Cisco ME 3400 - Page 618

To Next Page

To Previous Page

31-40

Cisco ME 3400 Ethernet Access Switch Software Configuration Guide

OL-9639-07

Chapter 31 Configuring Network Security with ACLs

Displaying IPv4 ACL Configuration

Main Page

Default Chapter3
- Table of Contents3
- Related Publications42
- Obtaining Documentation and Submitting a Service Request43
- Features45
Chapter 1 Overview46
- Performance Features46
- Management Options47
- Manageability Features47
- Availability Features49
- VLAN Features50
- Security Features50
- Quality of Service and Class of Service Features52
- Layer 2 Virtual Private Network Services53
- Layer 3 Features53
- Layer 3 VPN Services54
- Monitoring Features54
- Default Settings after Initial Switch Configuration55
- Network Configuration Examples58
- Where to Go Next61
- Understanding no and Default Forms of Commands63
- Understanding CLI Error Messages63
- Using Command History63
CHAPTER 2 Using the Command-Line Interface63
- Understanding Command Modes63
- C H a P T E R 2 Using the Command-Line Interface64
- Understanding the Help System65
- Understanding Abbreviated Commands65
- Using Editing Features68
- Searching and Filtering Output of Show and more Commands70
- Accessing the CLI71
  - Accessing the CLI through a Console Connection or through Telnet71
CHAPTER 3 Assigning the Switch IP Address and Default Gateway73
- Understanding the Boot Process73
- C H a P T E R 3 Assigning the Switch IP Address and Default Gateway74
- Assigning Switch Information74
- Checking and Saving the Running Configuration86
  - Modifying the Startup Configuration88
  - Scheduling a Reload of the Software Image93
    - Configuring a Scheduled Reload93
    - Displaying Scheduled Reload Information94
CHAPTER 4 Configuring Cisco IOS Configuration Engine95
- Understanding Cisco Configuration Engine Software95
- Understanding Cisco IOS Agents99
- Configuring Cisco IOS Agents100
- Displaying CNS Configuration109
- Administering the Switch111
- Managing the System Time and Date111
Chapter 5 Administering the Switch112
- Understanding the System Clock112
- Understanding Network Time Protocol112
- Configuring NTP114
- Configuring Time and Date Manually121
Step 1132
Configure Terminal132
Copy Running-Config Startup-Config132
- Enter Global Configuration Mode132
- Return to Privileged EXEC Mode132
- (Optional) Save Your Entries in the Configuration File132
- Changing the Address Aging Time132
- Removing Dynamic Address Entries133
- Configuring MAC Address Notification Traps133
- Adding and Removing Static Address Entries135
- Configuring Unicast MAC Address Filtering136
- Disabling MAC Address Learning on a VLAN137
- Displaying Address Table Entries138
  - Managing the ARP Table139
Configuring SDM Templates141
- Understanding the SDM Templates141
Chapter 6 Configuring SDM Template142
- Dual Ipv4 and Ipv6 SDM Templates142
- Understanding the SDM Templates142
- Configuring the Switch SDM Template143
- Displaying the SDM Templates145
Chapter 7 Configuring Switch-Based Authentication147
- Preventing Unauthorized Access to Your Switch147
- Protecting Access to Privileged EXEC Commands148
- Controlling Switch Access with TACACS156
- Controlling Switch Access with RADIUS163
- Default RADIUS Configuration166
- Identifying the RADIUS Server Host166
- Configuring RADIUS Login Authentication169
- Defining AAA Server Groups171
- Configuring RADIUS Authorization for User Privileged Access and Network Services173
- Starting RADIUS Accounting174
- Configuring Settings for All RADIUS Servers175
- Configuring the Switch to Use Vendor-Specific RADIUS Attributes175
