Cisco WS-C3750-48PS-S User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Catalyst 3750 Switch
Software Configuration Guide
Cisco IOS Release 12.2(20)SE
May 2004
Customer Order Number: DOC-7816180=
Text Part Number: 78-16180-02

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CCIP, CCSP, the Cisco Arrow logo, the Cisco Powered Network mark, Cisco Unity, Follow Me Browsing, FormShare, and StackWise are trademarks of Cisco Systems, Inc.;
Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE,
CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems
logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS,
IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar,
Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, Registrar, ScriptShare, SlideCast, SMARTnet, StrataView Plus, SwitchProbe, TeleRouter, The Fastest Way
to Increase Your Internet Quotient, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0403R)
Catalyst 3750 Switch Software Configuration Guide
Copyright © 2003–2004 Cisco Systems, Inc. All rights reserved.

iii
Catalyst 3750 Switch Software Configuration Guide
78-16180-02
CONTENTS
Preface xxxv
Audience xxxv
Purpose xxxv
Conventions xxxvi
Related Publications xxxvii
Obtaining Documentation xxxvii
Cisco.com xxxvii
Ordering Documentation xxxviii
Documentation Feedback xxxviii
Obtaining Technical Assistance xxxviii
Cisco Technical Support Website xxxix
Submitting a Service Request xxxix
Definitions of Service Request Severity xxxix
Obtaining Additional Publications and Information xl
CHAPTER 1Overview 1-1
Features 1-1
Default Settings After Initial Switch Configuration 1-10
Network Configuration Examples 1-12
Design Concepts for Using the Switch 1-12
Small to Medium-Sized Network Using Catalyst 3750 Switches 1-17
Large Network Using Catalyst 3750 Switches 1-18
Multidwelling Network Using Catalyst 3750 Switches 1-21
Long-Distance, High-Bandwidth Transport Configuration 1-22
Where to Go Next 1-23
CHAPTER 2Using the Command-Line Interface 2-1
Understanding Command Modes 2-1
Understanding the Help System 2-3
Understanding Abbreviated Commands 2-3
Understanding no and default Forms of Commands 2-4
Understanding CLI Error Messages 2-4
Using Command History 2-4

Contents
iv
Catalyst 3750 Switch Software Configuration Guide
78-16180-02
Changing the Command History Buffer Size 2-5
Recalling Commands 2-5
Disabling the Command History Feature 2-5
Using Editing Features 2-6
Enabling and Disabling Editing Features 2-6
Editing Commands through Keystrokes 2-6
Editing Command Lines that Wrap 2-8
Searching and Filtering Output of show and more Commands 2-8
Accessing the CLI 2-9
Accessing the CLI through a Console Connection or through Telnet 2-9
Accessing the CLI from a Browser 2-10
CHAPTER 3Getting Started with CMS 3-1
Understanding CMS 3-1
Front Panel View 3-2
Topology View 3-2
CMS Menu Bar, Toolbar, and Feature Bar 3-2
Online Help 3-5
Configuration Modes 3-5
Guide Mode 3-5
Expert Mode 3-6
Wizards 3-6
Privilege Levels 3-7
Access to Older Switches in a Cluster 3-7
Configuring CMS 3-8
CMS Requirements 3-8
Minimum Hardware Configuration 3-8
Operating System and Browser Support 3-9
CMS Plug-In 3-9
Cross-Platform Considerations 3-9
HTTP Access to CMS 3-10
Specifying an HTTP Port (Nondefault Configuration Only) 3-10
Configuring an Authentication Method (Nondefault Configuration Only) 3-10
Displaying CMS 3-11
Launching CMS 3-11
Front Panel View 3-14
Topology View 3-15
CMS Icons 3-16
Where to Go Next 3-16

Contents
v
Catalyst 3750 Switch Software Configuration Guide
78-16180-02
CHAPTER 4Assigning the Switch IP Address and Default Gateway 4-1
Understanding the Boot Process 4-1
Assigning Switch Information 4-2
Default Switch Information 4-3
Understanding DHCP-Based Autoconfiguration 4-3
DHCP Client Request Process 4-4
Configuring DHCP-Based Autoconfiguration 4-5
DHCP Server Configuration Guidelines 4-5
Configuring the TFTP Server 4-5
Configuring the DNS 4-6
Configuring the Relay Device 4-6
Obtaining Configuration Files 4-7
Example Configuration 4-8
Manually Assigning IP Information 4-10
Checking and Saving the Running Configuration 4-10
Modifying the Startup Configuration 4-11
Default Boot Configuration 4-12
Automatically Downloading a Configuration File 4-12
Specifying the Filename to Read and Write the System Configuration 4-12
Booting Manually 4-13
Booting a Specific Software Image 4-13
Controlling Environment Variables 4-14
Scheduling a Reload of the Software Image 4-16
Configuring a Scheduled Reload 4-16
Displaying Scheduled Reload Information 4-17
CHAPTER 5Managing Switch Stacks 5-1
Understanding Switch Stacks 5-1
Switch Stack Membership 5-3
Stack Master Election and Re-Election 5-4
Switch Stack Bridge ID and Router MAC Address 5-5
Stack Member Numbers 5-6
Stack Member Priority Values 5-7
Switch Stack Offline Configuration 5-7
Effects of Adding a Provisioned Switch to a Switch Stack 5-8
Effects of Replacing a Provisioned Switch in a Switch Stack 5-10
Effects of Removing a Provisioned Switch from a Switch Stack 5-10
Hardware Compatibility in Switch Stacks 5-10
Software Compatibility in Switch Stacks 5-10

