Cisco WS-C3020 - Page 632

To Next Page

To Previous Page

31-40

Cisco Catalyst Blade Switch 3020 for HP Software Configuration Guide

OL-8915-03

Chapter 31 Configuring Network Security with ACLs

Displaying IPv4 ACL Configuration

Main Page

Default Chapter3
- Table of Contents3
- Related Publications36
- Obtaining Documentation and Submitting a Service Request37
- Features39
Chapter 1 Overview40
- Ease-Of-Deployment and Ease-Of-Use Features40
- Performance Features40
- Management Options41
- Manageability Features42
- Availability and Redundancy Features43
- VLAN Features44
- Security Features44
- Qos and Cos Features46
- Layer 3 Features47
- Monitoring Features48
- Default Settings after Initial Switch Configuration48
- Design Concepts for Using the Switch51
- Where to Go Next54
CHAPTER 2 Using the Command-Line Interface2-155
- Understanding Command Modes55
- C H a P T E R 2 Using the Command-Line Interface56
- Understanding the Help System57
- Understanding Abbreviated Commands58
- Understanding no and Default Forms of Commands58
- Understanding CLI Error Messages59
- Using Configuration Logging59
- Using Command History60
- Using Editing Features61
- Searching and Filtering Output of Show and more Commands64
- Accessing the CLI64
Chapter 3 Assigning the Switch IP Address and Default Gateway65
- Understanding the Bootup Process65
- Assigning Switch Information66
- Checking and Saving the Running Configuration79
- Modifying the Startup Configuration81
Chapter 4 Configuring Cisco IOS CNS Agents89
- Understanding Cisco Configuration Engine Software89
- Understanding Cisco IOS Agents93
- Configuring Cisco IOS Agents94
- Displaying CNS Configuration102
CHAPTER 5 Administering the Switch104
- Managing the System Time and Date104
- Configuring Time and Date Manually113
- Configuring a System Name and Prompt116
- Creating a Banner119
- Managing the MAC Address Table121
  - Building the Address Table122
  - MAC Addresses and Vlans122
- Default MAC Address Table Configuration123
- Changing the Address Aging Time123
- Removing Dynamic Address Entries124
- Configuring MAC Address Notification Traps124
- Adding and Removing Static Address Entries126
- Configuring Unicast MAC Address Filtering127
- Displaying Address Table Entries128
  - Managing the ARP Table129
Chapter 6 Configuring SDM Templates131
- Understanding the SDM Templates131
  - Dual Ipv4 and Ipv6 SDM Templates132
- Configuring the Switch SDM Template133
- Displaying the SDM Templates135
CHAPTER 7 Configuring Switch-Based Authentication137
- Preventing Unauthorized Access to Your Switch137
- C H a P T E R 7 Configuring Switch-Based Authentication138
- Protecting Access to Privileged EXEC Commands138
- Controlling Switch Access with TACACS146
- Controlling Switch Access with RADIUS153
Controlling Switch Access with Kerberos168
- Understanding Kerberos168
- Kerberos Operation170
- Configuring Kerberos171
Configuring the Switch for Local Authentication and Authorization172
Configuring the Switch for Secure Shell173
- Understanding SSH173
  - SSH Servers, Integrated Clients, and Supported Versions173
  - Limitations174
- Configuring SSH174
- Displaying the SSH Configuration and Status177
Configuring the Switch for Secure Socket Layer HTTP177
- Understanding Secure HTTP Servers and Clients177
  - Certificate Authority Trustpoints178
  - Ciphersuites179
- Configuring Secure HTTP Servers and Clients180
- Displaying Secure HTTP Server and Client Status183
Configuring the Switch for Secure Copy Protocol184
- Information about Secure Copy184
CHAPTER 8 Configuring IEEE 802.1X Port-Based Authentication8-1185
Understanding IEEE 802.1X Port-Based Authentication185
- C H a P T E R 8 Configuring IEEE 802.1X Port-Based Authentication186
Configuring IEEE 802.1X Authentication186
- Device Roles186
- Authentication Process187
