D-Link DXS-3600-16S User manual

CLI Reference Guide
Product Model: DXS-3600 Series
Layer 2/3 Managed 10GbE Switch
Release: 1.10

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
ii
DXS-3600 Series CLI Reference Guide
Software Release F/W: 1.10.023
Copyright Statement
All rights reserved.
Without our written permission this document may not be excerpted, reproduced, transmitted, or otherwise in all or part
by any party by any means.
Preface
Version Description
This manual’s command descriptions are based on the software release 1.10.023. The commands listed here are the
subset of commands that are supported by the DXS-3600 Series switch.
Audience
This reference manual is intended for network administrators and other IT networking professionals responsible for
managing the switch by using the Command Line Interface (CLI). The CLI is the primary management interface to the
DXS-3600 Series switch, which will be generally be referred to simply as the “switch” within this manual. This manual is
written in a way that assumes that you already have the experience and knowledge of Ethernet and modern networking
principles for Local Area Networks.
Document Layout
Other Documentation
The documents below are a further source of information in regards to configuring and troubleshooting the switch . All
the documents are available either from the CD, bundled with this switch, or from the D-Link website. Other documents
related to this switch are:
• DXS-3600 Series Hardware Installation Guide
• DXS-3600 Series Web UI Reference Guide
Conventions
Preface Describes how to use the CLI reference manual.
Table of Contents Lists out the chapters discussed throughout this manual.
Chapters Each chapter contains a specific grouping of CLI commands that are related to the
topic labelled.
Appendices Contains extra information related to this switch.
Convention Description
Boldface Font Commands, command options and keywords are printed in boldface. Keywords, in
the command line, are to be entered exactly as they are displayed.
UPPERCASE ITALICS Font Parameters or values that must be specified are printed in UPPERCASE ITALICS.
Parameters in the command line, are to be replaced with the actual values that are
desired to be used with the command.
[ ] Square brackets enclose an optional value or set of optional arguments.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
iii
Notes, Notices, and Cautions
Below are examples of the 3 types of indicators used in this manual. When administering your switch using the
information in this document, you should pay special attention to these indicators. Each example below provides an
explanatory remark regarding each type of indicator.
Command Descriptions
The information pertaining to each command in this reference guide is presented using a number of template fields.
The fields are:
•Description - This is a short and concise statement describing the commands functionality.
•Syntax - The precise form to use when entering and issuing the command. The form conventions are described in
the table shown under the section “Conventions” on page iv of this guide.
•Syntax Description - A table where each row describes the optional or required arguments, and their use, that
can be issued with the command.
•Default - If the command sets a configuration value or administrative state of the switch then any default settings
(i.e. without issuing the command) of the configuration is shown here.
•Command Mode - The mode in which the command can be issued. The modes are either User EXEC, Privileged
EXEC, Global Configuration or a specific configuration mode. These modes are described in the section titled
“Command Modes” on page v below.
•Command Usage - If necessary, a detailed description of the command and its various utilization scenarios is
given here.
•Example(s) - Each command is accompanied by a practical example of the command being issued in a suitable
scenario.
Command Modes
There are several command modes available in the command-line interface (CLI). The set of commands available to
the user depends on both the mode the user is currently in and their privilege level. For each case, the user can see all
the commands that are available in a particular command mode by entering a question mark (?) at the system prompt.
The command-line interface has five privilege levels:
•Basic User - Privilege Level 1. This user account level has the lowest priority of the user accounts. The purpose of
this type of user account level is for basic system checking.
•Advanced User - Privilege Level 3. This user account level is allowed to configure the terminal control setting.
This user account can only show limited information that is not related to security.
•Power User - Privilege 8. This user account level can execute fewer commands than operator, including configura-
tion commands other than the operator level and administrator level commands.
{a | b | c} Braces enclose alternative keywords seperated by vertical bars. Generally, one of
the keywords in the seperated list can be chosen.
[a | d | c] Optional values or arguements are enclosed in square barackets and seperated by
vertical bars. Generally, one or more of the vales or arguements in the seperated list
can be chosen.
Blue Courier Font This convention is used to represent an example of a screen console display
including example entries of CLI command input with the corresponding output. All
examples used in this manual is based on the DXS-3600-32S switch in the DXS-
3600 Series.
NOTE: A note indicates important information that helps you make better use of your device
NOTICE: A notice indicates either potential damage to hardware or loss of data and tells you how to
avoid the problem
CAUTION: A caution indicates a potential for property damage, personal injury, or death.
Convention Description