Contents
vi
Catalyst 3750 Switch Software Configuration Guide
78-16180-02
Compatibility Recommendations 5-11
Incompatible Software and Stack Member Image Upgrades 5-11
Stack Protocol Version Compatibility 5-11
Switch Stack Configuration Files 5-12
Additional Considerations for System-Wide Configuration on Switch Stacks 5-13
Switch Stack Management Connectivity 5-14
Connectivity to the Switch Stack Through an IP Address 5-14
Connectivity to the Switch Stack Through an SSH Session 5-14
Connectivity to the Switch Stack Through Console Ports 5-14
Connectivity to Specific Stack Members 5-14
Switch Stack Configuration Scenarios 5-15
Assigning Stack Member Information 5-17
Default Switch Stack Configuration 5-17
Assigning a Stack Member Number 5-17
Setting the Stack Member Priority Value 5-18
Provisioning a New Member for a Switch Stack 5-18
Accessing the CLI of a Specific Stack Member 5-19
Displaying Switch Stack Information 5-20
CHAPTER 6Clustering Switches 6-1
Understanding Switch Clusters 6-2
Cluster Command Switch Characteristics 6-3
Standby Cluster Command Switch Characteristics 6-3
Candidate Switch and Cluster Member Switch Characteristics 6-4
Planning a Switch Cluster 6-4
Automatic Discovery of Cluster Candidates and Members 6-5
Discovery Through CDP Hops 6-5
Discovery Through Non-CDP-Capable and Noncluster-Capable Devices 6-6
Discovery Through Different VLANs 6-7
Discovery Through Different Management VLANs 6-7
Discovery Through Routed Ports 6-8
Discovery of Newly Installed Switches 6-9
HSRP and Standby Cluster Command Switches 6-10
Virtual IP Addresses 6-11
Other Considerations for Cluster Standby Groups 6-11
Automatic Recovery of Cluster Configuration 6-12
IP Addresses 6-13
Host Names 6-13
Passwords 6-14

Contents
vii
Catalyst 3750 Switch Software Configuration Guide
78-16180-02
SNMP Community Strings 6-14
Switch Clusters and Switch Stacks 6-14
TACACS+ and RADIUS 6-16
Access Modes in CMS 6-16
LRE Profiles 6-17
Availability of Switch-Specific Features in Switch Clusters 6-17
Creating a Switch Cluster 6-17
Enabling a Cluster Command Switch 6-17
Adding Cluster Member Switches 6-18
Creating a Cluster Standby Group 6-20
Verifying a Switch Cluster 6-22
Using the CLI to Manage Switch Clusters 6-23
Catalyst 1900 and Catalyst 2820 CLI Considerations 6-23
Using SNMP to Manage Switch Clusters 6-24
CHAPTER 7Administering the Switch 7-1
Managing the System Time and Date 7-1
Understanding the System Clock 7-2
Understanding Network Time Protocol 7-2
Configuring NTP 7-4
Default NTP Configuration 7-4
Configuring NTP Authentication 7-5
Configuring NTP Associations 7-6
Configuring NTP Broadcast Service 7-7
Configuring NTP Access Restrictions 7-8
Configuring the Source IP Address for NTP Packets 7-10
Displaying the NTP Configuration 7-11
Configuring Time and Date Manually 7-11
Setting the System Clock 7-11
Displaying the Time and Date Configuration 7-12
Configuring the Time Zone 7-12
Configuring Summer Time (Daylight Saving Time) 7-13
Configuring a System Name and Prompt 7-14
Default System Name and Prompt Configuration 7-15
Configuring a System Name 7-15
Configuring a System Prompt 7-16
Understanding DNS 7-16
Default DNS Configuration 7-17
Setting Up DNS 7-17

