Cisco WS-C2948G-GE-TX User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Catalyst 4500 Series, Catalyst 2948G,
Catalyst 2948G-GE-TX, and
Catalyst 2980G Switches Software
Configuration Guide
Release 8.2GLX
Customer Order Number: DOC-7815908=
Text Part Number: 78-15908-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.;
Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE,
CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems
logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ
Net Readiness Scorecard, LightStream, MGX, MICA, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX,
Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, Stratm, SwitchProbe, TeleRouter, The Fastest Way to Increase Your Internet Quotient, TransPath, and VCO
are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.
All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0304R)
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide
Copyright © 2000-2003, Cisco Systems, Inc. All rights reserved.

iii
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
CONTENTS
Preface xxv
Audience xxv
Organization xxv
Related Documentation xxvii
Conventions xxviii
Obtaining Documentation xxix
Cisco.com xxix
Documentation CD-ROM xxix
Ordering Documentation xxix
Documentation Feedback xxx
Obtaining Technical Assistance xxx
Cisco TAC Website xxx
Opening a TAC Case xxx
TAC CasePriority Definitions xxxi
Obtaining AdditionalPublications and Information xxxi
CHAPTER 1Product Overview 1-1
Catalyst 4000 and Catalyst 4500 Series Switches 1-1
Catalyst 2948G Switch 1-2
Catalyst 2948G-GE-TX Switch 1-3
Catalyst 2980G Switch 1-3
Supervisor Engine Software 1-3
CHAPTER 2Using the Command-Line Interface 2-1
Switch CLI Overview 2-1
Accessing the Switch CLI 2-2
Accessing the CLI Through the Console Port 2-2
Accessing the CLI Through Telnet 2-3
Switch CLI Command Modes 2-3
Accessing Help 2-4
Command-Line Editing 2-5
History Substitution 2-6
Abbreviating a Command 2-6

Contents
iv
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Completing a Partial Command 2-6
Scrolling Through Command Output 2-6
Using Command Aliases 2-7
Specifying Modules, Ports, and VLANs 2-7
Specifying MAC Addresses 2-8
Specifying IP Addresses, Host Names, and IP Aliases 2-8
ROM Monitor CLI 2-9
Example of a Catalyst 4003 Bootup Display 2-9
CHAPTER 3Configuring the Switch IP Address and Default Gateway 3-1
Understanding How the Switch Management Interfaces Work 3-1
Understanding How Automatic IP Configuration Works 3-2
Automatic IP Configuration Overview 3-2
Understanding DHCP 3-3
Understanding RARP 3-4
Preparing to Configure the IP Address and Default Gateway 3-4
Default IP Address and Default Gateway Configuration 3-5
Setting the In-Band (sc0) Interface IP Address 3-5
Setting the Management Ethernet (me1) Interface IP Address 3-6
Configuring Default Gateways 3-7
Configuring the SLIP (sl0) Interface on the Console Port 3-8
Using DHCP or RARP to Obtain an IP Address Configuration 3-10
Renewing and Releasing a DHCP-Assigned IP Address 3-11
CHAPTER 4Configuring Ethernet and Fast EthernetSwitching 4-1
Understanding How Ethernet Works 4-1
Ethernet Overview 4-1
Switching Frames Between Segments 4-2
Building the Address Table 4-2
Default Ethernet and Fast Ethernet Configurations 4-2
Configuring Ethernetand Fast Ethernet Ports 4-3
Setting Ethernet and Fast Ethernet Port Names 4-3
Setting Ethernet and Fast Ethernet PortPriority Levels 4-4
Setting Ethernet and Fast Ethernet PortSpeeds 4-4
Setting Ethernet and Fast Ethernet Port Duplex Modes 4-5
Setting Ethernet and Fast Ethernet Port Debounce Timers 4-6
Configuring errdisable State Ethernetand Fast Ethernet Port Timeout Periods 4-7