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
iv
•Operator - Privilege Level 12. This user account level is used to grant system configuration rights for users who
need to change or monitor system configuration, except for security related information such as user accounts and
SNMP account settings, etc.
•Administrator - Privilege Level 15. This administrator user account level can monitor all system information and
change any of the system configuration settings expressed in this configuration guide.
The command-line interface has a number of command modes. There are three basic command modes:
• User EXEC mode
• Privileged EXEC mode
• Global Configuration mode
All other sub-configuration modes can be accessed via global configuration mode.
When a user logs in to the Switch, the privilege level of the user determines the command mode the user will enter
after initially logging in. The user will either log into user EXEC mode or privileged EXEC mode. Users with a basic user
level will log into the Switch in user EXEC mode. Users with advanced user, power user, operator or administrator level
accounts will log into the Switch in privileged EXEC mode. Therefore, user EXEC mode can operate at basic user level
and privileged EXEC mode can operate at advanced user, power user, operator or administrator level. The user can
only enter global configuration mode from privileged EXEC mode. Therefore, global configuration mode can be
accessed by users who have advanced user, power user, operator or administrator level user accounts. As for sub-
configuration modes, a subset of those can only be accessed by users who have the highest secure administrator level
privileges.
The following table briefly lists the available command modes. Only the basic command modes and some of the sub-
configuration modes are enumerated. The basic command modes and basic sub-configuration modes are further
described in the following chapters. Descriptions for the rest of the sub-configuration modes are not provided in this
section. For more information on the additional sub-configuration modes, the user should refer to the chapters relating
to these functions.
The available command modes and privilege levels are described below:
Command Mode /
Privilege Level Purpose
User EXEC Mode /
Basic User level This level has the lowest priority of the user accounts. It is provided only to check basic system settings.
Privileged EXEC Mode /
Advanced User level This level is allowed to configure the terminal control setting. This user account can only show limited information that is not related to security.
Privileged EXEC Mode /
Power User level This level can execute less commands than operator, include the configure commands other than the operator level and administrator level commands.
Privileged EXEC Mode /
Operator level For changing both local and global terminal settings, monitoring, and performing certain system administration tasks. The system administration tasks that can be
performed at this level includes the clearing of system configuration settings, except
for any security related information, such as user accounts, SNMP account settings
etc.
Privileged EXEC Mode /
Administrator level This level is identical to privileged EXEC mode at power user level, except that a user at the administrator level can monitor and clear security related settings.
Global Configuration Mode /
Power User level For applying global settings, including the configuration commands other than the operator level and administrator level commands.
Global Configuration Mode /
Operator level For applyingglobal settings, except for security related settings, on the entire Switch. In addition to applying global settings on the entire Switch, the user can access other
sub-configuration modes from global configuration mode.
Global Configuration Mode /
Administrator level For applying global settings on the entire Switch. In addition to applying global settings on the entire Switch, the user can access other sub-configuration modes
from global configuration mode.
Interface Configuration Mode /
Administrator level For applying interface related settings.
VLAN Interface Configuration
Mode For applying VLAN interface related settings.
VLAN Configuration Mode For applying settings to a VLAN.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
v
User EXEC Mode at Basic User Level
This command mode is mainly designed for checking basic system settings. This command mode can be entered by
logging in as a basic user.
Privileged EXEC Mode at Advanced User Level
This command mode is mainly designed for checking basic system settings, allowing users to change the local
terminal session settings and carrying out basic network connectivity verification. One limitation of this command mode
is that it cannot be used to display information related to security. This command mode can be entered by logging in as
an advanced user.
Privileged EXEC Mode at Power User Level
User logged into the switch in privileged EXEC mode at this level can execute fewer commands than operator,
including the configuration commands other than the operator level and administrator level commands. The method to
enter privileged EXEC mode at power user level is to login to the switch with a user account that has a privileged level
of 8.
Privileged EXEC Mode at Operator Level
Users logged into the Switch in privileged EXEC mode at this level can change both local and global terminal settings,
monitor, and perform system administration tasks like clearing configuration settings (except for security related
information such as user accounts, SNMP account settings etc.) The method to enter privileged EXEC mode at
operator level is to login to the Switch with a user account that has a privilege level of 12.
Privileged EXEC Mode at Administrator Level
This command mode has a privilege level of 15. Users logged in with this command mode can monitor all system
information and change any system configuration settings mentioned in this Configuration Guide. The method to enter
privileged EXEC mode at administrator level is to login to the Switch with a user account that has a privilege level of 15.
Global Configuration Mode
The primary purpose of global configuration mode is to apply global settings on the entire Switch. Global configuration
mode can be accessed at advanced user, power user, operator or administrator level user accounts. However, security
related settings are not accessible at advanced user, power user or operator user accounts. In addition to applying
global settings on the entire Switch, the user can also access other sub-configuration modes. In order to access the
global configuration mode, the user must be logged in with the corresponding account level and use the configure
terminal command in privileged EXEC mode.
In the following example, the user is logged in as an Administrator in privileged EXEC mode and uses the configure
terminal command to access global configuration mode:
The exit command is used to exit global configuration mode and return to privileged EXEC mode.
The procedures to enter the different sub-configuration modes can be found in the related chapters in this
Configuration Guide. The command modes are used to configure the individual functions.
IP Access-List Configuration
Mode For specifying filtering criteria for an IP access list.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#
DXS-3600-32S(config)#exit
DXS-3600-32S#
Command Mode /
Privilege Level Purpose