- Authentication Initiation and Message Exchange189
- Ports in Authorized and Unauthorized States191
- IEEE 802.1X Host Mode191
- IEEE 802.1X Accounting Attribute-Value Pairs192
- IEEE 802.1X Accounting192
- Using 802.1X Readiness Check193
- Using IEEE 802.1X Authentication with VLAN Assignment194
- Using IEEE 802.1X Authentication with Per-User Acls195
- Using IEEE 802.1X Authentication with Guest VLAN196
- Using IEEE 802.1X Authentication with Restricted VLAN197
- Using IEEE 802.1X Authentication with Inaccessible Authentication Bypass198
- Using IEEE 802.1X Authentication with Voice VLAN Ports199
- Using IEEE 802.1X Authentication with Port Security199
- Using IEEE 802.1X Authentication with Wake-On-LAN200
- Using IEEE 802.1X Authentication with MAC Authentication Bypass201
  - Network Admission Control Layer 2 IEEE 802.1X Validation202
- Using Web Authentication202
  - Web Authentication with Automatic MAC Check203
  - Configuring IEEE 802.1X Authentication203
- Default IEEE 802.1X Authentication Configuration204
- IEEE 802.1X Authentication Configuration Guidelines205
  - IEEE 802.1X Authentication205
  - VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible Authentication Bypass206
  - MAC Authentication Bypass207
- Configuring 802.1X Readiness Check207
- Configuring IEEE 802.1X Authentication209
- Configuring the Switch-To-RADIUS-Server Communication210
- Configuring the Host Mode212
- Configuring Periodic Re-Authentication212
- Manually Re-Authenticating a Client Connected to a Port213
- Changing the Quiet Period213
- Changing the Switch-To-Client Retransmission Time214
- Setting the Switch-To-Client Frame-Retransmission Number215
- Setting the Re-Authentication Number215
- Configuring IEEE 802.1X Accounting216
- Configuring a Guest VLAN217
- Configuring a Restricted VLAN218
- Configuring the Inaccessible Authentication Bypass Feature219
- Configuring IEEE 802.1X Authentication with Wol222
- Configuring MAC Authentication Bypass222
- Configuring NAC Layer 2 IEEE 802.1X Validation223
- Configuring Web Authentication224
- Disabling IEEE 802.1X Authentication on the Port227
- Resetting the IEEE 802.1X Authentication Configuration to the Default Values227
  - Displaying IEEE 802.1X Statistics and Status228
CHAPTER 9 Configuring Interface Characteristics9-1229
- Understanding Interface Types229
Understanding Interface Types230
- Access Ports231
- Internal Gigabit Ethernet Ports231
- Trunk Ports231
- Tunnel Ports232
Using Interface Configuration Mode235
- Procedures for Configuring Interfaces236
- Configuring a Range of Interfaces237
- Configuring and Using Interface Range Macros238
- Configuring Ethernet Interfaces240
Configuring Layer 3 Interfaces247
Configuring the System MTU249
Monitoring and Maintaining the Interfaces250
- Monitoring Interface Status251
- Clearing and Resetting Interfaces and Counters251
- Shutting down and Restarting the Interface252
Chapter 10 Configuring Smartports Macros253
- Understanding Smartports Macros253
- Configuring Smartports Macros254
- Displaying Smartports Macros260
Chapter 11 Configuring Vlans261
- Understanding Vlans261
  - Supported Vlans262
  - VLAN Port Membership Modes263
- Configuring Normal-Range Vlans264
- Token Ring Vlans266
- Normal-Range VLAN Configuration Guidelines266
- VLAN Configuration Mode Options267
- Saving VLAN Configuration267
- Creating or Modifying an Ethernet VLAN269
- Deleting a VLAN270
- Assigning Static-Access Ports to a VLAN271
  - Configuring Extended-Range Vlans272
  - Configuring VLAN Trunks276
- Encapsulation Types278
- Configuring an Ethernet Interface as a Trunk Port279
- Default Layer 2 Ethernet Interface VLAN Configuration279
- Configuring Trunk Ports for Load Sharing284
  - Load Sharing Using STP Port Priorities284
  - Load Sharing Using STP Path Cost286
Chapter 12 Configuring VTP296
- The VTP Domain296
