Cisco Catalyst 3850 User manual

Cisco Systems, Inc.
www.cisco.com
Cisco has more than 200 offices worldwide.
Addresses, phone numbers, and fax numbers
are listed on the Cisco website at
www.cisco.com/go/offices.
Cisco Catalyst 3850 Series and Cisco
Catalyst 3650 Series Switches Best
Practices Guide
First Published: November 30, 2015
Last Updated: December 14, 2015

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this
URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display
output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in
illustrative content is unintentional and coincidental.
© 2015 Cisco Systems, Inc. All rights reserved.

i
Cisco Catalyst 3850 Series and Cisco Catalyst 3650 Series Switches Best Practices Guide
CONTENTS
Preface vii
Audience iii-vii
Conventions vii
Obtaining Documentation and Submitting a Service Request viii
Ease of Deployment 1-1
Purpose 1-1
Configuration Tool 1-2
Catalyst Switch Configuration Best Practices 1-2
LAN Access Switch Topology 1-4
Switch Address Plan 1-5
Initial Switch Configuration 2-7
Purpose 2-7
Prerequisites 2-7
Identify Configuration Values 2-8
Assign Initial Management Information 2-8
Configure the Hostname for Switch Identification 2-9
Configure Secure HTTPS and Secure Shell for Secure LAN Management 2-9
Configure SNMP for Remote Management 2-10
Configure Local Login and Password for Switch Access 2-10
Configure Centralized User Authentication Through TACACS+ 2-10
Assign an IP Address to the Switch 2-11
Configure the Management IP Address on an Out-of-Band Interface 2-12
Configure the Management IP Address on an In-Band Interface 2-14
Create a Management VLAN in Hardware 2-15
Verify Basic Switch Configuration 2-17
Show Running Configuration for Initial Management Information 2-17
Switch Stack Update 3-21
Purpose 3-21
Prerequisites 3-21
Identify Configuration Values 3-22

Contents
ii
Cisco Catalyst 3850 Series and Cisco Catalyst 3650 Series Switches Best Practices Guide
LAN Access Switch Topology with Configured FTP Server 3-22
Performing the Stack Update 3-23
Obtain the Switch Software Image 3-23
Check the Software Version on the Stack Members 3-23
Configure the Switch to Run in Install Mode 3-24
Download the Switch Image from Cisco.com to a FTP Server 3-25
Update the Switch Stack Image 3-27
Enable Switch Image Auto-Upgrade 3-27
Verify that Stack Members Are Running the Same Software Image 3-28
Global System Configuration 4-29
Purpose 4-29
Prerequisites 4-29
Identify Configuration Values 4-29
Assign Global Configuration Information 4-30
Configure High Availability on the Switch Stack 4-31
Configure VTP Transparent Mode 4-31
Enable Rapid Per-VLAN Spanning Tree 4-32
Configure BPDU Guard for Spanning-Tree PortFast Interfaces 4-32
Configure UDLD to Detect Link Failure 4-33
Configure an Access List to Limit Switch Access 4-33
Configure System Clock and Console Timestamps 4-34
Configure DHCP Snooping Security Features 4-34
Configure ARP Inspection 4-34
Configure EtherChannel Load Balancing 4-35
Create Access Layer VLANs 4-35
Create IPv6 First Hop Security Policies 4-35
Increase the TFTP Block Size 4-36
Enable New Members to Automatically Update to the Switch Stack Image 4-36
Verify Global Switch Configuration 4-37
Show Running Configuration For Global Management Information 4-37
Uplink Interface Connectivity 5-41
Purpose 5-41
Prerequisites 5-41
Restrictions 5-41
Identify Configuration Values 5-42
LAN Access Switch Topology with Uplinks to a Distribution Switch or Distribution Router 5-43
Configure Uplink Interface Connectivity 5-44