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
vi
Interface Configuration Mode
Interface configuration mode is used to configure the parameters for an interface or a range of interfaces. An interface
can be a physical port, VLAN, or other virtual interface. Thus, interface configuration mode is distinguished further
according to the type of interface. The command prompt for each type of interface is slightly different.
VLAN Interface Configuration Mode
VLAN interface configuration mode is one of the available interface modes and is used to configure the parameters of
a VLAN interface.
To access VLAN interface configuration mode, use the following command in global configuration mode:
DXS-3600-32S(config)#interface vlan 1
DXS-3600-32S(config-if)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
1
Table of Contents
Basic CLI Commands................................................................................................................................................1
802.1X Commands....................................................................................................................................................6
Access Control List (ACL) Commands....................................................................................................................17
Address Resolution Protocol (ARP) Commands.....................................................................................................40
Alternate Store and Forward (ASF) Commands......................................................................................................46
Authentication, Authorization, and Accounting (AAA) Commands..........................................................................48
Border Gateway Protocol (BGP) Commands..........................................................................................................65
Compound Authentication Commands..................................................................................................................172
Configuration Commands......................................................................................................................................175
Counter Commands ..............................................................................................................................................187
CPU Commands....................................................................................................................................................190
Debug Commands.................................................................................................................................................191
DHCP Relay Commands.......................................................................................................................................199
DHCP Server Commands .....................................................................................................................................205
Distance Vector Multicast Routing Protocol (DVMRP) Commands.......................................................................220
D-Link License Management System Commands ................................................................................................225
Domain Name System (DNS) Commands............................................................................................................227
DoS Attack Prevention Commands.......................................................................................................................230
Enhanced Transmission Selection (ETS) Commands ..........................................................................................233
File System Commands ........................................................................................................................................237
Filter Database (FDB) Commands........................................................................................................................243
GARP VLAN Registration Protocol (GVRP) Commands.......................................................................................251
Internet Group Management Protocol (IGMP) Commands ...................................................................................257
IGMP Snooping Commands..................................................................................................................................266
Interface Commands.............................................................................................................................................281
IP Access List Commands.....................................................................................................................................284
IP Address Commands..........................................................................................................................................287
IP Prefix List Commands.......................................................................................................................................290
IP Multicast (IPMC) Commands............................................................................................................................294
LINE Commands...................................................................................................................................................301
Link Aggregation Commands................................................................................................................................303
Link Layer Discovery Protocol (LLDP) Commands...............................................................................................309
LLDP-DCBX Commands.......................................................................................................................................327
LLDP-MED Commands.........................................................................................................................................332
Memory Commands..............................................................................................................................................337
Mirror Commands..................................................................................................................................................338
Multicast Filter Mode Commands..........................................................................................................................342
Multiprotocol Label Switching (MPLS) Commands ...............................................................................................344
Network Connectivity Test Commands .................................................................................................................377
Open Shortest Path First (OSPF) Version 2 Commands ......................................................................................379
Password Recovery Commands...........................................................................................................................417
Peripheral Commands...........................................................................................................................................419
Port Commands.....................................................................................................................................................421
Port Security Commands.......................................................................................................................................428
Priority-based Flow Control (PFC) Commands.....................................................................................................436
Protocol Independent Commands.........................................................................................................................439
Protocol Independent Multicast (PIM) Commands................................................................................................449
Quality of Service (QoS) Commands ....................................................................................................................467
Quantized Congestion Notification (QCN) Commands .........................................................................................487
RADIUS Commands..............................................................................................................................................497
Remote Network MONitoring (RMON) Commands...............................................................................................502
Routing Information Protocol (RIP) Commands....................................................................................................508

