Edge-Core ECS4210-12P User manual

CLI Reference Guide
www.edge-core.com
12/28-Port Gigabit Ethernet
Layer 2 Switch
ECS4210-12P
ECS4210-12T
ECS4210-28P
ECS4210-28T
Software Release v1.0.0.24

CLI Reference Guide
ECS4210-12P
Layer 2 Managed PoE Switch with
8 10/100/1000BASE-T (RJ-45) PoE Ports,
2 10/100/1000BASE-T (RJ-45) Ports,
and 2 Gigabit SFP Uplink Ports
ECS4210-12T
Layer 2 Managed Switch with
8 10/100/1000BASE-T (RJ-45) Ports,
and 4 Gigabit SFP Uplink Ports
ECS4210-28P
Layer 2 Managed PoE Switch with
24 10/100/1000BASE-T (RJ-45) PoE Ports,
and 4 Gigabit SFP Uplink Ports
ECS4210-28T
Layer 2 Managed Switch with
24 10/100/1000BASE-T (RJ-45) Ports,
and 4 Gigabit SFP Uplink Ports
ECS4210-12P 149100000219A
ECS4210-12T 149100000241A
ECS4210-28P 149100000217H
ECS4210-28T 149100000217H
E032014/ST-R03

– 3 –
How to Use This Guide
This guide includes detailed information on the switch software, including how to
operate and use the management functions of the switch. To deploy this switch
effectively and ensure trouble-free operation, you should first read the relevant
sections in this guide so that you are familiar with all of its software features.
Who Should Read This
Guide?
This guide is for network administrators who are responsible for operating and
maintaining network equipment. The guide assumes a basic working knowledge of
LANs (Local Area Networks), the Internet Protocol (IP), and Simple Network
Management Protocol (SNMP).
How This Guide is
Organized
This guide describes the switch’s command line interface (CLI). For more detailed
information on the switch’s key features refer to the Web Management Guide.
The guide includes these sections:
◆Section I “Getting Started” — Includes information on initial configuration.
◆Section II “Command Line Interface” — Includes all management options
available through the CLI.
◆Section III “Appendices” — Includes information on troubleshooting switch
management access.
Related
Documentation
This guide focuses on switch software configuration through the CLI.
For information on how to manage the switch through the Web management
interface, see the following guide:
Web Management Guide
For information on how to install the switch, see the following guide:
Installation Guide
For all safety information and regulatory statements, see the following documents:
Quick Start Guide
Safety and Regulatory Information

How to Use This Guide
– 4 –
Conventions The following conventions are used throughout this guide to show information:
Note: Emphasizes important information or calls your attention to related features
or instructions.
Caution: Alerts you to a potential hazard that could cause loss of data, or damage
the system or equipment.
Warning: Alerts you to a potential hazard that could cause personal injury.
Revision History This section summarizes the changes in each revision of this guide.
March 2014 Revision
This is the third version of this guide. This guide is valid for software release
v1.0.0.24. It includes the following changes.
◆Added the chapter "Power over Ethernet Commands" on page 375.
◆Changed maximum value for the command "mac-address-table aging-time" on
page 425.
◆Added the section "MLD Snooping" on page 570.
◆Added the command "ipv6 nd dad attempts" on page 675.
◆Added the command "ipv6 nd ns-interval" on page 676.
◆Added the command "ipv6 nd reachable-time" on page 678.
October 2013 Revision
This is the second version of this guide. This guide is valid for software release
v1.0.0.18. It includes the following changes.
◆Added the ECS4210-12T model.
◆Updated default setting for "port-isolation profile" on page 312.
◆Documented new command set for "Port-based Traffic Segmentation" on
page 313.
◆Added global command "ip access-group" on page 321.
◆Added VID parameter for "permit, deny (Extended IPv4 ACL)" on page 323.

How to Use This Guide
– 5 –
◆Added global command "ipv6 access-group" on page 329.
◆Added global command "mac access-group" on page 335.
◆Added mask parameter to the command "mac-vlan" on page 496.
◆Documented new syntax for "set cos" on page 531.
◆Documented new syntax for "set ip dscp" on page 532.
◆Added description for "ip igmp authentication" on page 566.
April 2013 Revision
This is the first version of this guide. This guide is valid for software release
v1.0.0.12.

