Cisco 2950 - Catalyst Switch User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Catalyst 2950 and Catalyst 2955 Switch
Software Configuration Guide
Cisco IOS Release 12.1(22)EA5
July 2005
Customer Order Number: DOC-7811380=
Text Part Number: 78-11380-12

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn,
and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the
Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Empowering the Internet
Generation, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise,
the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX,
Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StrataView Plus, TeleRouter, The Fastest Way to Increase Your Internet Quotient,
and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0502R)
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
Copyright © 2001–2005 Cisco Systems, Inc. All rights reserved.

iii
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
78-11380-12
CONTENTS
Preface xxvii
Audience xxvii
Purpose xxvii
Conventions xxviii
Related Publications xxix
Obtaining Documentation xxix
Cisco.com xxx
Product Documentation DVD xxx
Ordering Documentation xxx
Documentation Feedback xxxi
Cisco Product Security Overview xxxi
Reporting Security Problems in Cisco Products xxxi
Obtaining Technical Assistance xxxii
Cisco Technical Support & Documentation Website xxxii
Submitting a Service Request xxxiii
Definitions of Service Request Severity xxxiii
Obtaining Additional Publications and Information xxxiii
CHAPTER 1Overview 1-1
Features 1-1
Ease of Use and Ease of Deployment 1-2
Performance 1-3
Manageability 1-4
Redundancy 1-5
VLAN Support 1-6
Security 1-6
Quality of Service and Class of Service 1-7
Monitoring 1-8
LRE Features (available only on Catalyst 2950 LRE switches) 1-8
Management Options 1-9
Management Interface Options 1-9
Advantages of Using Network Assistant and Clustering Switches 1-10
Network Configuration Examples 1-11
Design Concepts for Using the Switch 1-12

Contents
iv
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
78-11380-12
Small to Medium-Sized Network Configuration 1-15
Collapsed Backbone and Switch Cluster Configuration 1-16
Hotel Network Configuration 1-17
Service-Provider Central-Office Configuration 1-20
Large Campus Configuration 1-21
Multidwelling Network Using Catalyst 2950 Switches 1-22
Long-Distance, High-Bandwidth Transport Configuration 1-24
Where to Go Next 1-24
CHAPTER 2Using the Command-Line Interface 2-1
Cisco IOS Command Modes 2-1
Getting Help 2-3
Abbreviating Commands 2-4
Using no and default Forms of Commands 2-4
Understanding CLI Messages 2-5
Using Command History 2-5
Changing the Command History Buffer Size 2-5
Recalling Commands 2-6
Disabling the Command History Feature 2-6
Using Editing Features 2-6
Enabling and Disabling Editing Features 2-6
Editing Commands through Keystrokes 2-7
Editing Command Lines that Wrap 2-8
Searching and Filtering Output of show and more Commands 2-9
Accessing the CLI 2-9
CHAPTER 3Configuring Catalyst 2955 Switch Alarms 3-1
Understanding Catalyst 2955 Switch Alarms 3-1
Global Status Monitoring Alarms 3-2
FCS Error Hysteresis Threshold 3-2
Port Status Monitoring Alarms 3-3
Triggering Alarm Options 3-3
Configuring Catalyst 2955 Switch Alarms 3-4
Default Catalyst 2955 Switch Alarm Configuration 3-4
Configuring the Power Supply Alarm 3-5
Setting the Power Mode 3-5
Setting the Power Supply Alarm Options 3-5
Configuring the Switch Temperature Alarms 3-6

Contents
v
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
78-11380-12
Setting a Secondary Temperature Threshold for the Switch 3-6
Associating the Temperature Alarms to a Relay 3-7
Configuring the FCS Bit Error Rate Alarm 3-7
Setting the FCS Error Threshold 3-8
Setting the FCS Error Hysteresis Threshold 3-8
Configuring Alarm Profiles 3-9
Creating or Modifying an Alarm Profile 3-9
Attaching an Alarm Profile to a Specific Port 3-10
Enabling SNMP Traps 3-11
Displaying Catalyst 2955 Switch Alarms Status 3-11
CHAPTER 4Assigning the Switch IP Address and Default Gateway 4-1
Understanding the Boot Process 4-1
Assigning Switch Information 4-2
Default Switch Information 4-3
Understanding DHCP-Based Autoconfiguration 4-3
DHCP Client Request Process 4-4
Configuring DHCP-Based Autoconfiguration 4-5
DHCP Server Configuration Guidelines 4-5
Configuring the TFTP Server 4-6
Configuring the DNS 4-6
Configuring the Relay Device 4-7
Obtaining Configuration Files 4-8
Example Configuration 4-9
Manually Assigning IP Information 4-10
Checking and Saving the Running Configuration 4-11
Modifying the Startup Configuration 4-11
Default Boot Configuration 4-12
Automatically Downloading a Configuration File 4-12
Specifying the Filename to Read and Write the System Configuration 4-12
Booting Manually 4-13
Booting a Specific Software Image 4-13
Controlling Environment Variables 4-14
Scheduling a Reload of the Software Image 4-16
Configuring a Scheduled Reload 4-16
Displaying Scheduled Reload Information 4-17