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
2
Route Map Commands..........................................................................................................................................523
Secure Shell (SSH) Commands............................................................................................................................536
Simple Network Management Protocol (SNMP) Commands................................................................................539
Simple Network Time Protocol (SNTP) and Clock Commands.............................................................................551
Spanning Tree Protocol (STP) Commands...........................................................................................................557
Storm Control Commands.....................................................................................................................................574
Switch Management Commands...........................................................................................................................578
Syslog Commands ................................................................................................................................................584
TACACS+ Commands ..........................................................................................................................................591
TELNET Commands .............................................................................................................................................595
Time Range Commands........................................................................................................................................597
Traffic Segmentation Commands..........................................................................................................................599
Upgrade and Maintenance Commands.................................................................................................................601
Virtual LAN (VLAN) Commands............................................................................................................................603
Virtual Private LAN Service (VPLS) Commands...................................................................................................616
Virtual Private Wire Service (VPWS) Commands .................................................................................................628
Virtual Router Redundancy Protocol (VRRP) Commands ....................................................................................632
VLAN Mapping Commands...................................................................................................................................642
VLAN Tunnel Commands......................................................................................................................................646
VRF-Lite Commands.............................................................................................................................................653
Weighted Random Early Detection (WRED) Commands......................................................................................659
Appendix A - Password Recovery Procedure .......................................................................................................664
Appendix B - System Log Entries..........................................................................................................................665
Appendix C - Trap Entries.....................................................................................................................................685

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
1
Basic CLI Commands
1-1 help
This command is used to display a brief description of the help system. Use the help command in any command mode.
help
Parameters None.
Default None.
Command Mode Exec Mode
Privileged Mode
All Configuration Modes
Command Default Level Level: 1
Usage Guideline This command provides a brief description of the context-sensitive help system,
which functions as follow:
• To list all commands available for a particular command mode, enter a question
mark “?” at the system prompt.
• To obtain a list of commands that begin with a particular character string, enter
the abbreviated command entry immediately followed by a question mark “?”. Do
not leave a space between the keyword and question mark. This form of help is
called word help, because it lists only the keywords or arguments that begin with
the abbreviation you entered.
• To list the keywords and arguments associated with a command, enter a
question mark “?” in place of a keyword or argument on the command line.
Leave a space between the keyword and question mark. This form of help is
called command syntax help, because it lists the keywords or arguments that
apply based on the command, keywords, and arguments you have already
entered.
Note: To complete a partial command name, enter the abbreviated command name
followed by a <Tab> key. Example: ‘show addr <Tab>’. To enter the character “?” in
the command argument, press Ctrl+V immediately followed by the character “?”.
Example This example shows how to display a brief description of the help system. The field
descriptions are self-explanatory.
DXS-3600-32S>help
Help may be requested at any point in a command by entering
a question mark '?'. If nothing matches, the help list will
be empty and you must backup until entering a '?' shows the
available options.
Two styles of help are provided:
1. Full help is available when you are ready to enter a
command argument (e.g. 'ip ?') and describes each possible
argument.
2. Partial help is provided when an abbreviated argument is entered
and you want to know what arguments match the input
(e.g. 'ip a?'.)
Note:
1. For completing a partial command name could enter the abbreviated
command name immediately followed by a <Tab> key.
2. If wants to enter the character '?' in the command argument,
please press ctrl+v immediately followed by the character '?'.
DXS-3600-32S>

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
2
1-2 prompt
This command is used to customize the CLI prompt. Execute the prompt command in global configuration mode. To
revert to the default prompt, execute the no form of this command.
prompt string
no prompt
Parameters
1-3 banner login
This command is used to configure and customized the banner that will be displayed before the username and
password login prompts. Use the banner login command in global configuration mode. To disable the customized login
banner, use no form of this command.
banner login c message c
no banner login
Example This example shows how to use the word ‘help’ to display all the privileged mode
commands that begin with the letters “re”. The letters entered, before the question
mark, are reprinted on the next command line to allow the user to continue entering
the command.
DXS-3600-32S#re?
reboot rename
DXS-3600-32S#re
Example This example shows how to use the command syntax, ‘help’, to display the next
argument of a partially completed ip access-list standard command. The
characters entered, before the question mark, is reprinted on the next command line
to allow the user to continue entering the command.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#ip access-list standard ?
WORD Access-list name(the first character must be a letter)
<1-1999> Standard IP access-list number
DXS-3600-32S(config)#ip access-list standard
string Enter the character string that will be displayed on screen as the CLI prompt here.
Default The default prompt value is ‘DXS-3600-32S’.
Command Mode Global Configuration Mode
Command Default Level Level: 3
Usage Guideline The default prompt string is the system’s name. To restore the prompt to the default
value, use the ‘no prompt’ command in global configuration mode.
Example This example shows how to configure a customized prompt string, used in the CLI.
IN this example we’ll change the prompt to the word ‘Router’.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#prompt Router
Router(config)#

