EasyManua.ls Logo

Cisco Catalyst 3550 Series User Manual

Cisco Catalyst 3550 Series
992 pages
To Next Page IconTo Next Page
To Next Page IconTo Next Page
To Previous Page IconTo Previous Page
To Previous Page IconTo Previous Page
Page #216 background imageLoading...
Page #216 background image
8-40
Catalyst 3550 Multilayer Switch Software Configuration Guide
78-11194-09
Chapter 8 Configuring Switch-Based Authentication
Configuring the Switch for Secure Shell
To delete the RSA key pair, use the crypto key zeroize rsa global configuration command. After the
RSA key pair is deleted, the SSH server is automatically disabled.
Configuring the SSH Server
Beginning in privileged EXEC mode, follow these steps to configure the SSH server:
Step 4
crypto key generate rsa Enable the SSH server for local and remote authentication on the switch
and generate an RSA key pair.
We recommend that a minimum modulus size of 1024 bits.
When you generate RSA keys, you are prompted to enter a modulus
length. A longer modulus length might be more secure, but it takes longer
to generate and to use.
Step 5
end Return to privileged EXEC mode.
Step 6
show ip ssh
or
show ssh
Show the version and configuration information for your SSH server.
Show the status of the SSH server on the switch.
Step 7
copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose
Command Purpose
Step 1
configure terminal Enter global configuration mode.
Step 2
ip ssh version [1 | 2] (Optional) Configure the switch to run SSH version 1 or SSH version 2.
1—Configure the switch to run SSH version 1.
2—Configure the switch to run SSH version 2.
If you do not enter this command or do not specify a keyword, the SSH
server selects the latest SSH version supported by the SSH client. For
example, if the SSH client sports SSHv1 and SSHv2, the SSH server
selects SSHv2.
Step 3
ip ssh {timeout seconds |
authentication-retries number}
Configure the SSH control parameters:
Specify the time-out value in seconds; the default is 120 seconds. The
range is 0 to 120 seconds. This parameter applies to the SSH
negotiation phase. After the connection is established, the switch uses
the default time-out values of the CLI-based sessions.
By default, up to five simultaneous, encrypted SSH connections for
multiple CLI-based sessions over the network are available (session 0
to session 4). After the execution shell starts, the CLI-based session
time-out value returns to the default of 10 minutes.
Specify the number of times that a client can re-authenticate to the
server. The default is 3; the range is 0 to 5.
Repeat this step when configuring both parameters.
Step 4
end Return to privileged EXEC mode.

Table of Contents

Question and Answer IconNeed help?

Do you have a question about the Cisco Catalyst 3550 Series and is the answer not in the manual?

Cisco Catalyst 3550 Series Specifications

General IconGeneral
Form FactorRack-mountable
ManageableYes
RAM64 MB
Device TypeSwitch
MAC Address Table Size12000 entries
Routing ProtocolRIP
FeaturesVLAN support
Power SupplyAC 120/230 V (50/60 Hz)
Ports24 or 48 x 10/100Base-TX, 1 x GBIC, 2 x 10/100/1000Base-T
Operating Temperature32 to 113°F (0 to 45°C)

Summary

CHAPTER 1 Overview

Features

Describes the hardware and software features supported in this release, including ease of use, performance, and manageability aspects.

Management Options

Explains how to configure and monitor switches and switch clusters using CMS and CLI interfaces, as well as IE2100 and SNMP.

Network Configuration Examples

Provides concepts and examples of using the switch to create dedicated network segments and interconnect them through Fast Ethernet and Gigabit Ethernet.

CHAPTER 2 Using the Command-Line Interface

Cisco IOS Command Modes

Explains the different modes within the Cisco IOS user interface and how commands available depend on the current mode.

Getting Help

Describes how to use the question mark (?) at the system prompt to display a list of commands and associated keywords and arguments.

Using Editing Features

Details editing features that help manipulate the command line, including keystroke editing and handling command line wraps.

CHAPTER 3 Getting Started with CMS

Understanding CMS

Explains the features of CMS for managing switch clusters and individual switches from web browsers, including views and interactive modes.

Privilege Levels

Explains the two levels of CMS access: read-write and read-only, and how privilege levels affect feature availability.

Configuring CMS

Covers requirements for running CMS, cross-platform considerations, and launching the CMS application.

CHAPTER 4 Assigning the Switch IP Address and Default Gateway

Understanding the Boot Process

Details the normal boot process involving the boot loader software, CPU initialization, power-on self-test, and loading of the operating system image.

