Cisco Catalyst 2960-XR User manual

Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS
Release 15.0(2)EX1
First Published: May 07, 2013
Last Modified: August 08, 2013
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-29434-01

©Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface 19
Document Conventions 19
Related Documentation 21
Obtaining Documentation and Submitting a Service Request 21
CHAPTER 1 Using the Command-Line Interface 1
Information About Using the Command-Line Interface 1
Command Modes 1
Using the Help System 3
Understanding Abbreviated Commands 4
No and default Forms of Commands 4
CLI Error Messages 4
Configuration Logging 5
How to Use the CLI to Configure Features 5
Configuring the Command History 5
Changing the Command History Buffer Size 6
Recalling Commands 6
Disabling the Command History Feature 7
Enabling and Disabling Editing Features 7
Editing Commands through Keystrokes 8
Editing Command Lines That Wrap 9
Searching and Filtering Output of show and more Commands 10
Accessing the CLI through a Console Connection or through Telnet 11
CHAPTER 2 Security Features Overview 13
Security Features Overview 13
CHAPTER 3 Preventing Unauthorized Access 19
Finding Feature Information 19
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 iii

Preventing Unauthorized Access 19
CHAPTER 4 Controlling Switch Access with Passwords and Privilege Levels 21
Finding Feature Information 21
Restrictions for Controlling Switch Access with Passwords and Privileges 21
Information About Passwords and Privilege Levels 22
Default Password and Privilege Level Configuration 22
Additional Password Security 22
Password Recovery 23
Terminal Line Telnet Configuration 23
Username and Password Pairs 23
Privilege Levels 24
How to Control Switch Access with Passwords and Privilege Levels 24
Setting or Changing a Static Enable Password 24
Protecting Enable and Enable Secret Passwords with Encryption 25
Disabling Password Recovery 27
Setting a Telnet Password for a Terminal Line 28
Configuring Username and Password Pairs 30
Setting the Privilege Level for a Command 31
Changing the Default Privilege Level for Lines 32
Logging into and Exiting a Privilege Level 33
Monitoring Switch Access 34
Configuration Examples for Setting Passwords and Privilege Levels 35
Example: Setting or Changing a Static Enable Password 35
Example: Protecting Enable and Enable Secret Passwords with Encryption 35
Example: Setting a Telnet Password for a Terminal Line 35
Example: Setting the Privilege Level for a Command 35
CHAPTER 5 Configuring TACACS+ 37
Finding Feature Information 37
Prerequisites for Controlling Switch Access with Terminal Access Controller Access Control
System Plus (TACACS+) 37
Information About TACACS+ 39
TACACS+ and Switch Access 39
TACACS+ Overview 39
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
iv OL-29434-01
Contents

TACACS+ Operation 41
Method List Description 42
TACACS+ Configuration Options 42
TACACS+ Login Authentication 42
TACACS+ Authorization for Privileged EXEC Access and Network Services 42
TACACS+ Accounting 43
Default TACACS+ Configuration 43
How to Configure TACACS+ 43
Identifying the TACACS+ Server Host and Setting the Authentication Key 43
Configuring TACACS+ Login Authentication 45
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 47
Starting TACACS+ Accounting 48
Establishing a Session with a Router if the AAA Server is Unreachable 49
Monitoring TACACS+ 50
CHAPTER 6 Configuring RADIUS 51
Finding Feature Information 51
Prerequisites for Controlling Switch Access with RADIUS 51
Restrictions for Controlling Switch Access with RADIUS 52
Information about RADIUS 53
RADIUS and Switch Access 53
RADIUS Overview 53
RADIUS Operation 54
RADIUS Change of Authorization 55
Change-of-Authorization Requests 55
RFC 5176 Compliance 56
CoA Request Response Code 57
Session Identification 57
CoA ACK Response Code 58
CoA NAK Response Code 58
CoA Request Commands 58
Session Reauthentication 58
Session Reauthentication in a Switch Stack 59
Session Termination 59
CoA Disconnect-Request 60
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 v
Contents

