Cisco SF500-24 Instruction Manual

Cisco ESW2 Series Advanced Switches
ADMINISTRATION
GUIDE

Cisco 500 Series Stackable Managed Switch Administration Guide 1
Contents
Chapter 1: Getting Started 1
Starting the Web-based Configuration Utility 1
Launching the Configuration Utility 2
HTTP/HTTPS 3
Logging Out 4
Quick Start Device Configuration 5
Interface Naming Conventions 6
Differences Between Sx500, SG500X and the ESW2-550X Devices 6
Window Navigation 8
Application Header 8
Management Buttons 10
Chapter 2: Status and Statistics 12
Viewing Ethernet Interfaces 12
Viewing Etherlike Statistics 13
Viewing GVRP Statistics 15
Viewing 802.1X EAP Statistics 16
Viewing TCAM Utilization[ 17
Managing RMON 18
Viewing RMON Statistics 19
Configuring RMON History 21
Viewing the RMON History Table 22
Defining RMON Events Control 23
Viewing the RMON Events Logs 24
Defining RMON Alarms 24
Chapter 3: Administration: System Log 28
Setting System Log Settings 28
Setting Remote Logging Settings 30
Viewing Memory Logs 31
RAM Memory 32
Flash Memory 32

Cisco 500 Series Stackable Managed Switch Administration Guide 2
Contents
Chapter 4: Administration: File Management 34
System Files 34
Upgrade/Backup Firmware/Language 37
Upgrade/Backing Firmware or Language File 38
Active Image 41
Download/Backup Configuration/Log 42
Configuration File Backwards Compatibility 42
Downloading or Backing-up a Configuration or Log File 43
Configuration Files Properties 48
Copy/Save Configuration 49
DHCP Auto Configuration 50
DHCP Server Options 51
Auto Configuration Download Protocol (TFTP or SCP) 52
SSH Client Authentication Parameters 52
Auto Configuration Process 53
Configuring DHCP Auto Configuration 54
Chapter 5: Administration: Stack Management 58
Overview 58
Types of Units in Stack 60
Backward Compatibility of Number of Units in Stack 60
Unit LEDs 61
Stack Topology 62
Types of Stack Topology 62
Topology Discovery 62
Unit ID Assignment 63
Duplicate Unit IDs 63
Master Selection Process 65
Stack Changes 66
Connecting a New Unit 66
Unit Failure in Stack 68

Cisco 500 Series Stackable Managed Switch Administration Guide 3
Contents
Failure of Master Unit 68
Master/Backup Switchover 69
Slave Unit Handling 69
Reconnecting the Original Master Unit After Failover 70
Software Auto Synchronization in Stack 70
Stack Unit Mode 70
Stack Configuration Options 71
Consistency of Stack Unit Modes in the Stack 72
Changing the Stack Unit Mode 72
Configuration After Reboot 73
Stack Ports 73
Default Stack and Network Ports 74
Port Pairs 74
Port Speeds 75
Auto Selection of Port Speed 75
Connecting Units 75
Cables Types 75
Default Configuration 78
Interactions With Other Features 78
System Modes 78
System Mode Backwards Compatibility 79
System Mode and Stack Management 79
Chapter 6: Administration: General Information 82
Device Models 82
System Information 84
Displaying the System Summary 84
Configuring the System Settings 87
Console Settings (Autobaud Rate Support) 88
Rebooting the Device 88
Routing Resources 90
Monitoring Fan Status 93

Cisco 500 Series Stackable Managed Switch Administration Guide 4
Contents
Defining Idle Session Timeout 95
Pinging a Host 95
Traceroute 97
Chapter 7: Administration: Time Settings 100
System Time Options 101
Time 101
Time Zone and Daylight Savings Time (DST) 102
SNTP Modes 102
Configuring System Time 103
Selecting Source of System Time 103
Adding a Unicast SNTP Server 105
Configuring the SNTP Mode 108
Defining SNTP Authentication 108
Time Range 109
Absolute Time Range 110
Recurring Time Range 111
Chapter 8: Administration: Diagnostics 112
Testing Copper Ports 112
Displaying Optical Module Status 114
MSA-compatible SFPs 114
Configuring Port and VLAN Mirroring 115
Viewing CPU Utilization and Secure Core Technology 117
Chapter 9: Administration: Discovery 120
Configuring Bonjour Discovery 120
Bonjour in Layer 2 System Mode 120
Bonjour in Layer 3 System Mode 121
LLDP and CDP 122
Configuring LLDP 123
LLDP Overview 124

