Cisco 500 Series Instruction Manual

Cisco 500 Series Stackable Managed Switch
Administration Guide
ADMINISTRATION
GUIDE

Cisco 500 Series Stackable Managed Switch Administration Guide 2
2
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco
trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use
of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Cisco 500 Series Stackable Managed Switch Administration Guide 1
Contents
Chapter 1: Getting Started 10
Starting the Web-based Configuration Utility 10
Quick Start Device Configuration 14
Interface Naming Conventions 15
Differences Between 500 Devices<500> 15
Window Navigation 17
Chapter 2: Status and Statistics 22
System Summary 22
Ethernet Interfaces 22
Etherlike Statistics 24
GVRP Statistics 25
802.1X EAP Statistics 26
ACL Statistics 27
TCAM Utilization 28
Health 29
RMON 29
View Log 37
Chapter 3: Administration: System Log 38
Setting System Log Settings 38
Setting Remote Logging Settings 40
Viewing Memory Logs 42
Chapter 4: Administration: File Management 44
System Files 44
Upgrade/Backup Firmware/Language 47
Active Image 51
Download/Backup Configuration/Log 52
Configuration Files Properties 58

Cisco 500 Series Stackable Managed Switch Administration Guide 2
Contents
Copy/Save Configuration 59
Auto Configuration/Image Update via DHCP 60
70
Chapter 5: Administration: Stack Management 71
Overview 71
Types of Units in Stack 73
Stack Topology 74
Unit ID Assignment 76
Master Selection Process 78
Stack Changes 78
Unit Failure in Stack 80
Software Auto Synchronization in Stack 82
Stack Unit Mode 82
Stack Ports 86
Default Configuration 94
Interactions With Other Features 94
System Modes 94
Chapter 6: Administration 100
Device Models 101
System Settings 103
Console Settings (Autobaud Rate Support) 106
Management Interface 107
System Mode and Stack Management 107
User Accounts 107
Defining Idle Session Timeout 107
Time Settings 108
System Log 108
File Management 108

Cisco 500 Series Stackable Managed Switch Administration Guide 3
Contents
Rebooting the Device 108
Routing Resources 110
Health 114
Diagnostics 116
Discovery - Bonjour 116
Discovery - LLDP 117
Discovery - CDP 117
Ping 117
Traceroute 119
Chapter 7: Administration: Time Settings 122
System Time Options 123
SNTP Modes 124
Configuring System Time 125
Chapter 8: Administration: Diagnostics 136
Copper Ports Tests 136
Displaying Optical Module Status 138
Configuring Port and VLAN Mirroring 140
Viewing CPU Utilization and Secure Core Technology 141
Chapter 9: Administration: Discovery 144
Bonjour 144
LLDP and CDP 146
Configuring LLDP 147
Configuring CDP 168
CDP Statistics 176
Chapter 10: Port Management 178
Configuring Ports 178

Cisco 500 Series Stackable Managed Switch Administration Guide 4
Contents
Loopback Detection 184
Link Aggregation 186
UDLD 194
PoE 194
Configuring Green Ethernet 194
Chapter 11: Port Management: Unidirectional Link Detection 202
UDLD Overview 202
UDLD Operation 203
Usage Guidelines 205
Dependencies On Other Features 206
Default Settings and Configuration 206
Before You Start 207
Common UDLD Tasks 207
Configuring UDLD 208
Chapter 12: Smartport 212
Overview 213
What is a Smartport 214
Smartport Types 214
Smartport Macros 216
Macro Failure and the Reset Operation 218
How the Smartport Feature Works 218
Auto Smartport 219
Error Handling 223
Default Configuration 223
Relationships with Other Features and Backwards Compatibility 224
Common Smartport Tasks 224
Configuring Smartport Using The Web-based Interface 226
Built-in Smartport Macros 231

Cisco 500 Series Stackable Managed Switch Administration Guide 5
Contents
Chapter 13: Port Management: PoE 244
PoE on the Device 244
PoE Properties 247
PoE Settings 248
Chapter 14: VLAN Management 252
Overview 252
Regular VLANs 261
Private VLAN Settings 269
GVRP Settings 270
VLAN Groups 271
Voice VLAN 276
Access Port Multicast TV VLAN 289
Customer Port Multicast TV VLAN 292
Chapter 15: Spanning Tree 296
STP Flavors 296
STP Status and Global Settings 297
Spanning Tree Interface Settings 299
Rapid Spanning Tree Settings 301
Multiple Spanning Tree 304
MSTP Properties 304
VLANs to a MSTP Instance 305
MSTP Instance Settings 306
MSTP Interface Settings 307
Chapter 16: Managing MAC Address Tables 310
Static MAC Addresses 311
Dynamic MAC Addresses 312
Reserved MAC Addresses 313