- VTP Modes297
- VTP Advertisements297
- VTP Version 2298
- VTP Pruning298
- Configuring VTP298
  - Default VTP Configuration300
- VTP Configuration Options301
  - VTP Configuration in Global Configuration Mode301
  - VTP Configuration in VLAN Database Configuration Mode301
- VTP Configuration Guidelines302
- Configuring a VTP Server303
- Configuring a VTP Client305
- Disabling VTP (VTP Transparent Mode)306
- Enabling VTP Version 2307
- Enabling VTP Pruning308
  - Monitoring VTP310
    - Table310
- Adding a VTP Client Switch to a VTP Domain308
Chapter 13 Configuring Voice VLAN311
- Understanding Voice VLAN311
  - Cisco IP Phone Voice Traffic312
  - Cisco IP Phone Data Traffic312
- Configuring Voice VLAN313
- Displaying Voice VLAN317
Chapter 14 Configuring Private Vlans319
- Understanding Private Vlans319
- Configuring Private Vlans323
- Monitoring Private Vlans332
Chapter 15 Configuring IEEE 802.1Q and Layer 2 Protocol Tunneling333
- Understanding IEEE 802.1Q Tunneling333
- Configuring IEEE 802.1Q Tunneling336
- Understanding Layer 2 Protocol Tunneling339
- Monitoring and Maintaining Tunneling Status350
Understanding Spanning-Tree Features351
- Configuring STP352
Chapter 16 Configuring STP352
- STP Overview352
- Spanning-Tree Topology and Bpdus353
  - Bridge ID, Switch Priority, and Extended System ID354
  - Spanning-Tree Interface States354
    - Blocking State355
Spanning-Tree Interface States355
- Forwarding State356
- Learning State356
- Listening State356
- Disabled State357
- How a Switch or Port Becomes the Root Switch or Root Port357
- Accelerated Aging to Retain Connectivity358
- Spanning Tree and Redundant Connectivity358
- Spanning-Tree Address Management358
- Spanning-Tree Modes and Protocols359
- Supported Spanning-Tree Instances359
Chapter 17 Configuring MSTP373
- Understanding MSTP374
  - Multiple Spanning-Tree Regions374
- IST, CIST, and CST375
  - Operations Within an MST Region375
  - Operations between MST Regions376
- Hop Count377
  - IEEE 802.1S Terminology377
- Boundary Ports378
- IEEE 802.1S Implementation378
- Interoperability with IEEE 802.1D STP380
  - Understanding RSTP380
  - Configuring MSTP Features386
- Specifying the MST Region Configuration and Enabling MSTP388
- Configuring the Root Switch389
- Configuring a Secondary Root Switch390
- Configuring Port Priority391
  - Configuring Path Cost392
- Configuring the Switch Priority393
- Configuring the Hello Time394
- Configuring the Forwarding-Delay Time395
- Configuring the Maximum-Aging Time395
- Configuring the Maximum-Hop Count396
- Specifying the Link Type to Ensure Rapid Transitions396
- Designating the Neighbor Type397
- Restarting the Protocol Migration Process397
  - Displaying the MST Configuration and Status398
CHAPTER 18 Configuring Optional Spanning-Tree Features399
- Understanding Optional Spanning-Tree Features399
Understanding Optional Spanning-Tree Features400
- Understanding Port Fast400
  - Configuring Optional Spanning-Tree Features400
- Understanding BPDU Guard400
- Understanding BPDU Filtering401
- Understanding Uplinkfast401
- Understanding Backbonefast403
- Understanding Etherchannel Guard405
- Understanding Root Guard406
  - Configuring Optional Spanning-Tree Features407
- Default Optional Spanning-Tree Configuration407
  - Understanding Loop Guard407
- Enabling Port Fast408
- Optional Spanning-Tree Configuration Guidelines408
- Enabling BPDU Guard409
- Enabling BPDU Filtering410
- Enabling Uplinkfast for Use with Redundant Links411
- Enabling Backbonefast411
- Enabling Etherchannel Guard412
- Enabling Root Guard413
  - Displaying the Spanning-Tree Status414
- Enabling Loop Guard413
Chapter 19 Configuring Flex Links and the MAC Address-Table Move Update Feature415
- Understanding Flex Links and the MAC Address-Table Move Update415
