Cisco WS-C3550-12G User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Catalyst 3550 Multilayer Switch
Software Configuration Guide
Cisco IOS Release 12.1(8)EA1
February 2002
Customer Order Number: DOC-7811194=
Text Part Number: 78-11194-03

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT
NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE
PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR
APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION
PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO
LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of
UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED
“AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED,
INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL
DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR
INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
AccessPath, AtmDirector, Browse with Me, CCIP, CCSI, CD-PAC, CiscoLink, the Cisco Powered Network logo, Cisco Systems Networking Academy,
the Cisco Systems Networking Academy logo, Cisco Unity, Fast Step, Follow Me Browsing, FormShare, FrameShare, IGX, Internet Quotient, IP/VC, iQ
Breakthrough, iQ Expertise, iQ FastTrack, the iQ Logo, iQ Net Readiness Scorecard, MGX, the Networkers logo, ScriptBuilder, ScriptShare, SMARTnet,
TransPath, Voice LAN, Wavelength Router, and WebViewer are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn,
and Discover All That’s Possible are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP,
Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems
logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, FastHub, FastSwitch, GigaStack, IOS, IP/TV, LightStream,
MICA, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, SlideCast, StrataView Plus, Stratm, SwitchProbe, TeleRouter,
and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.
All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. (0110R)
Catalyst 3550 Multilayer Switch Software Configuration Guide
Copyright © 2002, Cisco Systems, Inc.
All rights reserved.

iii
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-03
CONTENTS
Preface xxvii
Audience xxvii
Purpose xxvii
Organization xxviii
Conventions xxx
Related Publications xxxi
Obtaining Documentation xxxi
World Wide Web xxxi
Documentation CD-ROM xxxi
Ordering Documentation xxxii
Documentation Feedback xxxii
Obtaining Technical Assistance xxxii
Cisco.com xxxiii
Technical Assistance Center xxxiii
Cisco TAC Web Site xxxiii
Cisco TAC Escalation Center xxxiv
CHAPTER 1Overview 1-1
Features 1-1
ManagementOptions 1-5
ManagementInterface Options 1-5
Advantages of Using CMS and Clustering Switches 1-6
Network Configuration Examples 1-7
Design Concepts 1-7
Small to Medium-Sized Network Using Mixed Switches 1-11
Large Network Using Only Catalyst 3550 Switches 1-13
Multidwelling Network Using Catalyst 3550 Switches 1-14
CHAPTER 2Using the Command-Line Interface 2-1
IOS Command Modes 2-1
Getting Help 2-3
Abbreviating Commands 2-3
Using no and default Forms of Commands 2-4

Contents
iv
Catalyst 3550 Multilayer Switch Software Configuration Guide 78-11194-03
Understanding CLI Messages 2-4
Using Command History 2-5
Changing the Command History Buffer Size 2-5
Recalling Commands 2-5
Disabling the Command History Feature 2-5
Using Editing Features 2-6
Enabling and Disabling Editing Features 2-6
Editing Commands through Keystrokes 2-6
Editing Command Lines that Wrap 2-8
Searching and Filtering Output of show and more Commands 2-8
Accessing the CLI 2-9
CHAPTER 3Getting Started with CMS 3-1
Features 3-2
Front Panel View 3-4
Cluster Tree 3-5
Front-PanelImages 3-6
Redundant Power System LED 3-7
Port Modes and LEDs 3-8
VLAN Membership Modes 3-9
Topology View 3-10
Topology Icons 3-12
Device and Link Labels 3-13
Colors in the Topology View 3-14
Topology Display Options 3-14
Menus and Toolbar 3-15
Menu Bar 3-15
Toolbar 3-21
Front Panel View Popup Menus 3-22
Device Popup Menu 3-22
Port Popup Menu 3-22
Topology View Popup Menus 3-23
Link Popup Menu 3-23
Device Popup Menus 3-24
Interaction Modes 3-26
Guide Mode 3-26
Expert Mode 3-26
Wizards 3-26

Contents
v
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-03
ToolTips 3-27
Online Help 3-27
CMS Window Components 3-28
Host Name List 3-28
Tabs, Lists, and Tables 3-29
Icons Used in Windows 3-29
Buttons 3-29
Accessing CMS 3-30
Access Modes in CMS 3-31
HTTP Access to CMS 3-31
Verifying Your Changes 3-32
Change Notification 3-32
Error Checking 3-32
Saving Your Changes 3-32
Using Different Versions of CMS 3-33
Where to Go Next 3-33
CHAPTER 4Assigning the Switch IP Address and Default Gateway 4-1
Understanding the Boot Process 4-1
Assigning Switch Information 4-2
Default Switch Information 4-3
Understanding DHCP-Based Autoconfiguration 4-3
DHCP Client Request Process 4-4
Configuring the DHCP Server 4-5
Configuring the TFTP Server 4-5
Configuring the DNS 4-6
Configuring the Relay Device 4-6
Obtaining Configuration Files 4-7
Example Configuration 4-8
Manually Assigning IP Information 4-10
Checking and Saving the Running Configuration 4-10
Modifying the Startup Configuration 4-12
Default Boot Configuration 4-12
Automatically Downloading a Configuration File 4-12
Specifying the Filename to Read and Write the System Configuration 4-13
Booting Manually 4-13
Booting a Specific Software Image 4-14
Controlling Environment Variables 4-15