Contents
v
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Checking Ethernet and Fast Ethernet PortConnectivity 4-8
CHAPTER 5Configuring Gigabit Ethernet Switching 5-1
Understanding How Gigabit Ethernet Works 5-1
Understanding How Gigabit Ethernet Flow Control Works 5-1
Understanding How Port Negotiation Works 5-3
Understanding How Oversubscribed Gigabit Ethernet Works 5-4
Default Gigabit Ethernet Configuration 5-6
Configuring Gigabit Ethernet Ports 5-7
Assigning Gigabit Ethernet PortNames 5-7
Configuring Gigabit Ethernet Port Priority Levels 5-8
Configuring Flow Control on Gigabit Ethernet Ports 5-8
Enabling Port Negotiation on Gigabit Ethernet Ports 5-9
Disabling Port Negotiation 5-9
Configuring errdisable State Gigabit Ethernet Port Timeout Periods 5-9
Checking GigabitEthernet Port Connectivity 5-10
CHAPTER 6Configuring Fast EtherChannel and Gigabit EtherChannel 6-1
Understanding How EtherChannel Works 6-1
EtherChannelOverview 6-2
Understanding Frame Distribution 6-2
Hardware Support for EtherChannel 6-2
PAgP and LACP 6-2
EtherChannelConfiguration Guidelines and Restrictions 6-3
Guidelines for Configuring a Port 6-3
Guidelines for Configuring VLANs and Trunks 6-4
EtherChannelInteraction with other Features 6-4
Understanding PAgP 6-5
PAgP Modes 6-5
Understanding Administrative Groups and EtherChannel IDs 6-6
Configuring EtherChannel Using PAgP 6-6
Creating an EtherChannel 6-7
Defining an EtherChannel Administrative Group 6-7
Setting the EtherChannel Spanning Tree PortCost 6-8
Setting the EtherChannel Spanning Tree PortVLAN Cost 6-9
Removing an EtherChannel Bundle 6-9
Displaying EtherChannel Configuration Information 6-10
Displaying EtherChannel Traffic Statistics 6-11
Displaying EtherChannel PAgP Statistics 6-12

Contents
vi
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
EtherChannelConfiguration Examples 6-12
Configuration Example of a Four-Port Fast EtherChannel 6-12
Configuration Example of a Two-Port Gigabit EtherChannel 6-14
Understanding LACP 6-16
LACP Modes 6-16
LACP Parameters 6-17
Configuring EtherChannel Using LACP 6-18
Specifying the EtherChannel Protocol 6-18
Specifying the System Priority 6-19
Specifying the Port Priority 6-19
Specifying an Administrative Key Value 6-19
Changing the Channel Mode 6-20
Specifying the Channel Path Cost 6-21
Specifying the Channel VLAN Cost 6-21
Clearing LACP Statistics 6-21
Displaying EtherChannel Traffic Utilization 6-21
Disabling an EtherChannel 6-22
Displaying Spanning Tree-Related Information for EtherChannels 6-22
CHAPTER 7Configuring Spanning Tree 7-1
Understanding How STPs Work 7-2
Understanding How a Topology Is Created 7-2
Understanding Howa Switch or Port Becomes the Root Switch or Root Port 7-3
Understanding BPDUs 7-4
Calculating and Assigning Port Costs 7-4
Understanding Spanning Tree Port States 7-5
Understanding How PVST+ and MISTP Modes Work 7-11
PVST+ Mode 7-12
Rapid PVST+ 7-12
MISTP Mode 7-12
MISTP-PVST+ Mode 7-13
Understanding How Bridge Identifiers Work 7-13
MAC Address Allocation 7-13
MAC Address Reduction 7-13
Understanding How MST Works 7-14
Rapid Spanning Tree Protocol 7-16
MST-to-SST Interoperability 7-17
Common Spanning Tree 7-18
MST Instances 7-18