Contents
vi
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
78-11380-12
CHAPTER 5Configuring IE2100 CNS Agents 5-1
Understanding IE2100 Series Configuration Registrar Software 5-1
CNS Configuration Service 5-2
CNS Event Service 5-3
NameSpace Mapper 5-3
What You Should Know About ConfigID, DeviceID, and Host Name 5-3
ConfigID 5-3
DeviceID 5-4
Host Name and DeviceID 5-4
Using Host Name, DeviceID, and ConfigID 5-4
Understanding CNS Embedded Agents 5-5
Initial Configuration 5-5
Incremental (Partial) Configuration 5-6
Synchronized Configuration 5-6
Configuring CNS Embedded Agents 5-6
Enabling Automated CNS Configuration 5-6
Enabling the CNS Event Agent 5-8
Enabling the CNS Configuration Agent 5-9
Enabling an Initial Configuration 5-9
Enabling a Partial Configuration 5-12
Displaying CNS Configuration 5-12
CHAPTER 6Clustering Switches 6-1
Understanding Switch Clusters 6-1
Clustering Overview 6-1
Cluster Command Switch Characteristics 6-2
Standby Command Switch Characteristics 6-2
Candidate Switch and Member Switch Characteristics 6-3
Using the CLI to Manage Switch Clusters 6-4
Catalyst 1900 and Catalyst 2820 CLI Considerations 6-4
Using SNMP to Manage Switch Clusters 6-4
CHAPTER 7Administering the Switch 7-1
Managing the System Time and Date 7-1
Understanding the System Clock 7-1
Understanding Network Time Protocol 7-2
Configuring NTP 7-3
Default NTP Configuration 7-4

Contents
vii
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
78-11380-12
Configuring NTP Authentication 7-4
Configuring NTP Associations 7-5
Configuring NTP Broadcast Service 7-6
Configuring NTP Access Restrictions 7-8
Configuring the Source IP Address for NTP Packets 7-10
Displaying the NTP Configuration 7-11
Configuring Time and Date Manually 7-11
Setting the System Clock 7-11
Displaying the Time and Date Configuration 7-12
Configuring the Time Zone 7-12
Configuring Summer Time (Daylight Saving Time) 7-13
Configuring a System Name and Prompt 7-14
Default System Name and Prompt Configuration 7-15
Configuring a System Name 7-15
Understanding DNS 7-15
Default DNS Configuration 7-16
Setting Up DNS 7-16
Displaying the DNS Configuration 7-17
Creating a Banner 7-17
Default Banner Configuration 7-17
Configuring a Message-of-the-Day Login Banner 7-18
Configuring a Login Banner 7-19
Managing the MAC Address Table 7-19
Building the Address Table 7-20
MAC Addresses and VLANs 7-20
Default MAC Address Table Configuration 7-21
Changing the Address Aging Time 7-21
Removing Dynamic Address Entries 7-21
Configuring MAC Address Notification Traps 7-22
Adding and Removing Static Address Entries 7-24
Configuring Unicast MAC Address Filtering 7-25
Displaying Address Table Entries 7-26
Managing the ARP Table 7-26
CHAPTER 8Configuring Switch-Based Authentication 8-1
Preventing Unauthorized Access to Your Switch 8-1
Protecting Access to Privileged EXEC Commands 8-2
Default Password and Privilege Level Configuration 8-2
Setting or Changing a Static Enable Password 8-3

Contents
viii
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
78-11380-12
Protecting Enable and Enable Secret Passwords with Encryption 8-4
Disabling Password Recovery 8-5
Setting a Telnet Password for a Terminal Line 8-6
Configuring Username and Password Pairs 8-7
Configuring Multiple Privilege Levels 8-8
Setting the Privilege Level for a Command 8-8
Changing the Default Privilege Level for Lines 8-9
Logging into and Exiting a Privilege Level 8-10
Controlling Switch Access with TACACS+ 8-10
Understanding TACACS+ 8-10
TACACS+ Operation 8-12
Configuring TACACS+ 8-12
Default TACACS+ Configuration 8-13
Identifying the TACACS+ Server Host and Setting the Authentication Key 8-13
Configuring TACACS+ Login Authentication 8-14
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 8-16
Starting TACACS+ Accounting 8-17
Displaying the TACACS+ Configuration 8-17
Controlling Switch Access with RADIUS 8-17
Understanding RADIUS 8-18
RADIUS Operation 8-19
Configuring RADIUS 8-20
Default RADIUS Configuration 8-20
Identifying the RADIUS Server Host 8-20
Configuring RADIUS Login Authentication 8-23
Defining AAA Server Groups 8-25
Configuring RADIUS Authorization for User Privileged Access and Network Services 8-27
Starting RADIUS Accounting 8-28
Configuring Settings for All RADIUS Servers 8-29
Configuring the Switch to Use Vendor-Specific RADIUS Attributes 8-29
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 8-30
Displaying the RADIUS Configuration 8-31
Configuring the Switch for Local Authentication and Authorization 8-32
Configuring the Switch for Secure Shell 8-33
Understanding SSH 8-33
SSH Servers, Integrated Clients, and Supported Versions 8-33
Limitations 8-34
Configuring SSH 8-34
Configuration Guidelines 8-34

