Cisco ME 3400G-2CS - Ethernet Access Switch User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco ME 3400 Ethernet Access Switch
Software Configuration Guide
Cisco IOS Release 12.2(25)EX
November 2005
Customer Order Number: DOC-7817058=
Text Part Number: 78-17058-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn,
and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the
Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Empowering the Internet
Generation, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise,
the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX,
Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StrataView Plus, TeleRouter, The Fastest Way to Increase Your Internet Quotient,
and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0502R)
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide
© 2005 Cisco Systems, Inc. All rights reserved.

iii
Cisco ME 3400 EthernetAccess SwitchSoftware Configuration Guide
78-17058-01
CONTENTS
Preface xxxiii
Audience xxxiii
Purpose xxxiii
Conventions xxxiii
Related Publications xxxiv
Obtaining Documentation xxxv
Cisco.com xxxv
Product Documentation DVD xxxv
Ordering Documentation xxxv
Documentation Feedback xxxvi
Cisco Product Security Overview xxxvi
Reporting Security Problems in Cisco Products xxxvii
Obtaining Technical Assistance xxxvii
Cisco Technical Support & Documentation Website xxxvii
Submitting a Service Request xxxviii
Definitions of Service Request Severity xxxviii
Obtaining AdditionalPublications and Information xxxix
CHAPTER 1Overview 1-1
Features 1-1
Performance Features 1-2
ManagementOptions 1-3
Manageability Features 1-3
Availability Features 1-4
VLAN Features 1-5
Security Features 1-5
Subscriber Security 1-5
Switch Security 1-5
Network Security 1-6
Quality of Service and Classof Service Features 1-6
Layer 2 Virtual Private Network Services 1-7
Layer 3 Features 1-7
Layer 3 VPN Services 1-8
Monitoring Features 1-8

Contents
iv
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide 78-17058-01
Default Settings After Initial Switch Configuration 1-8
Network Configuration Examples 1-11
Multidwelling or Ethernet-to-the-Subscriber Network 1-11
Layer 2 VPN Application 1-13
Multi-VRF CE Application 1-14
Where to Go Next 1-15
CHAPTER 2Using the Command-Line Interface 2-1
Understanding Command Modes 2-1
Understanding the Help System 2-3
Understanding Abbreviated Commands 2-3
Understanding no and default Forms ofCommands 2-4
Understanding CLI Error Messages 2-4
Using Command History 2-4
Changing the Command History Buffer Size 2-5
Recalling Commands 2-5
Disabling the Command History Feature 2-5
Using Editing Features 2-6
Enabling and Disabling Editing Features 2-6
Editing Commands through Keystrokes 2-6
Editing Command Lines that Wrap 2-8
Searching and Filtering Output of show and more Commands 2-8
Accessing the CLI 2-9
Accessing the CLI through a Console Connection or through Telnet 2-9
CHAPTER 3Assigning the Switch IP Address and DefaultGateway 3-1
Understanding the Boot Process 3-1
Assigning Switch Information 3-2
Default Switch Information 3-3
Understanding DHCP-Based Autoconfiguration 3-3
DHCP Client Request Process 3-3
Configuring DHCP-Based Autoconfiguration 3-5
DHCP ServerConfiguration Guidelines 3-5
Configuring the TFTP Server 3-5
Configuring the DNS 3-6
Configuring the Relay Device 3-6
Obtaining Configuration Files 3-7
Example Configuration 3-8