Contents
vii
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
MST Configuration 7-18
MST Region 7-19
Message Age and Hop Count 7-21
MST-to-PVST+ Interoperability 7-21
Understanding How BPDU Skewing Works 7-22
Using PVST+ 7-22
Default PVST+ Configuration 7-22
Setting the PVST+ Bridge ID Priority 7-23
Configuring the PVST+ Port Cost 7-25
Configuring PVST+ Port Priority 7-25
Configuring the PVST+ Default Port Cost Mode 7-26
Configuring the PVST+ Port VLAN Cost 7-26
Configuring the PVST+ Port VLAN Priority 7-27
Disabling the PVST+ Mode on a VLAN 7-28
Using Rapid PVST+ 7-28
Using MISTP-PVST+ or MISTP 7-30
Default MISTP Mode Configuration 7-30
Setting the MISTP-PVST+ Mode or MISTP Mode 7-31
Configuring the MISTP Bridge ID Priority 7-32
Enabling an MISTP Instance 7-36
Mapping VLANs to an MISTP Instance 7-36
Disabling MISTP-PVST+ or MISTP 7-39
Configuring a Root Switch 7-39
Configuring a Primary Root Switch 7-39
Configuring a Secondary Root Switch 7-40
Configuring a Root Switch to Improve Convergence 7-41
Using Root Guard—Preventing Switches from Becoming Root 7-43
Displaying Spanning Tree BPDU Statistics 7-43
Configuring Spanning Tree Timers 7-44
Configuring the Hello Time 7-44
Configuring the Forward Delay Time 7-45
Configuring the Maximum Aging Time 7-45
Configuring MST 7-46
Enabling MST 7-46
Mapping and Unmapping VLANs to an MST Instance 7-54
Configuring Spanning Tree BPDU Skewing 7-57

Contents
viii
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
CHAPTER 8Configuring Spanning Tree PortFast, BPDU Guard, BPDU Filter, UplinkFast, BackboneFast,and
Loop Guard 8-1
Understanding How PortFast Works 8-2
Understanding How PortFast BPDU Guard Works 8-2
Understanding How PortFast BPDU Filtering Works 8-2
Understanding How UplinkFast Works 8-3
Understanding How BackboneFast Works 8-4
Understanding How Loop Guard Works 8-6
Configuring PortFast 8-8
Enabling PortFast on an Access Port 8-8
Enabling PortFast on a Trunk Port 8-9
Disabling PortFast 8-10
Resetting PortFast 8-11
Configuring PortFast BPDU Guard 8-11
Enabling PortFast BPDU Guard 8-11
Disabling PortFast BPDU Guard 8-12
Configuring PortFast BPDU Filtering 8-13
Enabling PortFast BPDU Filtering 8-13
Disabling PortFast BPDU Filtering 8-14
Configuring UplinkFast 8-15
Enabling UplinkFast 8-15
Disabling UplinkFast 8-16
Configuring BackboneFast 8-17
Enabling BackboneFast 8-17
Displaying BackboneFast Statistics 8-17
Disabling BackboneFast 8-18
Configuring Loop Guard 8-18
Enabling Loop Guard 8-18
Disabling Loop Guard 8-19
CHAPTER 9Configuring VTP 9-1
Understanding How VTP Version 1 and Version 2 Work 9-1
Understanding the VTP Domain 9-2
Understanding VTPModes 9-2
Understanding VTPAdvertisements 9-3
Understanding VTPVersion 2 9-3
Understanding VTPPruning 9-4
Default VTP Version 1 and Version 2 Configuration 9-5

Contents
ix
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
VTP Version 1 and Version 2 Configuration Guidelines 9-6
Configuring VTP Version 1 and Version 2 9-6
Configuring a VTP Server 9-7
Configuring a VTP Client 9-7
Configuring VTP (VTP Transparent Mode) 9-8
Disabling VTP Using the Off Mode 9-9
Enabling VTP Version 2 9-9
Disabling VTP Version 2 9-10
Enabling VTP Pruning 9-11
Disabling VTP Pruning 9-12
Displaying VTP Statistics 9-12
Understanding How VTP Version 3 Works 9-13
VTP Version 3 Authentication 9-13
VTP Version 3 Per-Port Configuration 9-14
VTP Version 3 Domains,Modes, and Partitions 9-14
VTP Version 3 Modes 9-18
VTP Version 3 Databases 9-19
Default VTP Version 3 Configuration 9-22
Configuring VTP Version 3 9-22
Enabling VTP Version 3 9-22
Changing VTP Version 3 Modes 9-23
Configuring VTP Version 3 Passwords 9-27
Configuring a VTP Version 3 Takeover 9-28
Disabling VTP Version 3 on a Per-PortBasis 9-29
VTP Version 3 show Commands 9-30
CHAPTER 10 Configuring VLANs 10-1
Understanding How VLANs Work 10-1
VLAN Ranges 10-3
Configurable VLAN Parameters 10-4
VLAN Default Configuration 10-4
VLAN Configuration Guidelines 10-5
Configuring VLANs on the Switch 10-6
Creating or Modifying an Ethernet VLAN 10-6
Creating or Modifying a Normal-Range Ethernet VLAN 10-7
Creating or Modifying an Extended-Range VLAN 10-9
Assigning Switch Ports to a VLAN 10-10
Mapping 802.1Q VLANs to ISL VLANs 10-11
Clearing 802.1Q-to-ISL VLAN Mappings 10-12

