SMC Networks 8126PL2-F Programming manual

MANAGEMENT GUIDE
ta
TigerSwitchTM 10/100/1000
L2-Lite SMB PoE Gigabit Switch
SMC8126PL2-F

20 Mason
Irvine, CA 92618
Phone: [phone]
TigerSwitch 10/100/1000
Management Guide
From SMC’s Tiger line of feature-rich workgroup LAN solutions
August 2009
Pub. # 149100000023A
E082009/MW-R01

Information furnished by SMC Networks, Inc. (SMC) is believed to be accurate and
reliable. However, no responsibility is assumed by SMC for its use, nor for any
infringements of patents or other rights of third parties which may result from its use. No
license is granted by implication or otherwise under any patent or patent rights of SMC.
SMC reserves the right to change specifications at any time without notice.
Copyright © 2009 by
SMC Networks, Inc.
20 Mason
Irvine, CA 92618
All rights reserved.
Trademarks:
SMC is a registered trademark; and EZ Switch, TigerStack and TigerSwitch are
trademarks of SMC Networks, Inc. Other product and company names are trademarks or
registered trademarks of their respective holders.

v
About This Guide
Purpose
This guide gives specific information on how to operate and use the management
functions of the switch.
Audience
The guide is intended for use by network administrators who are responsible for operating
and maintaining network equipment; consequently, it assumes a basic working
knowledge of general switch functions, the Internet Protocol (IP), and Simple Network
Management Protocol (SNMP).
Conventions
The following conventions are used throughout this guide to show information:
Note: Emphasizes important information or calls your attention to related features or
instructions.
Caution: Alerts you to a potential hazard that could cause loss of data, or damage the
system or equipment.
Warning: Alerts you to a potential hazard that could cause personal injury.
Related Publications
The following publication details the hardware features of the switch, including the
physical and performance-related characteristics, and how to install the switch:
The Installation Guide
Also, as part of the switch’s software, there is an online web-based help that describes all
management related features.
Revision History
This section summarizes the changes in each revision of this guide.
August 2009 Revision
This is the first revision of this guide. This guide is valid for software release v1.0.0.10.

vi

vii
Contents
Chapter 1: Introduction 1-1
Key Features 1-1
Description of Software Features 1-2
System Defaults 1-6
Chapter 2: Initial Configuration 2-1
Connecting to the Switch 2-1
Configuration Options 2-1
Required Connections 2-2
Remote Connections 2-3
Basic Configuration 2-3
Console Connection 2-3
Setting Passwords 2-4
Setting an IP Address 2-4
Manual Configuration 2-4
Dynamic Configuration 2-5
Enabling SNMP Management Access 2-6
Community Strings (for SNMP version 1 and 2c clients) 2-6
Trap Receivers 2-7
Configuring Access for SNMP Version 3 Clients 2-8
Managing System Files 2-8
Saving Configuration Settings 2-9
Chapter 3: Configuring the Switch 3-1
Using the Web Interface 3-1
Navigating the Web Browser Interface 3-2
Home Page 3-2
Configuration Options 3-3
Panel Display 3-3
Main Menu 3-4
Basic Configuration 3-11
Displaying System Information 3-11
Displaying Switch Hardware/Software Versions 3-13
Displaying Bridge Extension Capabilities 3-15
Setting the Switch’s IP Address 3-16
Manual Configuration 3-17
Using DHCP/BOOTP 3-18
Enabling Jumbo Frames 3-19
Managing Firmware 3-20
Downloading System Software from a Server 3-20