Contents
ix
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
78-11380-12
Cryptographic Software Image Guidelines 8-35
Setting Up the Switch to Run SSH 8-35
Configuring the SSH Server 8-36
Displaying the SSH Configuration and Status 8-37
Configuring the Switch for Secure Copy Protocol 8-37
CHAPTER 9Configuring IEEE 802.1x Port-Based Authentication 9-1
Understanding IEEE 802.1x Port-Based Authentication 9-1
Device Roles 9-2
Authentication Initiation and Message Exchange 9-3
Ports in Authorized and Unauthorized States 9-4
IEEE 802.1x Accounting 9-5
IEEE 802.1x Accounting Attribute-Value Pairs 9-5
IEEE 802.1x Host Mode 9-6
Using IEEE 802.1x with Port Security 9-7
Using IEEE 802.1x with Voice VLAN Ports 9-8
Using IEEE 802.1x with VLAN Assignment 9-8
Using IEEE 802.1x with Guest VLAN 9-9
Using IEEE 802.1x with Wake-on-LAN 9-10
Unidirectional State 9-10
Bidirectional State 9-10
Configuring IEEE 802.1x Authentication 9-11
Default IEEE 802.1x Configuration 9-11
IEEE 802.1x Configuration Guidelines 9-12
Upgrading from a Previous Software Release 9-13
Enabling IEEE 802.1x Authentication 9-14
Configuring the Switch-to-RADIUS-Server Communication 9-15
Configuring IEEE 802.1x Authentication Using a RADIUS Server 9-16
Enabling Periodic Re-Authentication 9-17
Manually Re-Authenticating a Client Connected to a Port 9-18
Changing the Quiet Period 9-18
Changing the Switch-to-Client Retransmission Time 9-19
Setting the Switch-to-Client Frame-Retransmission Number 9-19
Configuring the Host Mode 9-20
Configuring a Guest VLAN 9-21
Resetting the IEEE 802.1x Configuration to the Default Values 9-22
Configuring IEEE 802.1x Authentication 9-23
Configuring IEEE 802.1x Accounting 9-24
Displaying IEEE 802.1x Statistics and Status 9-25

Contents
x
Catalyst 2950 and Catalyst 2955 Switch Software Configuration Guide
78-11380-12
CHAPTER 10 Configuring Interface Characteristics 10-1
Understanding Interface Types 10-1
Access Ports 10-2
Trunk Ports 10-2
Port-Based VLANs 10-3
EtherChannel Port Groups 10-3
Connecting Interfaces 10-4
Using the Interface Command 10-4
Procedures for Configuring Interfaces 10-5
Configuring a Range of Interfaces 10-6
Configuring and Using Interface-Range Macros 10-7
Configuring Ethernet Interfaces 10-9
Default Ethernet Interface Configuration 10-9
Configuring Interface Speed and Duplex Mode 10-10
Configuration Guidelines 10-11
Setting the Interface Speed and Duplex Parameters on a Non-LRE Switch Port 10-12
Setting the Interface Speed and Duplex Parameters on an LRE Switch Port 10-13
Configuring Media Types for Gigabit Ethernet Interfaces on LRE Switches 10-13
Configuring IEEE 802.3z Flow Control on Gigabit Ethernet Ports 10-13
Adding a Description for an Interface 10-15
Configuring Loopback Detection 10-15
Monitoring and Maintaining the Interfaces 10-16
Monitoring Interface and Controller Status 10-16
Clearing and Resetting Interfaces and Counters 10-17
Shutting Down and Restarting the Interface 10-17
CHAPTER 11 Configuring Smartports Macros 11-1
Understanding Smartports Macros 11-1
Configuring Smartports Macros 11-2
Default Smartports Macro Configuration 11-2
Smartports Macro Configuration Guidelines 11-3
Creating Smartports Macros 11-4
Applying Smartports Macros 11-5
Applying Cisco-Default Smartports Macros 11-6
Displaying Smartports Macros 11-8