Cisco 500 Series Stackable Managed Switch Administration Guide 5
Contents
Setting LLDP Properties 125
Editing LLDP Port Settings 126
LLDP MED Network Policy 128
Configuring LLDP MED Port Settings 130
Displaying LLDP Port Status 131
Displaying LLDP Local Information 132
Displaying LLDP Neighbors Information 136
Accessing LLDP Statistics 140
LLDP Overloading 141
Configuring CDP 143
Setting CDP Properties 143
Editing CDP Interface Settings 146
Displaying CDP Local Information 147
Displaying CDP Neighbors Information 149
Viewing CDP Statistics 151
Chapter 10: Port Management 152
Configuring Ports 152
Setting Port Configuration 153
Configuring Link Aggregation 156
Link Aggregation Overview 157
Load Balancing 157
Default Settings and Configuration 158
Static and Dynamic LAG Workflow 158
Defining LAG Management 159
Configuring LAG Settings 160
Configuring LACP 162
LACP Priority and Rules 162
LACP With No Link Partner 162
Setting LACP Parameter Settings 163
Configuring Green Ethernet 164
Green Ethernet Overview 164
Power Saving by Disabling Port LEDs 165

Cisco 500 Series Stackable Managed Switch Administration Guide 6
Contents
802.3az Energy Efficient Ethernet Feature 166
Setting Global Green Ethernet Properties 168
Setting Green Ethernet Properties for Ports 169
Chapter 11: Smartport 172
Overview 173
What is a Smartport 174
Smartport Types 174
Special Smartport Types 176
Smartport Macros 177
Applying a Smartport Type to an Interface 178
Macro Failure and the Reset Operation 178
How the Smartport Feature Works 179
Auto Smartport 180
Enabling Auto Smartport 180
Identifying Smartport Type 180
Using CDP/LLDP Information to Identify Smartport Types 181
Multiple Devices Attached to the Port 182
Persistent Auto Smartport Interface 183
Error Handling 183
Default Configuration 184
Relationships with Other Features and Backwards Compatibility 184
Common Smartport Tasks 184
Configuring Smartport Using The Web-based Interface 187
Smartport Properties 187
Smartport Type Settings 188
Smartport Interface Settings 189
Built-in Smartport Macros 192
Chapter 12: Port Management: PoE 204
PoE on the Device 204

Cisco 500 Series Stackable Managed Switch Administration Guide 7
Contents
PoE Features 204
PoE Operation 205
PoE Configuration Considerations 205
Configuring PoE Properties 207
Configuring PoE Settings 208
PoE priority example: 209
Chapter 13: VLAN Management 212
VLANs 212
Configuring Default VLAN Settings 216
Creating VLANs 217
Configuring VLAN Interface Settings 218
Defining VLAN Membership 219
Configuring Port to VLAN 220
Configuring VLAN Membership 221
GVRP Settings 223
Defining GVRP Settings 223
VLAN Groups 224
MAC-based Groups 224
Assigning MAC-based VLAN Groups 225
Mapping VLAN Group to VLAN Per Interface 225
Protocol-based VLANs 226
Protocol-Based Groups 226
Protocol-Based Groups to VLAN Mapping 227
Voice VLAN 228
Voice VLAN Overview 228
Dynamic Voice VLAN Modes 229
Voice End-Points 230
Auto Voice VLAN, Auto Smartports, CDP, and LLDP 230
Voice VLAN QoS 232
Voice VLAN Constraints 233
Voice VLAN Workflows 233
Configuring Voice VLAN 234
Configuring Voice VLAN Properties 235

Cisco 500 Series Stackable Managed Switch Administration Guide 8
Contents
Displaying Auto Voice VLAN Settings 236
Configuring Telephony OUI 238
Adding OUIs to the Telephony OUI Table 239
Adding Interfaces to Voice VLAN on Basis of OUIs 240
Access Port Multicast TV VLAN 241
IGMP Snooping 242
Differences Between Regular and Multicast TV VLANs 242
Configuration 243
Multicast TV Group to VLAN 243
Port Multicast VLAN Membership 244
Customer Port Multicast TV VLAN 244
Mapping CPE VLANs to Multicast TV VLANs 245
CPE Port Multicast VLAN Membership 246
Chapter 14: Spanning Tree 248
STP Flavors 248
Configuring STP Status and Global Settings 249
Defining Spanning Tree Interface Settings 251
Configuring Rapid Spanning Tree Settings 253
Multiple Spanning Tree 256
Defining MSTP Properties 256
Mapping VLANs to a MSTP Instance 257
Defining MSTP Instance Settings 258
Defining MSTP Interface Settings 259
Chapter 15: Managing MAC Address Tables 262
Types of MAC Addresses 262
Configuring Static MAC Addresses 263
Managing Dynamic MAC Addresses 264
Configuring Dynamic MAC Address Aging Time 264
Querying Dynamic Addresses 264
Defining Reserved MAC Addresses 265