Contents
viii
Saving or Restoring Configuration Settings 3-22
Downloading Configuration Settings from a Server 3-23
Console Port Settings 3-24
Telnet Settings 3-26
Configuring Event Logging 3-28
System Log Configuration 3-28
Remote Log Configuration 3-29
Displaying Log Messages 3-31
Simple Mail Transfer Protocol 3-31
Renumbering the System 3-33
Resetting the System 3-34
Setting the System Clock 3-35
Setting the Time Manually 3-35
Configuring SNTP 3-35
Setting the Time Zone 3-36
Simple Network Management Protocol 3-37
Enabling the SNMP Agent 3-39
Setting Community Access Strings 3-39
Specifying Trap Managers and Trap Types 3-40
Configuring SNMPv3 Management Access 3-43
Setting the Local Engine ID 3-43
Specifying a Remote Engine ID 3-44
Configuring SNMPv3 Users 3-45
Configuring Remote SNMPv3 Users 3-47
Configuring SNMPv3 Groups 3-49
Setting SNMPv3 Views 3-52
User Authentication 3-54
Configuring User Accounts 3-54
Configuring Local/Remote Logon Authentication 3-56
Configuring Encryption Keys 3-59
AAA Authorization and Accounting 3-61
Configuring AAA RADIUS Group Settings 3-62
Configuring AAA TACACS+ Group Settings 3-63
Configuring AAA Accounting 3-63
AAA Accounting Update 3-65
AAA Accounting 802.1X Port Settings 3-66
AAA Accounting Exec Command Privileges 3-67
AAA Accounting Exec Settings 3-68
AAA Accounting Summary 3-68
Authorization Settings 3-70
Authorization EXEC Settings 3-71
Authorization Summary 3-72
Configuring HTTPS 3-73
Replacing the Default Secure-site Certificate 3-74
Configuring the Secure Shell 3-75

Contents
ix
Generating the Host Key Pair 3-77
Configuring the SSH Server 3-79
Configuring 802.1X Port Authentication 3-80
Displaying 802.1X Global Settings 3-81
Configuring 802.1X Global Settings 3-82
Configuring Port Settings for 802.1X 3-83
Displaying 802.1X Statistics 3-86
Filtering IP Addresses for Management Access 3-87
General Security Measures 3-89
Configuring Port Security 3-90
Access Control Lists 3-91
Configuring Access Control Lists 3-91
Setting the ACL Name and Type 3-92
Configuring a Standard IP ACL 3-93
Configuring an Extended IP ACL 3-94
Configuring a MAC ACL 3-96
Binding a Port to an Access Control List 3-98
Filtering IP Addresses for Management Access 3-99
DHCP Snooping 3-101
DHCP Snooping Configuration 3-102
DHCP Snooping VLAN Configuration 3-103
DHCP Snooping Information Option Configuration 3-103
DHCP Snooping Port Configuration 3-105
DHCP Snooping Binding Information 3-106
IP Source Guard 3-107
Configuring Ports for IP Source Guard 3-107
Configuring Static Binding for IP Source Guard 3-109
Displaying Information for Dynamic IP Source Guard Bindings 3-111
Port Configuration 3-112
Displaying Connection Status 3-112
Configuring Interface Connections 3-114
Creating Trunk Groups 3-116
Statically Configuring a Trunk 3-117
Enabling LACP on Selected Ports 3-118
Configuring Parameters for LACP Group Members 3-120
Displaying LACP Port Counters 3-122
Displaying LACP Settings and Status for the Local Side 3-124
Displaying LACP Settings and Status for the Remote Side 3-126
Setting Broadcast Storm Thresholds 3-127
Configuring Local Port Mirroring 3-128
Configuring Rate Limits 3-129
Rate Limit Configuration 3-129
Showing Port Statistics 3-130
Power Over Ethernet Settings 3-134
Switch Power Status 3-135