Contents
iii
Cisco Catalyst 3850 Series and Cisco Catalyst 3650 Series Switches Best Practices Guide
Recommendations for Configuring the Uplink Interface to a Router or Switch 5-44
Configure QoS on the Uplink EtherChannel Interfaces 5-44
Configure the Uplink Interface as an EtherChannel and as a Trunk 5-45
Configure the Uplink Interface to Connect to Distribution VSS or VPC Switches 5-45
Configure the Uplink Interface to Connect to Distribution Routers (or Standalone Distribution
Switches) 5-46
Configure Security Features on the Uplink EtherChannel Interfaces 5-48
Spanning-Tree Recommendations for Uplink Interfaces Connecting to Distribution Switches 5-48
Verify Uplink Interface Configurations 5-49
Show Running Configuration for Uplink Interface Connectivity 5-49
Access Interface Connectivity 6-51
Purpose 6-51
Prerequisites 6-51
Identify Configuration Values 6-51
LAN Access Switch Topology with Connections to End Devices 6-53
Configure Access Interface Connectivity 6-53
Recommendations for Configuring Access Interfaces 6-53
Configure the Interface for Access Mode 6-55
Configure VLAN Membership 6-55
Create an Interface Description 6-55
Configure Security Features on Access Interfaces 6-56
Configure QoS on the Access Interfaces 6-57
Verify Access Interface Configurations 6-58
Show Running Configuration for Access Interface Connectivity 6-61
Access Control on the Wired Network 7-65
Purpose 7-65
Prerequisites 7-65
Restrictions 7-65
Identify Configuration Values 7-66
LAN Access Switch Topology with IEEE 802.1x Secure Access Control 7-67
Provision IEEE 802.1x for Wired LAN 7-67
Recommendations for Configuring Security on a Wired LAN 7-67
Provision Common Wired Security Access 7-68
Provision in Monitor Mode 7-71
Provision in Low Impact Mode 7-72
Provision in High Impact Mode 7-73
Verify Secure Access Control on the Switch 7-74

Contents
iv
Cisco Catalyst 3850 Series and Cisco Catalyst 3650 Series Switches Best Practices Guide
Show Running Configuration for Provisioning Modes 7-74
Monitoring IEEE 802.1x Status and Statistics 7-77
Converged Wired and Wireless Access 8-81
Purpose 8-81
Prerequisites 8-81
Restrictions 8-82
Identify Configuration Values 8-82
LAN Access Switch Topology with Wireless Connectivity 8-83
Enable the Switch as a Wireless Controller 8-84
Install Access Point Licenses on the Switch 8-84
Verify AP-Count License Installation 8-85
Configure a Wireless Management VLAN 8-86
Configure Service Connectivity 8-86
Enable Wireless Controller Functionality 8-87
Change a Switch to Run in Mobility Controller Mode 8-87
Enable the Access Point Connections 8-88
Enable a Client VLAN 8-89
Provisioning a Small Branch WLAN 8-90
Provision in Easy-RADIUS 8-90
Disable Authentication to Enable Easy-RADIUS 8-90
Configure QoS to Secure the WLAN 8-91
Verify Client Connectivity in RADIUS 8-91
Provision in Secure Mode 8-93
Enable the AAA RADIUS Server 8-93
Configure the WLAN with IEEE 802.1x Authentication 8-94
Configure QoS Service Policies for an Open WLAN 8-94
Obtain WLAN Client IP Addresses 8-95
Manage Radio Frequency and Channel Settings 8-95
Disable Low Data Rates 8-96
Enable Clean Air 8-97
Enable Dynamic Channel Assignment 8-97
Associate WLAN Clients 8-98
Verify WLAN Client Connectivity 8-98
Verify the Converged Access Configuration on the Switch 8-99
Show Running Configuration for Wireless LAN Converged Access 8-99
System Health Monitoring 9-103
Purpose 9-103

Contents
v
Cisco Catalyst 3850 Series and Cisco Catalyst 3650 Series Switches Best Practices Guide
Prerequisites 9-103
Show Running Status 9-103
Run a System Baseline for Core Resources 9-104
Obtain CPU and Core Processor Usage 9-104
Obtain Switch Memory Usage 9-106
Monitor File Systems Usage 9-106
Run a System Baseline for Environmental Resources 9-107
Other System Monitoring Considerations 9-108
Spanning Tree Monitoring 9-108
I NDEX

Contents
vi
Cisco Catalyst 3850 Series and Cisco Catalyst 3650 Series Switches Best Practices Guide