Cisco 3845 - Security Bundle Router Quick start guide

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco ME 3800X and 3600X Switch
Software Configuration Guide
Cisco IOS Release 12.2(52)EY
October 2010
Text Part Number: OL-23400-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1005R)
Cisco ME 3800X and 3600X Switch Software Configuration Guide
© 2010 Cisco Systems, Inc. All rights reserved.

iii
Cisco ME 3800X and 3600X Switch Software Configuration Guide
OL-23400-01
CONTENTS
Preface xxxv
Audience xxxv
Purpose xxxv
Conventions xxxv
Related Publications xxxvi
Obtaining Documentation and Submitting a Service Request xxxvii
CHAPTER 1Overview 1-1
Software Licenses and Features 1-1
Features 1-2
Performance Features 1-2
Management Options 1-3
Manageability Features 1-3
Availability Features 1-5
VLAN Features 1-5
Security Features 1-6
Switch Security 1-6
Network Security 1-6
Quality of Service and Class of Service Features 1-7
Layer 2 Virtual Private Network Services 1-7
Layer 3 Features 1-8
Layer 3 VPN Services 1-8
Monitoring Features 1-9
Feature Support per License 1-9
Where to Go Next 1-11
CHAPTER 2Using the Command-Line Interface 2-1
Understanding Command Modes 2-1
Understanding the Help System 2-3
Understanding Abbreviated Commands 2-3
Understanding no and default Forms of Commands 2-4
Understanding CLI Error Messages 2-4
Using Command History 2-4

Contents
iv
Cisco ME 3800X and 3600X Switch Software Configuration Guide OL-23400-01
Changing the Command History Buffer Size 2-5
Recalling Commands 2-5
Disabling the Command History Feature 2-5
Using Editing Features 2-6
Enabling and Disabling Editing Features 2-6
Editing Commands through Keystrokes 2-6
Editing Command Lines that Wrap 2-8
Searching and Filtering Output of show and more Commands 2-8
Accessing the CLI 2-9
Accessing the CLI through a Console Connection or through Telnet 2-9
CHAPTER 3Assigning the Switch IP Address and Default Gateway 3-1
Understanding the Boot Process 3-1
Initial Configuration 3-2
Assigning Switch Information 3-3
Default Switch Information 3-3
Understanding DHCP-Based Autoconfiguration 3-4
DHCP Client Request Process 3-4
Understanding DHCP-based Autoconfiguration and Image Update 3-5
DHCP Autoconfiguration 3-5
DHCP Auto-Image Update 3-5
Limitations and Restrictions 3-6
Configuring DHCP-Based Autoconfiguration 3-6
DHCP Server Configuration Guidelines 3-7
Configuring the TFTP Server 3-7
Configuring the DNS 3-8
Configuring the Relay Device 3-8
Obtaining Configuration Files 3-9
Example Configuration 3-10
Configuring the DHCP Auto Configuration and Image Update Features 3-11
Configuring DHCP Autoconfiguration (Only Configuration File) 3-12
Configuring DHCP Auto-Image Update (Configuration File and Image) 3-13
Configuring the Client 3-14
Manually Assigning IP Information 3-15
Checking and Saving the Running Configuration 3-16
Modifying the Startup Configuration 3-17
Default Boot Configuration 3-18
Automatically Downloading a Configuration File 3-18
Specifying the Filename to Read and Write the System Configuration 3-18

Contents
v
Cisco ME 3800X and 3600X Switch Software Configuration Guide
OL-23400-01
Booting Manually 3-19
Booting a Specific Software Image 3-19
Controlling Environment Variables 3-20
Scheduling a Reload of the Software Image 3-21
Configuring a Scheduled Reload 3-22
Displaying Scheduled Reload Information 3-23
CHAPTER 4Configuring Cisco IOS Configuration Engine 4-1
Understanding Cisco Configuration Engine Software 4-1
Configuration Service 4-2
Event Service 4-3
NameSpace Mapper 4-3
What You Should Know About the CNS IDs and Device Hostnames 4-3
ConfigID 4-3
DeviceID 4-4
Hostname and DeviceID 4-4
Using Hostname, DeviceID, and ConfigID 4-4
Understanding Cisco IOS Agents 4-5
Initial Configuration 4-5
Incremental (Partial) Configuration 4-6
Synchronized Configuration 4-6
Configuring Cisco IOS Agents 4-6
Enabling Automated CNS Configuration 4-6
Enabling the CNS Event Agent 4-7
Enabling the Cisco IOS CNS Agent 4-8
Enabling an Initial Configuration 4-9
Enabling a Partial Configuration 4-12
Upgrading Devices with Cisco IOS Image Agent 4-13
Prerequisites for the CNS Image Agent 4-13
Restrictions for the CNS Image Agent 4-13
Displaying CNS Configuration 4-14
CHAPTER 5Administering the Switch 5-1
Managing the System Time and Date 5-1
Understanding the System Clock 5-1
Understanding Network Time Protocol 5-2
Configuring NTP 5-3
Default NTP Configuration 5-4
Configuring NTP Authentication 5-4