Contents
v
Cisco ME 3400 EthernetAccess SwitchSoftware Configuration Guide
78-17058-01
Manually Assigning IP Information 3-9
Checking and Saving the Running Configuration 3-10
Modifying the Startup Configuration 3-12
Default Boot Configuration 3-13
Automatically Downloading a Configuration File 3-13
Specifying the Filename to Read and Write the System Configuration 3-13
Booting Manually 3-14
Booting a Specific Software Image 3-14
Controlling Environment Variables 3-15
Scheduling a Reload of the Software Image 3-16
Configuring a Scheduled Reload 3-17
Displaying Scheduled Reload Information 3-18
CHAPTER 4Configuring Cisco IOS CNS Agents 4-1
Understanding Cisco Configuration Engine Software 4-1
Configuration Service 4-2
Event Service 4-3
NameSpace Mapper 4-3
What You Should Know About the CNS IDs and Device Hostnames 4-3
ConfigID 4-3
DeviceID 4-4
Hostname and DeviceID 4-4
Using Hostname, DeviceID,and ConfigID 4-4
Understanding Cisco IOS Agents 4-5
Initial Configuration 4-5
Incremental (Partial) Configuration 4-6
Synchronized Configuration 4-6
Configuring Cisco IOS Agents 4-6
Enabling Automated CNS Configuration 4-6
Enabling the CNS Event Agent 4-8
Enabling the Cisco IOS CNS Agent 4-9
Enabling an Initial Configuration 4-9
Enabling a Partial Configuration 4-11
Displaying CNS Configuration 4-12
CHAPTER 5Administering the Switch 5-1
Managing the System Time and Date 5-1
Understanding the System Clock 5-2
Understanding Network Time Protocol 5-2

Contents
vi
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide 78-17058-01
Configuring NTP 5-4
Default NTP Configuration 5-4
Configuring NTP Authentication 5-5
Configuring NTP Associations 5-6
Configuring NTP Broadcast Service 5-7
Configuring NTP Access Restrictions 5-8
Configuring the Source IP Address for NTP Packets 5-10
Displaying the NTP Configuration 5-11
Configuring Time and Date Manually 5-11
Setting the System Clock 5-11
Displaying the Time and Date Configuration 5-12
Configuring the TimeZone 5-12
Configuring Summer Time (Daylight Saving Time) 5-13
Configuring a System Nameand Prompt 5-14
Default System Name and Prompt Configuration 5-15
Configuring a System Name 5-15
Understanding DNS 5-15
Default DNS Configuration 5-16
Setting Up DNS 5-16
Displaying the DNS Configuration 5-17
Creating a Banner 5-17
Default Banner Configuration 5-17
Configuring a Message-of-the-Day Login Banner 5-18
Configuring a Login Banner 5-19
Managing the MAC Address Table 5-19
Building the Address Table 5-20
MAC Addresses and VLANs 5-20
Default MAC Address Table Configuration 5-21
Changing the Address Aging Time 5-21
Removing Dynamic Address Entries 5-22
Configuring MAC AddressNotification Traps 5-22
Adding and Removing Static Address Entries 5-24
Configuring Unicast MAC Address Filtering 5-25
Disabling MAC Address Learning on a VLAN 5-26
Displaying Address Table Entries 5-28
Managing the ARP Table 5-28

Contents
vii
Cisco ME 3400 EthernetAccess SwitchSoftware Configuration Guide
78-17058-01
CHAPTER 6Configuring SDM Templates 6-1
Understanding the SDM Templates 6-1
Configuring the Switch SDM Template 6-2
Default SDM Template 6-2
SDM Template Configuration Guidelines 6-2
Setting the SDM Template 6-3
Displaying the SDM Templates 6-4
CHAPTER 7Configuring Switch-Based Authentication 7-1
Preventing Unauthorized Access to Your Switch 7-1
Protecting Access to Privileged EXEC Commands 7-2
Default Password and Privilege Level Configuration 7-2
Setting or Changing a Static Enable Password 7-3
Protecting Enable and Enable Secret Passwords with Encryption 7-4
Disabling Password Recovery 7-5
Setting a Telnet Password for a Terminal Line 7-6
Configuring Username and Password Pairs 7-7
Configuring Multiple Privilege Levels 7-8
Setting the Privilege Level for a Command 7-8
Changing the Default Privilege Level for Lines 7-9
Logging into and Exiting a Privilege Level 7-10
Controlling Switch Access with TACACS+ 7-10
Understanding TACACS+ 7-10
TACACS+ Operation 7-12
Configuring TACACS+ 7-13
Default TACACS+ Configuration 7-13
Identifying the TACACS+ Server Host and Setting the Authentication Key 7-13
Configuring TACACS+ Login Authentication 7-14
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 7-16
Starting TACACS+ Accounting 7-17
Displaying the TACACS+ Configuration 7-17
Controlling Switch Access with RADIUS 7-18
Understanding RADIUS 7-18
RADIUS Operation 7-19