Contents
x
Setting a Switch Power Budget 3-136
Displaying Port Power Status 3-136
Configuring Port PoE Power 3-137
Address Table Settings 3-139
Setting Static Addresses 3-139
Displaying the Address Table 3-140
Changing the Aging Time 3-141
Spanning Tree Algorithm Configuration 3-142
Displaying Global Settings for STA 3-144
Configuring Global Settings for STA 3-147
Displaying Interface Settings for STA 3-151
Configuring Interface Settings for STA 3-154
Configuring Multiple Spanning Trees 3-158
Displaying Interface Settings for MSTP 3-161
Configuring Interface Settings for MSTP 3-163
VLAN Configuration 3-164
IEEE 802.1Q VLANs 3-164
Enabling or Disabling GVRP (Global Setting) 3-167
Displaying Basic VLAN Information 3-168
Displaying Current VLANs 3-169
Creating VLANs 3-170
Adding Static Members to VLANs (VLAN Index) 3-173
Adding Static Members to VLANs (Port Index) 3-175
Configuring VLAN Behavior for Interfaces 3-176
Configuring IEEE 802.1Q Tunneling 3-178
Enabling QinQ Tunneling on the Switch 3-181
Adding an Interface to a QinQ Tunnel 3-182
Configuring Private VLANs 3-184
Enabling Private VLANs 3-184
Configuring Uplink and Downlink Ports 3-185
Protocol VLANs 3-185
Configuring Protocol VLAN Groups 3-186
Mapping Protocols to VLANs 3-187
Class of Service Configuration 3-189
Layer 2 Queue Settings 3-189
Setting the Default Priority for Interfaces 3-189
Mapping CoS Values to Egress Queues 3-191
Selecting the Queue Mode 3-193
Setting the Service Weight for Traffic Classes 3-194
Layer 3/4 Priority Settings 3-195
Mapping Layer 3/4 Priorities to CoS Values 3-195
Selecting IP Precedence/DSCP Priority 3-195
Mapping IP Precedence 3-196
Mapping DSCP Priority 3-197
Mapping IP Port Priority 3-199

Contents
xi
Quality of Service 3-200
Configuring Quality of Service Parameters 3-201
Configuring a Class Map 3-201
Creating QoS Policies 3-204
Attaching a Policy Map to Ingress Queues 3-207
Multicast Filtering 3-208
Layer 2 IGMP (Snooping and Query) 3-209
Configuring IGMP Snooping and Query Parameters 3-210
Enabling IGMP Immediate Leave 3-212
Displaying Interfaces Attached to a Multicast Router 3-214
Specifying Static Interfaces for a Multicast Router 3-215
Displaying Port Members of Multicast Services 3-216
Assigning Ports to Multicast Services 3-217
IGMP Filtering and Throttling 3-218
Enabling IGMP Filtering and Throttling 3-218
Configuring IGMP Filter Profiles 3-219
Configuring IGMP Filtering and Throttling for Interfaces 3-221
Multicast VLAN Registration 3-223
Configuring Global MVR Settings 3-224
Displaying MVR Interface Status 3-226
Displaying Port Members of Multicast Groups 3-227
Configuring MVR Interface Status 3-228
Assigning Static Multicast Groups to Interfaces 3-230
Configuring Domain Name Service 3-231
Configuring General DNS Service Parameters 3-231
Configuring Static DNS Host to Address Entries 3-233
Displaying the DNS Cache 3-235
Switch Clustering 3-236
Cluster Configuration 3-236
Cluster Member Configuration 3-238
Displaying Information on Cluster Members 3-239
Cluster Candidate Information 3-240
Chapter 4: Command Line Interface 4-1
Using the Command Line Interface 4-1
Accessing the CLI 4-1
Console Connection 4-1
Telnet Connection 4-2
Entering Commands 4-3
Keywords and Arguments 4-3
Minimum Abbreviation 4-3
Command Completion 4-3
Getting Help on Commands 4-3
Showing Commands 4-4

Contents
xii
Partial Keyword Lookup 4-5
Negating the Effect of Commands 4-5
Using Command History 4-5
Understanding Command Modes 4-6
Exec Commands 4-6
Configuration Commands 4-7
Command Line Processing 4-9
Command Groups 4-10
General Commands 4-11
enable 4-11
disable 4-12
configure 4-12
show history 4-13
reload 4-13
prompt 4-14
end 4-14
exit 4-15
quit 4-15
System Management Commands 4-16
Device Designation Commands 4-16
hostname 4-16
System Status Commands 4-17
show startup-config 4-17
show running-config 4-18
show system 4-21
show users 4-21
show version 4-22
Frame Size Commands 4-23
jumbo frame 4-23
File Management Commands 4-24
copy 4-25
delete 4-28
dir 4-28
whichboot 4-29
boot system 4-30
Line Commands 4-31
line 4-31
login 4-32
password 4-33
timeout login response 4-34
exec-timeout 4-34
password-thresh 4-35
silent-time 4-36
databits 4-36
parity 4-37

