Cisco 4500-M Quick start guide

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Catalyst 4500 Series Switch Cisco IOS
Software Configuration Guide
Release 12.2(25)EW
Customer Order Number: DOC-OL6696=
Text Part Number: OL-6696-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CCSP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and
iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco
Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Empowering the Internet Generation,
Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo,
iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing,
Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StrataView Plus, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient,
TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0411R)
Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide
Copyright © 1999–2004 Cisco Systems, Inc. All rights reserved.

iii
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
CONTENTS
Preface xxi
Audience xxi
Organization xxi
Related Documentation xxiii
Conventions xxiv
Commands in Task Tables xxv
Obtaining Documentation xxv
Cisco.com xxv
Ordering Documentation xxv
Documentation Feedback xxvi
Obtaining Technical Assistance xxvi
Cisco Technical Support Website xxvi
Submitting a Service Request xxvii
Definitions of Service Request Severity xxvii
Obtaining Additional Publications and Information xxvii
CHAPTER 1Product Overview 1-1
Layer 2 Software Features 1-1
802.1Q and Layer 2 Protocol Tunneling 1-2
Storm Control 1-2
CDP 1-2
DHCP Snooping 1-2
EtherChannel Bundles 1-3
IP Source Guard 1-3
Jumbo Frames 1-3
Layer 2 Traceroute 1-3
MST 1-4
PVRST+ 1-4
Spanning Tree Protocol 1-4
UDLD 1-5
Unidirectional Ethernet 1-5
VLANs 1-5
Layer 3 Software Features 1-6
CEF 1-6

Contents
iv
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
HSRP 1-6
IP Routing Protocols 1-6
Multicast Services 1-9
Network Security with ACLs 1-9
Policy-Based Routing 1-10
Unidirectional Link Routing 1-10
VRF-lite 1-10
QoS Features 1-10
Management and Security Features 1-11
CHAPTER 2Command-Line Interfaces 2-1
Accessing the Switch CLI 2-1
Accessing the CLI Using the EIA/TIA-232 Console Interface 2-1
Accessing the CLI Through Telnet 2-2
Performing Command-Line Processing 2-3
Performing History Substitution 2-3
Understanding Cisco IOS Command Modes 2-4
Getting a List of Commands and Syntax 2-5
ROMMOM Command-Line Interface 2-6
CHAPTER 3Configuring the Switch for the First Time 3-1
Default Switch Configuration 3-1
Configuring DHCP-Based Autoconfiguration 3-2
Understanding DHCP-Based Autoconfiguration 3-2
DHCP Client Request Process 3-3
Configuring the DHCP Server 3-3
Configuring the TFTP Server 3-4
Configuring the DNS Server 3-5
Configuring the Relay Device 3-5
Obtaining Configuration Files 3-6
Example Configuration 3-7
Configuring the Switch 3-8
Using Configuration Mode to Configure Your Switch 3-9
Checking the Running Configuration Settings 3-9
Saving the Running Configuration Settings to Your Start-up File 3-10
Reviewing the Configuration in NVRAM 3-10
Configuring a Default Gateway 3-11
Configuring a Static Route 3-11

Contents
v
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Controlling Access to Privileged EXEC Commands 3-13
Setting or Changing a Static enable Password 3-13
Using the enable password and enable secret Commands 3-14
Setting or Changing a Privileged Password 3-14
Setting TACACS+ Password Protection for Privileged EXEC Mode 3-15
Encrypting Passwords 3-15
Configuring Multiple Privilege Levels 3-16
Recovering a Lost Enable Password 3-18
Modifying the Supervisor Engine Startup Configuration 3-18
Understanding the Supervisor Engine Boot Configuration 3-18
Configuring the Software Configuration Register 3-19
Specifying the Startup System Image 3-23
Controlling Environment Variables 3-24
CHAPTER 4Configuring Interfaces 4-1
Overview of Interface Configuration 4-1
Using the interface Command 4-2
Configuring a Range of Interfaces 4-4
Defining and Using Interface-Range Macros 4-5
Configuring Optional Interface Features 4-6
Configuring Ethernet Interface Speed and Duplex Mode 4-7
Configuring Jumbo Frame Support 4-10
Interacting with the Baby Giants Feature 4-12
Understanding Online Insertion and Removal 4-13
Monitoring and Maintaining the Interface 4-13
Monitoring Interface and Controller Status 4-13
Clearing and Resetting the Interface 4-14
Shutting Down and Restarting an Interface 4-14
CHAPTER 5Checking Port Status and Connectivity 5-1
Checking Module Status 5-1
Checking Interfaces Status 5-2
Checking MAC Addresses 5-3
Using Telnet 5-3
Changing the Logout Timer 5-4
Monitoring User Sessions 5-4
Using Ping 5-5
Understanding How Ping Works 5-5