Cisco 500 Series Stackable Managed Switch Administration Guide 9
Contents
Chapter 16: Multicast 266
Multicast Forwarding 266
Typical Multicast Setup 267
Multicast Address Properties 269
Defining Multicast Properties 269
Adding MAC Group Address 271
Adding IP Multicast Group Addresses 273
Configuring IGMP Snooping 274
MLD Snooping 277
Querying IGMP/MLD IP Multicast Group 279
Defining Multicast Router Ports 280
Defining Forward All Multicast 281
Defining Unregistered Multicast Settings 282
Chapter 17: IP Configuration 284
Overview 284
Layer 2 IP Addressing 285
Layer 3 IP Addressing 286
IPv4 Management and Interfaces 287
IPv4 Interface 287
Defining an IPv4 Interface in Layer 2 System Mode 287
Defining IPv4 Interface in Layer 3 System Mode 288
IPv4 Routes 291
RIPv2 292
Access List 292
IPv4 VRRP Virtual Routers 292
ARP 292
ARP Proxy 293
UDP Relay/IP Helper 294
DHCPv4 Snooping/Relay 295
DHCPv4 Snooping 295
DHCPv4 Relay 295

Cisco 500 Series Stackable Managed Switch Administration Guide 10
Contents
Transparent DHCP Relay 296
Option 82 296
Interactions Between DHCPv4 Snooping, DHCPv4 Relay and Option 82 297
DHCP Snooping Binding Database 300
DHCP Trusted Ports 301
How the DHCP Snooping Binding Database is Built 301
DHCP Snooping Along With DHCP Relay 303
DHCP Default Configuration 303
Configuring DHCP Work Flow 303
DHCP Snooping/Relay 304
Properties 304
Interface Settings 305
DHCP Snooping Trusted Interfaces 305
DHCP Snooping Binding Database 306
DHCP Server 307
DHCP Options 307
Dependencies Between Features 309
Default Settings and Configurations 309
DHCPv4 Server 310
Network Pool 310
Excluded Addresses 312
Static Hosts 312
Address Binding 314
IPv6 Management and Interfaces 315
IPv6 Static Routing 316
IPv6 Global Configuration 316
IPv6 Interface 317
IPv6 Tunnel 321
Types of Tunnels 321
Configuring Tunnels 321
Defining IPv6 Addresses 324
IPv6 Router Configuration 325
Router Advertisement 325
IPv6 Prefixes 327
IPv6 Default Router List 329
Defining IPv6 Neighbors Information 331

Cisco 500 Series Stackable Managed Switch Administration Guide 11
Contents
Viewing IPv6 Route Tables 332
DHCPv6 Relay 334
Dependencies with Other Features 334
Global Destinations 334
Interface Settings 335
Domain Name 335
DNS Settings 336
Search List 337
Host Mapping 338
Chapter 18: IP Configuration: RIPv2 340
Overview 340
How RIP Operates on the Device 341
Enabling RIP 341
Enabling RIP 341
Offset Configuration 341
Passive Mode 342
Filtering Routing Updates 343
Advertising Default Route Entries on IP Interfaces 343
Redistribution Feature 343
Using RIP in Network with Non-Rip Devices 345
RIP Authentication 345
RIP Statistical Counters 346
RIP Peers Database 346
Configuring RIP 346
RIPv2 Properties 347
RIPv2 Settings on an IP Interface 349
Displaying RIPv2 Statistic Counters 350
Displaying the RIPv2 Peers Database 351
Access Lists 351
Creating an Access List 352
Populate an Access List 352
Chapter 19: IP Configuration: IPv4 VRRP Virtual Routers 354