Contents
vi
Cisco ME 3800X and 3600X Switch Software Configuration Guide OL-23400-01
Configuring NTP Associations 5-5
Configuring NTP Broadcast Service 5-6
Configuring NTP Access Restrictions 5-8
Configuring the Source IP Address for NTP Packets 5-10
Displaying the NTP Configuration 5-11
Configuring Time and Date Manually 5-11
Setting the System Clock 5-11
Displaying the Time and Date Configuration 5-12
Configuring the Time Zone 5-12
Configuring Summer Time (Daylight Saving Time) 5-13
Configuring a System Name and Prompt 5-14
Default System Name and Prompt Configuration 5-15
Configuring a System Name 5-15
Understanding DNS 5-15
Default DNS Configuration 5-16
Setting Up DNS 5-16
Displaying the DNS Configuration 5-17
Creating a Banner 5-17
Default Banner Configuration 5-17
Configuring a Message-of-the-Day Login Banner 5-18
Configuring a Login Banner 5-19
Managing the MAC Address Table 5-19
Building the Address Table 5-20
MAC Addresses and VLANs 5-20
Default MAC Address Table Configuration 5-21
Changing the Address Aging Time 5-21
Removing Dynamic Address Entries 5-21
Configuring MAC Address Change Notification Traps 5-22
Configuring MAC Address Move Notification Traps 5-24
Configuring MAC Threshold Notification Traps 5-25
Adding and Removing Static Address Entries 5-26
Configuring Unicast MAC Address Filtering 5-27
Disabling MAC Address Learning on a VLAN 5-28
Displaying Address Table Entries 5-29
Managing the ARP Table 5-30
CHAPTER 6Configuring Synchronous Ethernet 6-1
Understanding SyncE 6-1
Reference Clocks 6-1

Contents
vii
Cisco ME 3800X and 3600X Switch Software Configuration Guide
OL-23400-01
SyncE Timing Using REP for Loop Prevention and Resiliency 6-2
BITS Interface 6-5
Configuring SyncE 6-5
Default SyncE Configuration 6-6
Configuring the Network Clock Selection 6-6
Configuring the BITS Interface 6-7
Selecting the Network Clock 6-9
Configuring REP for the SyncE Network 6-10
Monitoring SyncE 6-11
CHAPTER 7Configuring the Switch External Alarms 7-1
Understanding Switch Alarms 7-1
Configuring Switch Alarms 7-2
CHAPTER 8Configuring Switch-Based Authentication 8-1
Preventing Unauthorized Access to Your Switch 8-1
Protecting Access to Privileged EXEC Commands 8-2
Default Password and Privilege Level Configuration 8-2
Setting or Changing a Static Enable Password 8-3
Protecting Enable and Enable Secret Passwords with Encryption 8-3
Disabling Password Recovery 8-5
Setting a Telnet Password for a Terminal Line 8-6
Configuring Username and Password Pairs 8-6
Configuring Multiple Privilege Levels 8-7
Setting the Privilege Level for a Command 8-8
Changing the Default Privilege Level for Lines 8-9
Logging into and Exiting a Privilege Level 8-9
Controlling Switch Access with TACACS+ 8-10
Understanding TACACS+ 8-10
TACACS+ Operation 8-12
Configuring TACACS+ 8-12
Default TACACS+ Configuration 8-13
Identifying the TACACS+ Server Host and Setting the Authentication Key 8-13
Configuring TACACS+ Login Authentication 8-14
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 8-16
Starting TACACS+ Accounting 8-16
Displaying the TACACS+ Configuration 8-17
Controlling Switch Access with RADIUS 8-17
Understanding RADIUS 8-17