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
3
Parameters
cSpecifies the separator of the login banner message, for example a hash sign (#).
The delimiting character is not allowed in the login banner message.
message Enter the contents of the login banner, that will be displayed before the username
and password login prompts, here.
Default Displays the switch type and other contents defined by the system.
Command Mode Global Configuration Mode
Command Default Level Level: 3
Usage Guideline Follow the banner login command with one or more blank spaces and a delimiting
character of your choice. Enter one or more lines of text, terminating the message
with the second occurrence of the delimiting character. For example with a hash sign
(#) being the delimiting character, after inputting the delimiting character, press the
enter key, then the login banner contents can be typed. The delimiting character
need to be inputted then press enter to complete the type.
To reset the login banner contents to default, use the ‘no banner login’ command in
global configuration mode.
Note: The typed additional characters after the end delimiting character are invalid.
These characters will be discarded by the system. The delimiting character can not
be used in the text of login banner.
Example This example shows how to configure the login banner. The hash sign (#) is used as
the delimiting character. The starting delimiting character, banner contents and
ending delimiting character will be entered before pressing the first enter key.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#banner login #Enter Command Line Interface#
DXS-3600-32S(config)#end
DXS-3600-32S#logout
Enter Command Line Interface
User Access Verification
Username:
Example This example shows how to configure the login banner. The hash sign (#) is used as
the delimiting character.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#banner login #
LINE c banner-text c, where 'c' is a delimiting character
Enter Command Line Interface
#
DXS-3600-32S(config)#end
DXS-3600-32S#logout
Enter Command Line Interface
User Access Verification
Username:

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
4
1-4 exit
This command is used to exit any configuration mode to the next highest mode in the CLI mode hierarchy. Use the exit
command in any configuration mode. If the current mode is the highest mode (Exec Mode, Privileged Mode) in the CLI
mode hierarchy, execute the exit command to close the active terminal session by logging off the switch.
exit
1-5 end
This command is used to end the current configuration mode and return to the highest mode in the CLI mode hierarchy.
Use the end command in any configuration mode.
Parameters None.
Default None.
Command Mode Exec Mode
Privileged Mode
All Configuration Modes
Command Default Level Level: 1
Usage Guideline Use the exit command in the highest mode (Exec Mode, Privileged Mode) to exit the
active session (exit from the mode process and log off from the device). If the current
session is console, the account will logout. if there is another session running, it will
be closed.
Use the exit command in any configuration mode to the next highest mode in the CLI
mode hierarchy. For example, use the exit command in global configuration mode to
return to privileged mode.
Example This example shows how to exit from the Line Configuration Mode to return to the
Global Configuration Mode and exit from the Global Configuration Mode to return to
the privileged mode.
DXS-3600-32S(config-line)#exit
DXS-3600-32S(config)#exit
DXS-3600-32S#
Example This example shows how to use the exit command, in the privileged mode, to logout
of the current account.
DXS-3600-32S#exit
Switch con0 is now available
Press any key to login...
16 2000-01-22 01:20:37 INFO(6) Logout through Console (Username: admin)
DXS-3600-32S TenGigabit Ethernet Switch
Command Line Interface
Firmware: Build 1.10.023
Copyright(C) 2012 D-Link Corporation. All rights reserved.
User Access Verification
Username:
Example This example shows how to use the exit command, in the privileged mode, in a
Telnet session, to exit this mode and close the active session.
DXS-3600-32S#exit

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
5
end
Parameters None.
Default None.
Command Mode Exec Mode
Privileged Mode
All Configuration Modes
Command Default Level Level: 1
Usage Guideline Execute this command to return back to the highest mode in the CLI mode hierarchy
regardless of what configuration mode or configuration sub-mode currently located.
Note: This global command can be used in any mode, but if the current located
mode is the highest mode in the CLI mode hierarchy (Exec Mode, Privileged Mode),
executing this command will not have any effect. If the current located mode is any
configuration mode, execute this command will return to the privileged mode.
Example This example shows how to use the end command in the Line Configuration Mode to
return to the privileged mode.
DXS-3600-32S(config-line)#end
DXS-3600-32S#
Example This example shows how to use the end command in the privileged and EXEC
mode.
DXS-3600-32S#end
DXS-3600-32S#disable
DXS-3600-32S>end
DXS-3600-32S>

