D-Link DWS-1008 Instruction Manual

1
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
Table of Contents
Using the Command Line Interface ................................................................2
CLI Conventions ........................................................................................2
Globs .........................................................................................................4
Command Line Editing ..............................................................................6
Using CLI Help ...........................................................................................8
Access Commands .......................................................................................10
System Services Commands .......................................................................12
Port Commands ............................................................................................24
VLAN Commands .........................................................................................44
IP Services Commands ................................................................................54
AAA Commands .........................................................................................119
Access Point Commands ............................................................................163
Spanning Tree Protocol (STP) Commands .................................................230
IGMP Snooping Commands .......................................................................252
Security ACL Commands ...........................................................................270
Cryptography Commands ...........................................................................289
RADIUS Commands ...................................................................................301
802.1X Management Commands ...............................................................311
Session Management Commands .............................................................325
RF Detection Commands ...........................................................................336
File Management Commands ....................................................................351
Trace Commands .......................................................................................368
Snoop Commands ......................................................................................373
System Log Commands .............................................................................380
Boot Prompt Commands ............................................................................388
Warranty .....................................................................................................400
Registration ................................................................................................405
Table of Contents

2
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
Using the Command Line Interface
CLI Conventions
Command Prompts
By default, the MSS CLI provides the following prompt for restricted users. The mm portion
shows the DWS switch model number (for example, 1008) and the nnnnnn portion shows the
last 6 digits of the switch’s media access control (MAC) address.
DWS-mm-nnnnnn>
After you become enabled as an administrative user by typing enable and supplying a suitable
password, MSS displays the following prompt:
DWS-mm-nnnnnn#
For ease of presentation, this manual shows the restricted and enabled prompts as follows:
DWS-1008>
DWS-1008#
Syntax Notation
The MSS CLI uses standard syntax notation:
• Bold monospace font identifies the command and keywords you must type. For example:
set enablepass
• Italic monospace font indicates a placeholder for a value. For example, you replace vlan-id
in the following command with a virtual LAN (VLAN) ID:
clear interface vlan-id ip
• Curly brackets ({ }) indicate a mandatory parameter, and square brackets ([ ]) indicate
an optional parameter. For example, you must enter dynamic or port and a port list in the
following command, but a VLAN ID is optional:
clear fdb {dynamic | port port-list} [vlan vlan-id]
• A vertical bar (|) separates mutually exclusive options within a list of possibilities. For
example, you enter either enable or disable, not both, in the following command:
set port {enable | disable} port-list
Using the Command Line Interface

3
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
Using the Command Line Interface
Text Entry Conventions and Allowed Characters
Unless otherwise indicated, the MSS CLI accepts standard ASCII alphanumeric characters,
except for tabs and spaces, and is case-insensitive.
The CLI has specific notation requirements for MAC addresses, IP addresses, and masks,
and allows you to group usernames, MAC addresses, virtual LAN (VLAN) names, and ports
in a single command.
D-Link recommends that you do not use the same name with different capitalizations for
VLANs or access control lists (ACLs). For example, do not configure two separate VLANs
with the names red and RED.
The CLI does not support the use of special characters including the following in any named
elements such as SSIDs and VLANs: ampersand (&), angle brackets (< >), number sign (#),
question mark (?), or quotation marks (“”).
In addition, the CLI does not support the use of international characters such as the accented
É in DÉCOR.
MAC Address Notation
MSS displays MAC addresses in hexadecimal numbers with a colon (:) delimiter between
bytes—for example, 00:01:02:1a:00:01. You can enter MAC addresses with either hyphen (-)
or colon (:) delimiters, but colons are preferred.
For shortcuts:
• You can exclude leading zeros when typing a MAC address. MSS displays of MAC
addresses include all leading zeros.
• In some specified commands, you can use the single-asterisk (*) wildcard character
to represent from 1 byte to 5 bytes of a MAC address.
IP Address and Mask Notation
MSS displays IP addresses in dotted decimal notation—for example, 192.168.1.111. MSS
makes use of both subnet masks and wildcard masks.
Subnet Masks
Unless otherwise noted, use classless interdomain routing (CIDR) format to express subnet
masks—for example, 192.168.1.112/24. You indicate the subnet mask with a forward slash
(/) and specify the number of bits in the mask.