- Configuring the Switch for Vendor-Proprietary RADIUS Server Communication176
- Configuring RADIUS Server Load Balancing177
CHAPTER 8 Configuring IEEE 802.1X Port-Based Authentication189
- Understanding IEEE 802.1X Port-Based Authentication189
  - C H a P T E R 8 Configuring IEEE 802.1X Port-Based Authentication190
  - Device Roles190
- Authentication Initiation and Message Exchange191
- Ports in Authorized and Unauthorized States192
- IEEE 802.1X Accounting193
- IEEE 802.1X Accounting Attribute-Value Pairs193
- IEEE 802.1X Host Mode194
- Using 802.1X Readiness Check195
- Using IEEE 802.1X with Port Security195
- Using IEEE 802.1X with VLAN Assignment196
- Switch Supplicant with Network Edge Access Topology (NEAT)197
  - Configuring IEEE 802.1X Authentication198
    - Default IEEE 802.1X Configuration198
- IEEE 802.1X Configuration Guidelines200
  - Maximum Number of Allowed Devices Per Port200
  - Configuring 802.1X Readiness Check201
- Configuring IEEE 802.1X Authentication202
  - Configuring IEEE 802.1X Violation Modes202
- Configuring the Switch-To-RADIUS-Server Communication204
- Configuring Periodic Re-Authentication205
- Manually Re-Authenticating a Client Connected to a Port205
- Changing the Quiet Period206
- Changing the Switch-To-Client Retransmission Time206
- Setting the Switch-To-Client Frame-Retransmission Number207
- Setting the Re-Authentication Number208
- Configuring the Host Mode208
Configuring IEEE 802.1X Accounting209
- Resetting the IEEE 802.1X Configuration to the Default Values209
Configuring 802.1X Switch Supplicant with NEAT210
- Displaying IEEE 802.1X Statistics and Status212
- Understanding Interface Types213
  - UNI, NNI, and ENI Port Types214
  - Port-Based Vlans214
Chapter 9 Configuring Interface214
- Switch Ports215
- Routed Ports217
- Switch Virtual Interfaces217
- Etherchannel Port Groups218
  - Dual-Purpose Ports218
  - Connecting Interfaces219
- Using Interface Configuration Mode220
- Configuring Ethernet Interfaces224
  - Default Ethernet Interface Configuration224
- Configuring the Port Type226
- Configuring Interface Speed and Duplex Mode227
  - Speed and Duplex Configuration Guidelines227
  - Setting the Interface Speed and Duplex Parameters228
- Configuring a Dual-Purpose Port230
- Configuring IEEE 802.3X Flow Control232
- Configuring Auto-MDIX on an Interface233
- Adding a Description for an Interface234
Configuring Command Macros241
- Understanding Command Macros241
Chapter 10 Configuring Command Macro242
Configuring Command Macros242
- Default Command Macro Configuration242
- Command Macro Configuration Guidelines242
- Creating Command Macros243
- Applying Command Macros244
- Displaying Command Macros245
Configuring Vlans247
- Understanding Vlans247
  - Supported Vlans248
  - Normal-Range Vlans248
Chapter 11 Configuring VLAN248
- Extended-Range Vlans250
- VLAN Port Membership Modes250
- UNI-ENI Vlans251
- Creating and Modifying Vlans253
- Displaying Vlans260
- Configuring VLAN Trunks260
- Configuring VMPS269
- Understanding Private Vlans277
  - Types of Private Vlans and Private-VLAN Ports277
Chapter 12 Configuring Private VLAN278
- IP Addressing Scheme with Private Vlans280
- Private Vlans Across Multiple Switches280
- Private Vlans and Unicast, Broadcast, and Multicast Traffic281
- Private Vlans and Svis281
- Configuring Private Vlans281
- Monitoring Private Vlans290
CHAPTER 13 Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling291
- Understanding 802.1Q Tunneling291
- C H a P T E R 13 Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling292
- Configuring 802.1Q Tunneling294
- Understanding Layer 2 Protocol Tunneling297