CoA Request: Disable Host Port 60
CoA Request: Bounce-Port 60
Stacking Guidelines for Session Termination 61
Stacking Guidelines for CoA-Request Bounce-Port 61
Stacking Guidelines for CoA-Request Disable-Port 61
Default RADIUS Configuration 62
RADIUS Server Host 62
RADIUS Login Authentication 62
AAA Server Groups 63
AAA Authorization 63
RADIUS Accounting 63
Vendor-Specific RADIUS Attributes 64
Vendor-Proprietary RADIUS Server Communication 64
How to Configure RADIUS 65
Identifying the RADIUS Server Host 65
Configuring RADIUS Login Authentication 66
Defining AAA Server Groups 68
Configuring RADIUS Authorization for User Privileged Access and Network Services 71
Starting RADIUS Accounting 72
Configuring Settings for All RADIUS Servers 73
Configuring the Switch to Use Vendor-Specific RADIUS Attributes 75
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 75
Configuring CoA on the Switch 77
Monitoring CoA Functionality 79
Configuration Examples for Controlling Switch Access with RADIUS 79
Examples: Identifying the RADIUS Server Host 79
Examples: Configuring the Switch to Use Vendor-Specific RADIUS Attributes 80
Example: Configuring the Switch for Vendor-Proprietary RADIUS Server
Communication 80
CHAPTER 7 Configuring Local Authentication and Authorization 81
Finding Feature Information 81
How to Configure Local Authentication and Authorization 81
Configuring the Switch for Local Authentication and Authorization 81
Monitoring Local Authentication and Authorization 83
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
vi OL-29434-01
Contents

CHAPTER 8 Configuring Secure Shell (SSH) 85
Finding Feature Information 85
Prerequisites for Configuring the Switch for Secure Shell (SSH) and Secure Copy Protocol
(SCP) 85
Restrictions for Configuring the Switch for SSH 86
Information about SSH 86
SSH and Switch Access 86
SSH Servers, Integrated Clients, and Supported Versions 87
SSH Configuration Guidelines 87
Secure Copy Protocol Overview 88
Secure Copy Protocol Concepts 88
How to Configure SSH 89
Setting Up the Switch to Run SSH 89
Configuring the SSH Server 90
Monitoring the SSH Configuration and Status 92
CHAPTER 9 Configuring Secure Socket Layer HTTP 93
Finding Feature Information 93
Information about Secure Sockets Layer (SSL) HTTP 93
Certificate Authority Trustpoints 94
CipherSuites 95
Default SSL Configuration 96
SSL Configuration Guidelines 96
Secure HTTP Servers and Clients Overview 96
How to Configure Secure HTTP Servers and Clients 96
Configuring a CA Trustpoint 96
Configuring the Secure HTTP Server 99
Configuring the Secure HTTP Client 102
How to Configure Secure HTTP Servers and Clients 103
Monitoring Secure HTTP Server and Client Status 103
CHAPTER 10 Configuring IPv4 ACLs 105
Finding Feature Information 105
Prerequisites for Configuring Network Security with ACLs 105
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 vii
Contents

Restrictions for Configuring Network Security with ACLs 105
Information about Network Security with ACLs 107
ACL Overview 107
Access Control Entries 107
ACL Supported Types 107
Supported ACLs 108
ACL Precedence 108
Port ACLs 109
Router ACLs 110
VLAN Maps 110
ACEs and Fragmented and Unfragmented Traffic 111
Example: ACEs and Fragmented and Unfragmented Traffic 111
ACLs and Switch Stacks 112
Active Switch and ACL Functions 112
Stack Member and ACL Functions 112
Active Switch Failure and ACLs 112
Standard and Extended IPv4 ACLs 113
IPv4 ACL Switch Unsupported Features 113
Access List Numbers 113
Numbered Standard IPv4 ACLs 114
Numbered Extended IPv4 ACLs 114
Named IPv4 ACLs 115
ACL Logging 116
Hardware and Software Treatment of IP ACLs 116
VLAN Map Configuration Guidelines 117
VLAN Maps with Router ACLs 117
VLAN Maps and Router ACL Configuration Guidelines 118
VACL Logging 118
Time Ranges for ACLs 119
IPv4 ACL Interface Considerations 119
How to Configure ACLs 120
Configuring IPv4 ACLs 120
Creating a Numbered Standard ACL 120
Creating a Numbered Extended ACL 122
Creating Named Standard ACLs 125
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
viii OL-29434-01
Contents