Contents
viii
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide 78-17058-01
Configuring RADIUS 7-20
Default RADIUS Configuration 7-20
Identifying the RADIUS Server Host 7-20
Configuring RADIUS Login Authentication 7-23
Defining AAA Server Groups 7-25
Configuring RADIUS Authorization for User Privileged Access and Network Services 7-27
Starting RADIUS Accounting 7-28
Configuring Settings for All RADIUS Servers 7-29
Configuring the Switch to Use Vendor-Specific RADIUS Attributes 7-29
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 7-31
Displaying the RADIUS Configuration 7-31
Controlling Switch Access with Kerberos 7-32
Understanding Kerberos 7-32
Kerberos Operation 7-34
Authenticating to a Boundary Switch 7-35
Obtaining a TGT from a KDC 7-35
Authenticating to Network Services 7-35
Configuring Kerberos 7-36
Configuring the Switch for Local Authentication and Authorization 7-36
Configuring the Switch for Secure Shell 7-37
Understanding SSH 7-38
SSH Servers, Integrated Clients, and Supported Versions 7-38
Limitations 7-38
Configuring SSH 7-39
ConfigurationGuidelines 7-39
Setting Up the Switch to Run SSH 7-39
Configuring the SSH Server 7-40
Displaying the SSH Configuration and Status 7-41
CHAPTER 8Configuring IEEE 802.1x Port-Based Authentication 8-1
Understanding IEEE 802.1x Port-Based Authentication 8-1
Device Roles 8-2
Authentication Initiation and Message Exchange 8-3
Ports in Authorized and Unauthorized States 8-4
IEEE 802.1x Accounting 8-5
IEEE 802.1x Accounting Attribute-Value Pairs 8-5
IEEE 802.1x Host Mode 8-6
Using IEEE 802.1x with Port Security 8-7
Using IEEE 802.1x with VLAN Assignment 8-8

Contents
ix
Cisco ME 3400 EthernetAccess SwitchSoftware Configuration Guide
78-17058-01
Configuring IEEE 802.1x Authentication 8-9
Default IEEE 802.1x Configuration 8-9
IEEE 802.1x Configuration Guidelines 8-10
Configuring IEEE 802.1x Authentication 8-11
Configuring the Switch-to-RADIUS-ServerCommunication 8-12
Configuring Periodic Re-Authentication 8-13
Manually Re-Authenticating a Client Connected to a Port 8-14
Changing the Quiet Period 8-14
Changing the Switch-to-Client Retransmission Time 8-15
Setting the Switch-to-Client Frame-Retransmission Number 8-15
Setting the Re-Authentication Number 8-16
Configuring the Host Mode 8-17
Resetting the IEEE 802.1x Configuration to the Default Values 8-17
Configuring IEEE 802.1x Accounting 8-18
Displaying IEEE 802.1x Statistics and Status 8-19
CHAPTER 9Configuring Interface Characteristics 9-1
Understanding Interface Types 9-1
Port-Based VLANs 9-2
Switch Ports 9-2
UNI and NNI Ports 9-3
Access Ports 9-3
Trunk Ports 9-4
Tunnel Ports 9-4
Routed Ports 9-4
Switch Virtual Interfaces 9-5
EtherChannelPort Groups 9-6
Connecting Interfaces 9-6
Using Interface Configuration Mode 9-7
Procedures for Configuring Interfaces 9-7
Configuring a Range of Interfaces 9-8
Configuring and Using Interface Range Macros 9-10
Configuring EthernetInterfaces 9-11
Default Ethernet Interface Configuration 9-12
Configuring User Networkand Network Node Interfaces 9-13
Configuring Interface Speed and Duplex Mode 9-14
Speed and Duplex Configuration Guidelines 9-15
Setting the Interface Speed and Duplex Parameters 9-15
Configuring IEEE 802.3x Flow Control 9-17