Contents
xiii
speed 4-38
stopbits 4-38
disconnect 4-39
show line 4-39
Event Logging Commands 4-40
logging on 4-41
logging history 4-42
logging host 4-43
logging facility 4-43
logging trap 4-44
clear log 4-44
show logging 4-45
show log 4-46
SMTP Alert Commands 4-47
logging sendmail host 4-47
logging sendmail level 4-48
logging sendmail source-email 4-49
logging sendmail destination-email 4-49
logging sendmail 4-50
show logging sendmail 4-50
Time Commands 4-51
sntp client 4-51
sntp server 4-52
sntp poll 4-53
show sntp 4-53
clock timezone 4-54
calendar set 4-55
show calendar 4-55
Switch Cluster Commands 4-56
cluster 4-56
cluster commander 4-57
cluster ip-pool 4-58
cluster member 4-58
rcommand 4-59
show cluster 4-59
show cluster members 4-60
show cluster candidates 4-60
SNMP Commands 4-61
snmp-server 4-62
show snmp 4-62
snmp-server community 4-63
snmp-server contact 4-64
snmp-server location 4-64
snmp-server host 4-65
snmp-server enable traps 4-67

Contents
xiv
snmp-server engine-id 4-68
show snmp engine-id 4-69
snmp-server view 4-69
show snmp view 4-71
snmp-server group 4-71
show snmp group 4-73
snmp-server user 4-74
show snmp user 4-75
Authentication Commands 4-76
User Account and Privilege Level Commands 4-77
username 4-77
enable password 4-78
privilege 4-79
privilege rerun 4-79
show privilege 4-80
Authentication Sequence 4-80
authentication login 4-81
authentication enable 4-82
RADIUS Client 4-83
radius-server host 4-83
radius-server port 4-84
radius-server key 4-84
radius-server retransmit 4-85
radius-server timeout 4-85
show radius-server 4-85
TACACS+ Client 4-86
tacacs-server host 4-87
tacacs-server port 4-87
tacacs-server key 4-88
tacacs-server retransmit 4-88
tacacs-server timeout 4-89
show tacacs-server 4-89
AAA Commands 4-90
aaa group server 4-90
server 4-91
aaa accounting dot1x 4-92
aaa accounting exec 4-93
aaa accounting commands 4-94
aaa accounting update 4-95
accounting dot1x 4-95
accounting exec 4-96
accounting commands 4-96
aaa authorization exec 4-97
authorization exec 4-98
show accounting 4-98

Contents
xv
Web Server Commands 4-99
ip http port 4-99
ip http server 4-100
ip http secure-server 4-100
ip http secure-port 4-101
Telnet Server Commands 4-102
ip telnet server 4-102
Secure Shell Commands 4-103
ip ssh server 4-105
ip ssh timeout 4-106
ip ssh authentication-retries 4-106
ip ssh server-key size 4-107
delete public-key 4-107
ip ssh crypto host-key generate 4-108
ip ssh crypto zeroize 4-108
ip ssh save host-key 4-109
show ip ssh 4-109
show ssh 4-110
show public-key 4-111
802.1X Port Authentication 4-112
dot1x system-auth-control 4-112
dot1x default 4-113
dot1x max-req 4-113
dot1x port-control 4-113
dot1x operation-mode 4-114
dot1x re-authenticate 4-115
dot1x re-authentication 4-115
dot1x timeout quiet-period 4-116
dot1x timeout re-authperiod 4-116
dot1x timeout tx-period 4-117
dot1x timeout supp-timeout 4-117
show dot1x 4-118
Management IP Filter Commands 4-121
management 4-121
show management 4-122
General Security Measures 4-123
Port Security Commands 4-124
port security 4-124
Network Access (MAC Address Authentication) 4-126
network-access max-mac-count 4-126
network-access mode 4-127
mac-authentication reauth-time 4-128
mac-authentication intrusion-action 4-128
mac-authentication max-mac-count 4-129
show network-access 4-129