Cisco 500 Series Stackable Managed Switch Administration Guide 6
Contents
Chapter 17: Multicast 314
Multicast Forwarding 314
Multicast Properties 320
MAC Group Address 320
IP Multicast Group Addresses 322
IPv4 Multicast Configuration 324
IPv6 Multicast Configuration 330
IGMP/MLD Snooping IP Multicast Group 336
Multicast Router Ports 337
Forward All 338
Unregistered Multicast 338
Chapter 18: IP Configuration 340
Overview 340
IPv4 Management and Interfaces 344
DHCP Server 366
IPv6 Management and Interfaces 375
Domain Name 398
Chapter 19: IP Configuration: RIPv2 403
Overview 403
How Rip Operates on the Device 404
Configuring RIP 409
Chapter 20: IP Configuration: VRRP 417
Overview 417
Configurable Elements of VRRP 421
Configuring VRRP 424
Chapter 21: Security 428

Cisco 500 Series Stackable Managed Switch Administration Guide 7
Contents
Defining Users 429
Configuring TACACS+ 432
Configuring RADIUS 437
Key Management 442
Management Access Method 445
Management Access Authentication 450
Secure Sensitive Data Management 452
SSL Server 452
SSH Server 454
SSH Client 455
Configuring TCP/UDP Services 455
Defining Storm Control 456
Configuring Port Security 457
802.1X 460
Denial of Service Prevention 460
DHCP Snooping 470
IP Source Guard 470
ARP Inspection 474
First Hop Security 480
Chapter 22: Security: 802.1X Authentication 481
Overview of 802.1X 481
Authenticator Overview 484
Common Tasks 494
802.1X Configuration Through the GUI 495
Defining Time Ranges 507
Authentication Method and Port Mode Support 508
Chapter 23: Security: IPv6 First Hop Security 511
IPv6 First Hop Security Overview 512

Cisco 500 Series Stackable Managed Switch Administration Guide 8
Contents
Router Advertisement Guard 516
Neighbor Discovery Inspection 516
DHCPv6 Guard 517
Neighbor Binding Integrity 518
IPv6 Source Guard 521
Attack Protection 522
Policies, Global Parameters and System Defaults 523
Common Tasks 525
Default Settings and Configuration 527
Before You Start 527
Configuring IPv6 First Hop Security through Web GUI 528
Chapter 24: Security: SSH Client 546
Secure Copy (SCP) and SSH 546
Protection Methods 547
SSH Server Authentication 549
SSH Client Authentication 550
Before You Begin 551
Common Tasks 551
SSH Client Configuration Through the GUI 552
Chapter 25: Security: SSH Server 557
Overview 557
Common Tasks 558
SSH Server Configuration Pages 559
Chapter 26: Security: Secure Sensitive Data Management 562
Introduction 562
SSD Rules 563
SSD Properties 568

Cisco 500 Series Stackable Managed Switch Administration Guide 9
Contents
Configuration Files 571
SSD Management Channels 576
Menu CLI and Password Recovery 576
Configuring SSD 577
Chapter 27: Access Control 580
Access Control Lists 580
MAC-based ACLs 584
IPv4-based ACLs 586
IPv6-Based ACLs 591
ACL Binding 594
Chapter 28: Quality of Service 598
QoS Features and Components 599
Configuring QoS - General 602
QoS Basic Mode 615
QoS Advanced Mode 617
Managing QoS Statistics 628
Chapter 29: SNMP 632
SNMP Versions and Workflow 632
Model OIDs 635
SNMP Engine ID 636
Configuring SNMP Views 638
Creating SNMP Groups 639
Managing SNMP Users 641
Defining SNMP Communities 643
Defining Trap Settings 645
Notification Recipients 646
SNMP Notification Filters 650

1
Cisco 500 Series Stackable Managed Switch Administration Guide 10
Getting Started
This section provides an introduction to the web-based configuration utility, and
covers the following topics:
•Starting the Web-based Configuration Utility
•Quick Start Device Configuration
•Interface Naming Conventions
•Differences Between 500 Devices<500>
•Window Navigation
Starting the Web-based Configuration Utility
This section describes how to navigate the web-based switch configuration utility.
If you are using a pop-up blocker, make sure it is disabled.
Browser Restrictions
If you are using IPv6 interfaces on your management station, use the IPv6 global
address and not the IPv6 link local address to access the device from your
browser.
Date Updated By Comment
No changes for Nikola 1.4