Cisco 500 Series Stackable Managed Switch Administration Guide 12
Contents
Overview 354
Constraints 355
VRRP Topology 355
Configurable Elements of VRRP 358
Virtual Router Identification 358
VRRP Versions 358
Virtual Router IP Addresses 359
Source IP Address In a VRRP Router 360
VRRP Router Priority and Preemption 360
VRRP Advertisements 361
Configuring VRRP 361
Chapter 20: Security 364
Defining Users 365
Setting User Accounts 365
Setting Password Complexity Rules 367
Configuring TACACS+ 368
Accounting Using a TACACS+ Server 369
Defaults 370
Interactions With Other Features 370
Workflow 370
Configuring a TACACS+ Server 370
Configuring RADIUS 373
Accounting Using a RADIUS Server 373
Defaults 373
Interactions With Other Features 374
Radius Workflow 374
Key Management 377
Key Management 377
Creating a Key Chain 377
Creating a Key Settings 378
Configuring Management Access Authentication 380
Defining Management Access Method 381

Cisco 500 Series Stackable Managed Switch Administration Guide 13
Contents
Active Access Profile 382
Defining Profile Rules 384
SSL Server 386
SSL Overview 386
Default Settings and Configuration 387
SSL Server Authentication Settings 387
Configuring TCP/UDP Services 389
Defining Storm Control 390
Configuring Port Security 391
Configuring 802.1X 394
802.1X Parameters Workflow 397
Defining 802.1X Properties 397
Defining 802.1X Port Authentication 399
Defining Host and Session Authentication 402
Viewing Authenticated Hosts 404
Defining Time Ranges 404
Denial of Service Prevention 405
Secure Core Technology (SCT) 405
Types of DoS Attacks 405
Defense Against DoS Attacks 406
Dependencies Between Features 407
Default Configuration 407
Configuring DoS Prevention 407
Security Suite Settings 407
SYN Protection 409
Martian Addresses 410
SYN Filtering 411
SYN Rate Protection 412
ICMP Filtering 413
IP Fragmented Filtering 413
IP Source Guard 414
Interactions with Other Features 414
Filtering 415

Cisco 500 Series Stackable Managed Switch Administration Guide 14
Contents
Configuring IP Source Guard Work Flow 415
Enabling IP Source Guard 416
Configuring IP Source Guard on Interfaces 416
Binding Database 417
Dynamic ARP Inspection 418
How ARP Prevents Cache Poisoning 419
Interaction Between ARP Inspection and DHCP Snooping 420
ARP Defaults 420
ARP Inspection Work Flow 421
Defining ARP Inspection Properties 421
Defining Dynamic ARP Inspection Interfaces Settings 422
Defining ARP Inspection Access Control 422
Defining ARP Inspection Access Control Rules 423
Defining ARP Inspection VLAN Settings 423
Chapter 21: Security: SSH Client 424
Secure Copy (SCP) and SSH 424
Protection Methods 425
Passwords 425
Public/Private Keys 426
Import Keys 426
SSH Server Authentication 427
SSH Client Authentication 428
Supported Algorithms 428
Before You Begin 429
Common Tasks 429
SSH Client Configuration Through the GUI 431
SSH User Authentication 431
SSH Server Authentication 432
Modifying the User Password on the SSH Server 432
Chapter 22: Security: SSH Server 434

Cisco 500 Series Stackable Managed Switch Administration Guide 15
Contents
Overview 434
Common Tasks 435
SSH Server Configuration Pages 436
SSH User Authentication 436
SSH Server Authentication 437
Chapter 23: Security: Secure Sensitive Data Management 440
Introduction 440
SSD Management 441
SSD Rules 441
Elements of an SSD Rule 442
SSD Rules and User Authentication 445
Default SSD Rules 445
SSD Default Read Mode Session Override 446
SSD Properties 446
Passphrase 447
Default and User-defined Passphrases 447
Local Passphrase 447
Configuration File Passphrase Control 448
Configuration File Integrity Control 448
Read Mode 449
Configuration Files 449
File SSD Indicator 449
SSD Control Block 450
Startup Configuration File 450
Running Configuration File 451
Backup and Mirror Configuration File 452
Sensitive Data Zero-Touch Auto Configuration 453
SSD Management Channels 454
Menu CLI and Password Recovery 455
Configuring SSD 455
SSD Properties 455

