Cisco Catalyst 3560V2-48PS Switch User manual

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

Catalyst 3560 Switch Software

Configuration Guide

Cisco IOS Release 12.2(50)SE

March 2009

Text Part Number: OL-8553-06

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL

STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT

WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT

SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE

OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH

ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT

LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF

DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,

WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO

OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

CCDE, CCENT, Cisco Eos, Cisco HealthPresence, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco StadiumVision, Cisco TelePresence, Cisco WebEx, DCE, and Welcome

to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn and Cisco Store are service marks; and Access Registrar, Aironet, AsyncOS,

Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS,

Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step,

Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone,

MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase,

SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of

Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship

between Cisco and any other company. (0812R)

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the

document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

Catalyst 3560 Switch Software Configuration Guide

iii

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

CONTENTS

Preface xlv

Audience xlv

Purpose xlv

Conventions xlvi

Related Publications xlvi

Obtaining Documentation, Obtaining Support, and Security Guidelines xlvii

CHAPTER

1 Overview 1-1

Features 1-1

Ease-of-Deployment and Ease-of-Use Features 1-2

Performance Features 1-3

Management Options 1-4

Manageability Features 1-5

Availability and Redundancy Features 1-7

VLAN Features 1-7

Security Features 1-8

QoS and CoS Features 1-11

Layer 3 Features 1-12

Power over Ethernet Features 1-13

Monitoring Features 1-13

Default Settings After Initial Switch Configuration 1-14

Network Configuration Examples 1-17

Design Concepts for Using the Switch 1-17

Small to Medium-Sized Network Using Catalyst 3560 Switches 1-20

Large Network Using Catalyst 3560 Switches 1-21

Long-Distance, High-Bandwidth Transport Configuration 1-23

Where to Go Next 1-23

CHAPTER

2 Using the Command-Line Interface 2-1

Understanding Command Modes 2-1

Understanding the Help System 2-3

Understanding Abbreviated Commands 2-4

Understanding no and default Forms of Commands 2-4

Contents

iv

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

Understanding CLI Error Messages 2-5

Using Configuration Logging 2-5

Using Command History 2-6

Changing the Command History Buffer Size 2-6

Recalling Commands 2-6

Disabling the Command History Feature 2-7

Using Editing Features 2-7

Enabling and Disabling Editing Features 2-7

Editing Commands through Keystrokes 2-7

Editing Command Lines that Wrap 2-9

Searching and Filtering Output of show and more Commands 2-10

Accessing the CLI 2-10

Accessing the CLI through a Console Connection or through Telnet 2-10

CHAPTER

3 Assigning the Switch IP Address and Default Gateway 3-1

Understanding the Boot Process 3-1

Assigning Switch Information 3-2

Default Switch Information 3-3

Understanding DHCP-Based Autoconfiguration 3-3

DHCP Client Request Process 3-4

Understanding DHCP-based Autoconfiguration and Image Update 3-5

DHCP Autoconfiguration 3-5

DHCP Auto-Image Update 3-5

