ix
Configuration procedure for automatic requests ·····························································································426
Creating a PKI entity····················································································································································427
Creating a PKI domain ················································································································································428
Generating an RSA key pair·······································································································································431
Destroying the RSA key pair ·······································································································································432
Retrieving and displaying a certificate ······················································································································432
Requesting a local certificate ······································································································································434
Retrieving and displaying a CRL ································································································································435
PKI configuration example ··········································································································································437
Configuring port isolation······································································································································· 441
Overview·······································································································································································441
Configuring a port isolation group ····························································································································441
Recommended configuration procedure···········································································································441
Adding port isolation groups ·····························································································································441
Configuring member ports for a port isolation group ·····················································································442
Port isolation configuration example··························································································································444
Network requirements·········································································································································444
Configuring the switch ········································································································································444
Viewing information about the isolation group································································································446
Configuring authorized IP ······································································································································ 447
Configuration procedure·············································································································································447
Authorized IP configuration example·························································································································448
Network requirements·········································································································································448
Configuration procedure ····································································································································448
Configuring ACLs···················································································································································· 451
Overview·······································································································································································451
ACL categories ····················································································································································451
Match order ·························································································································································451
ACL rule numbering ············································································································································452
Implementing time-based ACL rules···················································································································453
IPv4 fragments filtering with ACLs ·····················································································································453
Configuration guidelines ·············································································································································453
ACL configuration procedures ····································································································································453
Configuring a time range ···································································································································454
Adding an IPv4 ACL ···········································································································································455
Configuring a rule for a basic IPv4 ACL···········································································································456
Configuring a rule for an advanced IPv4 ACL·································································································457
Configuring a rule for an Ethernet frame header ACL ····················································································460
Adding an IPv6 ACL ···········································································································································462
Configuring a rule for a basic IPv6 ACL···········································································································463
Configuring a rule for an advanced IPv6 ACL·································································································464
Configuring QoS····················································································································································· 467
Overview·······································································································································································467
Networks without QoS guarantee·····················································································································467
QoS requirements of new applications·············································································································467
Congestion: causes, impacts, and countermeasures·······················································································467
End-to-end QoS····················································································································································469
Traffic classification·············································································································································469
Packet precedences·············································································································································470
Queue scheduling ···············································································································································472
Rate limit·······························································································································································473
Priority mapping ··················································································································································475