Getting Started
Starting the Web-based Configuration Utility
11 Cisco 500 Series Stackable Managed Switch Administration Guide
1
Launching the Configuration Utility
To open the web-based configuration utility:
STEP 1 Open a Web browser.
STEP 2 Enter the IP address of the device you are configuring in the address bar on the
browser, and then press Enter.
NOTE When the device is using the factory default IP address of 192.168.1.254, its power
LED flashes continuously. When the device is using a DHCP-assigned IP address or
an administrator-configured static IP address, the power LED is on solid.
Logging In
The default username is cisco and the default password is cisco. The first time
that you log in with the default username and password, you are required to enter
a new password.
NOTE If you have not previously selected a language for the GUI, the language of the Login
page is determined by the language(s) requested by your browser and the
languages configured on your device. If your browser requests Chinese, for
example, and Chinese has been loaded into your device, the Login page is
automatically displayed in Chinese. If Chinese has not been loaded into your
device, the Login page appears in English.
The languages loaded into the device have a language and country code (en-US,
en-GB and so on). For the Login page to be automatically displayed in a particular
language, based on the browser request, both the language and country code of
the browser request must match those of the language loaded on the device. If the
browser request contains only the language code without a country code (for
example: fr). The first embedded language with a matching language code is
taken (without matching the country code, for example: fr_CA).
To log in to the device configuration utility:
STEP 1 Enter the username/password. The password can contain up to 64 ASCII
characters. Password-complexity rules are described in Setting Password
Complexity Rules.
STEP 2 If you are not using English, select the desired language from the Language drop-
down menu. To add a new language to the device or update a current one, see
Upgrade/Backup Firmware/Language.

Getting Started
Starting the Web-based Configuration Utility
Cisco 500 Series Stackable Managed Switch Administration Guide 12
1
STEP 3 If this is the first time that you logged on with the default user ID (cisco) and the
default password (cisco) or your password has expired, the Change Password
Page appears. See Password Expiration for additional information.
STEP 4 Choose whether to select Disable Password Complexity Enforcement or not.
For more information on password complexity, see the Setting Password
Complexity Rules section.
STEP 5 Enter the new password and click Apply.
When the login attempt is successful, the Getting Started page appears.
If you entered an incorrect username or password, an error message appears and
the Login page remains displayed on the window. If you are having problems
logging in, please see the Launching the Configuration Utility section in the
Administration Guide for additional information.
Select Don't show this page on startup to prevent the Getting Started page from
being displayed each time that you log on to the system. If you select this option,
the System Summary page is opened instead of the Getting Started page.
HTTP/HTTPS
You can either open an HTTP session (not secured) by clicking Log In, or you can
open an HTTPS (secured) session, by clicking Secure Browsing (HTTPS). You are
asked to approve the logon with a default RSA key, and an HTTPS session is
opened.
NOTE There is no need to input the username/password prior to clicking the Secure
Browsing (HTTPS) button.
For information on how to configure HTTPS, see SSL Server.
Password Expiration
The New Password page is displayed in the following cases:
•The first time that you access the device with the default username cisco
and password cisco. This page forces you to replace the factory default
password.
•When the password expires, this page forces you to select a new
password.

Getting Started
Starting the Web-based Configuration Utility
13 Cisco 500 Series Stackable Managed Switch Administration Guide
1
Logging Out
By default, the application logs out after ten minutes of inactivity. You can change
this default value as described in the Defining Idle Session Timeout section.
!
CAUTION Unless the Running Configuration is copied to the Startup Configuration, rebooting
the device removes all changes made since the last time the file was saved. Save
the Running Configuration to the Startup Configuration before logging off to
preserve any changes you made during this session.
A flashing red X icon to the left of the Save application link indicates that Running
Configuration changes have not yet been saved to the Startup Configuration file.
The flashing can be disabled by clicking on the Disable Save Icon Blinking button
on the Copy/Save Configuration page
When the device auto-discovers a device, such as an IP phone (see What is a
Smartport), and it configures the port appropriately for the device. These
configuration commands are written to the Running Configuration file. This causes
the Save icon to begin blinking when the you log on, even though you did not make
any configuration changes.
When you click Save, the Copy/Save Configuration page appears. Save the
Running Configuration file by copying it to the Startup Configuration file. After this
save, the red X icon and the Save application link are no longer displayed.
To l o g o u t , c l i c k Logout in the top right corner of any page. The system logs out of
the device.
When a timeout occurs or you intentionally log out of the system, a message is
displayed and the Login page appears, with a message indicating the logged-out
state. After you log in, the application returns to the initial page.
The initial page displayed depends on the “Do not show this page on startup”
option in the Getting Started page. If you did not select this option, the initial page
is the Getting Started page. If you did select this option, the initial page is the
System Summary page.