Limitations and Restrictions 3-5

Configuring DHCP-Based Autoconfiguration 3-6

DHCP Server Configuration Guidelines 3-6

Configuring the TFTP Server 3-7

Configuring the DNS 3-7

Configuring the Relay Device 3-8

Obtaining Configuration Files 3-8

Example Configuration 3-9

Configuring the DHCP Auto Configuration and Image Update Features 3-11

Configuring DHCP Autoconfiguration (Only Configuration File) 3-11

Configuring DHCP Auto-Image Update (Configuration File and Image) 3-12

Configuring the Client 3-13

Manually Assigning IP Information 3-14

Checking and Saving the Running Configuration 3-15

Contents

v

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

Modifying the Startup Configuration 3-16

Default Boot Configuration 3-16

Automatically Downloading a Configuration File 3-16

Specifying the Filename to Read and Write the System Configuration 3-16

Booting Manually 3-17

Booting a Specific Software Image 3-18

Controlling Environment Variables 3-18

Scheduling a Reload of the Software Image 3-20

Configuring a Scheduled Reload 3-20

Displaying Scheduled Reload Information 3-21

CHAPTER

4 Configuring Cisco EnergyWise 4-1

Managing Single Entities 4-1

EnergyWise Entity 4-1

EnergyWise Domain 4-2

EnergyWise Network 4-2

Single PoE Switch Scenario 4-3

EnergyWise Power Level 4-4

EnergyWise Importance 4-5

EnergyWise Names, Roles, and Keywords 4-5

Configuration Guidelines 4-5

PoE and EnergyWise Interactions 4-5

Manually Managing Power 4-6

Powering the Entity 4-6

Configuring Entity Attributes 4-7

Powering the PoE Port 4-8

Configuring PoE-Port Attributes 4-8

Automatically Managing Power (Recurrence) 4-9

Examples 4-11

Setting Up the Domain 4-11

Manually Managing Power 4-12

Automatically Managing Power 4-12

Managing Multiple Entities 4-12

Multiple PoE Switch Scenario 4-13

EnergyWise Query 4-13

Using Queries to Manage Power in the Domain 4-14

Contents

vi

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

Examples 4-15

Querying with the Name Attribute 4-15

Querying with Keywords 4-16

Querying to Set Power Levels 4-16

Troubleshooting EnergyWise 4-16

Using CLI Commands 4-17

Verifying the Power Usage 4-17

Additional Information 4-18

Managing Power in a LAN 4-18

Managing Power with IP Routing 4-18

CHAPTER

5 Configuring Cisco IOS Configuration Engine 5-1

Understanding Cisco Configuration Engine Software 5-1

Configuration Service 5-2

Event Service 5-3

NameSpace Mapper 5-3

What You Should Know About the CNS IDs and Device Hostnames 5-3

ConfigID 5-3

DeviceID 5-4

Hostname and DeviceID 5-4

Using Hostname, DeviceID, and ConfigID 5-4

Understanding Cisco IOS Agents 5-5

Initial Configuration 5-5

Incremental (Partial) Configuration 5-6

Synchronized Configuration 5-6

Configuring Cisco IOS Agents 5-6

Enabling Automated CNS Configuration 5-6

Enabling the CNS Event Agent 5-7

Enabling the Cisco IOS CNS Agent 5-9

Enabling an Initial Configuration 5-9

Enabling a Partial Configuration 5-13

Displaying CNS Configuration 5-14

CHAPTER

6 Clustering Switches 6-1

Understanding Switch Clusters 6-1

Cluster Command Switch Characteristics 6-3

Standby Cluster Command Switch Characteristics 6-3

Candidate Switch and Cluster Member Switch Characteristics 6-3

Contents

vii

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

Planning a Switch Cluster 6-4

Automatic Discovery of Cluster Candidates and Members 6-4

Discovery Through CDP Hops 6-5

Discovery Through Non-CDP-Capable and Noncluster-Capable Devices 6-6

Discovery Through Different VLANs 6-6

Discovery Through Different Management VLANs 6-7

Discovery Through Routed Ports 6-8

Discovery of Newly Installed Switches 6-9

HSRP and Standby Cluster Command Switches 6-10

Virtual IP Addresses 6-10