Creating Extended Named ACLs 126
Configuring Time Ranges for ACLs 128
Applying an IPv4 ACL to a Terminal Line 129
Applying an IPv4 ACL to an Interface 130
Creating Named MAC Extended ACLs 132
Applying a MAC ACL to a Layer 2 Interface 133
Configuring VLAN Maps 135
Creating a VLAN Map 136
Applying a VLAN Map to a VLAN 138
Monitoring IPv4 ACLs 139
Configuration Examples for ACLs 140
Examples: Using Time Ranges with ACLs 140
Examples: Including Comments in ACLs 141
IPv4 ACL Configuration Examples 142
ACLs in a Small Networked Office 142
Examples: ACLs in a Small Networked Office 143
Example: Numbered ACLs 143
Examples: Extended ACLs 143
Examples: Named ACLs 144
Examples: Time Range Applied to an IP ACL 145
Examples: Commented IP ACL Entries 145
Examples: ACL Logging 145
Configuration Examples for ACLs and VLAN Maps 147
Example: Creating an ACL and a VLAN Map to Deny a Packet 147
Example: Creating an ACL and a VLAN Map to Permit a Packet 147
Example: Default Action of Dropping IP Packets and Forwarding MAC Packets 147
Example: Default Action of Dropping MAC Packets and Forwarding IP Packets 148
Example: Default Action of Dropping All Packets 148
Configuration Examples for Using VLAN Maps in Your Network 149
Example: Wiring Closet Configuration 149
Example: Restricting Access to a Server on Another VLAN 150
Example: Denying Access to a Server on Another VLAN 150
Configuration Examples of Router ACLs and VLAN Maps Applied to VLANs 151
Example: ACLs and Switched Packets 151
Example: ACLs and Bridged Packets 151
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 ix
Contents

Example: ACLs and Routed Packets 152
Example: ACLs and Multicast Packets 153
CHAPTER 11 Configuring IPv6 ACLs 155
Finding Feature Information 155
Information about IPv6 ACLs 155
Switch Stacks and IPv6 ACLs 156
Interactions with Other Features and Switches 156
Restrictions for IPv6 ACLs 156
Default Configuration for IPv6 ACLs 157
How to Configure IPv6 ACLs 157
How to Attach an IPv6 ACL to an Interface 161
Monitoring IPv6 ACLs 162
CHAPTER 12 Configuring DHCP 165
Finding Feature Information 165
Information About DHCP 165
DHCP Server 165
DHCP Relay Agent 165
DHCP Snooping 166
Option-82 Data Insertion 167
Cisco IOS DHCP Server Database 170
DHCP Snooping Binding Database 170
DHCP Snooping and Switch Stacks 171
How to Configure DHCP Features 172
Default DHCP Snooping Configuration 172
DHCP Snooping Configuration Guidelines 173
Configuring the DHCP Server 173
DHCP Server and Switch Stacks 173
Configuring the DHCP Relay Agent 173
Specifying the Packet Forwarding Address 174
Prerequisites for Configuring DHCP Snooping and Option 82 176
Enabling DHCP Snooping and Option 82 177
Enabling the Cisco IOS DHCP Server Database 180
Monitoring DHCP Snooping Information 180
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
xOL-29434-01
Contents