Contents
x
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide 78-17058-01
Configuring Auto-MDIX on an Interface 9-18
Adding a Description foran Interface 9-19
Configuring Layer 3 Interfaces 9-20
Configuring the System MTU 9-21
Monitoring and Maintaining the Interfaces 9-22
Monitoring Interface Status 9-23
Clearing and Resetting Interfaces and Counters 9-24
Shutting Down and Restarting the Interface 9-24
CHAPTER 10 Configuring Command Macros 10-1
Understanding Command Macros 10-1
Configuring Command Macros 10-2
Default Command Macro Configuration 10-2
Command Macro Configuration Guidelines 10-2
Creating Command Macros 10-3
Applying Command Macros 10-4
Displaying Command Macros 10-5
CHAPTER 11 Configuring VLANs 11-1
Understanding VLANs 11-1
Supported VLANs 11-3
Normal-Range VLANs 11-3
Extended-Range VLANs 11-4
VLAN Port Membership Modes 11-4
UNI VLANs 11-5
Creating and Modifying VLANs 11-6
Default Ethernet VLAN Configuration 11-7
VLAN Configuration Guidelines 11-8
Creating or Modifying an Ethernet VLAN 11-9
Assigning Static-Access Ports to a VLAN 11-10
Creating an Extended-Range VLAN with an Internal VLAN ID 11-11
Configuring UNI VLANs 11-12
ConfigurationGuidelines 11-12
Configuring UNI VLANs 11-13
Displaying VLANs 11-14
Configuring VLAN Trunks 11-14
Trunking Overview 11-14
IEEE 802.1Q Configuration Considerations 11-15

Contents
xi
Cisco ME 3400 EthernetAccess SwitchSoftware Configuration Guide
78-17058-01
Default Layer 2 Ethernet Interface VLAN Configuration 11-16
Configuring an Ethernet Interface as a Trunk Port 11-16
Interaction with Other Features 11-16
Configuring a Trunk Port 11-17
Defining the Allowed VLANs on a Trunk 11-17
Configuring the Native VLAN for Untagged Traffic 11-19
Configuring Trunk Ports for Load Sharing 11-19
Load Sharing Using STP Port Priorities 11-20
Load Sharing Using STP Path Cost 11-21
Configuring VMPS 11-23
Understanding VMPS 11-23
Dynamic-Access Port VLAN Membership 11-24
Default VMPS ClientConfiguration 11-24
VMPS Configuration Guidelines 11-25
Configuring the VMPS Client 11-25
Entering the IP Address of the VMPS 11-25
Configuring Dynamic-Access Ports on VMPS Clients 11-26
Reconfirming VLAN Memberships 11-26
Changing the Reconfirmation Interval 11-27
Changing the Retry Count 11-27
Monitoring the VMPS 11-27
Troubleshooting Dynamic-Access Port VLAN Membership 11-28
VMPS Configuration Example 11-28
CHAPTER 12 Configuring Private VLANs 12-1
Understanding Private VLANs 12-1
Types of Private VLANs and Private-VLAN Ports 12-2
IP Addressing Scheme with Private VLANs 12-4
Private VLANs across Multiple Switches 12-4
Private VLANs and Unicast, Broadcast, and Multicast Traffic 12-5
Private VLANs and SVIs 12-5
Configuring PrivateVLANs 12-5
Tasks for Configuring Private VLANs 12-6
Default Private-VLAN Configuration 12-6
Private-VLAN Configuration Guidelines 12-6
Secondary and Primary VLAN Configuration 12-7
Private-VLAN Port Configuration 12-8
Limitations with Other Features 12-9
Configuring and Associating VLANs in a Private VLAN 12-10

