To Next Page

To Previous Page

31-39

Catalyst 3750 Switch Software Configuration Guide

78-16180-02

Chapter 31 Configuring Network Security with ACLs

Using VLAN Maps with Router ACLs

Figure 31-7 Applying ACLs on Bridged Packets

ACLs and Routed Packets

Figure 31-8 shows how ACLs are applied on routed packets. For routed packets, the ACLs are applied

in this order:

1. VLAN map for input VLAN

2. Input router ACL

3. Output router ACL

4. VLAN map for output VLAN

Figure 31-8 Applying ACLs on Routed Packets

Frame

Fallback bridge

VLAN 10

Host A

(VLAN 10)

Packet

101358

VLAN 20

Host B

(VLAN 20)

VLAN 10

map

VLAN 20

map

Frame

Routing function

VLAN 10

Host A

(VLAN 10)

Packet

101359

VLAN 20

Host B

(VLAN 20)

VLAN 10

map

Input

router

ACL

Output

router

ACL

VLAN 20

map

Default Chapter3
- Table of Contents3
- Obtaining Documentation37
  - Ordering Documentation38
- Related Publications37
- Documentation Feedback38
- Obtaining Technical Assistance38
- Obtaining Additional Publications and Information40
Chapter 1 Overview42
- Features42
- Default Settings after Initial Switch Configuration50
- Network Configuration Examples53
Chapter 4 Assigning the Switch IP Address and Default Gateway63
- Long-Distance, High-Bandwidth Transport Configuration63
- Where to Go Next64
Understanding Command Modes65
- C H a P T E R 2 Using the Command-Line Interface66
Understanding the Help System67
Understanding Abbreviated Commands67
Understanding no and Default Forms of Commands68
Understanding CLI Error Messages68
Using Command History68
- Changing the Command History Buffer Size69
- Disabling the Command History Feature69
- Recalling Commands69
- Editing Commands through Keystrokes70
- Enabling and Disabling Editing Features70
Using Editing Features70
- Editing Command Lines that Wrap72
Searching and Filtering Output of Show and more Commands72
Accessing the CLI73
- Accessing the CLI through a Console Connection or through Telnet73
- Accessing the CLI from a Browser74
- Understanding CMS75
Chapter 3 Getting Started with CM76
- Front Panel View76
- Topology View76
- CMS Menu Bar, Toolbar, and Feature Bar76
- Online Help79
- Configuration Modes79
  - Guide Mode79
  - Expert Mode80
- Wizards80
- Privilege Levels81
- Access to Older Switches in a Cluster81
- Configuring CMS82
- Displaying CMS85
- Default Boot Configuration102
- Automatically Downloading a Configuration File102
  - Specifying the Filename to Read and Write the System Configuration102
- Booting Manually103
- Booting a Specific Software Image103
- Controlling Environment Variables104
Managing Switch Stacks109
- Understanding Switch Stacks109
Chapter 5 Managing Switch Stack110
- Switch Stack Membership111
- Stack Master Election and Re-Election112
- Switch Stack Bridge ID and Router MAC Address113
- Stack Member Numbers114
- Stack Member Priority Values115
- Switch Stack Offline Configuration115
- Assigning Stack Member Information125
- Accessing the CLI of a Specific Stack Member127
- Displaying Switch Stack Information128
Clustering Switches129
Chapter 6 Clustering Switche130
- Understanding Switch Clusters130
- Planning a Switch Cluster132
- Automatic Discovery of Cluster Candidates and Members133
- HSRP and Standby Cluster Command Switches138
- IP Addresses141
- Host Names141
- SNMP Community Strings142
- Switch Clusters and Switch Stacks142
- Passwords142
- TACACS+ and RADIUS144
- Access Modes in CMS144
- LRE Profiles145
- Availability of Switch-Specific Features in Switch Clusters145
  - Creating a Switch Cluster145
Chapter 7 Administering the Switch154
- Understanding the System Clock154