Contents
vi
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Running Ping 5-6
Using IP Traceroute 5-7
Understanding How IP Traceroute Works 5-7
Running IP Traceroute 5-7
Using Layer 2 Traceroute 5-8
Understanding Layer 2 Traceroute 5-8
Layer 2 Traceroute Usage Guidelines 5-8
Running Layer 2 Traceroute 5-9
Configuring ICMP 5-10
Enabling ICMP Protocol Unreachable Messages 5-10
Enabling ICMP Redirect Messages 5-11
Enabling ICMP Mask Reply Messages 5-11
CHAPTER 6Configuring Supervisor Engine Redundancy Using RPR and SSO 6-1
Understanding Cisco IOS NSF-Awareness Support 6-2
Understanding Supervisor Engine Redundancy 6-3
Overview 6-3
RPR Operation 6-4
SSO Operation 6-4
Understanding Supervisor Engine Redundancy Synchronization 6-6
RPR Supervisor Engine Configuration Synchronization 6-6
SSO Supervisor Engine Configuration Synchronization 6-7
Supervisor Engine Redundancy Guidelines and Restrictions 6-7
Configuring Supervisor Engine Redundancy 6-8
Configuring Redundancy 6-8
Synchronizing the Supervisor Engine Configurations 6-10
Performing a Manual Switchover 6-11
Performing a Software Upgrade 6-12
Manipulating Bootflash on the Redundant Supervisor Engine 6-14
CHAPTER 7Environmental Monitoring and Power Management 7-1
Understanding Environmental Monitoring 7-1
Using CLI Commands to Monitor your Environment 7-2
System Alarms 7-2
Power Management 7-3
Power Management for the Catalyst 4948 Switches 7-3
Power Management for the Catalyst 4500 Series Switches 7-4
Power Management for the Catalyst 4006 Switch 7-12

Contents
vii
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Power Consumption of Chassis Components 7-15
Powering Down a Module 7-15
CHAPTER 8Configuring Power over Ethernet 8-1
Power Management Modes 8-1
Configuring Power Consumption for Powered Devices on an Interface 8-3
Displaying the Operational Status for an Interface 8-6
Displaying the PoE Consumed by a Module 8-7
CHAPTER 9Configuring Switches with Web-based Tools 9-1
Configuring and Using the Network Assistant 9-1
Understanding How the Network Assistant Works 9-2
Installation Requirements 9-2
Software and Hardware Requirements 9-2
Network Assistant-related Default Configuration 9-3
Installing the Network Assistant 9-3
Overview of the CLI Commands 9-4
Configuring the Cisco Device for Use with Network Assistant 9-4
Displaying the Network Assistant-Related Configuration 9-9
Launching the Network Assistant 9-10
Connecting Network Assistant to a Device 9-10
Clustering Switches 9-10
Understanding Switch Clusters 9-11
Using the CLI to Manage Switch Clusters 9-13
Configuring Embedded CiscoView Support 9-13
Understanding Embedded CiscoView 9-13
Installing and Configuring Embedded CiscoView 9-14
Displaying Embedded CiscoView Information 9-16
CHAPTER 10 Understanding and Configuring VLANs 10-1
Overview of VLANs 10-1
VLAN Configuration Guidelines and Restrictions 10-3
VLAN Ranges 10-3
Configurable Normal-Range VLAN Parameters 10-4
VLAN Default Configuration 10-4
Configuring VLANs 10-4
Configuring VLANs in Global Configuration Mode 10-5
Configuring VLANs in VLAN Database Mode 10-7
Assigning a Layer 2 LAN Interface to a VLAN 10-8