4
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
Using the Command Line Interface
Wildcard Masks
Security access control lists (ACLs) use source and destination IP addresses and wildcard
masks to determine whether the switch filters or forwards IP packets. Matching packets are
either permitted or denied network access. The ACL checks the bits in IP addresses that
correspond to any 0s (zeros) in the mask, but does not check the bits that correspond to 1s
(ones) in the mask. You specify the wildcard mask in dotted decimal notation.
For example, the address 10.0.0.0 and mask 0.255.255.255 match all IP addresses that
begin with 10 in the first octet.
User Globs, MAC Address Globs, and VLAN Globs
Name “globbing” is a way of using a wildcard pattern to expand a single element into a list of
elements that match the pattern. MSS accepts user globs, MAC address globs, and VLAN
globs. The order in which globs appear in the configuration is important, because once a glob
is matched, processing stops on the list of globs.
User Globs
A user glob is shorthand method for matching an authentication, authorization, and accounting
(AAA) command to either a single user or a set of users.
A user glob can be up to 80 characters long and cannot contain spaces or tabs. The
double-asterisk (**) wildcard characters with no delimiter characters match all usernames.
The single-asterisk (*) wildcard character matches any number of characters up to, but not
including, a delimiter character in the glob. Valid user glob delimiter characters are the at (@)
sign and the period (.).
For example, the following globs identify the following users:
User Glob User(s) Designated
[e-mail] User jose at example.com
*@example.com All users at example.com whose usernames do not
contain periods for example, [e-mail] and
[e-mail], but not [e-mail],
because nin.wong contains a period.
*@marketing.example.com All marketing users at example.com whose usernames do
not contain periods.
*.*@marketing.example.com All marketing users at example.com whose usernames
contain periods.
* All users with usernames that have no delimiters.

5
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
Using the Command Line Interface
EXAMPLE\* All users in the Windows Domain EXAMPLE with
usernames that have no delimiters.
EXAMPLE\*.* All users in the Windows Domain EXAMPLE whose
usernames contain periods.
** All users.
MAC Address Globs
A media access control (MAC) address glob is a similar method for matching some
authentication, authorization, and accounting (AAA) and forwarding database (FDB)
commands to one or more 6-byte MAC addresses. In a MAC address glob, you can use a
single asterisk (*) as a wildcard to match all MAC addresses, or as follows to match from 1
byte to 5 bytes of the MAC address:
00:*
00:01:*
00:01:02:*
00:01:02:03:*
00:01:02:03:04:*
For example, the MAC address glob 02:06:8c* represents all MAC addresses starting with
02:06:8c. Specifying only the first 3 bytes of a MAC address allows you to apply commands
to MAC addresses based on an organizationally unique identity (OUI).
VLAN Globs
A VLAN glob is a method for matching one of a set of local rules on a switch, known as the
location policy, to one or more users. MSS compares the VLAN glob, which can optionally
contain wildcard characters, against the VLAN-Name attribute returned by AAA, to determine
whether to apply the rule.
To match all VLANs, use the double-asterisk (**) wildcard characters with no delimiters. To
match any number of characters up to, but not including, a delimiter character in the glob, use
the single-asterisk (*) wildcard. Valid VLAN glob delimiter characters are the at (@) sign and
the period (.).
For example, the VLAN glob bldg4.* matches bldg4.security and bldg4.hr and all other VLAN
names with bldg4. at the beginning.
Matching Order for Globs
In general, the order in which you enter AAA commands determines the order in which MSS
matches the user, MAC address, or VLAN to a glob. To verify the order, view the output of the
show aaa or show config command. MSS checks globs that appear higher in the list before
items lower in the list and uses the first successful match.