Configuring DHCP Server Port-Based Address Allocation 181
Information About Configuring DHCP Server Port-Based Address Allocation 181
Default Port-Based Address Allocation Configuration 181
Port-Based Address Allocation Configuration Guidelines 181
Enabling the DHCP Snooping Binding Database Agent 182
Enabling DHCP Server Port-Based Address Allocation 183
Monitoring DHCP Server Port-Based Address Allocation 184
CHAPTER 13 Configuring IP Source Guard 185
Finding Feature Information 185
Information About IP Source Guard 185
IP Source Guard 185
IP Source Guard for Static Hosts 186
IP Source Guard Configuration Guidelines 187
How to Configure IP Source Guard 188
Enabling IP Source Guard 188
Configuring IP Source Guard for Static Hosts on a Layer 2 Access Port 189
Monitoring IP Source Guard 193
CHAPTER 14 Configuring Dynamic ARP Inspection 195
Finding Feature Information 195
Restrictions for Dynamic ARP Inspection 195
Understanding Dynamic ARP Inspection 197
Interface Trust States and Network Security 198
Rate Limiting of ARP Packets 199
Relative Priority of ARP ACLs and DHCP Snooping Entries 200
Logging of Dropped Packets 200
Default Dynamic ARP Inspection Configuration 200
Restrictions for Dynamic ARP Inspection 201
Relative Priority of ARP ACLs and DHCP Snooping Entries 202
Configuring ARP ACLs for Non-DHCP Environments 202
Configuring Dynamic ARP Inspection in DHCP Environments 205
How to Limit the Rate of Incoming ARP Packets 207
How to Perform Validation Checks 209
Monitoring DAI 210
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 xi
Contents

Verifying the DAI Configuration 211
CHAPTER 15 Configuring IEEE 802.1x Port-Based Authentication 213
Finding Feature Information 213
Information About 802.1x Port-Based Authentication 213
Port-Based Authentication Process 214
Port-Based Authentication Initiation and Message Exchange 216
Authentication Manager for Port-Based Authentication 217
Port-Based Authentication Methods 218
Per-User ACLs and Filter-Ids 219
Port-Based Authentication Manager CLI Commands 219
Ports in Authorized and Unauthorized States 221
Port-Based Authentication and Switch Stacks 222
802.1x Host Mode 222
802.1x Multiple Authentication Mode 223
MAC Move 223
MAC Replace 224
802.1x Accounting 224
802.1x Accounting Attribute-Value Pairs 225
802.1x Readiness Check 226
Switch-to-RADIUS-Server Communication 226
802.1x Authentication with VLAN Assignment 227
802.1x Authentication with Per-User ACLs 228
802.1x Authentication with Downloadable ACLs and Redirect URLs 229
Cisco Secure ACS and Attribute-Value Pairs for the Redirect URL 231
Cisco Secure ACS and Attribute-Value Pairs for Downloadable ACLs 231
VLAN ID-based MAC Authentication 232
802.1x Authentication with Guest VLAN 232
802.1x Authentication with Restricted VLAN 233
802.1x Authentication with Inaccessible Authentication Bypass 234
Inaccessible Authentication Bypass Support on Multiple-Authentication Ports 234
Inaccessible Authentication Bypass Authentication Results 234
Inaccessible Authentication Bypass Feature Interactions 235
802.1x User Distribution 236
802.1x User Distribution Configuration Guidelines 236
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
xii OL-29434-01
Contents

IEEE 802.1x Authentication with Voice VLAN Ports 236
IEEE 802.1x Authentication with Port Security 237
IEEE 802.1x Authentication with Wake-on-LAN 237
IEEE 802.1x Authentication with MAC Authentication Bypass 238
Network Admission Control Layer 2 IEEE 802.1x Validation 239
Flexible Authentication Ordering 239
Open1x Authentication 239
Multidomain Authentication 240
802.1x Supplicant and Authenticator Switches with Network Edge Access Topology
(NEAT) 241
Voice Aware 802.1x Security 242
Common Session ID 243
How to Configure 802.1x Port-Based Authentication 243
Default 802.1x Authentication Configuration 243
802.1x Authentication Configuration Guidelines 245
802.1x Authentication 245
VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible Authentication
Bypass 246
MAC Authentication Bypass 247
Maximum Number of Allowed Devices Per Port 247
Configuring 802.1x Readiness Check 247
Configuring Voice Aware 802.1x Security 248
Configuring 802.1x Violation Modes 250
Configuring 802.1x Authentication 252
Configuring 802.1x Port-Based Authentication 253
Configuring the Switch-to-RADIUS-Server Communication 255
Configuring the Host Mode 257
Configuring Periodic Re-Authentication 258
Changing the Quiet Period 259
Changing the Switch-to-Client Retransmission Time 261
Setting the Switch-to-Client Frame-Retransmission Number 262
Setting the Re-Authentication Number 263
Enabling MAC Move 264
Enabling MAC Replace 266
Configuring 802.1x Accounting 267
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 xiii
Contents