Contents
x
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Deleting a VLAN 10-12
Configuring Auxiliary VLANs 10-13
Understanding Auxiliary VLANs 10-13
Configuring PrivateVLANs 10-16
Private VLAN Configuration Guidelines 10-17
Creating a Private VLAN 10-19
Viewing the Port Capability of a Private VLAN Port 10-22
Deleting a Private VLAN 10-22
Deleting an Isolated orCommunity VLAN 10-23
Deleting a Private VLAN Mapping 10-23
CHAPTER 11 Configuring VLAN Trunks on Fast Ethernet and Gigabit Ethernet Ports 11-1
Understanding How VLAN Trunks Work 11-1
Trunking Overview 11-1
Trunking Modes and Encapsulation Types 11-2
Trunking Support 11-3
802.1Q Trunk Restrictions 11-4
Default Trunk Configuration 11-5
Configuring a Trunk Link 11-5
Configuring an 802.1Q Trunk 11-5
Defining the Allowed VLANs on a Trunk 11-6
Disabling a Trunk Port 11-7
Disabling VLAN 1 on a Trunk Link 11-8
Example VLAN Trunk Configurations 11-9
802.1Q Trunk over a Gigabit EtherChannel Link Example 11-9
Load-Sharing VLAN Traffic over Parallel Trunks Example 11-13
802.1Q Nonegotiate Trunk Configuration Example 11-19
CHAPTER 12 Configuring Dynamic VLAN Membership with VMPS 12-1
Understanding How VMPS Works 12-1
VMPS and Dynamic Port Hardware and Software Requirements 12-2
Default VMPS and Dynamic Port Configuration 12-2
Configuration Guidelines for Dynamic Ports and VMPS 12-3
Configuring VMPS 12-4
Creating the VMPS Database 12-4
Configuring the VMPS Server 12-7
Configuring VMPS Clients 12-7
Monitoring VMPS 12-9

Contents
xi
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Maintaining VMPS 12-9
Configuring Static Ports 12-10
Troubleshooting VMPS and Dynamic Port VLAN Membership 12-10
Troubleshooting VMPS 12-11
Troubleshooting Dynamic Ports 12-11
VMPS Example 12-11
Dynamic Port VLAN Membership with Auxiliary VLANs 12-14
ConfigurationGuidelines 12-14
Configuring Dynamic Port VLAN Membership with Auxiliary VLANs 12-14
CHAPTER 13 Configuring GVRP 13-1
Understanding How GVRPWorks 13-1
GVRP Hardware and Software Requirements 13-1
Default GVRP Configuration 13-2
GVRP Configuration Guidelines 13-2
Configuring GVRP on the Switch 13-2
Enabling GVRP Globally 13-2
Enabling GVRP on Individual 802.1Q Trunk Ports 13-3
Enabling GVRP Dynamic VLAN Creation 13-4
Configuring GVRP Registration 13-4
SendingGVRP VLAN Declarations from Blocking Ports 13-6
Setting the GARP Timers 13-6
Displaying GVRP Statistics 13-7
Clearing GVRP Statistics 13-8
Disabling GVRP on Individual 802.1Q Trunk Ports 13-8
Disabling GVRP Globally 13-8
CHAPTER 14 Configuring QoS 14-1
Understanding How QoS Works 14-1
QoS Overview 14-1
Understanding QoS Terminology 14-2
Understanding Classification and Marking at the Ingress Port 14-3
Understanding Scheduling 14-3
Software Requirements 14-4
QoS Default Configuration 14-4
Configuring QoS on the Switch 14-4
Enabling QoS Globally 14-5
Configuring the Default CoS Value for the Switch 14-5