Contents
xii
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide 78-17058-01
Configuring a Layer 2 Interface asa Private-VLAN Host Port 12-12
Configuring a Layer 2 Interface asa Private-VLAN Promiscuous Port 12-13
Mapping Secondary VLANs to a Primary VLAN Layer 3 VLAN Interface 12-14
Monitoring Private VLANs 12-15
CHAPTER 13 Configuring IEEE 802.1Q and Layer 2 Protocol Tunneling 13-1
Understanding IEEE 802.1Q Tunneling 13-1
Configuring IEEE 802.1Q Tunneling 13-4
Default IEEE 802.1Q Tunneling Configuration 13-4
IEEE 802.1Q Tunneling Configuration Guidelines 13-4
Native VLANs 13-4
System MTU 13-5
IEEE 802.1Q Tunneling and Other Features 13-6
Configuring an IEEE 802.1Q Tunneling Port 13-6
Understanding Layer 2 Protocol Tunneling 13-8
Configuring Layer 2 Protocol Tunneling 13-10
Default Layer 2 ProtocolTunneling Configuration 13-11
Layer 2 Protocol Tunneling Configuration Guidelines 13-11
Configuring Layer 2 Protocol Tunneling 13-12
Configuring Layer 2 Tunneling for EtherChannels 13-14
Configuring the SP Edge Switch 13-14
Configuring the Customer Switch 13-15
Monitoring and Maintaining Tunneling Status 13-18
CHAPTER 14 Configuring STP 14-1
Understanding Spanning-Tree Features 14-1
STP Overview 14-2
Spanning-Tree Topology and BPDUs 14-3
Bridge ID, Switch Priority, and Extended System ID 14-4
Spanning-Tree Interface States 14-4
Blocking State 14-6
Listening State 14-6
Learning State 14-6
Forwarding State 14-7
Disabled State 14-7
How a Switch orPort Becomes the Root Switch or Root Port 14-7
Spanning Tree and Redundant Connectivity 14-8
Spanning-Tree Address Management 14-8
Accelerated Aging to Retain Connectivity 14-9

Contents
xiii
Cisco ME 3400 EthernetAccess SwitchSoftware Configuration Guide
78-17058-01
Spanning-Tree Modes and Protocols 14-9
Supported Spanning-Tree Instances 14-10
Spanning-Tree Interoperability and Backward Compatibility 14-10
STP and IEEE 802.1Q Trunks 14-10
Configuring Spanning-Tree Features 14-11
Default Spanning-Tree Configuration 14-11
Spanning-Tree Configuration Guidelines 14-12
Changing the Spanning-Tree Mode. 14-13
Disabling Spanning Tree 14-14
Configuring the Root Switch 14-14
Configuring a Secondary Root Switch 14-16
Configuring Port Priority 14-16
Configuring Path Cost 14-18
Configuring the Switch Priority of a VLAN 14-19
Configuring Spanning-Tree Timers 14-20
Configuring the Hello Time 14-20
Configuring the Forwarding-Delay Time for a VLAN 14-21
Configuring the Maximum-Aging Time for a VLAN 14-21
Displaying the Spanning-Tree Status 14-22
CHAPTER 15 Configuring MSTP 15-1
Understanding MSTP 15-2
Multiple Spanning-Tree Regions 15-2
IST, CIST, and CST 15-2
Operations Within an MST Region 15-3
Operations Between MST Regions 15-3
Hop Count 15-4
Boundary Ports 15-5
Interoperability with IEEE 802.1D STP 15-5
Understanding RSTP 15-6
Port Roles and the Active Topology 15-6
Rapid Convergence 15-7
Synchronization of Port Roles 15-8
Bridge ProtocolData Unit Format and Processing 15-9
Processing Superior BPDU Information 15-10
Processing Inferior BPDU Information 15-10
Topology Changes 15-10