Configuring a Guest VLAN 269
Configuring a Restricted VLAN 270
Configuring Number of Authentication Attempts on a Restricted VLAN 272
Configuring the Inaccessible Authentication Bypass Feature 274
Example of Configuring Inaccessible Authentication Bypass 276
Configuring 802.1x Authentication with WoL 277
Configuring MAC Authentication Bypass 278
Formatting a MAC Authentication Bypass Username and Password 279
Configuring 802.1x User Distribution 280
Example of Configuring VLAN Groups 281
Configuring NAC Layer 2 802.1x Validation 282
Configuring an Authenticator Switch with NEAT 284
Configuring a Supplicant Switch with NEAT 286
Configuring 802.1x Authentication with Downloadable ACLs and Redirect URLs 289
Configuring Downloadable ACLs 289
Configuring a Downloadable Policy 291
Configuring VLAN ID-based MAC Authentication 293
Configuring Flexible Authentication Ordering 294
Configuring Open1x 295
Disabling 802.1x Authentication on the Port 297
Resetting the 802.1x Authentication Configuration to the Default Values 299
Monitoring 802.1x Statistics and Status 300
CHAPTER 16 Configuring Web-Based Authentication 301
Finding Feature Information 301
Information About Web-Based Authentication 301
Device Roles 302
Host Detection 302
Session Creation 303
Authentication Process 303
Local Web Authentication Banner 304
Web Authentication Customizable Web Pages 306
Guidelines 306
Authentication Proxy Web Page Guidelines 308
Redirection URL for Successful Login Guidelines 309
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
xiv OL-29434-01
Contents

Web-based Authentication Interactions with Other Features 309
Port Security 309
LAN Port IP 309
Gateway IP 309
ACLs 310
Context-Based Access Control 310
EtherChannel 310
How to Configure Web-Based Authentication 310
Default Web-Based Authentication Configuration 310
Web-Based Authentication Configuration Guidelines and Restrictions 311
Configuring the Authentication Rule and Interfaces 311
Configuring AAA Authentication 313
Configuring Switch-to-RADIUS-Server Communication 315
Configuring the HTTP Server 317
Customizing the Authentication Proxy Web Pages 318
Specifying a Redirection URL for Successful Login 319
Configuring the Web-Based Authentication Parameters 321
Configuring a Web Authentication Local Banner 321
Removing Web-Based Authentication Cache Entries 322
Monitoring Web-Based Authentication Status 323
CHAPTER 17 Configuring Port-Based Traffic Control 325
Overview of Port-Based Traffic Control 326
Finding Feature Information 326
Information About Storm Control 326
Storm Control 326
How Traffic Activity is Measured 326
Traffic Patterns 327
How to Configure Storm Control 328
Configuring Storm Control and Threshold Levels 328
Monitoring Storm Control 330
Information About Protected Ports 330
Protected Ports 330
Default Protected Port Configuration 331
Protected Ports Guidelines 331
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 xv
Contents

How to Configure Protected Ports 331
Configuring a Protected Port 331
Monitoring Protected Ports 333
Where to Go Next 333
Information About Port Blocking 333
Port Blocking 333
How to Configure Port Blocking 333
Blocking Flooded Traffic on an Interface 333
Monitoring Port Blocking 335
Prerequisites for Port Security 335
Restrictions for Port Security 335
Information About Port Security 336
Port Security 336
Types of Secure MAC Addresses 336
Sticky Secure MAC Addresses 336
Security Violations 337
Port Security Aging 338
Port Security and Switch Stacks 338
Default Port Security Configuration 338
Port Security Configuration Guidelines 339
How to Configure Port Security 340
Enabling and Configuring Port Security 340
Enabling and Configuring Port Security Aging 344
Monitoring Port Security 346
Configuration Examples for Port Security 347
Information About Protocol Storm Protection 347
Protocol Storm Protection 347
Default Protocol Storm Protection Configuration 348
How to Configure Protocol Storm Protection 348
Enabling Protocol Storm Protection 348
Monitoring Protocol Storm Protection 349
CHAPTER 18 Configuring IPv6 First Hop Security 351
Prerequisites for First Hop Security in IPv6 351
Restrictions for First Hop Security in IPv6 351
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
xvi OL-29434-01
Contents