Contents
viii
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
CHAPTER 11 Configuring Dynamic VLAN Membership 11-1
Understanding VMPS 11-1
VMPS Server Overview 11-1
Security Modes for VMPS Server 11-2
Fall-back VLAN 11-3
Illegal VMPS client requests 11-3
Understanding VMPS clients 11-4
Dynamic VLAN Membership Overview 11-4
Default VMPS Client Configuration 11-4
Configuring a Switch as a VMPS Client 11-5
Administering and Monitoring the VMPS 11-8
Troubleshooting Dynamic Port VLAN Membership 11-9
CHAPTER 12 Configuring Layer 2 Ethernet Interfaces 12-1
Overview of Layer 2 Ethernet Switching 12-1
Understanding Layer 2 Ethernet Switching 12-1
Understanding VLAN Trunks 12-3
Layer 2 Interface Modes 12-4
Default Layer 2 Ethernet Interface Configuration 12-4
Layer 2 Interface Configuration Guidelines and Restrictions 12-5
Configuring Ethernet Interfaces for Layer 2 Switching 12-5
Configuring an Ethernet Interface as a Layer 2 Trunk 12-6
Configuring an Interface as a Layer 2 Access Port 12-8
Clearing Layer 2 Configuration 12-9
CHAPTER 13 Configuring SmartPort Macros 13-1
Understanding SmartPort Macros 13-1
Configuring Smart-Port Macros 13-2
Default SmartPort Macro Configuration 13-2
SmartPort Macro Configuration Guidelines 13-4
Creating and Applying SmartPort Macros 13-4
Displaying SmartPort Macros 13-8
CHAPTER 14 Understanding and Configuring STP 14-1
Overview of STP 14-1
Understanding the Bridge ID 14-2
Bridge Protocol Data Units 14-3
Election of the Root Bridge 14-4

Contents
ix
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
STP Timers 14-4
Creating the STP Topology 14-4
STP Port States 14-5
MAC Address Allocation 14-5
STP and IEEE 802.1Q Trunks 14-6
Per-VLAN Rapid Spanning Tree 14-6
Default STP Configuration 14-6
Configuring STP 14-7
Enabling STP 14-7
Enabling the Extended System ID 14-8
Configuring the Root Bridge 14-9
Configuring a Secondary Root Switch 14-12
Configuring STP Port Priority 14-13
Configuring STP Port Cost 14-15
Configuring the Bridge Priority of a VLAN 14-16
Configuring the Hello Time 14-17
Configuring the Maximum Aging Time for a VLAN 14-18
Configuring the Forward-Delay Time for a VLAN 14-18
Disabling Spanning Tree Protocol 14-19
Enabling Per-VLAN Rapid Spanning Tree 14-20
CHAPTER 15 Configuring STP Features 15-1
Overview of Root Guard 15-2
Overview of Loop Guard 15-2
Overview of PortFast 15-3
Overview of BPDU Guard 15-4
Overview of PortFast BPDU Filtering 15-4
Overview of UplinkFast 15-5
Overview of BackboneFast 15-6
Enabling Root Guard 15-8
Enabling Loop Guard 15-9
Enabling PortFast 15-11
Enabling BPDU Guard 15-12
Enabling PortFast BPDU Filtering 15-12
Enabling UplinkFast 15-14
Enabling BackboneFast 15-15

Contents
x
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
CHAPTER 16 Understanding and Configuring Multiple Spanning Trees 16-1
Overview of MST 16-1
IEEE 802.1s MST 16-2
IEEE 802.1w RSTP 16-3
MST-to-SST Interoperability 16-4
Common Spanning Tree 16-5
MST Instances 16-5
MST Configuration Parameters 16-5
MST Regions 16-6
Message Age and Hop Count 16-7
MST-to-PVST+ Interoperability 16-8
MST Configuration Restrictions and Guidelines 16-8
Configuring MST 16-9
Enabling MST 16-9
Configuring MST Instance Parameters 16-11
Configuring MST Instance Port Parameters 16-12
Restarting Protocol Migration 16-12
Displaying MST Configurations 16-13
CHAPTER 17 Understanding and Configuring EtherChannel 17-1
Overview of EtherChannel 17-1
Understanding Port-Channel Interfaces 17-2
Understanding How EtherChannels Are Configured 17-2
Understanding Load Balancing 17-5
EtherChannel Configuration Guidelines and Restrictions 17-5
Configuring EtherChannel 17-6
Configuring Layer 3 EtherChannels 17-6
Configuring Layer 2 EtherChannels 17-9
Configuring the LACP System Priority and System ID 17-11
Configuring EtherChannel Load Balancing 17-12
Removing an Interface from an EtherChannel 17-13
Removing an EtherChannel 17-14
CHAPTER 18 Configuring IGMP Snooping and Filtering 18-1
Overview of IGMP Snooping 18-1
Immediate-Leave Processing 18-3
Explicit Host Tracking 18-3
Configuring IGMP Snooping 18-4