Contents
xiv
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide 78-17058-01
Configuring MSTP Features 15-11
Default MSTP Configuration 15-12
MSTP Configuration Guidelines 15-12
Specifying the MST Region Configuration and Enabling MSTP 15-13
Configuring the Root Switch 15-14
Configuring a Secondary Root Switch 15-16
Configuring Port Priority 15-17
Configuring Path Cost 15-18
Configuring the Switch Priority 15-19
Configuring the Hello Time 15-19
Configuring the Forwarding-Delay Time 15-20
Configuring the Maximum-Aging Time 15-21
Configuring the Maximum-Hop Count 15-21
Specifying the Link Type to Ensure Rapid Transitions 15-22
Restarting the Protocol Migration Process 15-22
Displaying the MST Configuration and Status 15-23
CHAPTER 16 Configuring Optional Spanning-Tree Features 16-1
Understanding Optional Spanning-Tree Features 16-1
Understanding Port Fast 16-2
Understanding BPDU Guard 16-2
Understanding BPDU Filtering 16-3
Understanding EtherChannel Guard 16-3
Understanding Root Guard 16-3
Understanding Loop Guard 16-4
Configuring OptionalSpanning-Tree Features 16-5
Default OptionalSpanning-Tree Configuration 16-5
Optional Spanning-Tree Configuration Guidelines 16-5
Enabling Port Fast 16-5
Enabling BPDU Guard 16-6
Enabling BPDU Filtering 16-7
Enabling EtherChannelGuard 16-8
Enabling Root Guard 16-9
Enabling Loop Guard 16-9
Displaying the Spanning-Tree Status 16-10

Contents
xv
Cisco ME 3400 EthernetAccess SwitchSoftware Configuration Guide
78-17058-01
CHAPTER 17 Configuring Flex Links 17-1
Understanding Flex Links 17-1
Configuring Flex Links 17-2
Default Flex Link Configuration 17-2
Flex Link Configuration Guidelines 17-2
Configuring Flex Links 17-3
Monitoring Flex Links 17-4
CHAPTER 18 Configuring DHCP Features and IP Source Guard 18-1
Understanding DHCP Features 18-1
DHCP Server 18-2
DHCP Relay Agent 18-2
DHCP Snooping 18-2
Option-82 Data Insertion 18-3
DHCP Snooping Binding Database 18-5
Configuring DHCP Features 18-6
Default DHCP Configuration 18-7
DHCP Snooping Configuration Guidelines 18-7
Configuring the DHCP Relay Agent 18-8
Specifying the Packet Forwarding Address 18-9
Enabling DHCP Snooping and Option 82 18-10
Enabling DHCP Snooping on Private VLANs 18-11
Enabling the DHCP Snooping Binding Database Agent 18-12
Displaying DHCP Snooping Information 18-13
Understanding IP Source Guard 18-13
Source IP Address Filtering 18-14
Source IP and MAC Address Filtering 18-14
Configuring IP Source Guard 18-14
Default IP Source Guard Configuration 18-14
IP Source Guard Configuration Guidelines 18-15
Enabling IP Source Guard 18-15
Displaying IP Source Guard Information 18-16