Information about First Hop Security in IPv6 352
How to Configure an IPv6 Snooping Policy 352
How to Attach an IPv6 Snooping Policy to an Interface or a VLAN on an Interface 354
How to Attach an IPv6 Snooping Policy to VLANs Globally 356
How to Configure the IPv6 Binding Table Content 356
How to Configure an IPv6 Neighbor Discovery Inspection Policy 358
How to Attach an IPv6 Neighbor Discovery Inspection Policy to an Interface 360
How to Attach an IPv6 Neighbor Discovery Inspection Policy to VLANs Globally 361
How to Configure an IPv6 Router Advertisement Guard Policy 362
How to Attach an IPv6 RA Guard Policy to an Interface 364
How to Attach an IPv6 RA Guard Policy to VLANs Globally 365
How to Configure an IPv6 DHCP Guard Policy 366
How to Attach an IPv6 DHCP Guard Policy to an Interface 367
How to Attach an IPv6 DHCP Guard Policy to VLANs Globally 368
How to Configure IPv6 Source Guard 369
How to Attach an IPv6 Source Guard Policy to an Interface 370
CHAPTER 19 Configuring Cisco TrustSec 373
Configuring Cisco TrustSec 373
Finding Feature Information 373
Information About Cisco TrustSec 374
Feature Information for Cisco TrustSec 375
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 xvii
Contents

Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
xviii OL-29434-01
Contents

Preface
Document Conventions
This document uses the following conventions:
DescriptionConvention
Both the ^symbol and Ctrl represent the Control (Ctrl) key on a keyboard.
For example, the key combination ^D or Ctrl-D means that you hold
down the Control key while you press the D key. (Keys are indicated in
capital letters but are not case sensitive.)
^ or Ctrl
Commands and keywords and user-entered text appear in bold font.bold font
Document titles, new or emphasized terms, and arguments for which you
supply values are in italic font.
Italic font
Terminal sessions and information the system displays appear in courier
font.
Courier font
Bold Courier font indicates text that the user must enter.Bold Courier font
Elements in square brackets are optional.[x]
An ellipsis (three consecutive nonbolded periods without spaces) after
a syntax element indicates that the element can be repeated.
...
A vertical line, called a pipe, indicates a choice within a set of keywords
or arguments.
|
Optional alternative keywords are grouped in brackets and separated by
vertical bars.
[x | y]
Required alternative keywords are grouped in braces and separated by
vertical bars.
{x | y}
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
OL-29434-01 19

DescriptionConvention
Nested set of square brackets or braces indicate optional or required
choices within optional or required elements. Braces and a vertical bar
within square brackets indicate a required choice within an optional
element.
[x {y | z}]
A nonquoted set of characters. Do not use quotation marks around the
string or the string will include the quotation marks.
string
Nonprinting characters such as passwords are in angle brackets.< >
Default responses to system prompts are in square brackets.[ ]
An exclamation point (!) or a pound sign (#) at the beginning of a line
of code indicates a comment line.
!, #
Reader Alert Conventions
This document uses the following conventions for reader alerts:
Means reader take note. Notes contain helpful suggestions or references to material not covered in the
manual.
Note
Means the following information will help you solve a problem.
Tip
Means reader be careful. In this situation, you might do something that could result in equipment damage
or loss of data.
Caution
Means the described action saves time. You can save time by performing the action described in the
paragraph.
Timesaver
Means reader be warned. In this situation, you might perform an action that could result in bodily
injury.
Warning
Catalyst 2960-XR Switch Security Configuration Guide, Cisco IOS Release 15.0(2)EX1
20 OL-29434-01
Preface
Document Conventions