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
6
802.1X Commands
2-1 dot1x default
This command is used to reset the IEEE 802.1X parameters on a specific port to their default settings.
dot1x default
2-2 dot1x port-control
This command is used to manually control the authorization state on a specific port. Use the no form of this command
to reset the authorization state of the specific port to its default state (auto).
dot1x port-control {auto | force-authorized | force-unauthorized}
no dot1x port-control
Parameters
Parameters None.
Default Port control mode - Auto
Port PAE type - None
Port control direction - Both
Quiet period when authentication fails - 60 seconds
Re-authentication interval when authentication succeeds - 3600 seconds
Default timeout value waiting for a response from RADIUS - 30 seconds
Default timeout value waiting for a reply from Supplicant - 30 seconds
Default transmission interval from the Authenticator to the Supplicant - 30 seconds
Default maximum number of authentication request - 2 times
Re-authentication state on the port - Disabled
Command Mode Interface Configuration Mode.
Command Default Level Level: 8
Usage Guideline This command is used to reset all the IEEE 802.1X parameters on a specific port to
their default settings.
Example This example shows how to reset the 802.1X parameters on port 1.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1
DXS-3600-32S(config-if)#dot1x default
DXS-3600-32S(config-if)#
auto Specifies to enable IEEE 802.1X authentication. The state (authorized or
unauthorized) for a specific port is determined according to the outcome of the
authentication.
force-authorized Specifies to force a specific port to change to the authorized state without an
authentication exchange.
force-unauthorized Specifies to deny all access on a specific port by forcing the port to change to the
unauthorized state, ignoring all authentication attempts.
Default The default authorization state is auto.
Command Mode Interface Configuration Mode.
Command Default Level Level: 8
Usage Guideline The configuration for this command on a specific port won’t be in operation if you
don’t configure the port as an IEEE 802.1X PAE authenticator by using the ‘dot1x
pae authenticator’ command.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
7
2-3 dot1x pae authenticator
This command is used to configure a specific port as an IEEE 802.1X port access entity (PAE) authenticator. Use the
no form of this command to disable IEEE 802.1X authentication on the port.
dot1x pae authenticator
no dot1x pae
2-4 dot1x control-direction
This command is used to configure the direction of the traffic on a controlled port as unidirectional (in) or bidirectional
(both). Use the no form of this command to reset the control direction of a port to its default value (both).
dot1x control-direction {both | in}
no dot1x control-direction
Parameters
Example This example shows how to deny all access to port 1.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1
DXS-3600-32S(config-if)#dot1x port-control force-unauthorized
DXS-3600-32S(config-if)#
Parameters None.
Default The 802.1X is disabled on a port by default.
Command Mode Interface Configuration Mode.
Command Default Level Level: 8
Usage Guideline You must also globally enable IEEE 802.1X authentication on the switch by using the
‘dot1x system-auth-control’ command.
Example This example shows how to configure port 1 as an IEEE 802.1X PAE authenticator.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1
DXS-3600-32S(config-if)#dot1x pae authenticator
DXS-3600-32S(config-if)#
both Specifies to enable bidirectional control. Both incoming and outgoing traffic through
an IEEE 802.1X-enabled port are prevented if the port is not in the authorized state.
in Specifies to enable unidirectional control. Incoming traffic through an IEEE 802.1X-
enabled port is prohibited if the port is not the authorized state.
Default The default is in bidirectional mode.
Command Mode Interface Configuration Mode.
Command Default Level Level: 8