Contents
xvi
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide 78-17058-01
CHAPTER 19 Configuring Dynamic ARP Inspection 19-1
Understanding Dynamic ARP Inspection 19-1
Interface Trust States and Network Security 19-3
Rate Limiting of ARP Packets 19-4
Relative Priority of ARP ACLs and DHCP Snooping Entries 19-4
Logging of Dropped Packets 19-4
Configuring Dynamic ARP Inspection 19-5
Default Dynamic ARP Inspection Configuration 19-5
Dynamic ARP Inspection Configuration Guidelines 19-6
Configuring Dynamic ARP Inspection in DHCP Environments 19-7
Configuring ARP ACLs for Non-DHCP Environments 19-8
Limiting the Rate of Incoming ARP Packets 19-10
Performing Validation Checks 19-12
Configuring the Log Buffer 19-13
Displaying Dynamic ARP Inspection Information 19-14
CHAPTER 20 Configuring IGMP Snooping and MVR 20-1
Understanding IGMP Snooping 20-1
IGMP Versions 20-2
Joining a Multicast Group 20-3
Leaving a Multicast Group 20-5
Immediate Leave 20-5
IGMP Configurable-Leave Timer 20-5
IGMP Report Suppression 20-6
Configuring IGMP Snooping 20-6
Default IGMP Snooping Configuration 20-6
Enabling or Disabling IGMP Snooping 20-7
Configuring a Multicast Router Port 20-8
Configuring a Host Statically to Join a Group 20-8
Enabling IGMP Immediate Leave 20-9
Configuring the IGMP Leave Timer 20-10
Configuring TCN-Related Commands 20-11
Controlling the Multicast Flooding Time After a TCN Event 20-11
Recovering from Flood Mode 20-11
Disabling Multicast Flooding During a TCN Event 20-12
Configuring the IGMP Snooping Querier 20-13
Disabling IGMP Report Suppression 20-14
Displaying IGMP Snooping Information 20-15

Contents
xvii
Cisco ME 3400 EthernetAccess SwitchSoftware Configuration Guide
78-17058-01
Understanding Multicast VLAN Registration 20-16
Using MVR in a Multicast Television Application 20-16
Configuring MVR 20-18
Default MVR Configuration 20-18
MVR Configuration Guidelines and Limitations 20-19
Configuring MVR Global Parameters 20-19
Configuring MVR Interfaces 20-20
Displaying MVR Information 20-22
Configuring IGMP Filtering and Throttling 20-22
Default IGMP Filtering and Throttling Configuration 20-23
Configuring IGMP Profiles 20-23
Applying IGMP Profiles 20-25
Setting the Maximum Number of IGMP Groups 20-25
Configuring the IGMP Throttling Action 20-26
Displaying IGMP Filtering and Throttling Configuration 20-28
CHAPTER 21 Configuring Port-Based Traffic Control 21-1
Configuring Storm Control 21-1
Understanding Storm Control 21-1
Default Storm Control Configuration 21-3
Configuring Storm Control and Threshold Levels 21-3
Configuring Protected Ports 21-5
Default Protected PortConfiguration 21-5
Protected Port Configuration Guidelines 21-6
Configuring a Protected Port 21-6
Configuring Port Blocking 21-7
Default Port Blocking Configuration 21-7
Blocking Flooded Traffic on an Interface 21-7
Configuring Port Security 21-8
Understanding Port Security 21-8
Secure MAC Addresses 21-8
Security Violations 21-9
Default Port Security Configuration 21-10
Port Security Configuration Guidelines 21-10
Enabling and Configuring Port Security 21-11
Enabling and Configuring Port Security Aging 21-15
Displaying Port-Based Traffic ControlSettings 21-17

Contents
xviii
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide 78-17058-01
CHAPTER 22 Configuring CDP 22-1
Understanding CDP 22-1
Configuring CDP 22-2
Default CDP Configuration 22-2
Configuring the CDP Characteristics 22-2
Disabling and Enabling CDP 22-3
Disabling and Enabling CDP on an Interface 22-4
Monitoring and Maintaining CDP 22-5
CHAPTER 23 Configuring UDLD 23-1
Understanding UDLD 23-1
Modes of Operation 23-1
Methods to Detect Unidirectional Links 23-2
Configuring UDLD 23-4
Default UDLD Configuration 23-4
Configuration Guidelines 23-4
Enabling UDLD Globally 23-5
Enabling UDLD on an Interface 23-5
Resetting an Interface Disabled by UDLD 23-6
Displaying UDLD Status 23-6
CHAPTER 24 Configuring SPAN and RSPAN 24-1
Understanding SPAN and RSPAN 24-1
Local SPAN 24-2
Remote SPAN 24-2
SPAN and RSPAN Conceptsand Terminology 24-3
SPAN Sessions 24-3
Monitored Traffic 24-4
Source Ports 24-5
Source VLANs 24-6
VLAN Filtering 24-6
Destination Port 24-7
RSPAN VLAN 24-8
SPAN and RSPAN Interaction with Other Features 24-8
Configuring SPAN and RSPAN 24-9
Default SPAN and RSPAN Configuration 24-10