6
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
Using the Command Line Interface
Port Lists
The physical Ethernet ports on a switch can be set for connection to DWL-8220AP access
points, authenticated wired users, or the network backbone. You can include a single port or
multiple ports in one CLI command by using the appropriate list format.
The ports on a DWS-1008 switch are numbered 1 through 8. No port 0 exists on the switch.
You can include a single port or multiple ports in a command that includes port port-list. Use
one of the following formats for port-list:
• A single port number. For example:
DWS-1008# set port enable 3
• A comma-separated list of port numbers, with no spaces. For example:
DWS-1008# show port poe 1,2,4,5
• A hyphen-separated range of port numbers, with no spaces. For example:
DWS-1008# reset port 1-4
• Any combination of single numbers, lists, and ranges. Hyphens take precedence over
commas. For example:
DWS-1008# show port status 1-3,6
Virtual LAN Identification
The names of virtual LANs (VLANs) are set by you and can be changed. In contrast, VLAN
ID numbers, which the DWS-1008 switch uses locally, are determined when the VLAN is first
configured and cannot be changed. Unless otherwise indicated, you can refer to a VLAN by
either its VLAN name or its VLAN number. CLI set and show commands use a VLAN’s name
or number to uniquely identify the VLAN within the switch.
Command-Line Editing
MSS editing functions are similar to those of many other network operating systems.

7
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
Using the Command Line Interface
Tabs
The CLI uses the Tab key for command completion. You can type the first few characters of a
command and press the Tab key to display the command(s) that begin with those characters.
For example:
DWS-1008# show i <Tab>
igmp Show igmp information
interface Show interfaces
ip Show ip information
Keyboard Shortcuts
The following table lists the keyboard shortcuts for entering and editing CLI commands:
Keyboard Shortcut(s) Function
---------------------------------- ---------------------------------------------------------------------------
Ctrl+A Jumps to the first character of the command line.
Ctrl+B or Left Arrow key Moves the cursor back one character.
Ctrl+C Escapes and terminates prompts and tasks.
Ctrl+D Deletes the character at the cursor.
Ctrl+E Jumps to the end of the current command line.
Ctrl+F or Right Arrow key Moves the cursor forward one character.
Ctrl+K Deletes from the cursor to the end of the command line.
Ctrl+L or Ctrl+R Repeats the current command line on a new line.
Ctrl+N or Down Arrow key Enters the next command line in the history buffer.
Ctrl+P or Up Arrow key Enters the previous command line in the history buffer.
Ctrl+U or Ctrl+X Deletes characters from the cursor to the beginning of the
command line.
Ctrl+W Deletes the last word typed.
Esc B Moves the cursor back one word.
Esc D Deletes characters from the cursor forward to the end of
the word.
Delete key or Backspace key Erases mistake made during command entry. Reenter the
command after using this key.
History Buffer
The history buffer stores the last 63 commands you entered during a terminal session. You
can use the Up Arrow and Down Arrow keys to select a command that you want to repeat
from the history buffer.

8
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
Using the Command Line Interface
To see a subset of the online help, type the command for which you want more information.
For example, to display all the commands that begin with the letter i, type the following
command:
DWS-1008# show i?
igmp Show igmp information
interface Show interfaces
ip Show ip information
Using CLI Help
The CLI provides online help. To see the full range of commands available at your access
level, type the help command. For example:
DWS-1008# help
Commands:
---------------------------------------------------------------------------------------------------
backup Backup system information to filename (or url)
clear Clear, use ‘clear help’ for more information
commit Commit the content of the ACL table
copy Copy from filename (or url) to filename (or url)
crypto Crypto, use ‘crypto help’ for more information
delete Delete url
dir Show list of files on flash device
disable Disable privileged mode
exit Exit from the Admin session
help Show this help screen
history Show contents of history substitution buffer
hit-sample-rate Set NP hit-counter sample rate
load Load, use ‘load help’ for more information
logout Exit from the Admin session
md5 md5 filename
mkdir Create a subdirectory on flash device
monitor Monitor, use ‘monitor help’ for more information
ping Send echo packets to hosts
quickstart Perform an initial configuration
quit Exit from the Admin session
reset Reset, use ‘reset help’ for more information
restore Restore system information from filename (or url)
rmdir Remove a subdirectory created by mkdir
rollback Remove changes to the edited ACL table
save Save the running configuration to persistent storage
set Set, use ‘set help’ for more information
show Show, use ‘show help’ for more information
telnet telnet IP address [server port]
test Test AAA
traceroute Print the route packets take to network host
validate validate action functions