Contents
xvi
show network-access mac-address-table 4-130
DHCP Snooping Commands 4-131
ip dhcp snooping 4-132
ip dhcp snooping vlan 4-133
ip dhcp snooping trust 4-134
ip dhcp snooping verify mac-address 4-135
ip dhcp snooping information option 4-136
ip dhcp snooping information policy 4-137
show ip dhcp snooping 4-138
show ip dhcp snooping binding 4-138
IP Source Guard Commands 4-139
ip source-guard 4-139
ip source-guard binding 4-141
show ip source-guard 4-142
show ip source-guard binding 4-142
Access Control List Commands 4-143
IP ACLs 4-143
access-list ip 4-144
permit, deny (Standard ACL) 4-145
permit, deny (Extended ACL) 4-146
show ip access-list 4-148
ip access-group 4-148
show ip access-group 4-149
MAC ACLs 4-149
access-list mac 4-150
permit, deny (MAC ACL) 4-150
show mac access-list 4-152
mac access-group 4-152
show mac access-group 4-153
ACL Information 4-154
show access-list 4-154
show access-group 4-154
Interface Commands 4-155
interface 4-155
description 4-156
speed-duplex 4-156
negotiation 4-157
capabilities 4-158
flowcontrol 4-159
media-type 4-160
shutdown 4-160
switchport packet-rate 4-161
clear counters 4-162
show interfaces status 4-163
show interfaces counters 4-164

Contents
xvii
show interfaces switchport 4-165
Link Aggregation Commands 4-167
channel-group 4-168
lacp 4-169
lacp system-priority 4-170
lacp admin-key (Ethernet Interface) 4-171
lacp admin-key (Port Channel) 4-172
lacp port-priority 4-173
show lacp 4-174
Mirror Port Commands 4-178
port monitor 4-178
show port monitor 4-179
RSPAN Mirroring Commands 4-180
rspan source 4-181
rspan destination 4-182
rspan remote vlan 4-183
no rspan session 4-184
show rspan 4-184
Rate Limit Commands 4-185
rate-limit 4-185
Power over Ethernet Commands 4-186
power mainpower maximum allocation 4-186
power inline compatible 4-187
power inline 4-188
power inline maximum allocation 4-189
power inline priority 4-189
power inline overload-auto-recover 4-190
show power inline status 4-191
show power mainpower 4-192
mac-address-table static 4-193
clear mac-address-table dynamic 4-194
show mac-address-table 4-194
mac-address-table aging-time 4-195
show mac-address-table aging-time 4-195
Spanning Tree Commands 4-196
spanning-tree 4-197
spanning-tree mode 4-197
spanning-tree forward-time 4-198
spanning-tree hello-time 4-199
spanning-tree max-age 4-200
spanning-tree priority 4-200
spanning-tree pathcost method 4-201
spanning-tree transmission-limit 4-202
spanning-tree mst-configuration 4-202
mst vlan 4-203