Contents
xix
Cisco ME 3400 EthernetAccess SwitchSoftware Configuration Guide
78-17058-01
Configuring Local SPAN 24-10
SPAN Configuration Guidelines 24-10
Creating a Local SPAN Session 24-11
Creating a Local SPAN Session and Configuring Ingress Traffic 24-13
Specifying VLANs to Filter 24-15
Configuring RSPAN 24-16
RSPAN Configuration Guidelines 24-16
Configuring a VLAN as an RSPAN VLAN 24-17
Creating an RSPAN Source Session 24-17
Creating an RSPAN Destination Session 24-19
Creating an RSPAN Destination Session and Configuring Ingress Traffic 24-20
Specifying VLANs to Filter 24-21
Displaying SPAN and RSPAN Status 24-22
CHAPTER 25 Configuring RMON 25-1
Understanding RMON 25-1
Configuring RMON 25-2
Default RMON Configuration 25-3
Configuring RMON Alarms and Events 25-3
Collecting Group History Statistics on an Interface 25-5
Collecting Group Ethernet Statistics on an Interface 25-6
Displaying RMON Status 25-6
CHAPTER 26 Configuring System Message Logging 26-1
Understanding System Message Logging 26-1
Configuring System Message Logging 26-2
System Log Message Format 26-2
Default System Message Logging Configuration 26-3
Disabling Message Logging 26-3
Setting the Message Display Destination Device 26-4
Synchronizing Log Messages 26-5
Enabling and Disabling Time Stamps on Log Messages 26-7
Enabling and Disabling Sequence Numbers in Log Messages 26-7
Defining the Message Severity Level 26-8
Limiting Syslog Messages Sentto the History Table and to SNMP 26-9
Configuring UNIX Syslog Servers 26-10
Logging Messages to a UNIX Syslog Daemon 26-10
Configuring the UNIX System Logging Facility 26-11
Displaying the Logging Configuration 26-12

Contents
xx
Cisco ME 3400 Ethernet Access Switch Software Configuration Guide 78-17058-01
CHAPTER 27 Configuring SNMP 27-1
Understanding SNMP 27-1
SNMP Versions 27-2
SNMP Manager Functions 27-3
SNMP Agent Functions 27-4
SNMP Community Strings 27-4
Using SNMP to Access MIB Variables 27-4
SNMP Notifications 27-5
SNMP ifIndex MIB Object Values 27-5
Configuring SNMP 27-6
Default SNMP Configuration 27-6
SNMP Configuration Guidelines 27-6
Disabling the SNMP Agent 27-7
Configuring Community Strings 27-8
Configuring SNMP Groups and Users 27-9
Configuring SNMP Notifications 27-11
Setting the Agent Contactand Location Information 27-14
Limiting TFTP Servers Used Through SNMP 27-15
SNMP Examples 27-15
Displaying SNMP Status 27-16
CHAPTER 28 Configuring Network Security with ACLs 28-1
Understanding ACLs 28-1
Supported ACLs 28-2
Port ACLs 28-3
Router ACLs 28-4
VLAN Maps 28-5
Handling Fragmented and Unfragmented Traffic 28-5
Configuring IPv4 ACLs 28-6
Creating Standard and Extended IPv4 ACLs 28-7
IPv4 Access List Numbers 28-8
ACL Logging 28-8
Creating a Numbered Standard ACL 28-9
Creating a Numbered Extended ACL 28-10
Resequencing ACEs in an ACL 28-14
Creating Named Standard and Extended ACLs 28-14
Using Time Ranges with ACLs 28-16
Including Comments in ACLs 28-18
Applying an IPv4 ACL to a TerminalLine 28-18