- Configuring Layer 2 Protocol Tunneling300
- Monitoring and Maintaining Tunneling and Mapping Status308
- Configuring STP309
- Understanding Spanning-Tree Features309
Chapter 14 Configuring STP310
Understanding Spanning-Tree Features310
- STP Overview310
- Spanning-Tree Topology and Bpdus311
  - Bridge ID, Switch Priority, and Extended System ID312
  - Spanning-Tree Interface States312
Spanning-Tree Interface States313
- Blocking State314
- Listening State314
- Disabled State315
- Forwarding State315
- How a Switch or Port Becomes the Root Switch or Root Port315
  - Learning State315
- Spanning Tree and Redundant Connectivity316
- Spanning-Tree Address Management317
- Accelerated Aging to Retain Connectivity317
Default Spanning-Tree Configuration320
- Spanning-Tree Configuration Guidelines320
  - STP and IEEE 802.1Q Trunks319
- Enabling Spanning Tree on an ENI321
  - Changing the Spanning-Tree Mode322
- Disabling Spanning Tree323
- Configuring the Root Switch323
- Configuring a Secondary Root Switch325
- Configuring Port Priority325
- Configuring Path Cost327
- Configuring the Switch Priority of a VLAN328
- Configuring Spanning-Tree Timers329
Chapter 15 Configuring MSTP334
- Understanding MSTP334
- Understanding RSTP340
- Configuring MSTP Features346
  - Default MSTP Configuration346
Default MSTP Configuration347
- MSTP Configuration Guidelines347
- Specifying the MST Region Configuration and Enabling MSTP348
- Configuring the Root Switch349
- Configuring a Secondary Root Switch350
- Configuring Port Priority351
- Configuring Path Cost353
- Configuring the Switch Priority354
- Configuring the Hello Time355
- Configuring the Forwarding-Delay Time355
- Configuring the Maximum-Aging Time356
- Configuring the Maximum-Hop Count356
- Specifying the Link Type to Ensure Rapid Transitions357
- Designating the Neighbor Type357
- Restarting the Protocol Migration Process358
  - Displaying the MST Configuration and Status359
CHAPTER 16 Configuring Optional Spanning-Tree Features361
Understanding Optional Spanning-Tree Features361
- Understanding Port Fast362
  - Configuring Optional Spanning-Tree Features362
- Understanding BPDU Guard363
- Understanding BPDU Filtering363
- Understanding Etherchannel Guard363
- Understanding Root Guard364
- Understanding Loop Guard365
  - Configuring Optional Spanning-Tree Features365
    - Default Optional Spanning-Tree Configuration365
- Optional Spanning-Tree Configuration Guidelines366
- Enabling Port Fast366
- Enabling BPDU Guard367
- Enabling BPDU Filtering368
- Enabling Etherchannel Guard369
- Enabling Root Guard370
  - Displaying the Spanning-Tree Status371
    - Table371
- Enabling Loop Guard370
CHAPTER 17 Configuring Resilient Ethernet Protocol373
- Understanding REP373
- Configuring REP378
- Monitoring REP386
CHAPTER 18 Configuring Flex Links and the MAC Address-Table Move Update Feature387
- Understanding Flex Links and the MAC Address-Table Move Update387
- Configuring Flex Links and MAC Address-Table Move Update393
- Monitoring Flex Links and the MAC Address-Table Move Update400
Chapter 19 Configuring DHCP Features and IP Source Guard401
- Understanding DHCP Features401
- Configuring DHCP Features407
- Displaying DHCP Snooping Information415
- Understanding DHCP Server Port-Based Address Allocation415
- Configuring DHCP Server Port-Based Address Allocation415
- Displaying DHCP Server Port-Based Address Allocation418
- Understanding IP Source Guard418
  - Source IP Address Filtering419
  - Source IP and MAC Address Filtering419
- Configuring IP Source Guard419
- Displaying IP Source Guard Information422