Contents
xii
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Reverting to the Default Switch CoS Value 14-5
Mapping CoS Values to Transmit Queues and Drop Thresholds 14-6
Reverting to the Default CoS-to-Transmit Queue and Drop Threshold Mapping 14-6
Displaying QoS Information 14-7
Reverting to QoS Defaults 14-7
Disabling QoS 14-7
CHAPTER 15 Configuring Multicast Services 15-1
Understanding How Multicasting Works 15-1
Understanding Multicasting and Multicast Services Operation 15-1
Joining a Multicast Group 15-2
Leaving a Multicast Group 15-2
Understanding GMRP Operation 15-3
Configuring CGMP 15-4
CGMP Hardware and Software Requirements 15-4
Default CGMP Configuration 15-4
Enabling CGMP 15-4
Enabling CGMP Leave Processing 15-5
Enabling CGMP Fast-Leave Processing 15-5
Displaying Multicast Router Information 15-6
Displaying Multicast Group Information 15-6
Displaying CGMP Statistics 15-7
Disabling CGMP Leave Processing 15-8
Disabling CGMP Fast-Leave Processing 15-8
Disabling CGMP 15-8
Configuring GMRP 15-9
GMRP Software Requirements 15-9
Default GMRP Configuration 15-9
Enabling GMRP Globally 15-9
Enabling GMRP on Individual Switch Ports 15-10
Disabling GMRP on IndividualSwitch Ports 15-10
Enabling GMRP Forward-AllOption 15-11
Disabling GMRP Forward-All Option 15-11
Configuring GMRP Registration 15-12
Setting the GARP Timers 15-13
Displaying GMRP Statistics 15-14
Clearing GMRP Statistics 15-15
Disabling GMRP 15-15
Configuring Multicast Router Ports and Group Entries 15-15

Contents
xiii
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Specifying Multicast Router Ports 15-16
Configuring Multicast Groups 15-16
Disabling Multicast Router Ports 15-17
Disabling Multicast Group Entries 15-17
Filtering IGMP Traffic 15-17
Using IGMP Traffic Filtering 15-18
IGMP Software Requirements 15-18
Default IGMP Filter Configuration 15-18
IGMP Multicast Filter Activation 15-19
Configuring Port IP Multicast Filtering 15-20
CHAPTER 16 Configuring Port Security 16-1
Understanding How Port Security Works 16-1
Allowing Traffic Based on the Host MAC Address 16-1
Restricting Traffic Based on the Host MAC Address 16-2
Blocking Unicast Flood Packets on Secure Ports 16-3
Port Security Configuration Guidelines 16-3
Configuring Port Security on the Switch 16-3
Enabling Port Security 16-3
Setting the Maximum Number of Secure MAC Addresses 16-4
Setting the Port Security Age Time 16-5
Clearing MAC Addresses 16-5
Configuring Unicast Flood Blocking on Secure Ports 16-6
Enabling MAC Address Notification 16-7
Setting the Security Violation Action 16-8
Setting the Shutdown Time 16-9
Disabling Port Security 16-9
Restricting Traffic for a Host MAC Address 16-10
Monitoring Port Security 16-10
CHAPTER 17 Configuring Unicast Flood Blocking 17-1
Understanding How Unicast Flood Blocking Works 17-1
Configuration Guidelines forUnicast Flood Blocking 17-2
Configuring Unicast Flood Blocking on the Switch 17-2
Enabling Unicast Flood Blocking 17-2
Disabling Unicast Flood Blocking 17-3
Displaying Unicast Flood Blocking 17-3