Other Considerations for Cluster Standby Groups 6-11

Automatic Recovery of Cluster Configuration 6-12

IP Addresses 6-13

Hostnames 6-13

Passwords 6-13

SNMP Community Strings 6-14

TACACS+ and RADIUS 6-14

LRE Profiles 6-14

Using the CLI to Manage Switch Clusters 6-15

Catalyst 1900 and Catalyst 2820 CLI Considerations 6-15

Using SNMP to Manage Switch Clusters 6-15

CHAPTER

7 Administering the Switch 7-1

Managing the System Time and Date 7-1

Understanding the System Clock 7-1

Understanding Network Time Protocol 7-2

Configuring NTP 7-3

Default NTP Configuration 7-4

Configuring NTP Authentication 7-4

Configuring NTP Associations 7-5

Configuring NTP Broadcast Service 7-6

Configuring NTP Access Restrictions 7-8

Configuring the Source IP Address for NTP Packets 7-10

Displaying the NTP Configuration 7-11

Configuring Time and Date Manually 7-11

Setting the System Clock 7-11

Displaying the Time and Date Configuration 7-12

Configuring the Time Zone 7-12

Configuring Summer Time (Daylight Saving Time) 7-13

Contents

viii

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

Configuring a System Name and Prompt 7-14

Default System Name and Prompt Configuration 7-15

Configuring a System Name 7-15

Understanding DNS 7-15

Default DNS Configuration 7-16

Setting Up DNS 7-16

Displaying the DNS Configuration 7-17

Creating a Banner 7-17

Default Banner Configuration 7-17

Configuring a Message-of-the-Day Login Banner 7-18

Configuring a Login Banner 7-18

Managing the MAC Address Table 7-19

Building the Address Table 7-20

MAC Addresses and VLANs 7-20

Default MAC Address Table Configuration 7-21

Changing the Address Aging Time 7-21

Removing Dynamic Address Entries 7-22

Configuring MAC Address Notification Traps 7-22

Adding and Removing Static Address Entries 7-24

Configuring Unicast MAC Address Filtering 7-25

Disabling MAC Address Learning on a VLAN 7-26

Displaying Address Table Entries 7-27

Managing the ARP Table 7-28

CHAPTER

8 Configuring SDM Templates 8-1

Understanding the SDM Templates 8-1

Dual IPv4 and IPv6 SDM Templates 8-2

Configuring the Switch SDM Template 8-3

Default SDM Template 8-3

SDM Template Configuration Guidelines 8-3

Setting the SDM Template 8-4

Displaying the SDM Templates 8-5

CHAPTER

9 Configuring Switch-Based Authentication 9-1

Preventing Unauthorized Access to Your Switch 9-1

Protecting Access to Privileged EXEC Commands 9-2

Default Password and Privilege Level Configuration 9-2

Setting or Changing a Static Enable Password 9-3

Protecting Enable and Enable Secret Passwords with Encryption 9-3

Contents

ix

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

Disabling Password Recovery 9-5

Setting a Telnet Password for a Terminal Line 9-6

Configuring Username and Password Pairs 9-6

Configuring Multiple Privilege Levels 9-7

Setting the Privilege Level for a Command 9-8

Changing the Default Privilege Level for Lines 9-9

Logging into and Exiting a Privilege Level 9-9

Controlling Switch Access with TACACS+ 9-10

Understanding TACACS+ 9-10

TACACS+ Operation 9-12

Configuring TACACS+ 9-12

Default TACACS+ Configuration 9-13

Identifying the TACACS+ Server Host and Setting the Authentication Key 9-13

Configuring TACACS+ Login Authentication 9-14

Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 9-16

Starting TACACS+ Accounting 9-17

Displaying the TACACS+ Configuration 9-17

Controlling Switch Access with RADIUS 9-17

Understanding RADIUS 9-18

RADIUS Operation 9-19

Configuring RADIUS 9-19

Default RADIUS Configuration 9-20

Identifying the RADIUS Server Host 9-20

Configuring RADIUS Login Authentication 9-23

Defining AAA Server Groups 9-25

Configuring RADIUS Authorization for User Privileged Access and Network Services 9-27