Contents
xi
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Default IGMP Snooping Configuration 18-4
Enabling IGMP Snooping 18-5
Configuring Learning Methods 18-6
Configuring a Multicast Router Port Statical 18-7
Enabling IGMP Immediate-Leave Processing 18-7
Configuring Explicit Host Tracking 18-8
Configuring a Host Statically 18-8
Suppressing Multicast Flooding 18-9
Displaying IGMP Snooping Information 18-11
Displaying Querier Information 18-12
Displaying IGMP Host Membership Information 18-12
Displaying Group Information 18-13
Displaying Multicast Router Interfaces 18-14
Displaying MAC Address Multicast Entries 18-15
Displaying IGMP Snooping Information on a VLAN Interface 18-15
Configuring IGMP Filtering 18-16
Default IGMP Filtering Configuration 18-17
Configuring IGMP Profiles 18-17
Applying IGMP Profiles 18-18
Setting the Maximum Number of IGMP Groups 18-19
Displaying IGMP Filtering Configuration 18-20
CHAPTER 19 Configuring 802.1Q and Layer 2 Protocol Tunneling 19-1
Understanding 802.1Q Tunneling 19-1
Configuring 802.1Q Tunneling 19-4
802.1Q Tunneling Configuration Guidelines 19-4
802.1Q Tunneling and Other Features 19-5
Configuring an 802.1Q Tunneling Port 19-6
Understanding Layer 2 Protocol Tunneling 19-7
Configuring Layer 2 Protocol Tunneling 19-9
Default Layer 2 Protocol Tunneling Configuration 19-9
Layer 2 Protocol Tunneling Configuration Guidelines 19-10
Configuring Layer 2 Tunneling 19-10
Monitoring and Maintaining Tunneling Status 19-12
CHAPTER 20 Understanding and Configuring CDP 20-1
Overview of CDP 20-1
Configuring CDP 20-2

Contents
xii
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Enabling CDP Globally 20-2
Displaying the CDP Global Configuration 20-2
Enabling CDP on an Interface 20-3
Displaying the CDP Interface Configuration 20-3
Monitoring and Maintaining CDP 20-3
CHAPTER 21 Configuring UDLD 21-1
Overview of UDLD 21-1
Default UDLD Configuration 21-2
Configuring UDLD on the Switch 21-2
Enabling UDLD Globally 21-3
Enabling UDLD on Individual Interfaces 21-3
Disabling UDLD on Nonfiber-Optic Interfaces 21-3
Disabling UDLD on Fiber-Optic Interfaces 21-4
Resetting Disabled Interfaces 21-4
CHAPTER 22 Configuring Unidirectional Ethernet 22-1
Overview of Unidirectional Ethernet 22-1
Configuring Unidirectional Ethernet 22-1
CHAPTER 23 Configuring Layer 3 Interfaces 23-1
Overview of Layer 3 Interfaces 23-1
Logical Layer 3 VLAN Interfaces 23-2
Physical Layer 3 Interfaces 23-2
Configuration Guidelines 23-3
Configuring Logical Layer 3 VLAN Interfaces 23-3
Configuring Physical Layer 3 Interfaces 23-4
CHAPTER 24 Configuring Cisco Express Forwarding 24-1
Overview of CEF 24-1
Benefits of CEF 24-1
Forwarding Information Base 24-2
Adjacency Tables 24-2
Catalyst 4500 Series Switch Implementation of CEF 24-3
Hardware and Software Switching 24-4
Load Balancing 24-6
Software Interfaces 24-6
CEF Configuration Restrictions 24-6