Contents
xiv
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
CHAPTER 18 Configuring the IP Permit List 18-1
Understanding How the IP PermitList Works 18-1
IP Permit List Default Configuration 18-2
Configuring the IP Permit List on the Switch 18-2
Adding IP Addresses to the IP Permit List 18-2
Enabling the IP Permit List 18-3
Disabling the IP Permit List 18-4
Clearing an IP PermitList Entry 18-4
CHAPTER 19 Configuring Protocol Filtering 19-1
Understanding How Protocol Filtering Works 19-1
Default Protocol Filtering Configuration 19-2
Configuring Protocol Filtering on the Switch 19-2
Configuring Protocol Filtering 19-2
Disabling Protocol Filtering 19-3
CHAPTER 20 Checking Status and Connectivity 20-1
Checking Module Status 20-1
Checking Port Status 20-2
Displaying the Port MAC Address 20-4
Displaying PortCapabilities 20-5
Using Telnet 20-6
Changing the Login Timer 20-6
Using Secure Shell Encryption forTelnet Sessions 20-7
Monitoring User Sessions 20-8
Using Ping 20-9
Understanding How Ping Works 20-9
Executing Ping 20-10
Using Layer 2 Traceroute 20-11
Layer 2 Traceroute Usage Guidelines 20-11
Identifying a Layer 2 Path 20-11
Using IP Traceroute 20-12
Understanding How IP Traceroute Works 20-12
Executing IP Traceroute 20-13
CHAPTER 21 Configuring CDP 21-1
Understanding How CDP Works 21-1

Contents
xv
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Default CDP Configuration 21-1
Configuring CDP on the Switch 21-2
Setting the CDP Global Enable State 21-2
Setting the CDP Enable State on a Port 21-2
Setting the CDP Message Interval 21-4
Setting the CDP Holdtime 21-4
Displaying CDP Neighbor Information 21-5
CHAPTER 22 Using Switch TopN Reports 22-1
Understanding How Switch TopN Reports Works 22-1
RunningSwitch TopN Reports Withoutthe Background Keyword 22-2
RunningSwitch TopN Reports with the Background Keyword 22-2
Runningand Viewing Switch TopN Reports 22-3
CHAPTER 23 Configuring UDLD 23-1
Understanding How UDLD Works 23-1
UDLD Software and Hardware Requirements 23-2
Default UDLD Configuration 23-2
Configuring UDLD on the Switch 23-3
Enabling UDLD Globally 23-3
Enabling UDLD on IndividualPorts 23-4
Disabling UDLD on Individual Ports 23-4
Disabling UDLD Globally 23-4
Specifying the UDLD Message Interval 23-5
Enabling UDLD Aggressive Mode 23-5
Displaying the UDLD Configuration 23-6
CHAPTER 24 Configuring SNMP 24-1
SNMP Terminology 24-1
Understanding How SNMP Works 24-3
Security Models and Levels 24-4
SNMP ifindex Persistence Feature 24-4
Understanding How SNMPv1 and SNMPv2c Work 24-5
SNMPv1 and SNMPv2c Default Configuration 24-6
Understanding SNMPv3 24-6
Benefits of SNMPv3 24-6
SNMP Entity 24-6
Configuring SNMP from an NMS 24-9

Contents
xvi
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Configuring SNMPv1 and SNMPv2c from the CLI 24-9
SNMPv1 and SNMPv2c Enhancements in Software Release 7.5(1) 24-10
Configuring SNMPv3 from the CLI 24-14
Using CiscoWorks2000 24-17
CHAPTER 25 Configuring RMON 25-1
Understanding How RMON Works 25-1
Enabling RMON 25-2
Viewing RMON Data 25-2
Supported RMON and RMON2 MIB Objects 25-3
CHAPTER 26 Configuring SPAN and RSPAN 26-1
Understanding How SPAN and RSPAN Work 26-1
SPAN Session 26-1
Destination Port 26-2
Source Port 26-2
Reflector Port 26-3
Ingress SPAN 26-3
Egress SPAN 26-3
VSPAN 26-3
Trunk VLAN Filtering 26-4
SPAN Traffic 26-4
SPAN and RSPAN Session Limits 26-4
Configuring SPAN 26-4
Understanding How SPAN Works 26-4
SPAN Configuration Guidelines 26-5
Configuring SPAN 26-6
Configuring RSPAN 26-8
RSPAN Software and Hardware Requirements 26-8
Understanding How RSPAN Works 26-8
RSPAN Configuration Guidelines 26-9
Configuring RSPAN 26-10
RSPAN Configuration Examples 26-14
CHAPTER 27 Administering the Switch 27-1
Setting the System Name and System Prompt 27-1
Configuring the System Name and Prompt 27-2
Setting the System Contact and Location 27-3