Assigning Switch Information

Describes how to assign IP information through the switch setup program, DHCP server, or CLI, including host name and enable secret password.

Understanding DHCP-Based Autoconfiguration

Explains how DHCP provides configuration information to hosts and internetworking devices, including address allocation and parameter delivery.

CHAPTER 5 Configuring IE2100 CNS Agents

Understanding IE2100 Series Configuration Registrar Software

Describes the IE2100 Series Configuration Registrar as a network management device that automates device deployment and management.

Configuring CNS Embedded Agents

Details the procedures for connecting and automatically configuring switches using embedded CNS agents, including initial and partial configurations.

CHAPTER 6 Clustering Switches

Understanding Switch Clusters

Defines a switch cluster as a group of connected Catalyst switches managed as a single entity, highlighting benefits like centralized management and IP address conservation.

Planning a Switch Cluster

Outlines guidelines, requirements, and caveats for managing switches through a cluster, including automatic discovery and compatibility issues.

CHAPTER 7 Administering the Switch

Managing the System Time and Date

Details managing switch time and date using automatic configuration (NTP) or manual methods, including understanding the system clock.

Configuring a System Name and Prompt

Describes how to configure the system name and prompt, including default settings and rules for host names.

Managing the MAC Address Table

Details how the MAC address table is used for traffic forwarding, including dynamic and static address entries and their association with ports.

CHAPTER 8 Configuring Switch-Based Authentication

Preventing Unauthorized Access to Your Switch

Describes methods to prevent unauthorized users from reconfiguring the switch or viewing configuration information, such as passwords and privilege levels.

Protecting Access to Privileged EXEC Commands

Explains how to use passwords and privilege levels to control terminal access and command entry for network devices.

Controlling Switch Access with TACACS+

Details how to enable and configure TACACS+ for authentication, authorization, and accounting (AAA) services.

Controlling Switch Access with RADIUS

Explains how to enable and configure RADIUS for authentication and authorization processes, facilitated through AAA commands.

CHAPTER 9 Configuring 802.1X Port-Based Authentication

Understanding 802.1X Port-Based Authentication

Defines the IEEE 802.1X standard as a client-server access control and authentication protocol that restricts unauthorized clients from LAN access.

Device Roles

Explains the specific roles of devices in 802.1X port-based authentication: Client, Authentication Server, and Switch.

Configuring 802.1X Authentication

Provides guidelines and procedures for configuring 802.1X authentication, including default settings, guidelines, and enabling the feature.

CHAPTER 10 Configuring Interface Characteristics

Understanding Interface Types

Describes different interface types supported by the switch, including physical ports, SVIs, and EtherChannel port groups.

Port-Based VLANs

Defines a VLAN as a logically segmented network, explaining packet forwarding within and between VLANs and the creation of VLANs.

Switch Ports

Explains switch ports as Layer 2 interfaces that can be access ports, trunk ports, or tunnel ports, and their association with Layer 2 protocols.

Configuring Ethernet Interfaces

Details the default interface configuration and optional features that can be configured on most physical interfaces.

CHAPTER 11 Configuring SmartPort Macros

Understanding SmartPort Macros

Explains that SmartPort macros provide a convenient way to save and share common configurations for enabling features and settings based on switch location.

Creating and Applying SmartPort Macros

Details the steps to create a macro definition, apply it to an interface, add a description, and verify the configuration.

CHAPTER 12 Configuring VLANs

Understanding VLANs

Defines a VLAN as a logically segmented network, explaining packet forwarding within and between VLANs and the creation of VLANs.

Configuring Normal-Range VLANs

Describes how to configure normal-range VLANs (VLAN IDs 1 to 1005) using config-vlan mode or VLAN database mode.

Configuring VLAN Trunks

Covers trunking overview, encapsulation types (ISL, 802.1Q), default Layer 2 Ethernet interface VLAN configuration, and interaction with other features.

CHAPTER 13 Configuring VTP

Understanding VTP

Defines VTP as a Layer 2 messaging protocol for maintaining VLAN configuration consistency, minimizing misconfigurations, and propagating changes across the network.

Configuring VTP

Covers default VTP configuration, options, guidelines, configuring VTP server, client, disabling VTP, enabling version 2, and adding a VTP client switch.

CHAPTER 14 Configuring Voice VLAN

Understanding Voice VLAN

Explains how the voice VLAN feature enables access ports to carry IP voice traffic from an IP phone, supporting QoS and prioritizing voice traffic.