- Understanding Network Time Protocol154
- Configuring NTP156
- Configuring Time and Date Manually163
- Configuring a System Name and Prompt166
- MAC Addresses and Switch Stacks174
- Default MAC Address Table Configuration174
- Changing the Address Aging Time174
- Removing Dynamic Address Entries175
- Configuring MAC Address Notification Traps175
- Adding and Removing Static Address Entries177
- Configuring Unicast MAC Address Filtering178
- Displaying Address Table Entries180
Configuring SDM Templates181
- Understanding the SDM Templates181
  - SDM Templates and Switch Stacks182
- Configuring the Switch SDM Template183
- Displaying the SDM Templates185
Chapter 9 Configuring Switch-Based Authentication187
- Preventing Unauthorized Access to Your Switch187
- Protecting Access to Privileged EXEC Commands188
Controlling Switch Access with TACACS196
- Understanding TACACS196
- TACACS+ Operation198
- Configuring TACACS199
- Displaying the TACACS+ Configuration203
Controlling Switch Access with RADIUS204
- Understanding RADIUS204
- RADIUS Operation205
- Configuring RADIUS206
- Displaying the RADIUS Configuration217
Controlling Switch Access with Kerberos218
- Understanding Kerberos218
- Kerberos Operation220
- Configuring Kerberos222
Configuring the Switch for Local Authentication and Authorization222
Configuring the Switch for Secure Shell223
- Understanding SSH224
  - SSH Servers, Integrated Clients, and Supported Versions224
  - Limitations225
- Configuring SSH225
- Displaying the SSH Configuration and Status227
CHAPTER 10 Configuring 802.1X Port-Based Authentication230
- Understanding 802.1X Port-Based Authentication230
- Configuring 802.1X Authentication238
- Configuring the Switch-To-RADIUS-Server Communication243
- Configuring Periodic Re-Authentication244
- Manually Re-Authenticating a Client Connected to a Port244
- Changing the Quiet Period245
- Changing the Switch-To-Client Retransmission Time245
  - Setting the Re-Authentication Number246
- Setting the Switch-To-Client Frame-Retransmission Number246
- Configuring the Host Mode247
- Configuring a Guest VLAN248
- Resetting the 802.1X Configuration to the Default Values249
  - Displaying 802.1X Statistics and Status250
- Configuring 802.1X Accounting249
CHAPTER 11 Configuring Interface Characteristics251
- Understanding Interface Types251
- Using Interface Configuration Mode257
- Configuring Ethernet Interfaces262
  - Default Ethernet Interface Configuration262
- Configuration Guidelines for 10-Gigabit Ethernet Interfaces264
- Configuring Interface Speed and Duplex Mode264
  - Configuration Guidelines265
  - Setting the Interface Speed and Duplex Parameters265
- Configuring IEEE 802.3Z Flow Control267
- Configuring Auto-MDIX on an Interface268
- Configuring Power over Ethernet on an Interface269
- Adding a Description for an Interface270
Configuring Smartports Macros277
- Understanding Smartports Macros277
- Configuring Smartports Macros278
- Displaying Smartports Macros284
Configuring Vlans285
- Understanding Vlans285
Chapter 13 Configuring VLAN287
- Supported Vlans287
- VLAN Port Membership Modes287
- Configuring Normal-Range Vlans289
- Token Ring Vlans290
- Normal-Range VLAN Configuration Guidelines290
- VLAN Configuration Mode Options291
  - VLAN Configuration in Config-Vlan Mode291
  - VLAN Configuration in VLAN Database Configuration Mode291
- Saving VLAN Configuration292
- Default Ethernet VLAN Configuration292
- Creating or Modifying an Ethernet VLAN293
- Deleting a VLAN295
- Assigning Static-Access Ports to a VLAN295
Chapter 14 Configuring VTP320
- The VTP Domain320
- VTP Modes321
- VTP Advertisements321