Getting Started
Quick Start Device Configuration
Cisco 500 Series Stackable Managed Switch Administration Guide 14
1
Quick Start Device Configuration
To simplify device configuration through quick navigation, the Getting Started
page provides links to the most commonly used pages.
There are two hot links on the Getting Started page that take you to Cisco web
pages for more information. Clicking on the Support link takes you to the device
product support page, and clicking on the Forums link takes you to the Support
Community page.
Category Link Name (on the Page) Linked Page
<300-
500>Initial
Setup
Change System Mode and
Stack Management
System Mode and Stack
Management page
Change Management
Applications and Services
TCP/UDP Services page
Change Device IP Address IPv4 Interface page
Create VLAN Create VLAN page
Configure Port Settings Port Setting page
Device Status System Summary System Summary page
Port Statistics Interface page
RMON Statistics Statistics page
View Log RAM Memory page
Quick Access Change Device Password User Accounts page
Upgrade Device Software Upgrade/Backup Firmware/
Language page
Backup Device Configuration Download/Backup
Configuration/Log page
<300-500> Create MAC Based ACL MAC Based ACL page
Create IP Based ACL IPv4 Based ACL page
Configure QoS QoS Properties page
Configure Port Mirroring Port and VLAN Mirroring page

Getting Started
Interface Naming Conventions
15 Cisco 500 Series Stackable Managed Switch Administration Guide
1
Interface Naming Conventions
Within the GUI, interfaces are denoted by concatenating the following elements:
•Type of interface: The following types of interfaces are found on the various
types of devices:
-Fast Ethernet (10/100 bits)—These are displayed as FE.
-Gigabit Ethernet ports (10/100/1000 bits)—These are displayed as
GE.
-<500>Ten Gigabit Ethernet ports (10000 bits)—These are displayed
as XG.
-LAG (Port Channel)—These are displayed as LAG.
-VLAN—These are displayed as VLAN.
-Tunnel —These are displayed as Tunnel.
•<500>Unit Number—Number of the unit in the stack. In standalone mode
this is always 1.
•<500>Slot Number—The slot number is either 1 or 2.
•Interface Number: Port, LAG, tunnel or VLAN ID
Differences Between 500 Devices<500>
This guide is relevant for both Sx500, SG500X,SG500XG and ESW2-550X
devices. Notes are provided when a feature is relevant for one but not all of these
devices.
The following summarizes the differences between these devices:
•The RIP and VRRP features are only supported on SG500X, SG500XG, and
ESW2-550X devices, running in standalone mode and in advanced hybrid
stack of SG500X and Sx500 devices - see Administration: Stack
Management for more details).
•TCAM size, see TCAM Utilization
•Stack ports are different on these devices. See Default Stack and
Network Ports.

Getting Started
Differences Between 500 Devices<500>
Cisco 500 Series Stackable Managed Switch Administration Guide 16
1
•Port speed availability per cable types are different on these devices. See
Cables Types.
•Enabling IPv4 routing is done differently in the devices, as follows:
-SG500XSG500XG/ESW2-550X—IPv4 routing must be enabled in the
IPv4 Interface page.
-Sx500—When the device is switched from Layer 2 to Layer 3 system
mode, IPv4 routing is automatically enabled.

Getting Started
Window Navigation
17 Cisco 500 Series Stackable Managed Switch Administration Guide
1
Window Navigation
This section describes the features of the web-based switch configuration utility.
Application Header
The Application Header appears on every page. It provides the following
application links:
Application Link
Name
Description
A flashing red X icon displayed to the left of the Save
application link indicates that Running Configuration
changes have been made that have not yet been saved to
the Startup Configuration file. The flashing of the red X can
be disabled on the Copy/Save Configuration page.
Click Save to display the Copy/Save Configuration page.
Save the Running Configuration file by copying it to the
Startup Configuration file type on the device. After this
save, the red X icon and the Save application link are no
longer displayed. When the device is rebooted, it copies
the Startup Configuration file type to the Running
Configuration and sets the device parameters according
to the data in the Running Configuration.
Username Displays the name of the user logged on to the device. The
default username is cisco. (The default password is cisco).

Getting Started
Window Navigation
Cisco 500 Series Stackable Managed Switch Administration Guide 18
1
Language Menu This menu provides the following options:
•Select a language: Select one of the languages that
appear in the menu. This language will be the web-
based configuration utility language.
•Download Language: Add a new language to the
device.
•Delete Language: Deletes the second language on
the device. The first language (English) cannot be
deleted.
•Debug: Used for translation purposes. If you select
this option, all web-based configuration utility labels
disappear and in their place are the IDs of the
strings that correspond to the IDs in the language
file.
NOTE To upgrade a language file, use the Upgrade/
Backup Firmware/Language page.
Logout Click to log out of the web-based switch configuration
utility.
About Click to display the device name and device version
number.
Help Click to display the online help.
The SYSLOG Alert Status icon appears when a SYSLOG
message, above the critical severity level, is logged. Click
the icon to open the RAM Memory page. After you access
this page, the SYSLOG Alert Status icon is no longer
displayed. To display the page when there is not an active
SYSLOG message, Click Status and Statistics > View
Log > RAM Memory.
Application Link
Name
Description