Configuring Voice VLAN

Provides procedures for configuring voice VLAN on access ports, including default configuration, guidelines, and configuring ports for Cisco IP Phones.

CHAPTER 15 Configuring 802.1Q and Layer 2 Protocol Tunneling

Understanding 802.1Q Tunneling

Describes VPNs and how 802.1Q tunneling segregates customer traffic within an SP network using a VLAN-in-VLAN hierarchy.

Configuring 802.1Q Tunneling

Details the default configuration, guidelines, features, and procedures for configuring an 802.1Q tunneling port.

Understanding Layer 2 Protocol Tunneling

Explains how Layer 2 protocol tunneling helps scale topologies, supports STP, CDP, and VTP, and can enhance 802.1Q tunneling.

Configuring Layer 2 Protocol Tunneling

Provides procedures for configuring Layer 2 protocol tunneling on access ports or tunnel ports, including support for CDP, STP, and VTP.

CHAPTER 16 Configuring STP

Understanding Spanning-Tree Features

Describes basic spanning-tree features, including STP overview, topology, BPDUs, interface states, root switch/port selection, and redundancy.

Spanning-Tree Modes and Protocols

Explains the supported spanning-tree modes (PVST+, Rapid PVST+, MSTP) and protocols, and their interoperability.

Configuring Spanning-Tree Features

Covers default configuration, guidelines, changing the mode, disabling STP, configuring root switches, port priority, path cost, and timers.

CHAPTER 17 Configuring MSTP

Understanding MSTP

Explains MSTP, which uses RSTP for rapid convergence, enabling VLANs to be grouped into spanning-tree instances for load balancing and fault tolerance.

Understanding RSTP

Details how RSTP provides rapid convergence by assigning port roles and determining the active topology, improving on 802.1D STP.

Configuring MSTP Features

Covers default MSTP configuration, guidelines, specifying MST region configuration, enabling MSTP, root switch configuration, port priority, path cost, and timers.

CHAPTER 18 Configuring Optional Spanning-Tree Features

Understanding Optional Spanning-Tree Features

Describes optional spanning-tree features like Port Fast, BPDU Guard, BPDU Filtering, UplinkFast, BackboneFast, EtherChannel Guard, Root Guard, and Loop Guard.

Enabling Port Fast

Explains how Port Fast immediately brings an interface to the forwarding state from blocking, bypassing listening and learning states, for end stations.

Enabling BPDU Guard

Details how BPDU guard can be enabled globally or per interface to shut down ports that receive BPDUs, preventing invalid configurations.

Enabling BPDU Filtering

Explains how BPDU filtering can be enabled globally or per interface to prevent ports in a Port Fast-operational state from sending or receiving BPDUs.

CHAPTER 19 Configuring DHCP Features

Understanding DHCP Features

Explains DHCP's role in dynamically assigning IP addresses, reducing administration overhead, and conserving IP address space.

DHCP Snooping

Describes DHCP snooping as a security feature that filters untrusted DHCP messages and builds a binding table.

Configuring DHCP Features

Covers default configuration, guidelines, upgrading from previous releases, enabling DHCP snooping and Option 82.

Displaying DHCP Information

Explains how to display DHCP snooping binding table and configuration information for all interfaces using privileged EXEC commands.

CHAPTER 20 Configuring IGMP Snooping and MVR

Understanding IGMP Snooping

Explains how Layer 2 switches use IGMP snooping to constrain multicast traffic flooding by dynamically configuring interfaces and tracking group memberships.

Configuring IGMP Snooping

Details how to configure IGMP snooping, including default settings, enabling/disabling, snooping method, multicast router ports, and static joins.

Understanding Multicast VLAN Registration

Describes MVR for applications using multicast traffic across networks, allowing subscribers in separate VLANs to share a single multicast VLAN.

Configuring MVR

Covers configuring MVR global parameters, interfaces, default configuration, guidelines, and examples.

Configuring IGMP Filtering and Throttling

Explains how to control multicast group membership by filtering joins and configuring throttling actions based on IGMP profiles.

CHAPTER 21 Configuring Port-Based Traffic Control

Configuring Storm Control

Describes how storm control prevents switchport disruption from broadcast, multicast, or unicast storms by monitoring traffic and suppressing it when thresholds are reached.

Configuring Protected Ports

Details how protected ports prevent traffic forwarding between ports on the same switch to enhance security and isolate traffic.