9
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
Using the Command Line Interface
To see all the variations, type one of the commands followed by a question mark (?). For
example:
DWS-1008# show ip ?
alias Show ip aliases
dns Show DNS status
route Show ip route table
ssh show ip ssh
telnet show ip telnet
To determine the port on which Telnet is running, type the following command:
DWS-1008# show ip telnet
Server Status Port
----------------------------------
Disabled 23
Understanding Command Descriptions
Each command description in the D-Link Command Reference contains the following
elements:
• A command name, which shows the keywords but not the variables. For example, the
following command name appears at the top of a command description and in the
index:
set {ap | dap} name
The set {ap | dap} name command has the following complete syntax:
set {ap port-list | dap dap-num} name name
• A brief description of the command’s functions.
• The full command syntax.
• Any command defaults.
• The command access, which is either enabled or all. All indicates that anyone can
access this command. Enabled indicates that you must enter the enable password
before entering the command.
• Special tips for command usage. These are omitted if the command requires no
special usage.
• One or more examples of the command in context, with the appropriate system
prompt and response.

10
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
Access Commands
Use access commands to control access to the Mobility Software System (MSS) (CLI).
This chapter presents access commands alphabetically. Use the following table to locate
commands in this chapter based on their use.
disable
Changes the CLI session from enabled mode to restricted access.
Syntax: disable
Defaults: None.
Access: Enabled.
Examples: The following command restricts access to the CLI for the current session:
DWS-1008# disable
DWS-1008>
enable
Places the CLI session in enabled mode, which provides access to all commands required
for configuring and monitoring the system.
Syntax: enable
Access: All
Usage: MSS displays a password prompt to challenge you with the enable password. To
enable a session, your or another administrator must have configured the enable
password to this switch with the set enablepass command.
Examples: The following command plus the enable password provides enabled access to the
CLI for the current sessions:
DWS-1008> enable
Enter password: password
DWS-1008#
Access Commands

11
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
Access Commands
quit
Exit from the CLI session.
Syntax: quit
Defaults: None
Access: All
Examples: To end the administrator’s session, type the following command:
DWS-1008> quit
set enablepass
Sets the password that provides enabled access (for configuration and monitoring) to the
DWS-1008 switch.
Note: The enable password is case-sensitive.
Syntax: set enablepass
Defaults: None.
Access: Enabled.
Usage: After typing the set enablepass command, press Enter. If you are entering the first
enable password on this switch, press Enter at the Enter old password prompt.
Otherwise, type the old password. Then type a password of up to 32 alphanumeric
characters with no spaces, and reenter it at the Retype new password prompt.
Caution: Be sure to use a password that you will remember. If you lose the enable password,
the only way to restore it causes the system to return to its default settings and wipes out the
configuration.
Examples: The following example illustrates the prompts that the system displays when the
enable password is changed. The passwords you enter are not displayed.
DWS-1008# set enablepass
Enter old password: old-password
Enter new password: new-password
Retype new password: new-password
Password changed

12
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
System Services Commands
System Services Commands
Use system services commands to configure and monitor system information for a
DWS-1008 switch. This chapter presents system services commands alphabetically. Use the
following table to located commands in this chapter based on their use.
clear banner motd
Deletes the message-of-the-day (MOTD) banner that is displayed before the login prompt for
each CLI session on the switch.
Syntax: clear banner motd
Defaults: None Access: Enabled
Examples: To clear a banner, type the following command:
DWS-1008# clear banner motd
success: change accepted
Note: As an alternative to clearing the banner, you can overwrite the existing banner with an
empty banner by typing the following command: set banner motd ^^
clear history
Deletes the command history buffer for the current CLI session.
Syntax: clear history
Defaults: None Access: All
Examples: To clear the history buffer, type the following command:
DWS-1008# clear history
success: command buffer was flushed.
clear prompt
Resets the system prompt to its previously configured value. If the prompt was not configured
previously, this command resets the prompt to its default.
Syntax: clear prompt
Defaults: None
Access: Enabled