Cisco 500 Series Stackable Managed Switch Administration Guide 16
Contents
SSD Rules 456
Chapter 24: Access Control 460
Access Control Lists 460
Defining MAC-based ACLs 462
Adding Rules to a MAC-based ACL 463
IPv4-based ACLs 465
Defining an IPv4-based ACL 465
Adding Rules (ACEs) to an IPv4-Based ACL 466
IPv6-Based ACLs 469
Adding Rules (ACEs) for an IPv6-Based ACL 470
Defining ACL Binding 473
Chapter 25: Quality of Service 476
QoS Features and Components 477
QoS Modes 477
QoS Workflow 478
Configuring QoS - General 479
Setting QoS Properties 480
Configuring QoS Queues 481
Mapping CoS/802.1p to a Queue 482
Mapping DSCP to Queue 484
Configuring Bandwidth 487
Configuring Egress Shaping per Queue 489
Configuring VLAN Ingress Rate Limit 489
TCP Congestion Avoidance 491
QoS Basic Mode 491
Workflow to Configure Basic QoS Mode 491
Configuring Global Settings 492
Interface QoS Settings 493
QoS Advanced Mode 493
Workflow to Configure Advanced QoS Mode 495

Cisco 500 Series Stackable Managed Switch Administration Guide 17
Contents
Configuring Global Settings 495
Configuring Out-of-Profile DSCP Mapping 496
Defining Class Mapping 498
QoS Policers 499
Defining Aggregate Policers 500
Configuring a Policy 501
Policy Class Maps 502
Policy Binding 504
Managing QoS Statistics 504
Policer Statistics 505
Viewing Single Policer Statistics 505
Viewing Aggregated Policer Statistics 506
Viewing Queues Statistics 506
Chapter 26: SNMP 510
SNMP Versions and Workflow 510
SNMPv1 and v2 511
SNMPv3 511
SNMP Workflow 511
Supported MIBs 513
Model OIDs 513
SNMP Engine ID 514
Configuring SNMP Views 516
Creating SNMP Groups 517
Managing SNMP Users 519
Defining SNMP Communities 521
Defining Trap Settings 523
Notification Recipients 523
Defining SNMPv1,2 Notification Recipients 524
Defining SNMPv3 Notification Recipients 525
SNMP Notification Filters 527

1
Cisco 500 Series Stackable Managed Switch Administration Guide Release 1.3 1
Getting Started
This section provides an introduction to the web-based configuration utility, and
covers the following topics:
•Starting the Web-based Configuration Utility
•Quick Start Device Configuration
•Interface Naming Conventions
•Differences Between Sx500, SG500X and the ESW2-550X Devices
•Window Navigation
Starting the Web-based Configuration Utility
This section describes how to navigate the web-based switch configuration utility.
If you are using a pop-up blocker, make sure it is disabled.
Browser Restrictions
•If you are using older versions of Internet Explorer, you cannot directly use
an IPv6 address to access the device. You can, however, use the DNS
(Domain Name System) server to create a domain name that contains the
IPv6 address, and then use that domain name in the address bar in place of
the IPv6 address.
•If you have multiple IPv6 interfaces on your management station, use the
IPv6 global address instead of the IPv6 link local address to access the
device from your browser.

Getting Started
Starting the Web-based Configuration Utility
Cisco 500 Series Stackable Managed Switch Administration Guide Release 1.3 2
1
Launching the Configuration Utility
To open the web-based configuration utility:
STEP 1 Open a Web browser.
STEP 2 Enter the IP address of the device you are configuring in the address bar on the
browser, and then press Enter.
NOTE When the device is using the factory default IP address of 192.168.1.254, its power
LED flashes continuously. When the device is using a DHCP assigned IP address or
an administrator-configured static IP address, the power LED is on solid.
Logging In
The default username is cisco and the default password is cisco. The first time
that you log in with the default username and password, you are required to enter
a new password.
NOTE If you have not previously selected a language for the GUI, the language of the Login
page is determined by the language(s) requested by your browser and the
languages configured on your device. If your browser requests Chinese, for
example, and Chinese has been loaded into your device, the Login page is
automatically displayed in Chinese. If Chinese has not been loaded into your
device, the Login page appears in English.
The languages loaded into the device have a language and country code (en-US,
en-GB and so on). For the Login page to be automatically displayed in a particular
language, based on the browser request, both the language and country code of
the browser request must match those of the language loaded on the device. If the
browser request contains only the language code without a country code (for
example: fr). The first embedded language with a matching language code is
taken (without matching the country code, for example: fr_CA).
To log in to the device configuration utility:
STEP 1 Enter the username/password. The password can contain up to 64 ASCII
characters. Password-complexity rules are described in the Setting Password
Complexity Rules section of the Configuring Security chapter.
STEP 2 If you are not using English, select the desired language from the Language drop-
down menu. To add a new language to the device or update a current one, refer to
the Upgrade/Backup Firmware/Language section.