Contents
viii
Cisco ME 3800X and 3600X Switch Software Configuration Guide OL-23400-01
RADIUS Operation 8-19
Configuring RADIUS 8-19
Default RADIUS Configuration 8-20
Identifying the RADIUS Server Host 8-20
Configuring RADIUS Login Authentication 8-22
Defining AAA Server Groups 8-24
Configuring RADIUS Authorization for User Privileged Access and Network Services 8-26
Starting RADIUS Accounting 8-27
Configuring Settings for All RADIUS Servers 8-28
Configuring the Switch to Use Vendor-Specific RADIUS Attributes 8-28
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 8-29
Configuring RADIUS Server Load Balancing 8-30
Displaying the RADIUS Configuration 8-30
Controlling Switch Access with Kerberos 8-31
Understanding Kerberos 8-31
Kerberos Operation 8-33
Authenticating to a Boundary Switch 8-33
Obtaining a TGT from a KDC 8-34
Authenticating to Network Services 8-34
Configuring Kerberos 8-34
Configuring the Switch for Local Authentication and Authorization 8-35
Configuring the Switch for Secure Shell 8-36
Understanding SSH 8-36
SSH Servers, Integrated Clients, and Supported Versions 8-36
Limitations 8-37
Configuring SSH 8-37
Configuration Guidelines 8-37
Setting Up the Switch to Run SSH 8-37
Configuring the SSH Server 8-38
Displaying the SSH Configuration and Status 8-39
Configuring the Switch for Secure Copy Protocol 8-39
Information About Secure Copy 8-40
CHAPTER 9Configuring Interfaces 9-1
Understanding Interface Types 9-1
NNI Port Type 9-2
Port-Based VLANs 9-2
Switch Ports 9-2
Access Ports 9-3

Contents
ix
Cisco ME 3800X and 3600X Switch Software Configuration Guide
OL-23400-01
Trunk Ports 9-3
Routed Ports 9-3
Ethernet Management Port 9-4
Switch Virtual Interfaces 9-4
EtherChannel Port Groups 9-4
Ethernet Flow Points 9-5
Connecting Interfaces 9-5
Using Interface Configuration Mode 9-6
Procedures for Configuring Interfaces 9-6
Configuring a Range of Interfaces 9-7
Configuring and Using Interface Range Macros 9-8
Using the Ethernet Management Port 9-10
Understanding the Ethernet Management Port 9-10
Supported Features on the Ethernet Management Port 9-12
Configuring the Ethernet Management Port 9-12
TFTP and the Ethernet Management Port 9-12
Configuring Ethernet Interfaces 9-13
Default Ethernet Interface Configuration 9-13
Configuring Interface Speed and Duplex Mode 9-14
Speed and Duplex Configuration Guidelines 9-14
Setting the Interface Speed and Duplex Parameters 9-15
Configuring IEEE 802.3x Flow Control 9-17
Configuring Auto-MDIX on an Interface 9-18
Adding a Description for an Interface 9-19
Configuring Layer 3 Interfaces 9-19
Configuring the Interface MTU 9-21
Monitoring and Maintaining the Interfaces 9-21
Monitoring Interface Status 9-21
Clearing and Resetting Interfaces and Counters 9-23
Shutting Down and Restarting the Interface 9-23
CHAPTER 10 Configuring VLANs 10-1
Understanding VLANs 10-1
Supported VLANs 10-3
Normal-Range VLANs 10-3
Extended-Range VLANs 10-4
VLAN Port Membership Modes 10-4
UNI VLANs 10-4
Creating and Modifying VLANs 10-5

Contents
x
Cisco ME 3800X and 3600X Switch Software Configuration Guide OL-23400-01
Default Ethernet VLAN Configuration 10-5
VLAN Configuration Guidelines 10-6
Creating or Modifying an Ethernet VLAN 10-7
Assigning Static-Access Ports to a VLAN 10-8
Displaying VLANs 10-9
Configuring VLAN Trunks 10-9
Trunking Overview 10-9
IEEE 802.1Q Configuration Considerations 10-10
Default Layer 2 Ethernet Interface VLAN Configuration 10-10
Configuring an Ethernet Interface as a Trunk Port 10-11
Interaction with EtherChannels 10-11
Configuring a Trunk Port 10-11
Defining the Allowed VLANs on a Trunk 10-12
Configuring the Native VLAN for Untagged Traffic 10-13
Configuring Trunk Ports for Load Sharing 10-14
Load Sharing Using STP Port Priorities 10-14
Load Sharing Using STP Path Cost 10-15
CHAPTER 11 Configuring Ethernet Virtual Connections (EVCs) 11-1
Supported EVC Features 11-2
Understanding EVC Features 11-3
Ethernet Virtual Connections 11-3
Service Instances and EFPs 11-3
Encapsulation 11-4
Bridge Domains 11-6
Split-Horizon 11-6
Rewrite Operations 11-7
Configuring EFPs 11-8
Default EVC Configuration 11-8
Configuration Guidelines 11-8
Creating Service Instances 11-9
Configuration Examples 11-10
Configuring a Service Instance 11-10
Encapsulation Using a VLAN Range 11-10
Two Service Instances Joining the Same Bridge Domain 11-10
Bridge Domains and VLAN Encapsulation 11-11
Rewrite 11-11
Split Horizon 11-11
Hairpinning 11-12