CHAPTER 20 Configuring Dynamic ARP Inspection423
- Understanding Dynamic ARP Inspection423
- Configuring Dynamic ARP Inspection426
- Displaying Dynamic ARP Inspection Information436
Chapter 21 Configuring IGMP Snooping and MVR439
- Understanding IGMP Snooping439
- Configuring IGMP Snooping445
- Displaying IGMP Snooping Information452
- Understanding Multicast VLAN Registration453
  - Using MVR in a Multicast Television Application454
- Configuring MVR456
- Displaying MVR Information461
- Configuring IGMP Filtering and Throttling461
- Displaying IGMP Filtering and Throttling Configuration466
Chapter 22 Configuring Port-Based Traffic Control469
- Configuring Storm Control469
- Configuring Protected Ports474
- Configuring Port Blocking475
  - Default Port Blocking Configuration475
  - Blocking Flooded Traffic on an Interface476
- Configuring Port Security476
- Displaying Port-Based Traffic Control Settings486
Configuring CDP487
- Understanding CDP487
  - Default CDP Configuration488
  - Configuring the CDP Characteristics488
Chapter 23 Configuring CDP489
- Disabling and Enabling CDP489
- Disabling and Enabling CDP on an Interface490
- Monitoring and Maintaining CDP491
- Configuring LLDP and LLDP-MED493
- Understanding LLDP and LLDP-MED493
  - Understanding LLDP493
Chapter 24 Configuring LLDP and LLDP-MED494
- Understanding LLDP-MED494
- Configuring LLDP and LLDP-MED495
- Monitoring and Maintaining LLDP and LLDP-MED500
- Understanding UDLD501
  - Modes of Operation501
Chapter 25 Configuring UDLD502
- Methods to Detect Unidirectional Links502
- Configuring UDLD503
- Displaying UDLD Status506
- Configuring SPAN and RSPAN507
- Understanding SPAN and RSPAN507
Chapter 26 Configuring SPAN and RSPAN508
- Local SPAN508
- Remote SPAN508
- SPAN and RSPAN Concepts and Terminology509
- SPAN and RSPAN Interaction with Other Features514
- Configuring SPAN and RSPAN515
- Displaying SPAN and RSPAN Status528
  - Understanding RMON529
Chapter 27 Configuring RMON530
- Default RMON Configuration531
- Configuring RMON Alarms and Events531
- Collecting Group History Statistics on an Interface533
- Collecting Group Ethernet Statistics on an Interface533
- Displaying RMON Status534
- Understanding System Message Logging535
CHAPTER 28 Configuring System Message Logging536
- System Log Message Format536
- C H a P T E R 28 Configuring System Message Logging537
- Default System Message Logging Configuration537
- Disabling Message Logging538
- Setting the Message Display Destination Device539
- Synchronizing Log Messages540
- Enabling and Disabling Time Stamps on Log Messages541
- Enabling and Disabling Sequence Numbers in Log Messages542
- Defining the Message Severity Level542
- Limiting Syslog Messages Sent to the History Table and to SNMP544
- Enabling the Configuration-Change Logger544
- Configuring UNIX Syslog Servers546
  - Logging Messages to a UNIX Syslog Daemon546
  - Configuring the UNIX System Logging Facility546
- Displaying the Logging Configuration547
- Understanding SNMP549
Chapter 29 Configuring SNMP550
- SNMP Versions550
- SNMP Manager Functions551
- SNMP Agent Functions552
- SNMP Community Strings552
- Using SNMP to Access MIB Variables552
- SNMP Notifications553
- SNMP Ifindex MIB Object Values553
- MIB Data Collection and Transfer554
- Configuring SNMP554
- Default SNMP Configuration555
- SNMP Configuration Guidelines555
- Disabling the SNMP Agent556
- Configuring Community Strings556
- Configuring SNMP Groups and Users558
- Configuring SNMP Notifications560
- Setting the CPU Threshold Notification Types and Values564
- Setting the Agent Contact and Location Information565
- Limiting TFTP Servers Used through SNMP565