Contents
xviii
mst priority 4-203
name 4-204
revision 4-205
max-hops 4-205
spanning-tree spanning-disabled 4-206
spanning-tree cost 4-206
spanning-tree port-priority 4-208
spanning-tree edge-port 4-208
spanning-tree portfast 4-209
spanning-tree link-type 4-210
spanning-tree mst cost 4-211
spanning-tree mst port-priority 4-212
spanning-tree protocol-migration 4-212
show spanning-tree 4-213
show spanning-tree mst configuration 4-215
VLAN Commands 4-215
GVRP and Bridge Extension Commands 4-216
bridge-ext gvrp 4-216
show bridge-ext 4-217
switchport gvrp 4-217
show gvrp configuration 4-218
garp timer 4-218
show garp timer 4-219
Editing VLAN Groups 4-220
vlan database 4-220
vlan 4-221
Configuring VLAN Interfaces 4-222
interface vlan 4-222
switchport mode 4-223
switchport acceptable-frame-types 4-224
switchport ingress-filtering 4-224
switchport native vlan 4-225
switchport allowed vlan 4-226
switchport forbidden vlan 4-227
Displaying VLAN Information 4-228
show vlan 4-228
Configuring IEEE 802.1Q Tunneling 4-229
dot1q-tunnel system-tunnel-control 4-230
switchport dot1q-tunnel mode 4-230
switchport dot1q-tunnel tpid 4-231
show dot1q-tunnel 4-232
Configuring Port-based Traffic Segmentation 4-233
pvlan 4-233
pvlan up-link/down-link 4-234
show pvlan 4-234

Contents
xix
Configuring Private VLANs 4-235
private-vlan 4-236
private vlan association 4-237
switchport mode private-vlan 4-238
switchport private-vlan host-association 4-238
switchport private-vlan mapping 4-239
show vlan private-vlan 4-239
Configuring Protocol-based VLANs 4-240
protocol-vlan protocol-group (Configuring Groups) 4-241
protocol-vlan protocol-group (Configuring Interfaces) 4-241
show protocol-vlan protocol-group 4-242
show interfaces protocol-vlan protocol-group 4-243
Class of Service Commands 4-244
Priority Commands (Layer 2) 4-244
queue mode 4-245
switchport priority default 4-245
queue bandwidth 4-246
queue cos-map 4-247
show queue mode 4-248
show queue bandwidth 4-249
show queue cos-map 4-249
Priority Commands (Layer 3 and 4) 4-250
map ip port (Global Configuration) 4-250
map ip port (Interface Configuration) 4-251
map ip precedence (Global Configuration) 4-251
map ip precedence (Interface Configuration) 4-252
map ip dscp (Global Configuration) 4-252
map ip dscp (Interface Configuration) 4-253
show map ip port 4-254
show map ip precedence 4-255
show map ip dscp 4-255
Quality of Service Commands 4-257
class-map 4-258
match 4-259
rename 4-260
description 4-260
policy-map 4-261
class 4-261
set 4-262
police 4-263
service-policy 4-264
show class-map 4-264
show policy-map 4-265
show policy-map interface 4-265
Multicast Filtering Commands 4-266

Contents
xx
IGMP Snooping Commands 4-266
ip igmp snooping 4-267
ip igmp snooping vlan static 4-267
ip igmp snooping version 4-268
ip igmp snooping leave-proxy 4-268
ip igmp snooping immediate-leave 4-269
show ip igmp snooping 4-270
show mac-address-table multicast 4-270
IGMP Query Commands (Layer 2) 4-271
ip igmp snooping querier 4-271
ip igmp snooping query-count 4-272
ip igmp snooping query-interval 4-273
ip igmp snooping query-max-response-time 4-273
ip igmp snooping router-port-expire-time 4-274
Static Multicast Routing Commands 4-275
ip igmp snooping vlan mrouter 4-275
show ip igmp snooping mrouter 4-276
IGMP Filtering and Throttling Commands 4-277
ip igmp filter (Global Configuration) 4-277
ip igmp profile 4-278
permit, deny 4-278
range 4-279
ip igmp filter (Interface Configuration) 4-279
ip igmp max-groups 4-280
ip igmp max-groups action 4-281
show ip igmp filter 4-281
show ip igmp profile 4-282
show ip igmp throttle interface 4-283
Multicast VLAN Registration Commands 4-284
mvr (Global Configuration) 4-284
mvr (Interface Configuration) 4-286
show mvr 4-287
Domain Name Service Commands 4-290
ip host 4-290
clear host 4-291
ip domain-name 4-291
ip domain-list 4-292
ip name-server 4-293
ip domain-lookup 4-294
show hosts 4-295
show dns 4-295
show dns cache 4-296
clear dns cache 4-296
IP Interface Commands 4-297
ip address 4-297