Starting RADIUS Accounting 9-28

Configuring Settings for All RADIUS Servers 9-29

Configuring the Switch to Use Vendor-Specific RADIUS Attributes 9-29

Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 9-31

Configuring RADIUS Server Load Balancing 9-31

Displaying the RADIUS Configuration 9-32

Controlling Switch Access with Kerberos 9-32

Understanding Kerberos 9-32

Kerberos Operation 9-34

Authenticating to a Boundary Switch 9-35

Obtaining a TGT from a KDC 9-35

Authenticating to Network Services 9-35

Configuring Kerberos 9-35

Contents

x

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

Configuring the Switch for Local Authentication and Authorization 9-36

Configuring the Switch for Secure Shell 9-37

Understanding SSH 9-38

SSH Servers, Integrated Clients, and Supported Versions 9-38

Limitations 9-39

Configuring SSH 9-39

Configuration Guidelines 9-39

Setting Up the Switch to Run SSH 9-39

Configuring the SSH Server 9-40

Displaying the SSH Configuration and Status 9-41

Configuring the Switch for Secure Socket Layer HTTP 9-42

Understanding Secure HTTP Servers and Clients 9-42

Certificate Authority Trustpoints 9-42

CipherSuites 9-44

Configuring Secure HTTP Servers and Clients 9-44

Default SSL Configuration 9-45

SSL Configuration Guidelines 9-45

Configuring a CA Trustpoint 9-45

Configuring the Secure HTTP Server 9-46

Configuring the Secure HTTP Client 9-47

Displaying Secure HTTP Server and Client Status 9-48

Configuring the Switch for Secure Copy Protocol 9-48

Information About Secure Copy 9-49

CHAPTER

10 Configuring IEEE 802.1x Port-Based Authentication 10-1

Understanding IEEE 802.1x Port-Based Authentication 10-1

Device Roles 10-2

Authentication Process 10-3

Authentication Initiation and Message Exchange 10-5

Authentication Manager 10-7

Port-Based Authentication Methods 10-7

Per-User ACLs and Filter-Ids 10-8

Authentication Manager CLI Commands 10-8

Ports in Authorized and Unauthorized States 10-9

802.1x Host Mode 10-10

Multidomain Authentication 10-11

802.1x Multiple Authentication Mode 10-12

802.1x Accounting 10-12

802.1x Accounting Attribute-Value Pairs 10-13

Contents

xi

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

802.1x Readiness Check 10-14

802.1x Authentication with VLAN Assignment 10-14

Using 802.1x Authentication with Per-User ACLs 10-15

802.1x Authentication with Downloadable ACLs and Redirect URLs 10-16

Cisco Secure ACS and Attribute-Value Pairs for the Redirect URL 10-17

Cisco Secure ACS and Attribute-Value Pairs for Downloadable ACLs 10-17

802.1x Authentication with Guest VLAN 10-17

802.1x Authentication with Restricted VLAN 10-18

802.1x Authentication with Inaccessible Authentication Bypass 10-19

802.1x Authentication with Voice VLAN Ports 10-21

802.1x Authentication with Port Security 10-21

802.1x Authentication with Wake-on-LAN 10-22

802.1x Authentication with MAC Authentication Bypass 10-23

Network Admission Control Layer 2 802.1x Validation 10-24

Flexible Authentication Ordering 10-24

Open1x Authentication 10-25

Using Voice Aware 802.1x Security 10-25

802.1x Switch Supplicant with Network Edge Access Topology (NEAT) 10-25

Web Authentication 10-26

Web Authentication with Automatic MAC Check 10-27

Local Web Authentication Banner 10-27

Configuring 802.1x Authentication 10-29

Default 802.1x Authentication Configuration 10-30

802.1x Authentication Configuration Guidelines 10-31

802.1x Authentication 10-31

VLAN Assignment, Guest VLAN, Restricted VLAN, and Inaccessible Authentication

Bypass 10-32

MAC Authentication Bypass 10-33

Maximum Number of Allowed Devices Per Port 10-33

Configuring 802.1x Readiness Check 10-34

Configuring Voice Aware 802.1x Security 10-35

Configuring 802.1x Violation Modes 10-36

Configuring 802.1x Authentication 10-37

Configuring the Switch-to-RADIUS-Server Communication 10-38

Configuring the Host Mode 10-40

Configuring Periodic Re-Authentication 10-41

Manually Re-Authenticating a Client Connected to a Port 10-42