- Configuring MIB Data Collection and Transfer566
- Configuring the Cisco Process MIB CPU Threshold Table568
- SNMP Examples569
- Displaying SNMP Status570
- Understanding Embedded Event Manager573
  - Event Detectors574
  - C H a P T E R 30 Configuring Embedded Event Manager575
  - Embedded Event Manager Actions576
  - Embedded Event Manager Policies576
  - Embedded Event Manager Environment Variables576
CHAPTER 30 Configuring Embedded Event Manager577
- Registering and Defining an Embedded Event Manager Applet577
- Registering and Defining an Embedded Event Manager TCL Script578
- Displaying Embedded Event Manager Information578
CHAPTER 31 Configuring Network Security with Acls579
- Understanding Acls579
- Configuring Ipv4 Acls584
- Creating Named MAC Extended Acls604
  - Applying a MAC ACL to a Layer 2 Interface606
- Configuring VLAN Maps607
- Using VLAN Maps with Router Acls613
  - VLAN Maps and Router ACL Configuration Guidelines614
  - Examples of Router Acls and VLAN Maps Applied to Vlans615
- Displaying Ipv4 ACL Configuration617
- C H a P T E R 32 Configuring Control-Plane Security620
- Understanding Control-Plane Security620
CHAPTER 32 Configuring Control-Plane Security624
- Monitoring Control-Plane Security626
- Understanding Qos627
Chapter 33 Configuring Qo628
- Modular Qos CLI629
- Input and Output Policies630
Configuring Qos655
- Default Qos Configuration656
- Qos Configuration Guidelines656
- Using Acls to Classify Traffic657
- Displaying Qos Information691
  - Qos Statistics691
- Configuration Examples for Policy Maps692
- Understanding Etherchannels701
CHAPTER 34 Configuring Etherchannels709
- Default Etherchannel Configuration710
- Etherchannel Configuration Guidelines710
- Configuring Layer 2 Etherchannels711
- Configuring Layer 3 Etherchannels714
- Displaying Etherchannel, Pagp, and LACP Status722
- Understanding Link-State Tracking722
- Configuring Link-State Tracking724
  - Default Link-State Tracking Configuration724
  - Link-State Tracking Configuration Guidelines724
- Displaying Link-State Tracking Status725
- Configuring Ip Unicast Routing727
Chapter 35 Configuring IP Unicast Routing728
- Understanding IP Routing728
  - Types of Routing728
- Steps for Configuring Routing729
- Configuring IP Addressing729
- Enabling Ipv4 Unicast Routing743
- Configuring ISO CLNS Routing788
  - Configuring IS-IS Dynamic Routing789
  - Monitoring and Maintaining IS-IS797
- Configuring BFD798
- Configuring Multi-VRF CE807
- Configuring Protocol-Independent Features821
- Monitoring and Maintaining the IP Network835
  - Understanding Ipv6837
  - C H a P T E R 36 Configuring Ipv6 Unicast Routing838
CHAPTER 36 Configuring Ipv6 Unicast Routing838
- Ipv6 Addresses838
- Supported Ipv6 Unicast Routing Features838
Configuring Ipv6844
- Default Ipv6 Configuration845
- Configuring Ipv6 Addressing and Enabling Ipv6 Routing845
- Configuring Default Router Preference847
- Configuring Ipv4 and Ipv6 Protocol Stacks848
- Configuring DHCP for Ipv6 Address Assignment849
- Displaying Ipv6858
- Understanding Ipv6 Acls863
Chapter 37 Configuring Ipv6 ACL864
- Supported ACL Features864
- Ipv6 ACL Limitations864
- Configuring Ipv6 Acls864
- Displaying Ipv6 Acls870
- Understanding HSRP871
Chapter 38 Configuring HSRP872
- HSRP Versions873
- Multiple HSRP874
- Configuring HSRP875
  - Default HSRP Configuration875
  - HSRP Configuration Guidelines875
- Enabling HSRP876
- Configuring HSRP Priority877
- Configuring HSRP Authentication and Timers880
- Configuring MHSRP880
- Displaying HSRP Configurations882
- Enabling HSRP Support for ICMP Redirect Messages882