Contents
vi
Catalyst 3550 Multilayer Switch Software Configuration Guide 78-11194-03
Scheduling a Reload of the Software Image 4-17
Configuring a Scheduled Reload 4-17
Displaying Scheduled Reload Information 4-18
CHAPTER 5Clustering Switches 5-1
Understanding Switch Clusters 5-2
Command Switch Characteristics 5-2
Standby Command Switch Characteristics 5-3
Candidate and Member Switches Characteristics 5-3
Planning a Switch Cluster 5-4
Automatic Discovery of Cluster Candidates and Members 5-4
Discovery through CDP Hops 5-5
Discovery through Non-CDP-Capable and Noncluster-Capable Devices 5-6
Discovery through Different VLANs 5-7
Discovery through the Same Management VLAN 5-8
Discovery through Different Management VLANs 5-9
Discovery through Routed Ports 5-10
Discovery of Newly Installed Switches 5-11
HSRP and Standby Command Switches 5-12
Virtual IP Addresses 5-13
Automatic Recovery of Cluster Configuration 5-13
Considerations for Cluster Standby Groups 5-14
IP Addresses 5-15
Host Names 5-16
Passwords 5-16
SNMP Community Strings 5-16
TACACS+ 5-17
Access Modes in CMS 5-17
LRE Profiles 5-17
Availability of Switch-Specific Features in Switch Clusters 5-18
Creating a Switch Cluster 5-18
Enabling a Command Switch 5-19
Adding Member Switches 5-20
Creating a Cluster Standby Group 5-22
Verifying a Switch Cluster 5-24
Using the CLI to Manage Switch Clusters 5-25
Catalyst 1900 and Catalyst 2820 CLI Considerations 5-25
Using SNMP to Manage Switch Clusters 5-26

Contents
vii
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-03
CHAPTER 6Administering the Switch 6-1
Preventing Unauthorized Access to Your Switch 6-1
Protecting Access to Privileged EXEC Commands 6-2
Default Password and Privilege Level Configuration 6-3
Setting or Changing a Static Enable Password 6-3
Protecting Enable and Enable Secret Passwords with Encryption 6-4
Disabling Password Recovery 6-5
Setting a Telnet Password for a Terminal Line 6-6
Configuring Username and Password Pairs 6-7
Configuring Multiple Privilege Levels 6-8
Setting the Privilege Level for a Command 6-8
Changing the Default Privilege Level for Lines 6-9
Logging into and Exiting a Privilege Level 6-10
Controlling Switch Access with TACACS+ 6-10
Understanding TACACS+ 6-10
TACACS+ Operation 6-12
Configuring TACACS+ 6-13
Default TACACS+ Configuration 6-13
Identifying the TACACS+ Server Host and Setting the Authentication Key 6-13
Configuring TACACS+ Login Authentication 6-14
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 6-16
Starting TACACS+ Accounting 6-17
Displaying the TACACS+ Configuration 6-17
Controlling Switch Access with RADIUS 6-17
Understanding RADIUS 6-18
RADIUS Operation 6-19
Configuring RADIUS 6-19
Default RADIUS Configuration 6-20
Identifying the RADIUS Server Host 6-20
Configuring RADIUS Login Authentication 6-23
Defining AAA Server Groups 6-24
Configuring RADIUS Authorization for User Privileged Access and Network Services 6-26
Starting RADIUS Accounting 6-27
Configuring Settings for All RADIUS Servers 6-28
Configuring the Switch to Use Vendor-Specific RADIUS Attributes 6-28
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 6-29
Displaying the RADIUS Configuration 6-30
Configuring the Switch for Local Authentication and Authorization 6-31