Changing the Quiet Period 10-42

Changing the Switch-to-Client Retransmission Time 10-43

Setting the Switch-to-Client Frame-Retransmission Number 10-44

Contents

xii

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

Setting the Re-Authentication Number 10-44

Configuring 802.1x Accounting 10-45

Configuring a Guest VLAN 10-46

Configuring a Restricted VLAN 10-47

Configuring the Inaccessible Authentication Bypass Feature 10-49

Configuring 802.1x Authentication with WoL 10-52

Configuring MAC Authentication Bypass 10-53

Configuring NAC Layer 2 802.1x Validation 10-54

Configuring 802.1x Switch Supplicant with NEAT 10-55

Configuring 802.1x Authentication with Downloadable ACLs and Redirect URLs 10-57

Configuring Downloadable ACLs 10-57

Configuring a Downloadable Policy 10-58

Configuring Flexible Authentication Ordering 10-59

Configuring Open1x 10-60

Configuring Web Authentication 10-60

Configuring a Web Authentication Local Banner 10-64

Disabling 802.1x Authentication on the Port 10-64

Resetting the 802.1x Authentication Configuration to the Default Values 10-65

Displaying 802.1x Statistics and Status 10-65

CHAPTER

11 Configuring Interface Characteristics 11-1

Understanding Interface Types 11-1

Port-Based VLANs 11-2

Switch Ports 11-2

Access Ports 11-3

Trunk Ports 11-3

Tunnel Ports 11-3

Routed Ports 11-4

Switch Virtual Interfaces 11-4

SVI Autostate Exclude 11-5

EtherChannel Port Groups 11-6

Dual-Purpose Uplink Ports 11-6

Power over Ethernet Ports 11-7

Supported Protocols and Standards 11-7

Powered-Device Detection and Initial Power Allocation 11-7

Power Management Modes 11-8

Connecting Interfaces 11-9

Contents

xiii

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

Using Interface Configuration Mode 11-10

Procedures for Configuring Interfaces 11-11

Configuring a Range of Interfaces 11-11

Configuring and Using Interface Range Macros 11-13

Configuring Ethernet Interfaces 11-14

Default Ethernet Interface Configuration 11-15

Setting the Type of a Dual-Purpose Uplink Port 11-16

Configuring Interface Speed and Duplex Mode 11-17

Speed and Duplex Configuration Guidelines 11-18

Setting the Interface Speed and Duplex Parameters 11-18

Configuring IEEE 802.3x Flow Control 11-20

Configuring Auto-MDIX on an Interface 11-21

Configuring a Power Management Mode on a PoE Port 11-22

Budgeting Power for Devices Connected to a PoE Port 11-23

Adding a Description for an Interface 11-24

Configuring Layer 3 Interfaces 11-25

Configuring SVI Autostate Exclude 11-27

Configuring the System MTU 11-27

Monitoring and Maintaining the Interfaces 11-29

Monitoring Interface Status 11-29

Clearing and Resetting Interfaces and Counters 11-30

Shutting Down and Restarting the Interface 11-31

CHAPTER

12 Configuring Auto Smartports Macros 12-1

Understanding Auto Smartports and Static Smartports Macros 12-1

Configuring Auto Smartports 12-2

Default Auto Smartports Configuration 12-2

Auto Smartports Configuration Guidelines 12-3

Enabling Auto Smartports 12-3

Configuring Auto Smartports Built-in Macros 12-4

Configuring Event Triggers 12-6

Configuring Auto Smartports User-Defined Macros 12-9

Configuring Static Smartports Macros 12-11

Default Static Smartports Configuration 12-11

Static Smartports Configuration Guidelines 12-12

Applying Static Smartports Macros 12-12

Displaying Auto Smartports and Static Smartports Macros 12-14

Contents

xiv

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

CHAPTER

13 Configuring VLANs 13-1

Understanding VLANs 13-1

Supported VLANs 13-2

VLAN Port Membership Modes 13-3

Configuring Normal-Range VLANs 13-4

Token Ring VLANs 13-6

Normal-Range VLAN Configuration Guidelines 13-6

VLAN Configuration Mode Options 13-7

VLAN Configuration in config-vlan Mode 13-7

VLAN Configuration in VLAN Database Configuration Mode 13-7

Saving VLAN Configuration 13-7

Default Ethernet VLAN Configuration 13-8

Creating or Modifying an Ethernet VLAN 13-9

Deleting a VLAN 13-10