How to Use This Guide
– 6 –

– 7 –
Contents
How to Use This Guide 3
Contents 7
Figures 33
Tables 35
Section I Getting Started 41
1 Initial Switch Configuration 43
Connecting to the Switch 43
Configuration Options 43
Required Connections 44
Remote Connections 45
Basic Configuration 45
Console Connection 45
Setting Passwords 46
Setting an IP Address 46
Downloading a Configuration File Referenced by a DHCP Server 53
Enabling SNMP Management Access 55
Managing System Files 57
Saving or Restoring Configuration Settings 58
Section II Command Line Interface 61
2 Using the Command Line Interface 63
Accessing the CLI 63
Console Connection 63
Telnet Connection 63

Contents
– 8 –
Entering Commands 65
Keywords and Arguments 65
Minimum Abbreviation 65
Command Completion 65
Getting Help on Commands 66
Partial Keyword Lookup 68
Negating the Effect of Commands 68
Using Command History 68
Understanding Command Modes 68
Exec Commands 69
Configuration Commands 69
Command Line Processing 71
CLI Command Groups 72
3 General Commands 75
prompt 75
reload (Global Configuration) 76
enable 77
quit 78
show history 78
configure 79
disable 80
reload (Privileged Exec) 80
show reload 81
end 81
exit 81
4 System Management Commands 83
Device Designation 83
hostname 84
Banner Information 84
banner configure 85
banner configure company 86
banner configure dc-power-info 87
banner configure department 87
banner configure equipment-info 88

Contents
– 9 –
banner configure equipment-location 89
banner configure ip-lan 89
banner configure lp-number 90
banner configure manager-info 91
banner configure mux 91
banner configure note 92
show banner 93
System Status 93
show access-list tcam-utilization 94
show memory 94
show process cpu 95
show running-config 96
show startup-config 97
show system 98
show tech-support 99
show users 100
show version 100
show watchdog 101
watchdog software 101
Frame Size 102
jumbo frame 102
File Management 103
General Commands 104
boot system 104
copy 105
delete 108
dir 108
whichboot 109
Automatic Code Upgrade Commands 110
upgrade opcode auto 110
upgrade opcode path 111
upgrade opcode reload 112
show upgrade 113
Line 113
line 114

Contents
– 10 –
databits 115
exec-timeout 115
login 116
parity 117
password 118
password-thresh 119
silent-time 119
speed 120
stopbits 121
timeout login response 121
disconnect 122
terminal 122
show line 123
Event Logging 124
logging facility 125
logging history 125
logging host 126
logging on 127
logging trap 128
clear log 128
show log 129
show logging 130
Time 132
SNTP Commands 132
sntp client 132
sntp poll 133
sntp server 134
show sntp 134
NTP Commands 135
ntp authenticate 135
ntp authentication-key 136
ntp client 137
ntp server 137
show ntp 138

Contents
– 11 –
Manual Configuration Commands 139
clock timezone 139
calendar set 140
show calendar 140
Time Range 141
time-range 141
absolute 142
periodic 143
show time-range 144
Switch Clustering 144
cluster 145
cluster commander 146
cluster ip-pool 146
cluster member 147
rcommand 148
show cluster 148
show cluster members 149
show cluster candidates 149
5 SNMP Commands 151
General SNMP Commands 153
snmp-server 153
snmp-server community 153
snmp-server contact 154
snmp-server location 154
show snmp 155
SNMP Target Host Commands 156
snmp-server enable traps 156
snmp-server host 157
SNMPv3 Commands 159
snmp-server engine-id 159
snmp-server group 160
snmp-server user 162
snmp-server view 163
show snmp engine-id 164

Contents
– 12 –
show snmp group 165
show snmp user 166
show snmp view 167
Notification Log Commands 167
nlm 167
snmp-server notify-filter 168
show nlm oper-status 169
show snmp notify-filter 170
Additional Trap Commands 170
memory 170
process cpu 171
6 Remote Monitoring Commands 173
rmon alarm 174
rmon event 175
rmon collection history 176
rmon collection rmon1 177
show rmon alarms 178
show rmon events 178
show rmon history 179
show rmon statistics 179
7 Authentication Commands 181
User Accounts and Privilege Levels 182
enable password 182
username 183
privilege 184
show privilege 185
Authentication Sequence 185
authentication enable 186
authentication login 187
RADIUS Client 188
radius-server acct-port 188
radius-server auth-port 189
radius-server host 189
radius-server key 190