- Configuring Flex Links and MAC Address-Table Move Update418
- Monitoring Flex Links and the MAC Address-Table Move Update Information425
CHAPTER 20 Configuring DHCP Features and IP Source Guard427
- Understanding DHCP Features427
Understanding DHCP Features429
- Cisco IOS DHCP Server Database432
- DHCP Snooping Binding Database432
Configuring DHCP Features433
Displaying DHCP Snooping Information441
Understanding IP Source Guard441
- Source IP Address Filtering442
- Source IP and MAC Address Filtering442
Configuring IP Source Guard442
- Default IP Source Guard Configuration442
- IP Source Guard Configuration Guidelines442
- Enabling IP Source Guard443
- Displaying IP Source Guard Information444
Chapter 21 Configuring Dynamic ARP Inspection445
- Understanding Dynamic ARP Inspection445
- Configuring Dynamic ARP Inspection448
  - Default Dynamic ARP Inspection Configuration449
- Dynamic ARP Inspection Configuration Guidelines450
- Configuring Dynamic ARP Inspection in DHCP Environments451
- Configuring ARP Acls for Non-DHCP Environments452
- Limiting the Rate of Incoming ARP Packets454
- Performing Validation Checks456
- Configuring the Log Buffer457
  - Displaying Dynamic ARP Inspection Information458
Chapter 22 Configuring IGMP Snooping and MVR462
Understanding IGMP Snooping462
- IGMP Versions463
- Joining a Multicast Group463
- Leaving a Multicast Group465
- Immediate Leave466
- IGMP Configurable-Leave Timer466
- IGMP Report Suppression466
- Configuring IGMP Snooping467
Displaying IGMP Snooping Information476
Understanding Multicast VLAN Registration477
- Using MVR in a Multicast Television Application478
- Configuring MVR480
Displaying MVR Information484
Configuring IGMP Filtering and Throttling484
- Default IGMP Filtering and Throttling Configuration485
- Configuring IGMP Profiles485
- Applying IGMP Profiles487
- Setting the Maximum Number of IGMP Groups487
- Configuring the IGMP Throttling Action488
Displaying IGMP Filtering and Throttling Configuration489
CHAPTER 23 Configuring Port-Based Traffic Control23-1491
- Configuring Storm Control491
- Configuring Protected Ports496
- Configuring Port Blocking498
  - Default Port Blocking Configuration498
  - Blocking Flooded Traffic on an Interface498
- Configuring Port Security499
- Displaying Port-Based Traffic Control Settings510
Chapter 24 Configuring CDP511
- Understanding CDP511
- Configuring CDP512
- Monitoring and Maintaining CDP515
Chapter 25 Configuring LLDP and LLDP-MED517
- Understanding LLDP and LLDP-MED517
  - Understanding LLDP517
  - Understanding LLDP-MED518
- Configuring LLDP and LLDP-MED519
- Monitoring and Maintaining LLDP and LLDP-MED523
Chapter 26 Configuring UDLD525
- Understanding UDLD525
  - Modes of Operation525
  - Methods to Detect Unidirectional Links526
- Configuring UDLD527
- Displaying UDLD Status530
Chapter 27 Configuring SPAN and RSPAN531
- Understanding SPAN and RSPAN531
- Configuring SPAN and RSPAN539
- Displaying SPAN and RSPAN Status553
Chapter 28 Configuring RMON555
- Understanding RMON555
- Configuring RMON556
- Displaying RMON Status560
Chapter 29 Configuring System Message Logging561
- Understanding System Message Logging561
- Configuring System Message Logging562
- Displaying the Logging Configuration573
Chapter 30 Configuring SNMP575
- Understanding SNMP575
- Configuring SNMP580
- Displaying SNMP Status591
Chapter 31 Configuring Network Security with Acls593
- Understanding Acls593
  - Supported Acls594
  - Handling Fragmented and Unfragmented Traffic597
- Configuring Ipv4 Acls598
- Creating Named MAC Extended Acls618
  - Applying a MAC ACL to a Layer 2 Interface619
- Configuring VLAN Maps620
- Using VLAN Maps with Router Acls628
  - VLAN Maps and Router ACL Configuration Guidelines628
  - Examples of Router Acls and VLAN Maps Applied to Vlans629
    - Acls and Switched Packets629
    - Acls and Routed Packets630