- VTP Version 2322
- VTP Pruning323
- VTP and Switch Stacks324
- Configuring VTP324
- Monitoring VTP334
Configuring Private Vlans335
- Understanding Private Vlans335
Chapter 15 Configuring Private VLAN336
- IP Addressing Scheme with Private Vlans337
- Private Vlans Across Multiple Switches338
- Private-VLAN Interaction with Other Features338
- Configuring Private Vlans339
- Tasks for Configuring Private Vlans340
- Default Private-VLAN Configuration341
- Private-VLAN Configuration Guidelines341
- Configuring and Associating Vlans in a Private VLAN344
- Configuring a Layer 2 Interface as a Private-VLAN Host Port345
  - Configuration File346
- Configuring a Layer 2 Interface as a Private-VLAN Promiscuous Port347
Step 1348
- Monitoring Private Vlans349
- Configuring Voice VLAN351
- Understanding Voice VLAN351
- Mapping Secondary Vlans to a Primary VLAN Layer 3 VLAN Interface348
Chapter 16 Configuring Voice VLAN352
- Cisco IP Phone Voice Traffic352
- Cisco IP Phone Data Traffic352
- Configuring Voice VLAN353
- Displaying Voice VLAN356
- Configuring STP357
- Understanding Spanning-Tree Features357
Chapter 17 Configuring STP358
- STP Overview358
- Spanning-Tree Topology and Bpdus359
- Bridge ID, Switch Priority, and Extended System ID360
- Spanning-Tree Interface States361
- Configuring Spanning-Tree Features368
- Displaying the Spanning-Tree Status380
- Configuring MSTP381
Chapter 18 Configuring MSTP382
- Understanding MSTP382
- Understanding RSTP386
- Configuring MSTP Features392
- Default MSTP Configuration393
- MSTP Configuration Guidelines393
- Specifying the MST Region Configuration and Enabling MSTP394
- Configuring the Root Switch395
- Configuring a Secondary Root Switch397
- Configuring Port Priority398
  - Configuring Path Cost399
- Configuring the Switch Priority400
- Configuring the Hello Time400
- Configuring the Forwarding-Delay Time401
- Configuring the Maximum-Aging Time402
- Configuring the Maximum-Hop Count402
- Specifying the Link Type to Ensure Rapid Transitions403
  - Displaying the MST Configuration and Status404
- Restarting the Protocol Migration Process403
CHAPTER 19 Configuring Optional Spanning-Tree Features405
- Understanding Optional Spanning-Tree Features405
Understanding Optional Spanning-Tree Features406
- Understanding Port Fast406
- Understanding BPDU Guard407
- Understanding BPDU Filtering407
- Understanding Uplinkfast408
- Understanding Cross-Stack Uplinkfast409
  - How CSUF Works410
  - Events that Cause Fast Convergence411
- Understanding Backbonefast411
- Understanding Etherchannel Guard414
- Understanding Root Guard414
  - Configuring Optional Spanning-Tree Features415
- Understanding Loop Guard415
  - Displaying the Spanning-Tree Status423
Configuring Flex Links425
- Understanding Flex Links425
- Configuring Flex Links426
  - Default Flex Link Configuration426
  - Flex Link Configuration Guidelines426
Chapter 20 Configuring Flex Link426
- Configuring Flex Links427
- Monitoring Flex Links427
- Configuring Flex Links428
CHAPTER 21 Configuring DHCP Features and IP Source Guard429
- Understanding DHCP Features429
- Configuring DHCP Features435
- Displaying DHCP Snooping Information442
  - Displaying the DHCP Snooping Configuration442
  - Displaying the DHCP Snooping Binding Database442
- Understanding IP Source Guard443
  - Source IP Address Filtering444
  - Source IP and MAC Address Filtering444
- Configuring IP Source Guard444
- Displaying IP Source Guard Information447
Configuring Dynamic ARP Inspection449
- Understanding Dynamic ARP Inspection449
- Configuring Dynamic ARP Inspection453
- Displaying Dynamic ARP Inspection Information462