Configuring Port Security

Describes how to restrict input to an interface by limiting and identifying MAC addresses of allowed stations, covering static, dynamic, and sticky MAC addresses.

CHAPTER 22 Configuring CDP

Understanding CDP

Defines CDP as a device discovery protocol for learning about neighbors, device types, and SNMP agent addresses.

Configuring CDP

Details how to configure CDP characteristics, including timer, holdtime, and advertisement type, and how to disable/enable CDP globally and per interface.

CHAPTER 23 Configuring UDLD

Understanding UDLD

Explains UDLD as a Layer 2 protocol for monitoring physical cable configuration and detecting unidirectional links on fiber-optic or twisted-pair Ethernet.

Configuring UDLD

Covers default UDLD configuration, guidelines, enabling UDLD globally and on an interface, and resetting interfaces shut down by UDLD.

CHAPTER 24 Configuring SPAN and RSPAN

Understanding SPAN and RSPAN

Explains how to analyze network traffic using SPAN to send copies of traffic to ports or VLANs for monitoring, and how RSPAN extends this for remote monitoring.

SPAN and RSPAN Concepts and Terminology

Defines concepts like SPAN session, destination port, source port, traffic types, and RSPAN VLANs.

Configuring SPAN

Provides guidelines and procedures for creating SPAN sessions, specifying source and destination ports, and enabling ingress traffic.

Configuring RSPAN

Details how to configure RSPAN sessions, including creating sessions, destination sessions, and specifying VLANs to monitor or filter.

CHAPTER 25 Configuring RMON

Understanding RMON

Defines RMON as an IETF standard for network monitoring, using network agents and console systems to exchange data for fault diagnosis and performance tuning.

Configuring RMON Alarms and Events

Describes how to configure RMON alarms and events using CLI or SNMP-compatible network management stations.

Configuring RMON Collection on an Interface

Details how to collect group history statistics and group Ethernet statistics on an interface using RMON commands.

CHAPTER 26 Configuring System Message Logging

Understanding System Message Logging

Explains how switches send system messages and debug output to a logging process for distribution to various destinations like consoles or syslog servers.

System Log Message Format

Describes the format of system log messages, including sequence number, timestamp, facility, severity, and description.

Configuring System Message Logging

Covers default configuration, enabling/disabling logging, setting message display destinations, synchronizing logs, and configuring UNIX syslog servers.

CHAPTER 27 Configuring SNMP

Understanding SNMP

Defines SNMP as an application-layer protocol for communication between managers and agents, using MIB variables for device parameters and network data.

Configuring SNMP

Details how to configure SNMP, including default settings, guidelines, disabling the agent, community strings, groups, users, and notifications.

CHAPTER 28 Configuring Network Security with ACLs

Understanding ACLs

Explains ACLs as packet filters to limit network traffic and restrict network use by applying sequential permit or deny conditions.

Configuring IP ACLs

Describes how to configure IP ACLs on Layer 2/3 switch or VLAN interfaces, including hardware/software handling and unsupported features.

Configuring Named MAC Extended ACLs

Details how to filter non-IP traffic on VLANs and physical Layer 2 interfaces using MAC addresses and named MAC extended ACLs.

Configuring VLAN Maps

Explains how VLAN maps control filtering within a VLAN, using ACLs for specific traffic direction and applying maps to VLANs.

Using VLAN Maps with Router ACLs

Covers combining router ACLs and VLAN maps for access control on bridged and routed traffic, with guidelines for merging them.

CHAPTER 29 Configuring QoS

Understanding QoS

Explains QoS's role in prioritizing traffic, managing congestion, and improving network performance by classifying, policing, and marking packets.

Classification

Describes the process of distinguishing traffic types by examining packet fields and using ACLs, class maps, and policy maps for classification.

Policing and Marking

Details how to create policers to specify bandwidth limits and actions for out-of-profile traffic, including passing, marking down, or dropping packets.

Configuring Standard QoS

Covers default standard QoS configuration, guidelines, enabling QoS globally, configuring classification, policing, marking, and egress queues.

CHAPTER 30 Configuring EtherChannels

Understanding EtherChannels

Defines EtherChannel as bundling individual links into a single logical link for fault tolerance and high-bandwidth connections, with automatic recovery from link failures.

Configuring EtherChannels

Provides procedures for configuring EtherChannel on Layer 2 and Layer 3 interfaces, including default configuration, guidelines, and Layer 2/3 configurations.