Contents
xvii
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Setting the System Clock 27-4
Creating a Login Banner 27-4
Configuring a Login Banner 27-4
Clearing the Login Banner 27-5
Enabling or Disabling the “Cisco Systems Console” Telnet Login Banner 27-5
Defining and Using Command Aliases 27-6
Defining and UsingIP Aliases 27-7
Configuring Permanent and StaticARP Entries 27-8
Configuring Static Routes 27-9
Scheduling a System Reset 27-10
Scheduling a Reset at a Specific Time 27-10
Scheduling a Reset Within a Specified Amount of Time 27-11
Generating System Status Reports for Tech Support 27-12
CHAPTER 28 Power Management 28-1
Understanding How Power Management Works on the Catalyst4500 Series Switches 28-1
Power Management Overview 28-2
Understanding Power Management Modes 28-2
Available Power for Power Supplies 28-4
Power Management Limitations 28-4
1400 W DC Power Supply Guidelines and Restrictions 28-5
Understanding How Power Management Works on the Catalyst 4006 Switch 28-6
Understanding Power Redundancy 28-6
1+1 Redundancy ModeGuidelines and Restrictions 28-7
1+1 Redundancy ModeLimitations 28-7
Power Consumption for Modules 28-9
Migrating a Supervisor Engine II from a Catalyst 4006 Switch to a Catalyst 4500 Series Switch 28-10
Understanding How PoE Works 28-11
PoE Management Modes 28-12
Power Requirements 28-12
Phone Detection Summary 28-14
Configuring Power Management 28-14
Setting Redundant Mode for the Catalyst 4500 Series Switches 28-14
Setting Combined Mode on the Catalyst 4500 Series Switches 28-15
Setting the DC Power Input 28-16
Setting the Power Budget for the Catalyst 4006 Switch 28-16
Displaying System Information 28-17
MigratingaSupervisorEngineIIfromaCatalyst4006SwitchtoaCatalyst4500SeriesSwitch 28-18

Contents
xviii
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Configuring PoE 28-18
Setting the Power Mode of a Portor Group of Ports 28-18
Setting the Default PowerAllocation for a Port 28-19
Displaying the Power Status for Modules and Individual Ports 28-19
CHAPTER 29 Configuring VoIP 29-1
Hardware and Software Requirements 29-1
Overview of IP Phones 29-2
Configuring VoIP on a Switch 29-3
CHAPTER 30 Configuring Switch Access Using AAA 30-1
Understanding How Authentication Works 30-1
Understanding How Login Authentication Works 30-2
Understanding How Local Authentication Works 30-2
Understanding How Local User Authentication Works 30-3
Understanding How TACACS+ Authentication Works 30-3
Understanding How RADIUS Authentication Works 30-4
Understanding How Kerberos Authentication Works 30-5
Configuring Authentication 30-8
Authentication Default Configuration 30-8
Authentication Configuration Guidelines 30-9
Configuring Login Authentication 30-9
Configuring Local Authentication 30-12
Configuring Local User Authentication 30-15
Configuring TACACS+ Authentication 30-17
Configuring RADIUS Authentication 30-23
Configuring Kerberos Authentication 30-30
Authentication Example 30-39
Understanding How Authorization Works 30-40
Authorization Events 30-40
TACACS+ Primary and Fallback Options 30-41
TACACS+ Command Authorization 30-41
RADIUS Authorization 30-42
Configuring Authorization 30-42
Authorization Default Configuration 30-42
TACACS+ Authorization Configuration Guidelines 30-42
Configuring TACACS+ Authorization 30-43
Authorization Example 30-46