Contents
– 13 –
radius-server retransmit 190
radius-server timeout 191
show radius-server 191
TACACS+ Client 192
tacacs-server host 192
tacacs-server key 193
tacacs-server port 194
tacacs-server retransmit 194
tacacs-server timeout 195
show tacacs-server 195
AAA 196
aaa accounting dot1x 196
aaa accounting exec 197
aaa accounting update 198
aaa authorization exec 199
aaa group server 200
server 200
accounting dot1x 201
accounting exec 201
authorization exec 202
show accounting 202
Web Server 203
ip http port 204
ip http server 204
ip http secure-port 205
ip http secure-server 205
Telnet Server 207
ip telnet max-sessions 207
ip telnet port 208
ip telnet server 208
show ip telnet 209
Secure Shell 209
ip ssh authentication-retries 212
ip ssh server 212
ip ssh server-key size 213

Contents
– 14 –
ip ssh timeout 214
delete public-key 214
ip ssh crypto host-key generate 215
ip ssh crypto zeroize 216
ip ssh save host-key 216
show ip ssh 217
show public-key 217
show ssh 218
802.1X Port Authentication 219
General Commands 220
dot1x default 220
dot1x eapol-pass-through 220
dot1x system-auth-control 221
Authenticator Commands 221
dot1x intrusion-action 221
dot1x max-reauth-req 222
dot1x max-req 222
dot1x operation-mode 223
dot1x port-control 224
dot1x re-authentication 224
dot1x timeout quiet-period 225
dot1x timeout re-authperiod 225
dot1x timeout supp-timeout 226
dot1x timeout tx-period 227
dot1x re-authenticate 227
Supplicant Commands 228
dot1x identity profile 228
dot1x max-start 228
dot1x pae supplicant 229
dot1x timeout auth-period 230
dot1x timeout held-period 230
dot1x timeout start-period 231
Display Information Commands 231
show dot1x 231

Contents
– 15 –
Management IP Filter 234
management 234
show management 235
PPPoE Intermediate Agent 236
pppoe intermediate-agent 237
pppoe intermediate-agent format-type 237
pppoe intermediate-agent port-enable 238
pppoe intermediate-agent port-format-type 239
pppoe intermediate-agent trust 240
pppoe intermediate-agent vendor-tag strip 240
clear pppoe intermediate-agent statistics 241
show pppoe intermediate-agent info 241
show pppoe intermediate-agent statistics 242
8 General Security Measures 245
Port Security 246
port security 246
show port security 248
Network Access (MAC Address Authentication) 250
network-access aging 251
network-access mac-filter 251
mac-authentication reauth-time 252
network-access dynamic-qos 253
network-access dynamic-vlan 254
network-access guest-vlan 255
network-access link-detection 255
network-access link-detection link-down 256
network-access link-detection link-up 256
network-access link-detection link-up-down 257
network-access max-mac-count 257
network-access mode mac-authentication 258
network-access port-mac-filter 259
mac-authentication intrusion-action 260
mac-authentication max-mac-count 260
clear network-access 261

Contents
– 16 –
show network-access 261
show network-access mac-address-table 262
show network-access mac-filter 263
Web Authentication 263
web-auth login-attempts 264
web-auth quiet-period 265
web-auth session-timeout 265
web-auth system-auth-control 266
web-auth 266
web-auth re-authenticate (Port) 267
web-auth re-authenticate (IP) 267
show web-auth 268
show web-auth interface 268
show web-auth summary 269
DHCP Snooping 269
ip dhcp snooping 270
ip dhcp snooping information option 272
ip dhcp snooping information policy 273
ip dhcp snooping verify mac-address 274
ip dhcp snooping vlan 275
ip dhcp snooping information option circuit-id 276
ip dhcp snooping trust 277
clear ip dhcp snooping binding 278
clear ip dhcp snooping database flash 278
ip dhcp snooping database flash 279
show ip dhcp snooping 279
show ip dhcp snooping binding 280
IP Source Guard 280
ip source-guard binding 280
ip source-guard 282
ip source-guard max-binding 283
show ip source-guard 284
show ip source-guard binding 284
ARP Inspection 285
ip arp inspection 286