- Understanding IGMP Snooping465
Chapter 23 Configuring IGMP Snooping and MVR466
- IGMP Versions466
- Joining a Multicast Group467
- Leaving a Multicast Group469
- Immediate Leave469
- IGMP Report Suppression469
- IGMP Snooping and Switch Stacks470
- Configuring IGMP Snooping470
- Displaying IGMP Snooping Information476
- Understanding Multicast VLAN Registration477
  - Using MVR in a Multicast Television Application477
- Configuring MVR479
- Displaying MVR Information483
- Configuring IGMP Filtering and Throttling483
- Displaying IGMP Filtering and Throttling Configuration489
CHAPTER 24 Configuring Port-Based Traffic Control491
- Configuring Storm Control491
- Configuring Protected Ports495
- Configuring Port Blocking496
  - Default Port Blocking Configuration496
  - Blocking Flooded Traffic on an Interface496
- Configuring Port Security497
- Displaying Port-Based Traffic Control Settings505
Configuring CDP507
- Understanding CDP507
  - CDP and Switch Stacks508
- Configuring CDP508
  - Default CDP Configuration508
  - Configuring the CDP Characteristics508
Chapter 25 Configuring CDP509
- Disabling and Enabling CDP509
- Disabling and Enabling CDP on an Interface510
- Monitoring and Maintaining CDP511
- Configuring UDLD513
- Understanding UDLD513
  - Modes of Operation513
Chapter 26 Configuring UDLD514
- Default UDLD Configuration516
- Configuration Guidelines516
- Enabling UDLD Globally517
- Enabling UDLD on an Interface518
- Resetting an Interface Disabled by UDLD518
- Displaying UDLD Status519
- Configuring SPAN and RSPAN521
- Understanding SPAN and RSPAN521
Chapter 27 Configuring SPAN and RSPAN522
- Local SPAN522
- Remote SPAN523
- SPAN and RSPAN Concepts and Terminology524
- SPAN and RSPAN Interaction with Other Features529
- SPAN and RSPAN and Switch Stacks530
- Configuring SPAN and RSPAN530
- Displaying SPAN and RSPAN Status544
Configuring RMON545
- Understanding RMON545
- Configuring RMON546
- Displaying RMON Status550
Configuring System Message Logging551
- Understanding System Message Logging551
- Configuring System Message Logging552
- Configuring SNMP565
  - Understanding SNMP565
Chapter 30 Configuring SNMP566
- SNMP Versions566
- SNMP Manager Functions567
- SNMP Agent Functions568
- SNMP Community Strings568
- Using SNMP to Access MIB Variables569
- SNMP Notifications569
- SNMP Ifindex MIB Object Values570
- Configuring SNMP570
- Displaying SNMP Status581
Configuring Network Security with Acls583
- Understanding Acls583
- Acls and Switch Stacks588
- Configuring IP Acls588
- Creating Named MAC Extended Acls609
  - Applying a MAC ACL to a Layer 2 Interface611
- Configuring VLAN Maps612
- Using VLAN Maps with Router Acls619
  - Guidelines619
  - Examples of Router Acls and VLAN Maps Applied to Vlans620
- Displaying ACL Configuration622
Configuring Qos625
- Understanding Qos625
Chapter 32 Configuring Qo627
- Basic Qos Model627
- Classification628
  - Classification Based on Qos Acls631
  - Classification Based on Class Maps and Policy Maps631
- Policing and Marking632
- Mapping Tables634
- Queueing and Scheduling Overview635
- Packet Modification641
- Configuring Auto-Qos642
- Displaying Auto-Qos Information652
- Configuring Standard Qos652
- Displaying Standard Qos Information691
Configuring Etherchannels693
- Understanding Etherchannels693
- Configuring Etherchannels702
Configuring IP Unicast Routing717
- Understanding IP Routing718
  - Types of Routing718
Chapter 34 Configuring IP Unicast Routing719
- IP Routing and Switch Stacks719
- Steps for Configuring Routing720
- Configuring IP Addressing721
- Enabling IP Unicast Routing735
- Configuring RIP736