Contents
xix
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Understanding How Accounting Works 30-47
Accounting Overview 30-47
Accounting Events 30-47
Specifying When to Create Accounting Records 30-48
Specifying RADIUS Servers 30-48
Updating the Server 30-49
Suppressing Accounting 30-49
Configuring Accounting 30-49
Accounting Default Configuration 30-49
Accounting Configuration Guidelines 30-50
Configuring Accounting 30-50
Accounting Example 30-53
CHAPTER 31 Configuring 802.1x Authentication 31-1
Understanding How 802.1x Authentication Works 31-1
Device Roles 31-2
Authentication Initiation and Message Exchange 31-3
Ports in Authorized and Unauthorized States 31-4
Authentication Server 31-5
802.1x Parameters Configurable on the Switch 31-6
802.1x VLAN Assignment Using a RADIUS Server 31-6
Using 802.1x Authentication with Port Security 31-7
Using 802.1x Authentication on Ports Configured for Auxiliary VLAN Traffic 31-8
Using 802.1x Authentication forGuest VLANs 31-8
Authentication Default Configuration 31-9
Authentication Configuration Guidelines 31-9
Configuring 802.1x Authentication on the Switch 31-10
Enabling 802.1x Globally 31-10
Disabling 802.1x Globally 31-10
Enabling and Initializing 802.1x Authentication for Individual Ports 31-10
Enabling Multiple 802.1x Authentications 31-11
Setting and Enabling Automatic Reauthentication ofthe Host 31-12
Manually Reauthenticating the Host 31-13
Enabling Multiple Hosts 31-13
Disabling Multiple Hosts 31-14
Setting the Quiet Period 31-14
Setting the Authenticator-to-Host Retransmission Time for EAP-Request/Identity Frames 31-14
Setting the Supplicant-to-Host Retransmission Time for EAP-Request Frames 31-15

Contents
xx
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Setting the Back-End Authenticator-to-Authentication-Server Retransmission Time forTransport
Layer Packets 31-15
Setting the Back-End Authenticator-to-Host Frame-Retransmission Number 31-16
Setting the Shutdown Timeout Period 31-16
Setting the Back-End Authenticator-to-Host Frame-Retransmission Number 31-16
Setting the Back-End Authenticator-to-Host Frame-Retransmission Number 31-17
Resetting the 802.1x Configuration Parameters to the Default Values 31-17
Setting the Trace Severity 31-18
Using the show Commands 31-18
CHAPTER 32 Modifying the Switch Boot Configuration 32-1
Understanding How the Switch Boot Configuration Works 32-1
Understanding the Boot Process 32-1
Understanding the ROM Monitor 32-2
Understanding the Configuration Register 32-2
Understanding the BOOT Environment Variable 32-3
Understanding the CONFIG_FILE Environment Variable 32-3
Default Switch Boot Configuration 32-4
Setting the Configuration Register 32-4
Setting the Boot Field in the Configuration Register 32-4
Setting CONFIG_FILE Recurrence 32-5
Setting the Switch to Ignore the NVRAM Configuration 32-6
Setting the BOOT Environment Variable 32-6
Setting the BOOT Environment Variable 32-6
Clearing the BOOT Environment Variable Settings 32-7
Setting and Clearing the CONFIG_FILE Environment Variable 32-7
Setting the CONFIG_FILE Environment Variable 32-7
Clearing CONFIG_FILE Environment Variable Entries 32-8
Displaying the Switch Boot Configuration 32-8
CHAPTER 33 Working with System Software Images 33-1
Software Image Naming Conventions 33-1
Downloading System Software Images to the Switch Using TFTP 33-1
Understanding How TFTP Software Image Downloads Work 33-2
Preparing to Download an Image Using TFTP 33-2
Downloading SupervisorEngine Images Using TFTP 33-2
Sample TFTP DownloadProcedures 33-3
Uploading System Software Images to a TFTP Server 33-4
Preparing to Upload an Image to a TFTP Server 33-5