Contents
– 17 –
ip arp inspection filter 287
ip arp inspection log-buffer logs 288
ip arp inspection validate 289
ip arp inspection vlan 289
ip arp inspection limit 290
ip arp inspection trust 291
show ip arp inspection configuration 292
show ip arp inspection interface 292
show ip arp inspection log 293
show ip arp inspection statistics 293
show ip arp inspection vlan 293
Denial of Service Protection 294
Global Protection 295
dos-protection 295
Protection for ICMP 296
dos-protection icmp flood 296
dos-protection icmp nuke 296
dos-protection icmp ping-of-death 297
dos-protection icmp smurf 297
Protection for IPv4 298
dos-protection ip invalid-destination-ip-address 298
dos-protection ip invalid-header-length 298
dos-protection ip invalid-ip-address 299
dos-protection ip invalid-source-ip-address 299
Protection for IPv6 300
dos-protection ipv6 invalid-destination-ip-address 300
dos-protection ipv6 invalid-header-length 301
dos-protection ipv6 invalid-ip-address 301
dos-protection ipv6 invalid-source-ip-address 301
Protection for TCP 302
dos-protection tcp blat-block 302
dos-protection tcp invalid-header-length 303
dos-protection tcp null-scan 303
dos-protection tcp syn-ack-psh-block 304
dos-protection tcp syn-fin-scan 304

Contents
– 18 –
dos-protection tcp syn-flood 305
dos-protection tcp syn-psh-block 305
dos-protection tcp syn-rst-scan 306
dos-protection tcp syn-urg-block 306
dos-protection tcp xmas-scan 307
Protection for UDP 307
dos-protection udp blat-block 307
dos-protection udp flood 308
dos-protection udp invalid-header-length 308
Other Protection Commands 309
dos-protection echo-chargen 309
DoS Configuration Information 309
show dos-protection 309
Port Isolation 310
port-isolation 310
port-isolation join 311
port-isolation profile 312
show port-isolation 312
Port-based Traffic Segmentation 313
traffic-segmentation 313
traffic-segmentation session 314
traffic-segmentation uplink/downlink 315
traffic-segmentation uplink-to-uplink 316
show traffic-segmentation 317
9 Access Control Lists 319
IPv4 ACLs 319
access-list ip 320
ip access-group 321
permit, deny (Standard IP ACL) 322
permit, deny (Extended IPv4 ACL) 323
ip access-group 326
show ip access-group 326
show ip access-list 327

Contents
– 19 –
IPv6 ACLs 327
access-list ipv6 328
ipv6 access-group 329
permit, deny (Standard IPv6 ACL) 329
permit, deny (Extended IPv6 ACL) 330
ipv6 access-group 332
show ipv6 access-group 333
show ipv6 access-list 333
MAC ACLs 334
access-list mac 334
mac access-group 335
permit, deny (MAC ACL) 336
mac access-group 338
show mac access-group 338
show mac access-list 339
ARP ACLs 339
access-list arp 339
permit, deny (ARP ACL) 340
show arp access-list 341
ACL Information 342
clear access-list hardware counters 342
show access-group 342
show access-list 343
10 Interface Commands 345
Interface Configuration 346
interface 346
alias 346
capabilities 347
description 348
flowcontrol 349
negotiation 350
shutdown 350
speed-duplex 351
clear counters 352

Contents
– 20 –
show interfaces brief 353
show interfaces counters 353
show interfaces status 357
show interfaces transceiver 358
Cable Diagnostics 359
test cable-diagnostics 359
show cable-diagnostics 360
11 Link Aggregation Commands 363
Manual Configuration Commands 364
port channel load-balance 364
channel-group 366
Dynamic Configuration Commands 366
lacp 366
lacp admin-key (Ethernet Interface) 368
lacp port-priority 368
lacp system-priority 369
lacp admin-key (Port Channel) 370
Trunk Status Display Commands 371
show lacp 371
show port-channel load-balance 374
12 Power over Ethernet Commands 375
power inline compatible 375
power inline 376
power inline maximum allocation 377
power inline priority 378
show power inline status 379
show power mainpower 380
13 Port Mirroring Commands 381
Local Port Mirroring Commands 381
port monitor 381
show port monitor 383
RSPAN Mirroring Commands 384
rspan source 386