Contents
xiii
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Configuring CEF 24-6
Enabling CEF 24-6
Configuring Load Balancing for CEF 24-7
Monitoring and Maintaining CEF 24-8
Displaying IP Statistics 24-8
CHAPTER 25 Understanding and Configuring IP Multicast 25-1
Overview of IP Multicast 25-1
IP Multicast Protocols 25-2
IP Multicast on the Catalyst 4500 Series Switch 25-4
Unsupported Features 25-12
Configuring IP Multicast Routing 25-12
Default Configuration in IP MUlticast Routing 25-13
Enabling IP Multicast Routing 25-13
Enabling PIM on an Interface 25-13
Monitoring and Maintaining IP Multicast Routing 25-15
Displaying System and Network Statistics 25-15
Displaying the Multicast Routing Table 25-16
Displaying IP MFIB 25-18
Displaying IP MFIB Fast Drop 25-19
Displaying PIM Statistics 25-20
Clearing Tables and Databases 25-20
Configuration Examples 25-21
PIM Dense Mode Example 25-21
PIM Sparse Mode Example 25-21
BSR Configuration Example 25-21
CHAPTER 26 Configuring Policy-Based Routing 26-1
Overview of Policy-Based Routing 26-1
Understanding PBR 26-2
Understanding PBR Flow Switching 26-2
Using Policy-Based Routing 26-2
Policy-Based Routing Configuration Task List 26-3
Enabling PBR 26-3
Enabling Local PBR 26-5
Unsupported Commands 26-5
Policy-Based Routing Configuration Examples 26-5
Equal Access Example 26-5
Differing Next Hops Example 26-6

Contents
xiv
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Deny ACE Example 26-6
CHAPTER 27 Understanding and Configuring VTP 27-1
Overview of VTP 27-1
Understanding the VTP Domain 27-2
Understanding VTP Modes 27-2
Understanding VTP Advertisements 27-3
Understanding VTP Version 2 27-3
Understanding VTP Pruning 27-3
VTP Configuration Guidelines and Restrictions 27-5
VTP Default Configuration 27-5
Configuring VTP 27-6
Configuring VTP Global Parameters 27-6
Configuring the Switch as a VTP Server 27-7
Configuring the Switch as a VTP Client 27-8
Disabling VTP (VTP Transparent Mode) 27-9
Displaying VTP Statistics 27-10
CHAPTER 28 Configuring VRF-lite 28-1
Understanding VRF-lite 28-2
Default VRF-lite Configuration 28-3
VRF-lite Configuration Guidelines 28-4
Configuring VRFs 28-5
Configuring a VPN Routing Session 28-5
Configuring BGP PE to CE Routing Sessions 28-6
VRF-lite Configuration Example 28-7
Configuring Switch S8 28-8
Configuring Switch S20 28-9
Configuring Switch S11 28-10
Configuring the PE Switch S3 28-10
Displaying VRF-lite Status 28-11
CHAPTER 29 Configuring QoS 29-1
Overview of QoS 29-1
Prioritization 29-2
QoS Terminology 29-3
Basic QoS Model 29-5
Classification 29-5

Contents
xv
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Policing and Marking 29-9
Mapping Tables 29-13
Queueing and Scheduling 29-13
Packet Modification 29-15
QoS and Software Processed Packets 29-15
Configuring Auto-QoS 29-16
Generated Auto-QoS Configuration 29-16
Effects of Auto-QoS on the Configuration 29-17
Configuration Guidelines 29-17
Enabling Auto-QoS for VoIP 29-18
Displaying Auto-QoS Information 29-19
Auto-QoS Configuration Example 29-20
Configuring QoS 29-22
Default QoS Configuration 29-22
Configuration Guidelines 29-24
Enabling QoS Globally 29-24
Configuring a Trusted Boundary to Ensure Port Security 29-24
Enabling Dynamic Buffer Limiting 29-26
Creating Named Aggregate Policers 29-26
Configuring a QoS Policy 29-28
Configuring User Based Rate Limiting 29-35
Enabling or Disabling QoS on an Interface 29-39
Configuring VLAN-Based QoS on Layer 2 Interfaces 29-39
Configuring the Trust State of Interfaces 29-40
Configuring the CoS Value for an Interface 29-41
Configuring DSCP Values for an Interface 29-42
Configuring Transmit Queues 29-43
Configuring DSCP Maps 29-45
CHAPTER 30 Configuring Voice Interfaces 30-1
Overview of Voice Interfaces 30-1
Configuring a Port to Connect to a Cisco 7690 IP Phone 30-2
Configuring Voice Ports for Voice and Data Traffic 30-2
Overriding the CoS Priority of Incoming Frames 30-3
Configuring Inline Power 30-4
CHAPTER 31 Understanding and Configuring 802.1X Port-Based Authentication 31-1
Understanding 802.1X Port-Based Authentication 31-1
Device Roles 31-2