13
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
System Services Commands
Clear Prompt (continued)
Examples: To reset the prompt, type the following command:
switch1# clear prompt
success: change accepted.
DWS-1008#
clear system
Clears the system configuration of the specified information.
Syntax: clear system [contact | countrycode | ip-address | location | name]
contact Resets the name of contact person for the DWS-1008 switch to null.
countrycode Resets the country code for the switch to null.
ip-address Resets the IP address of the switch to null.
location Resets the location of the switch to null.
name Resets the name of the switch to the default system name, which is
DWS-1008-nnnnnn, where nnnnnn is the last 6 digits of the switch’s
MAC address.
Defaults: None
Access: Enabled
Examples: To clear the location of the switch, type the following command:
DWS-1008# clear system location
success: change accepted.

14
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
System Services Commands
help
Displays a list of commands that can be used to configure and monitor the switch.
Syntax: help
Defaults: None.
Access: All.
Examples: Use this command to see a list of available commands. If you have restricted
access, you see fewer commands than if you have enabled access. To display
a list of CLI commands available at the enabled access level, type the following
command at the enabled access level:
DWS-1008# help
Commands:
-------------------------------------------------------------------------------------------------
backup Backup system information to filename (or url)
clear Clear aaa accounting parameters
commit Commit the content of the ACL table
copy Copy from filename (or url) to filename (or url)
crypto Incorporate a signed certificate
delete Delete url
dir Show list of files on flash device
disable Disable privileged mode
disable Disable privileged mode
help Show this help screen
history Show contents of history substitution buffer
hit-sample-rate Set NP hit-counter sample rate
load load configuration from persistent storage
logout Exit from the Admin session
md5 md5 filename
mkdir Create a subdirectory on flash device
monitor monitor port counters statistics
ping Send echo packets to hosts
quickstart Perform an initial configuration
quit Exit from the Admin session
reset reset ap
restore Restore system information from filename (or url)
rmdir Remove a subdirectory created by mkdir
rollback Remove changes to the edited ACL table
save Save the running configuration to persistent storage
set Set aaa debugging
show Show aaa information
telnet telnet ip address [server port]
test Test AAA
traceroute Print the route packets take to network host
validate validate action functions

15
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
System Services Commands
history
Displays the command history buffer for the current CLI session.
Syntax: history
Defaults: None
Access: All
Examples To show the history of your session, type the following command:
DWS-1008# history
Show History (most recent first)
------------------------------------------
[00] show config
[01] show version
[02] enable
set banner motd
Configures the banner string that is displayed before the beginning of each login prompt for
each CLI session on the switch.
Syntax: set banner motd ^text^
^ Delimiting character that begins and ends the message.
text Up to 2000 alphanumeric characters, including tabs and carriage returns, but not the
delimiting character (^). The maximum number of characters is approximately 24 lines
by 80 characters.
Defaults: None
Access: Enabled
Usage: Type a caret (^), then the message, then another caret. Do not use the following
characters with commands in which you set text to be displayed on the switch, such
as message-of-the-day (MOTD) banners:
• Ampersand (&) • Number sign (#) • Single quotation mark (‘)
• Question mark (?) • Angle brackets (< >) • Double quotation marks (“”)
Examples: To create a banner that says Meeting at 3 p.m., type the following command:
DWS-1008# set banner motd ^Update meeting at 3 p.m.^
success: change accepted.