Contents
viii
Catalyst 3550 Multilayer Switch Software Configuration Guide 78-11194-03
Managing the System Time and Date 6-32
Understanding the System Clock 6-32
Understanding Network Time Protocol 6-32
Configuring NTP 6-34
Default NTP Configuration 6-35
Configuring NTP Authentication 6-35
Configuring NTP Associations 6-36
Configuring NTP Broadcast Service 6-37
Configuring NTP Access Restrictions 6-38
Configuring the Source IP Address for NTP Packets 6-40
Displaying the NTP Configuration 6-41
Configuring Time and Date Manually 6-41
Setting the System Clock 6-42
Displaying the Time and Date Configuration 6-42
Configuring the TimeZone 6-43
Configuring Summer Time (Daylight Saving Time) 6-44
Configuring a System Nameand Prompt 6-46
Default System Name and Prompt Configuration 6-46
Configuring a System Name 6-46
Configuring a System Prompt 6-47
Understanding DNS 6-47
Default DNS Configuration 6-48
Setting Up DNS 6-48
Displaying the DNS Configuration 6-49
Creating a Banner 6-49
Default Banner Configuration 6-49
Configuring a Message-of-the-Day Login Banner 6-50
Configuring a Login Banner 6-51
Managing the MAC Address Table 6-51
Building the Address Table 6-52
MAC Addresses and VLANs 6-52
Default MAC Address Table Configuration 6-53
Changing the Address Aging Time 6-53
Removing Dynamic Address Entries 6-54
Configuring MAC AddressNotification Traps 6-54
Adding and Removing Static Address Entries 6-56
Displaying Address Table Entries 6-57
Optimizing System Resourcesfor User-Selected Features 6-57
Using the Templates 6-59

Contents
ix
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-03
CHAPTER 7Configuring 802.1X Port-Based Authentication 7-1
Understanding 802.1X Port-Based Authentication 7-1
Device Roles 7-2
Authentication Initiation and Message Exchange 7-3
Ports in Authorized and Unauthorized States 7-4
Supported Topologies 7-4
Configuring 802.1X Authentication 7-5
Default 802.1X Configuration 7-6
802.1X Configuration Guidelines 7-7
Enabling 802.1X Authentication 7-8
Configuring the Switch-to-RADIUS-ServerCommunication 7-9
Enabling Periodic Re-Authentication 7-10
Manually Re-Authenticating a Client Connected to a Port 7-11
Changing the Quiet Period 7-11
Changing the Switch-to-Client Retransmission Time 7-12
Setting the Switch-to-Client Frame-Retransmission Number 7-13
Enabling Multiple Hosts 7-13
Resetting the 802.1X Configuration to the Default Values 7-14
Displaying 802.1X Statisticsand Status 7-14
CHAPTER 8Configuring Interface Characteristics 8-1
Understanding Interface Types 8-1
Port-Based VLANs 8-2
Switch Ports 8-2
Access Ports 8-2
Trunk Ports 8-3
EtherChannelPort Groups 8-3
Switch Virtual Interfaces 8-4
Routed Ports 8-4
Connecting Interfaces 8-5
Using the Interface Command 8-6
Procedures for Configuring Interfaces 8-7
Configuring a Range of Interfaces 8-9
Configuring and Using Interface Range Macros 8-11
Configuring Layer 2 Interfaces 8-12
Default Layer 2 EthernetInterface Configuration 8-13
Configuring Interface Speed and Duplex Mode 8-14
ConfigurationGuidelines 8-14
Setting the Interface Speed and Duplex Parameters 8-14

Contents
x
Catalyst 3550 Multilayer Switch Software Configuration Guide 78-11194-03
Configuring IEEE 802.3X Flow Control 8-16
Adding a Description foran Interface 8-17
Monitoring and Maintaining the Layer 2 Interface 8-18
Monitoring Interface and ControllerStatus 8-18
Clearing and Resetting Interfaces and Counters 8-20
Shutting Down and Restarting the Interface 8-21
Configuring Layer 3 Interfaces 8-22
CHAPTER 9Creating and Maintaining VLANs 9-1
Understanding VLANs 9-1
Number of SupportedVLANs 9-2
VLAN Port Membership Modes 9-3
Using the VLAN Trunking Protocol 9-3
The VTP Domain and VTP Modes 9-4
VTP Advertisements 9-5
VTP Version 2 9-6
VTP Pruning 9-6
Configuring VTP 9-8
Default VTP Configuration 9-8
VTP Configuration Guidelines 9-8
Configuring a VTP Server 9-10
Configuring a VTP Client 9-11
Disabling VTP (VTP Transparent Mode) 9-11
Enabling VTP Version 2 9-12
Enabling VTP Pruning 9-13
Monitoring VTP 9-13
VLANs in the VTP Database 9-15
Token Ring VLANs 9-15
Default VLAN Configuration 9-15
VLAN Configuration Guidelines 9-16
Configuring VLANs in the VTP Database 9-17
Adding an Ethernet VLAN 9-17
Modifying an Ethernet VLAN 9-18
Deleting a VLAN from the Database 9-18
Assigning Static-Access Ports to a VLAN 9-19
Displaying VLANs in the VTP Database 9-21
Understanding VLAN Trunks 9-22
Trunking Overview 9-22
Encapsulation Types 9-23