- Configuring OSPF741
- Configuring EIGRP750
- Configuring BGP756
- Configuring Protocol-Independent Features776
- Monitoring and Maintaining the IP Network790
- Configuring HSRP791
- Understanding HSRP791
Chapter 35 Configuring HSRP792
- HSRP and Switch Stacks792
- Configuring HSRP793
- Displaying HSRP Configurations801
Configuring IP Multicast Routing803
- C H a P T E R 36 Configuring IP Multicast Routing804
- Understanding Cisco's Implementation of IP Multicast Routing804
- Multicast Routing and Switch Stacks810
- Configuring IP Multicast Routing810
- Configuring Advanced PIM Features825
- Configuring Optional IGMP Features829
- Configuring Optional Multicast Routing Features834
- Configuring Basic DVMRP Interoperability Features839
- Configuring Advanced DVMRP Interoperability Features844
- Monitoring and Maintaining IP Multicast Routing852
- Configuring MSDP855
- Understanding MSDP855
Chapter 37 Configuring MSDP856
- MSDP Operation856
- MSDP Benefits857
- Configuring MSDP858
- Monitoring and Maintaining MSDP873
Configuring Fallback Bridging875
- Understanding Fallback Bridging875
  - Fallback Bridging Overview875
  - Fallback Bridging and Switch Stacks877
- Configuring Fallback Bridging877
- Monitoring and Maintaining Fallback Bridging885
- Troubleshooting887
Chapter 39 Troubleshooting888
- Recovering from Corrupted Software by Using the Xmodem Protocol888
- Recovering from a Lost or Forgotten Password890
  - Procedure with Password Recovery Enabled891
  - Procedure with Password Recovery Disabled892
- Preventing Switch Stack Problems894
- Recovering from a Command Switch Failure895
  - Replacing a Failed Command Switch with a Cluster Member895
  - Replacing a Failed Command Switch with Another Switch897
- Recovering from Lost Cluster Member Connectivity898
- Preventing Autonegotiation Mismatches899
- Troubleshooting Power over Ethernet Switch Ports899
- SFP Module Security and Identification899
- Monitoring SFP Module Status900
- Using Ping900
  - Understanding Ping900
  - Executing Ping901
- Using Layer 2 Traceroute902
- Using IP Traceroute903
  - Understanding IP Traceroute903
  - Executing IP Traceroute904
Using TDR905
- Understanding TDR905
- Running TDR and Displaying the Results906
- Using Debug Commands907
Appendix913
Supported Mibs913
- MIB List913
Appendix A Supported MIB914
- MIB List914
- Using FTP to Access the MIB Files915
Appendix917
Working with the Cisco IOS File System, Configuration Files, and Software Images917
- Working with the Flash File System917
- Working with Configuration Files924
- Working with Software Images936
Appendix951
Unsupported Commands in Cisco IOS Release 12.2(20)SE951
- Access Control Lists951
- ARP Commands952
  - Unsupported Global Configuration Commands952
  - Unsupported Interface Configuration Commands952
- Fallback Bridging952
  - Unsupported Privileged EXEC Commands952
  - Unsupported Interface Configuration Commands953
- Hsrp954
Msdp959
- Unsupported Global Configuration Commands960
- Network Address Translation (NAT) Commands960
  - Unsupported User EXEC Commands960
  - Unsupported Interface Configuration Commands960
Radius960
Snmp961
- Unsupported Global Configuration Commands961
- Spanning Tree961
  - Unsupported Global Configuration Command961
  - Unsupported Interface Configuration Command961
Vlan961
- Unsupported User EXEC Commands961
Vtp961
- Unsupported Privileged EXEC Commands961
I N D E X963

Brand	Cisco
Model	WS-C3750-48PS-S
Category	Switch
Language	English

Cisco WS-C3750-48PS-S User Manual

Table of Contents

Questions and Answers:

Cisco WS-C3750-48PS-S Specifications

Related product manuals