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
8
2-5 dot1x timeout
This command is used to configure the IEEE 802.1X timers.
dot1x timeout {quiet-period <sec 0-65535> | reauth-period <sec 1-65535> | server-timeout <sec 1-65535> |
supp-timeout <sec 1-65535> | tx-period <sec 1-65535>}
Parameters
Usage Guideline The configuration for this command on a specific port won’t be in operation if you
don’t configure the port as an IEEE 802.1X PAE authenticator by using the ‘dot1x
pae authenticator’ command.
When the port is in the force-unauthorized state or in the unauthorized state after
authentication, the traffic is controlled based on the setting of this command.
When the port is in the force-authorized state or becomes authorized after
authentication, the traffic will be allowed in both directions.
Example This example shows how to specify the direction of traffic through Ethernet port 1.
The direction is set as unidirectional.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1
DXS-3600-32S(config-if)#dot1x control-direction in
DXS-3600-32S(config-if)#
quiet-period <sec 0-
65535> Number of seconds that the switch will be in the quiet state in the wake of a failed authentication process. The range is 0 to 65535
reauth-period <sec 1-
65535> Number of seconds between re-authentication attempts. The range is 1 to 65535.
server-timeout <sec 1-
65535> Number of seconds that the switch will wait for the request from the authentication server before timing out the server. The range is 1 to 65535.
supp-timeout <sec 1-
65535> Number of seconds that the switch will wait for the response from the supplicant before timing out the supplicant. The range is 1 to 65535.
tx-period <sec 1-65535> Number of seconds that the switch will wait for a response to an EAP-Request or
Identity frame from the supplicant before retransmitting the request. The range is 1
to 65535
Default The default quiet period when authentication fails is 60 seconds (quiet-period).
The default re-authentication interval when authentication succeeds is 3600 seconds
(reauth-period).
The default timeout value waiting for a response from RADIUS is 30 seconds
(server-timeout).
The default timeout value waiting for a reply from Supplicant is 30 seconds (supp-
timeout).
The default transmission interval from the Authenticator to the Supplicant is 30
seconds (tx-period).
Command Mode Interface Configuration Mode.
Command Default Level Level: 8
Usage Guideline The ‘dot1x timeout reauth-period’ command is in operation only if you have
enabled re-authentication by using the ‘dot1x re-authentication interface
configuration’ command.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
9
2-6 dot1x max-req
This command is used to configure the maximum number of times that the backend authentication state machine will
retransmit an Extensible Authentication Protocol (EAP) request frame to the supplicant before restarting the
authentication process. Use the no form of this command to reset the maximum number of times to its default value.
dot1x max-req <int 1-10>
no dot1x max-req
Parameters
2-7 dot1x reauthentication
This command is used to enable periodic reauthentication. Use the no form of this command to return to disable
periodic reuthentication.
dot1x reauthentication
no dot1x reauthentication
Example This example shows how to configure the quiet period, reauthentication period,
server timeout value, supplicant timeout value, and transmission period for Ethernet
port 1 to be 20, 1000, 15, 15, and 10 seconds, respectively.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1
DXS-3600-32S(config-if)#dot1x timeout quiet-period 20
DXS-3600-32S(config-if)#dot1x timeout reauth-period 1000
DXS-3600-32S(config-if)#dot1x timeout server-timeout 15
DXS-3600-32S(config-if)#dot1x timeout supp-timeout 15
DXS-3600-32S(config-if)#dot1x timeout tx-period 10
DXS-3600-32S(config-if)#
max-req <int 1-10> Number of times that the switch retransmits an EAP frame to the supplicant before
restarting the authentication process. The range is 1 to 10.
Default The default value is 2 times.
Command Mode Interface Configuration Mode.
Command Default Level Level: 8
Usage Guideline This command is used to set the maximum number of times that the backend
authentication state machine will retransmit an Extensible Authentication Protocol
(EAP) request frame to the supplicant before restarting the authentication process.
Example This example shows how to set the maximum number of retries allowed on port 1.
The maximum number of retries is set to 3.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1
DXS-3600-32S(config-if)#dot1x max-req 3
DXS-3600-32S(config-if)#
Parameters None.
Default The periodic reauthentication on interface is disabled by default.
Command Mode Interface Configuration Mode.
Command Default Level Level: 8