Contents
xvi
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Authentication Initiation and Message Exchange 31-3
Ports in Authorized and Unauthorized States 31-4
Using 802.1X with VLAN Assignment 31-5
Using 802.1X Authentication for Guest VLANs 31-6
Using 802.1X with Port Security 31-6
802.1X RADIUS Accounting 31-7
Using 802.1X with Voice VLAN Ports 31-10
Supported Topologies 31-10
How to Configure 802.1X 31-11
Default 802.1X Configuration 31-12
802.1X Configuration Guidelines 31-13
Enabling 802.1X Authentication 31-13
Configuring Switch-to-RADIUS-Server Communication 31-15
Enabling 802.1X Accounting 31-16
Configuring 802.1X with Guest VLANs 31-17
Configuring 802.1X with Voice VLAN 31-18
Enabling Periodic Reauthentication 31-18
Manually Reauthenticating a Client Connected to a Port 31-19
Changing the Quiet Period 31-19
Changing the Switch-to-Client Retransmission Time 31-20
Setting the Switch-to-Client Frame-Retransmission Number 31-21
Enabling Multiple Hosts 31-21
Resetting the 802.1X Configuration to the Default Values 31-22
Displaying 802.1X Statistics and Status 31-22
CHAPTER 32 Configuring Port Security 32-1
Overview of Port Security 32-1
Default Port Security Configuration 32-3
Port Security Guidelines and Restrictions 32-3
Configuring Port Security 32-3
Configuring Port Security on an Interface 32-4
Configuring Port Security Aging 32-6
Displaying Port Security Settings 32-7
CHAPTER 33 Configuring DHCP Snooping and IP Source Guard 33-1
Overview of DHCP Snooping 33-1
Overview of the DHCP Snooping Database Agent 33-2
Configuring DHCP Snooping on the Switch 33-3

Contents
xvii
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Default Configuration for DHCP Snooping 33-3
Enabling DHCP Snooping 33-4
Enabling DHCP Snooping on Private VLAN 33-5
Enabling the DHCP Snooping Database Agent 33-6
Configuration Examples for the Database Agent 33-6
Displaying DHCP Snooping Information 33-9
Displaying a Binding Table 33-10
Displaying the DHCP Snooping Configuration 33-10
Overview of IP Source Guard 33-10
Configuring IP Source Guard on the Switch 33-11
Configuring IP Source Guard on Private VLANs 33-12
Displaying IP Source Guard Information 33-13
Displaying IP Source Binding Information 33-14
CHAPTER 34 Understanding and Configuring Dynamic ARP Inspection 34-1
Overview of Dynamic ARP Inspection 34-1
ARP Cache Poisoning 34-2
Dynamic ARP Inspection 34-2
Interface Trust state, Security Coverage and Network Configuration 34-3
Relative Priority of Static Bindings and DHCP Snooping Entries 34-4
Logging of Denied Packets 34-4
Rate Limiting of ARP Packets 34-4
Port Channels and Their Behavior 34-4
Configuring Dynamic ARP Inspection 34-5
Scenario One: Two Switches Support Dynamic ARP Inspection 34-5
Scenario Two: One Switch Supports Dynamic ARP Inspection 34-9
CHAPTER 35 Configuring Network Security with ACLs 35-1
Understanding ACLs 35-1
ACL Overview 35-2
Supported Features That Use ACLs 35-2
Router ACLs 35-3
Port ACLs 35-4
VLAN Maps 35-5
Hardware and Software ACL Support 35-5
TCAM Programming and ACLs 35-6
Layer 4 Operators in ACLs 35-7
Restrictions for Layer 4 Operations 35-8

