13-14
dual-action detection 38-6
dual IPv4 and IPv6 templates 35-5
dual protocol stacks
IPv4 and IPv6 35-5
SDM templates supporting 35-5
dual-purpose uplinks
defined 12-4
LEDs 12-5
link selection 12-4, 12-25
setting the type 12-25
dynamic access ports
characteristics 13-4
configuring 13-26
defined 12-3
dynamic addresses
See addresses
dynamic ARP inspection
ARP cache poisoning 22-1
ARP requests, described 22-1
ARP spoofing attack 22-1
clearing
log buffer 22-16
statistics 22-16
configuration guidelines 22-6
configuring
ACLs for non-DHCP environments 22-9
in DHCP environments 22-7
log buffer 22-13