- Displaying Ipv4 ACL Configuration630
Chapter 32 Configuring Qos633
- Understanding Qos634
- Configuring Auto-Qos652
- Displaying Auto-Qos Information662
- Configuring Standard Qos662
- Displaying Standard Qos Information710
Chapter 33 Configuring Etherchannels and Layer 2 Trunk Failover713
- Understanding Etherchannels713
- Configuring Etherchannels720
- Displaying Etherchannel, Pagp, and LACP Status732
- Understanding Layer 2 Trunk Failover732
  - Configuring Layer 2 Trunk Failover733
Chapter 34 Configuring IP Unicast Routing737
- Understanding IP Routing737
  - Types of Routing738
- Steps for Configuring Routing739
- Configuring IP Addressing739
- Enabling IP Unicast Routing753
- Configuring RIP753
- Configuring Stub Routing759
- Configuring Protocol-Independent Features763
- Monitoring and Maintaining the IP Network773
Chapter 35 Configuring Ipv6 Host Functions775
- Understanding Ipv6775
- Configuring Ipv6787
- Displaying Ipv6792
Chapter 36 Configuring Ipv6 MLD Snooping795
- Understanding MLD Snooping795
- Configuring Ipv6 MLD Snooping799
- Displaying MLD Snooping Information805
Chapter 37 Configuring Ipv6 Acls807
- Understanding Ipv6 Acls807
  - Supported ACL Features808
  - Ipv6 ACL Limitations808
- Configuring Ipv6 Acls809
- Displaying Ipv6 Acls813
Chapter 38 Configuring HSRP and Enhanced Object Tracking815
- Understanding HSRP815
  - Multiple HSRP817
- Configuring HSRP818
- Displaying HSRP Configurations825
- Configuring Enhanced Object Tracking826
Chapter 39 Configuring Cisco IOS IP Slas Operations835
- Understanding Cisco IOS IP Slas835
- Configuring IP Slas Operations839
- Monitoring IP Slas Operations840
Chapter 40 Troubleshooting841
- Recovering from a Software Failure842
- Recovering from a Lost or Forgotten Password843
  - Procedure with Password Recovery Enabled844
  - Procedure with Password Recovery Disabled846
- Preventing Autonegotiation Mismatches847
- SFP Module Security and Identification848
- Monitoring SFP Module Status848
- Monitoring Temperature849
- Using Ping849
- Using TDR854
Chapter 41 Configuring Online Diagnostics861
- Understanding How Online Diagnostics Work861
- Scheduling Online Diagnostics862
- Configuring Health-Monitoring Diagnostics862
- Running Online Diagnostic Tests863
  - Starting Online Diagnostic Tests863
- Displaying Online Diagnostic Tests and Test Results863
Appendix865
Supported Mibs865
- MIB List865
Appendix A Supported MIB866
- MIB List866
- Using FTP to Access the MIB Files867
- Using FTP to Access the MIB Files868
Appendix869
Working with the Cisco IOS File System, Configuration Files, and Software Images869
- Working with the Flash File System869
- Copying Files872
- Deleting Files873
- Creating, Displaying, and Extracting Tar Files873
- Displaying the Contents of a File876
- Working with Configuration Files877
- Working with Software Images891
Appendix907
Unsupported Commands in Cisco IOS Release 12.2(44)SE907
- Access Control Lists907
- Archive Commands908
  - Unsupported Privileged EXEC Commands908
- ARP Commands908
  - Unsupported Global Configuration Commands908
  - Unsupported Interface Configuration Commands908
- Bootloader Commands908
  - Unsupported User EXEC Command908
  - Unsupported Global Configuration Command908
- Debug Commands909
  - Unsupported Privileged EXEC Commands909
- Hsrp909
Qos913
- Unsupported Global Configuration Command913
- Unsupported Interface Configuration Commands913
- Unsupported Policy-Map Configuration Command913
- Radius914
  - Unsupported Global Configuration Commands914
Snmp914
- Spanning Tree914
  - Unsupported Global Configuration Command914
  - Unsupported Interface Configuration Command914
Vlan914
- Unsupported User EXEC Commands915
Vtp915
- Unsupported Privileged EXEC Command915
I N D E X917

Cisco WS-C3020 - Page 632

Table of Contents

Related product manuals