CHAPTER 39 Configuring Cisco IOS IP Slas Operations883
- Understanding Cisco IOS IP Slas883
- Configuring IP Slas Operations888
- Monitoring IP Slas Operations895
CHAPTER 40 Configuring Enhanced Object Tracking897
- Understanding Enhanced Object Tracking897
- C H a P T E R 40 Configuring Enhanced Object Tracking898
- Configuring Enhanced Object Tracking Features898
- Monitoring Enhanced Object Tracking908
- C H a P T E R 41 Configuring Ethernet OAM, CFM, and E-LMI912
CHAPTER 41 Configuring Ethernet OAM, CFM, and E-LMI912
- Understanding Ethernet CFM912
- Configuring Ethernet CFM915
- Displaying Ethernet CFM Information923
- Understanding the Ethernet OAM Protocol924
  - OAM Features925
  - OAM Messages925
- Setting up and Configuring Ethernet OAM926
- Displaying Ethernet OAM Protocol Information934
- Understanding E-LMI934
  - E-LMI Interaction with OAM Manager935
  - CFM Interaction with OAM Manager935
- Configuring E-LMI936
CHAPTER 42 Configuring IP Multicast Routing954
- Default Multicast Routing Configuration954
- Multicast Routing Configuration Guidelines955
- Configuring Source Specific Multicast Mapping963
- Configuring a Rendezvous Point968
- Using Auto-RP and a BSR978
- Monitoring the RP Mapping Information979
- Troubleshooting Pimv1 and Pimv2 Interoperability Problems979
- Configuring Advanced PIM Features979
- Configuring Optional IGMP Features982
- Configuring Optional Multicast Routing Features989
  - Configuring Sdr Listener Support989
    - Enabling Sdr Listener Support989
    - Limiting How Long an Sdr Cache Entry Exists990
  - Configuring an IP Multicast Boundary990
- Monitoring and Maintaining IP Multicast Routing992
Chapter 43 Configuring MSDP996
- MSDP Operation996
- MSDP Benefits997
- Configuring MSDP997
Chapter 44 Troubleshooting1014
- Recovering from Corrupted Software by Using the Xmodem Protocol1014
- Recovering from a Lost or Forgotten Password1015
  - Procedure with Password Recovery Enabled1017
  - Procedure with Password Recovery Disabled1019
- Preventing Autonegotiation Mismatches1020
- SFP Module Security and Identification1021
- Monitoring SFP Module Status1021
- Monitoring Temperature1021
- Using Ping1022
  - Understanding Ping1022
- Using Layer 2 Traceroute1025
- Using IP Traceroute1026
  - Understanding IP Traceroute1027
  - Executing IP Traceroute1027
- Using TDR1028
  - Understanding TDR1028
  - Running TDR and Displaying the Results1029
- Using Debug Commands1029
- Using the Show Platform Forward Command1031
- Using the Crashinfo File1033
Supported Mibs1035
- Mib List1035
Appendix A Supported MIB1036
- MIB List1036
- Using Ftp to Access the Mib Files1037
- Using FTP to Access the MIB Files1038
APPENDIX B Working with the Cisco IOS File System, Configuration Files, and Software Images1039
- Working with the Flash File System1039
- Working with Configuration Files1046
- Working with Software Images1061
APPENDIX C Unsupported Commands in Cisco IOS Release 12.2(50)SE1075
- Access Control Lists1075
- ARP Commands1075
- Boot Loader Commands1076
  - Unsupported User EXEC Command1076
  - Unsupported Global Configuration Command1076
- Debug Commands1076
- Embedded Event Manager1076
- Hsrp1077
- IGMP Snooping Commands1078
  - Unsupported Global Configuration Commands1078
- Interface Commands1079
- IP Multicast Routing1079
  - Unsupported Global Configuration Commands1080
  - Unsupported Interface Configuration Commands1080
- IP Unicast Routing1080
- Miscellaneous1083
- Msdp1084
  - Unsupported Privileged EXEC Commands1084
- Netflow1085
- Snmp1086

Cisco ME 3400 - Page 618

Table of Contents

Other manuals for Cisco ME 3400

Related product manuals