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
10
2-8 dot1x re-authenticate
This command is used to reauthenticate a specific port or a specific MAC address.
dot1x re-authenticate {interface <interface-id> | mac-address <mac-address>}
Parameters
2-9 dot1x initialize
This command is used to initialize the authenticator state machine on a specific port or associated with a specific MAC
address.
dot1x initialize {interface <interface-id> | mac-address H.H.H}
Parameters
Usage Guideline You can configure the number of seconds between reauthentication attempts by
using the ‘dot1x timeout reauth-period’ command.
Example This example shows how to enable periodic reauthentication on Ethernet port 1.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1
DXS-3600-32S(config-if)#dot1x reauthentication
DXS-3600-32S(config-if)#
interface <interface-id> (Optional) Specifies a port to reauthenticate. Valid interfaces are physical ports.
mac-address <mac-
address> (Optional) Specifies a MAC address to re-authenticate. The function can be used only if the authentication mode is host-based.
Default This command has no default value.
Command Mode Global Configuration Mode.
Command Default Level Level: 8
Usage Guideline Under port-based mode, use the parameter interface <interface-id> to re-
authenticate a specific port. Under host-based mode, use the parameter mac-
address <mac-address> to reauthenticate a specific MAC address.
Example This example shows how to reauthenticate Ethernet port 1.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#dot1x re-authenticate interface tenGigabitEthernet 1/0/1
DXS-3600-32S(config)#
interface <interface-id> (Optional) Specifies a port on which the authenticator state machine will be
initialized. Valid interfaces are physical ports.
mac-address H.H.H (Optional) Specifies a MAC address with which the authenticator state machine
associates will be initialized. The function can be used only if the authentication
mode is host-based.
Default None.
Command Mode Global Configuration Mode.
Command Default Level Level: 8

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
11
2-10 dot1x system-auth-control
This command is used to globally enable IEEE 802.1X authentication on the switch. Use the no form of this command
to disable IEEE 802.1X function.
dot1x system-auth-control
no dot1x system-auth-control
2-11 dot1x system-max-user
This command is used to configure the maximum number of users that can be learned via 802.1X authentication. Use
the no form of this command to reset to the defaulting settings.
dot1x system-max-user <int 1-4096>
no dot1x system-max-user
Parameters
Usage Guideline Under port-based mode, use the parameter interface <interface-id> to initialize a
specific port. Under host-based mode, use the parameter mac-address <mac-
address> to initialize a specific MAC address.
Example This example shows how to initialize the authenticator state machine on Ethernet
port 1.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#dot1x initialize interface tenGigabitEthernet 1/0/1
DXS-3600-32S(config)#
Parameters None.
Default 802.1X is disabled globally by default.
Command Mode Global Configuration Mode.
Command Default Level Level: 8
Usage Guideline Use this command to enable 802.1X authentication globally.
Example This example shows how to enable IEEE 802.1X authentication on the switch.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#dot1x system-auth-control
DXS-3600-32S(config)#
<int 1-4096> Specifies the maximum number of users.
Default By default, the maximum number of users that can be learned via 802.1X
authentication is 4096.
Command Mode Global Configuration Mode.
Command Default Level Level: 8
Usage Guideline The setting is a global limitation on the maximum number of users that can be
learned via 802.1X authentication. In addition to the global limitation, the maximum
number of users per port is also limited.

DXS-3600 Series 10GbE Layer 2/3 Switch CLI Reference Guide
12
2-12 dot1x port-max-user
This command is used to configure the maximum number of users that can be learned via 802.1X authentication on a
specific port. Use the no form of this command to reset to the defaulting settings.
dot1x port-max-user <int 1-4096>
no dot1x port-max-user
Parameters
2-13 dot1x system-fwd-pdu
This command is used to globally control the forwarding of EAPOL PDUs. Use the no form of this command to reset to
the defaulting settings.
dot1x system-fwd-pdu
no dot1x system-fwd-pdu
Example This example shows how to configure the maximum number of users, that is allowed
to be learned via the 802.1X authentication. The maximum number of users allowed
is 128.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#dot1x system-max-user 128
DXS-3600-32S(config)#
<int 1-4096> Specifies the maximum number of users on a port.
Default By default, the maximum number of users that can be learned via 802.1X
authentication on a port is 16.
Command Mode Interface Configuration Mode.
Command Default Level Level: 8
Usage Guideline The setting is an interface limitation on the maximum number of users that can be
learned via 802.1X authentication. In addition to the interface limitation, the global
maximum number of users is also limited.
Example This example shows how to configure the maximum numbers of users allowed on
port 1. The maximum number of users allowed is 32.
DXS-3600-32S#configure terminal
DXS-3600-32S(config)#interface tenGigabitEthernet 1/0/1
DXS-3600-32S(config-if)#dot1x port-max-user 32
DXS-3600-32S(config-if)#
Parameters None.
Default 802.1X can not forward EAPOL PDUs by default.
Command Mode Global Configuration Mode.
Command Default Level Level: 8
Usage Guideline When 802.1X functionality is disabled globally or for a port, and if 802.1X is set to
forward EAPOL PDUs both globally and for the port, a received EAPOL packet on
the port will be flooded in the same VLAN to those ports which have 802.1X
forwarding EAPOL PDUs enabled and 802.1X is disabled (globally or just for the
port). 802.1X can not forward EAPOL PDUs by default.