Contents
xviii
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Configuration Guidelines for Layer 4 Operations 35-8
How ACL Processing Impacts CPU 35-9
Configuring Unicast MAC Address Filtering 35-11
Configuring Named MAC Extended ACLs 35-11
Configuring VLAN Maps 35-12
VLAN Map Configuration Guidelines 35-13
Creating and Deleting VLAN Maps 35-13
Applying a VLAN Map to a VLAN 35-16
Using VLAN Maps in Your Network 35-16
Displaying VLAN Access Map Information 35-19
Using VLAN Maps with Router ACLs 35-19
Guidelines for Using Router ACLs and VLAN Maps 35-20
Examples of Router ACLs and VLAN Maps Applied to VLANs 35-20
Configuring PACLs 35-22
Creating a PACL 35-22
PACL Configuration Guidelines 35-23
Configuring IP and MAC ACLs on a Layer 2 Interface 35-23
Using PACL with Access-Group Mode 35-24
Configuring Access-group Mode on Layer 2 Interface 35-24
Applying ACLs to a Layer 2 Interface 35-25
Displaying an ACL Configuration on a Layer 2 Interface 35-25
Using PACL with VLAN Maps and Router ACLs 35-26
CHAPTER 36 Configuring Private VLANs 36-1
Overview of PVLANs 36-1
PVLAN Trunks 36-2
PVLANs and VLAN ACL/QoS 36-2
How to Configure PVLANs 36-3
PVLAN Configuration Guidelines and Restrictions 36-3
Configuring a VLAN as a PVLAN 36-5
Associating a Secondary VLAN with a Primary VLAN 36-6
Configuring a Layer 2 Interface as a PVLAN Promiscuous Port 36-7
Configuring a Layer 2 Interface as a PVLAN Host Port 36-8
Configuring a Layer 2 Interface as a PVLAN Trunk Port 36-9
Permitting Routing of Secondary VLAN Ingress Traffic 36-11
CHAPTER 37 Port Unicast and Multicast Flood Blocking 37-1
Overview of Flood Blocking 37-1

Contents
xix
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Configuring Port Blocking 37-1
Blocking Flooded Traffic on an Interface 37-2
Resuming Normal Forwarding on a Port 37-3
CHAPTER 38 Configuring Port-Based Traffic Control 38-1
Overview of Storm Control 38-1
Hardware-based Storm Control Implementation 38-2
Software-based Storm Control Implementation 38-2
Enabling Storm Control 38-3
Disabling Storm Control 38-4
Displaying Storm Control 38-4
Multicast Storm Control 38-6
Multicast Suppression on the WS-X4516 Supervisor Engine 38-6
Multicast Suppression on the WS-X4515, WS-X4014, and WS-X4013+ Supervisor Engines 38-7
CHAPTER 39 Configuring SPAN and RSPAN 39-1
Overview of SPAN and RSPAN 39-1
SPAN and RSPAN Concepts and Terminology 39-3
SPAN and RSPAN Session Limits 39-6
Default SPAN and RSPAN Configuration 39-6
Configuring SPAN 39-6
SPAN Configuration Guidelines and Restrictions 39-7
Configuring SPAN Sources 39-8
Configuring SPAN Destinations 39-9
Monitoring Source VLANs on a Trunk Interface 39-9
Configuration Scenario 39-10
Verifying a SPAN Configuration 39-10
CPU Port Sniffing 39-10
Encapsulation Configuration 39-12
Ingress Packets 39-12
Access List Filtering 39-13
ACL Configuration Guidelines 39-13
Configuring Access List Filtering 39-14
Packet Type Filtering 39-14
Configuration Example 39-15
Configuring RSPAN 39-16
RSPAN Configuration Guidelines 39-16
Creating an RSPAN Session 39-17

Contents
xx
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Creating an RSPAN Destination Session 39-18
Creating an RSPAN Destination Session and Enabling Ingress Traffic 39-19
Removing Ports from an RSPAN Session 39-21
Specifying VLANs to Monitor 39-22
Specifying VLANs to Filter 39-23
Displaying SPAN and RSPAN Status 39-24
CHAPTER 40 Configuring NetFlow Statistics Collection 40-1
Overview of NetFlow Statistics Collection 40-1
Information Derived from Hardware 40-3
Information Derived from Software 40-4
Determining the Input and Output Interface and AS Numbers 40-4
Feature Interaction of Netflow Statistics with UBRL and Microflow Policing 40-5
VLAN Statistics 40-5
Configuring NetFlow Statistics Collection 40-6
Checking for Required Hardware 40-6
Enabling NetFlow Statistics Collection 40-7
Exporting NetFlow Statistics 40-8
Managing NetFlow Statistics Collection 40-8
Configuring an Aggregation Cache 40-8
Configuring a NetFlow Minimum Prefix Mask for Router-Based Aggregation 40-9
Configuring NetFlow Aging Parameters 40-11
NetFlow Statistics Collection Configuration Example 40-11
NetFlow Configuration Examples 40-13
Sample NetFlow Enabling Schemes 40-13
Sample NetFlow Aggregation Configurations 40-13
Sample NetFlow Minimum Prefix Mask Router-Based Aggregation Schemes 40-14
APPENDIX AAcronyms A-1
I NDEX