Contents
viii
Catalyst 3750 Switch Software Configuration Guide
78-16180-02
Displaying the DNS Configuration 7-18
Creating a Banner 7-18
Default Banner Configuration 7-18
Configuring a Message-of-the-Day Login Banner 7-19
Configuring a Login Banner 7-20
Managing the MAC Address Table 7-20
Building the Address Table 7-21
MAC Addresses and VLANs 7-21
MAC Addresses and Switch Stacks 7-22
Default MAC Address Table Configuration 7-22
Changing the Address Aging Time 7-22
Removing Dynamic Address Entries 7-23
Configuring MAC Address Notification Traps 7-23
Adding and Removing Static Address Entries 7-25
Configuring Unicast MAC Address Filtering 7-26
Displaying Address Table Entries 7-28
Managing the ARP Table 7-28
CHAPTER 8Configuring SDM Templates 8-1
Understanding the SDM Templates 8-1
SDM Templates and Switch Stacks 8-2
Configuring the Switch SDM Template 8-3
Default SDM Template 8-3
SDM Template Configuration Guidelines 8-4
Setting the SDM Template 8-4
Displaying the SDM Templates 8-5
CHAPTER 9Configuring Switch-Based Authentication 9-1
Preventing Unauthorized Access to Your Switch 9-1
Protecting Access to Privileged EXEC Commands 9-2
Default Password and Privilege Level Configuration 9-2
Setting or Changing a Static Enable Password 9-3
Protecting Enable and Enable Secret Passwords with Encryption 9-4
Disabling Password Recovery 9-5
Setting a Telnet Password for a Terminal Line 9-6
Configuring Username and Password Pairs 9-7
Configuring Multiple Privilege Levels 9-8
Setting the Privilege Level for a Command 9-8
Changing the Default Privilege Level for Lines 9-9

Contents
ix
Catalyst 3750 Switch Software Configuration Guide
78-16180-02
Logging into and Exiting a Privilege Level 9-10
Controlling Switch Access with TACACS+ 9-10
Understanding TACACS+ 9-10
TACACS+ Operation 9-12
Configuring TACACS+ 9-13
Default TACACS+ Configuration 9-13
Identifying the TACACS+ Server Host and Setting the Authentication Key 9-13
Configuring TACACS+ Login Authentication 9-14
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 9-16
Starting TACACS+ Accounting 9-17
Displaying the TACACS+ Configuration 9-17
Controlling Switch Access with RADIUS 9-18
Understanding RADIUS 9-18
RADIUS Operation 9-19
Configuring RADIUS 9-20
Default RADIUS Configuration 9-20
Identifying the RADIUS Server Host 9-21
Configuring RADIUS Login Authentication 9-23
Defining AAA Server Groups 9-25
Configuring RADIUS Authorization for User Privileged Access and Network Services 9-27
Starting RADIUS Accounting 9-28
Configuring Settings for All RADIUS Servers 9-29
Configuring the Switch to Use Vendor-Specific RADIUS Attributes 9-29
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 9-31
Displaying the RADIUS Configuration 9-31
Controlling Switch Access with Kerberos 9-32
Understanding Kerberos 9-32
Kerberos Operation 9-34
Authenticating to a Boundary Switch 9-35
Obtaining a TGT from a KDC 9-35
Authenticating to Network Services 9-35
Configuring Kerberos 9-36
Configuring the Switch for Local Authentication and Authorization 9-36
Configuring the Switch for Secure Shell 9-37
Understanding SSH 9-38
SSH Servers, Integrated Clients, and Supported Versions 9-38
Limitations 9-39
Configuring SSH 9-39
Configuration Guidelines 9-39

Contents
x
Catalyst 3750 Switch Software Configuration Guide
78-16180-02
Setting Up the Switch to Run SSH 9-39
Configuring the SSH Server 9-40
Displaying the SSH Configuration and Status 9-41
CHAPTER 10 Configuring 802.1x Port-Based Authentication 10-1
Understanding 802.1x Port-Based Authentication 10-1
Device Roles 10-2
Authentication Initiation and Message Exchange 10-3
Ports in Authorized and Unauthorized States 10-4
802.1x Accounting 10-5
Supported Topologies 10-5
Using 802.1x with Port Security 10-6
Using 802.1x with Voice VLAN Ports 10-7
Using 802.1x with VLAN Assignment 10-7
Using 802.1x with Guest VLAN 10-8
Using 802.1x with Per-User ACLs 10-9
802.1x and Switch Stacks 10-10
Configuring 802.1x Authentication 10-10
Default 802.1x Configuration 10-11
802.1x Configuration Guidelines 10-12
Upgrading from a Previous Software Release 10-13
Configuring 802.1x Authentication 10-13
Configuring the Switch-to-RADIUS-Server Communication 10-15
Configuring Periodic Re-Authentication 10-16
Manually Re-Authenticating a Client Connected to a Port 10-16
Changing the Quiet Period 10-17
Changing the Switch-to-Client Retransmission Time 10-17
Setting the Switch-to-Client Frame-Retransmission Number 10-18
Setting the Re-Authentication Number 10-18
Configuring the Host Mode 10-19
Configuring a Guest VLAN 10-20
Resetting the 802.1x Configuration to the Default Values 10-21
Configuring 802.1x Accounting 10-21
Displaying 802.1x Statistics and Status 10-22
CHAPTER 11 Configuring Interface Characteristics 11-1
Understanding Interface Types 11-1
Port-Based VLANs 11-2
Switch Ports 11-2