Displaying EtherChannel, PAgP, and LACP Status

Explains how to display EtherChannel, PAgP, and LACP status information using privileged EXEC commands.

CHAPTER 31 Configuring IP Unicast Routing

Understanding IP Routing

Explains IP routing basics, including VLAN association with networks, inter-VLAN routing, and routing between VLANs using SVIs or routed ports.

Steps for Configuring Routing

Outlines the general procedures for configuring routing, including enabling IP routing, configuring IP addressing, and enabling routing protocols.

Configuring IP Addressing on Layer 3 Interfaces

Describes how to assign IP addresses to Layer 3 interfaces, including default addressing, static assignment, and use of subnet zero.

Enabling IP Unicast Routing

Details the process to enable IP routing on the switch, including configuring the router for RIP, IGRP, OSPF, EIGRP, or BGP.

CHAPTER 32 Configuring HSRP

Understanding HSRP

Defines HSRP as a method for providing high network availability through first-hop redundancy for IP hosts, using virtual MAC and IP addresses.

Configuring HSRP

Covers default HSRP configuration, guidelines, enabling HSRP, configuring group attributes, and groups and clustering.

CHAPTER 33 Configuring Web Cache Services By Using WCCP

Understanding WCCP

Explains WCCP's role in localizing web-traffic patterns by redirecting content requests to cache engines, supporting WCCPv2 and clustering.

Configuring WCCP

Details default WCCP configuration, guidelines, and enabling the web cache service, setting passwords, and redirecting traffic.

CHAPTER 34 Configuring IP Multicast Routing

Cisco Implementation of IP Multicast Routing

Outlines Cisco's implementation of IP multicast routing, supporting IGMP, PIM, and DVMRP protocols, and explains the roles of different devices.

Configuring IP Multicast Routing

Covers default multicast routing configuration, guidelines, basic configuration, advanced PIM features, optional IGMP features, and optional multicast routing features.

Configuring Advanced PIM Features

Describes advanced PIM features such as shared and source trees, delaying SPT use, and modifying router-query message intervals.

Configuring Optional IGMP Features

Details optional IGMP features, including changing IGMP version, query timeout, maximum query response time, and configuring multicast groups.

Configuring Optional Multicast Routing Features

Covers features like CGMP server support, SDR listener support, TTL threshold, and IP multicast boundary configuration.

CHAPTER 35 Configuring MSDP

Understanding MSDP

Explains MSDP's role in connecting PIM-SM domains to discover multicast sources, relying on BGP or MBGP for interdomain operation.

Configuring MSDP

Provides procedures for configuring MSDP, including default configuration, default MSDP peer, caching SA state, requesting source information, and controlling source information.

CHAPTER 36 Configuring Fallback Bridging

Understanding Fallback Bridging

Explains fallback bridging for forwarding non-IP packets between VLANs or routed ports, connecting multiple VLANs into one bridge domain.

Configuring Fallback Bridging

Covers default configuration, guidelines, creating bridge groups, preventing dynamic station forwarding, configuring bridge table aging, and filtering frames.

Adjusting Spanning-Tree Parameters

Details how to adjust spanning-tree parameters like switch priority, interface priority, path cost, BPDU intervals, and disabling spanning tree on an interface.

CHAPTER 37 Troubleshooting

Using Recovery Procedures

Describes procedures for identifying and resolving Catalyst 3550 software problems, including corrupted software, lost passwords, and connectivity issues.

Diagnosing Connectivity Problems

Covers methods for troubleshooting connectivity problems, including using Ping, IP Traceroute, and Layer 2 Traceroute.

Using Debug Commands

Explains how to use debug commands to diagnose and resolve internetworking problems, including enabling debugging on specific features and redirecting output.

APPENDIX A Supported MIBs

MIB List

Lists the Catalyst 3550 supported management information base (MIB) objects for this release.

Using FTP to Access the MIB Files

Provides procedures for obtaining MIB files by using FTP to access the server ftp.cisco.com.

APPENDIX B Working with the Cisco IOS File System, Configuration Files, and Software Images

Working with the Flash File System

Describes how to manage software image and configuration files using commands like dir, cd, and mkdir.

Working with Configuration Files

Details how to create, load, and maintain configuration files, including guidelines, types, locations, and copying via TFTP, FTP, or RCP.

Working with Software Images

Explains how to archive, download, and upload software images, including using TFTP, FTP, or RCP for these operations.

Related product manuals