Assigning Static-Access Ports to a VLAN 13-11

Configuring Extended-Range VLANs 13-12

Default VLAN Configuration 13-12

Extended-Range VLAN Configuration Guidelines 13-13

Creating an Extended-Range VLAN 13-13

Creating an Extended-Range VLAN with an Internal VLAN ID 13-15

Displaying VLANs 13-16

Configuring VLAN Trunks 13-16

Trunking Overview 13-16

Encapsulation Types 13-18

IEEE 802.1Q Configuration Considerations 13-19

Default Layer 2 Ethernet Interface VLAN Configuration 13-19

Configuring an Ethernet Interface as a Trunk Port 13-19

Interaction with Other Features 13-20

Configuring a Trunk Port 13-20

Defining the Allowed VLANs on a Trunk 13-21

Changing the Pruning-Eligible List 13-23

Configuring the Native VLAN for Untagged Traffic 13-23

Configuring Trunk Ports for Load Sharing 13-24

Load Sharing Using STP Port Priorities 13-24

Load Sharing Using STP Path Cost 13-26

Configuring VMPS 13-27

Understanding VMPS 13-28

Dynamic-Access Port VLAN Membership 13-28

Default VMPS Client Configuration 13-29

Contents

xv

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

VMPS Configuration Guidelines 13-29

Configuring the VMPS Client 13-30

Entering the IP Address of the VMPS 13-30

Configuring Dynamic-Access Ports on VMPS Clients 13-30

Reconfirming VLAN Memberships 13-31

Changing the Reconfirmation Interval 13-31

Changing the Retry Count 13-32

Monitoring the VMPS 13-32

Troubleshooting Dynamic-Access Port VLAN Membership 13-33

VMPS Configuration Example 13-33

CHAPTER

15 Configuring Voice VLAN 15-1

Understanding Voice VLAN 15-1

Cisco IP Phone Voice Traffic 15-2

Cisco IP Phone Data Traffic 15-2

Configuring Voice VLAN 15-3

Default Voice VLAN Configuration 15-3

Voice VLAN Configuration Guidelines 15-3

Configuring a Port Connected to a Cisco 7960 IP Phone 15-4

Configuring Cisco IP Phone Voice Traffic 15-5

Configuring the Priority of Incoming Data Frames 15-6

Displaying Voice VLAN 15-7

CHAPTER

16 Configuring VTP 16-1

Understanding VTP 16-1

The VTP Domain 16-2

VTP Modes 16-3

VTP Advertisements 16-3

VTP Version 2 16-4

VTP Pruning 16-4

Configuring VTP 16-6

Default VTP Configuration 16-6

VTP Configuration Options 16-7

VTP Configuration in Global Configuration Mode 16-7

VTP Configuration in VLAN Database Configuration Mode 16-7

Contents

xvi

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

VTP Configuration Guidelines 16-8

Domain Names 16-8

Passwords 16-8

VTP Version 16-8

Configuration Requirements 16-9

Configuring a VTP Server 16-9

Configuring a VTP Client 16-11

Disabling VTP (VTP Transparent Mode) 16-12

Enabling VTP Version 2 16-13

Enabling VTP Pruning 16-14

Adding a VTP Client Switch to a VTP Domain 16-14

Monitoring VTP 16-16

CHAPTER

14 Configuring Private VLANs 14-1

Understanding Private VLANs 14-1

IP Addressing Scheme with Private VLANs 14-3

Private VLANs across Multiple Switches 14-4

Private-VLAN Interaction with Other Features 14-4

Private VLANs and Unicast, Broadcast, and Multicast Traffic 14-5

Private VLANs and SVIs 14-5

Configuring Private VLANs 14-5

Tasks for Configuring Private VLANs 14-6

Default Private-VLAN Configuration 14-6

Private-VLAN Configuration Guidelines 14-6

Secondary and Primary VLAN Configuration 14-6

Private-VLAN Port Configuration 14-8

Limitations with Other Features 14-8

Configuring and Associating VLANs in a Private VLAN 14-9

Configuring a Layer 2 Interface as a Private-VLAN Host Port 14-11

Configuring a Layer 2 Interface as a Private-VLAN Promiscuous Port 14-12

Mapping Secondary VLANs to a Primary VLAN Layer 3 VLAN Interface 14-13

Monitoring Private VLANs 14-14

CHAPTER

16 Configuring IEEE 802.1Q and Layer 2 Protocol Tunneling 16-1

Understanding IEEE 802.1Q Tunneling 16-1

Configuring IEEE 802.1Q Tunneling 16-4

Default IEEE 802.1Q Tunneling Configuration 16-4

IEEE 802.1Q Tunneling Configuration Guidelines 16-4

Native VLANs 16-4

Contents

xvii

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

System MTU 16-5

IEEE 802.1Q Tunneling and Other Features 16-6