16
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
System Services Commands
set confirm
Enables or disables the display of confirmation messages for commands that might have a
large impact on the network.
Syntax: set confirm {on | off}
on Enables confirmation messages.
off Disables confirmation messages.
Defaults: Configuration messages are enabled
Access: Enabled
Usage: This command remains in effect for the duration of the session, until you enter an exit
or quit command, or until you enter another set confirm command.
MSS displays a message requiring confirmation when you enter certain commands that can
have a potentially large impact on the network. For example:
DWS-1008# clear vlan red
This may disrupt user connectivity. Do you wish to continue? (y/n) [n]
Examples: To turn off these confirmation messages, type the following command:
DWS-1008# set confirm off
success: Confirm state is off
set length
Defines the number of lines of CLI output to display between paging prompts. MSS displays
the set number of lines and waits for you to press any key to display another set, or type q
to quit the display.
Syntax: set length number-of-lines
number-of-lines Number of lines of text to display between paging prompts. You can
specify from 0 to 512. The 0 value disables the paging prompt action
entirely.
Defaults: Displays 24 lines by default.
Access: All
Usage: Use this command if the output of a CLI command is greater than the number of
lines allowed by default for a terminal type.

17
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
System Services Commands
Examples: To set the number of lines displayed to 100, type the following command:
DWS-1008# set length 100
success: screen length for this session set to 100
Set Prompt
Changes the CLI prompt for the DWS-1008 switch to a string you specify.
Syntax: set prompt string
string Alphanumeric string up to 32 characters long. To include spaces in the prompt,
you must enclose the string in double quotation marks (“”).
Defaults: The factory default for the switch name is DWS-1008-nnnnnn, where nnnnnn is the
last 6 digits of the 12-digit system MAC address.
Access: Enabled
Usage: When you first log in for the initial configuration of the switch, the CLI provides an
DWS-mm-nnnnnn> prompt. After you become enabled by typing enable and giving a suitable
password, the DWS-1008-nnnnnn# prompt is displayed. If you use the set system name
command to change the default system name, MSS uses that name in the prompt, unless
you also change the prompt with set prompt.
Examples: The following example sets the prompt from DWS-1008 to happy_days:
DWS-1008# set prompt happy_days
success: change accepted.
happy_days#

18
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
System Services Commands
set system contact
Stores a contact name for the DWS-1008 switch.
Syntax: set system contact string
string Alphanumeric string up to 256 characters long, with no blank spaces.
Defaults: None
Access: Enabled
To view the system contact string, type the show system command.
Examples: The following command sets the system contact information to
[e-mail]:
DWS-1008# set system contact [email protected]
success: change accepted.
set system countrycode
Defines the country-specific IEEE 802.11 regulations to enforce on the switch.
Syntax: set system countrycode code
code Two-letter code for the country of operation for the switch. You can specify one
of the codes listed below.
Country Code
Australia AU
Austria AT
Belgium BE
Brazil BR
Canada CA
China CN
Czech Republic CZ
Denmark DK
Finland FI
France FR
Germany DE
Greece GR
Hong Kong HK
Hungary HU
Iceland IS
India IN
Ireland IE
Israel IL
Italy IT
Japan JP
Liechtenstein LI
Luxembourg LU
Country Code
Malaysia MY
Mexico MX
Netherlands NL
New Zealand NZ
Norway NO
Poland PL
Portugal PT
Saudi Arabia SA
Singapore SG
Slovakia SK
Slovenia SI
South Africa ZA
South Korea KR
Spain ES
Sweden SE
Switzerland CH
Taiwan TW
Thailand TH
United Arab Emirates AE
United Kingdom GB
United States US

19
DWS-1008 CLI Reference Guide
D-Link Systems, Inc.
System Services Commands
set system countrycode (continued)
Defaults: The factory default country code is None.
Access: Enabled.
Usage: You must set the system county code to a valid value before using any set ap com-
mands to configure a DWL-8220AP access point.
Examples: To set the country code to Canada, type the following command:
DWS-1008# set system country code CA
success: change accepted.
set system ip-address
Sets the system IP address so that it can be used by various services in the switch.
Syntax: set system ip-address ip-addr
ip-addr IP address, in dotted decimal notation.
Defaults: None
Access: Enabled
Examples: The following command sets the IP address of the switch to 192.168.253.1:
DWS-1008# set system ip-address 192.168.253.1
success: change accepted.