Configuring an IEEE 802.1Q Tunneling Port 16-6

Understanding Layer 2 Protocol Tunneling 16-7

Configuring Layer 2 Protocol Tunneling 16-10

Default Layer 2 Protocol Tunneling Configuration 16-11

Layer 2 Protocol Tunneling Configuration Guidelines 16-11

Configuring Layer 2 Protocol Tunneling 16-12

Configuring Layer 2 Tunneling for EtherChannels 16-14

Configuring the SP Edge Switch 16-14

Configuring the Customer Switch 16-15

Monitoring and Maintaining Tunneling Status 16-17

CHAPTER

17 Configuring STP 17-1

Understanding Spanning-Tree Features 17-1

STP Overview 17-2

Spanning-Tree Topology and BPDUs 17-3

Bridge ID, Switch Priority, and Extended System ID 17-4

Spanning-Tree Interface States 17-4

Blocking State 17-5

Listening State 17-6

Learning State 17-6

Forwarding State 17-6

Disabled State 17-7

How a Switch or Port Becomes the Root Switch or Root Port 17-7

Spanning Tree and Redundant Connectivity 17-8

Spanning-Tree Address Management 17-8

Accelerated Aging to Retain Connectivity 17-8

Spanning-Tree Modes and Protocols 17-9

Supported Spanning-Tree Instances 17-9

Spanning-Tree Interoperability and Backward Compatibility 17-10

STP and IEEE 802.1Q Trunks 17-10

VLAN-Bridge Spanning Tree 17-10

Configuring Spanning-Tree Features 17-11

Default Spanning-Tree Configuration 17-11

Spanning-Tree Configuration Guidelines 17-12

Changing the Spanning-Tree Mode. 17-13

Disabling Spanning Tree 17-14

Configuring the Root Switch 17-14

Contents

xviii

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

Configuring a Secondary Root Switch 17-16

Configuring Port Priority 17-17

Configuring Path Cost 17-18

Configuring the Switch Priority of a VLAN 17-19

Configuring Spanning-Tree Timers 17-20

Configuring the Hello Time 17-20

Configuring the Forwarding-Delay Time for a VLAN 17-21

Configuring the Maximum-Aging Time for a VLAN 17-21

Configuring the Transmit Hold-Count 17-22

Displaying the Spanning-Tree Status 17-22

CHAPTER

18 Configuring MSTP 18-1

Understanding MSTP 18-2

Multiple Spanning-Tree Regions 18-2

IST, CIST, and CST 18-2

Operations Within an MST Region 18-3

Operations Between MST Regions 18-3

IEEE 802.1s Terminology 18-5

Hop Count 18-5

Boundary Ports 18-6

IEEE 802.1s Implementation 18-6

Port Role Naming Change 18-6

Interoperation Between Legacy and Standard Switches 18-7

Detecting Unidirectional Link Failure 18-7

Interoperability with IEEE 802.1D STP 18-8

Understanding RSTP 18-8

Port Roles and the Active Topology 18-9

Rapid Convergence 18-10

Synchronization of Port Roles 18-11

Bridge Protocol Data Unit Format and Processing 18-12

Processing Superior BPDU Information 18-13

Processing Inferior BPDU Information 18-13

Topology Changes 18-13

Configuring MSTP Features 18-14

Default MSTP Configuration 18-14

MSTP Configuration Guidelines 18-15

Specifying the MST Region Configuration and Enabling MSTP 18-16

Configuring the Root Switch 18-17

Configuring a Secondary Root Switch 18-18

Contents

xix

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

Configuring Port Priority 18-19

Configuring Path Cost 18-20

Configuring the Switch Priority 18-21

Configuring the Hello Time 18-22

Configuring the Forwarding-Delay Time 18-23

Configuring the Maximum-Aging Time 18-23

Configuring the Maximum-Hop Count 18-24

Specifying the Link Type to Ensure Rapid Transitions 18-24

Designating the Neighbor Type 18-25

Restarting the Protocol Migration Process 18-25

Displaying the MST Configuration and Status 18-26

CHAPTER

19 Configuring Optional Spanning-Tree Features 19-1

Understanding Optional Spanning-Tree Features 19-1

Understanding Port Fast 19-2

Understanding BPDU Guard 19-2

Understanding BPDU Filtering 19-3

Understanding UplinkFast 19-3

Understanding BackboneFast 19-5

Understanding EtherChannel Guard 19-7

Understanding Root Guard 19-8

Understanding Loop Guard 19-9

Configuring Optional Spanning-Tree Features 19-9

Default Optional Spanning-Tree Configuration 19-9

Optional Spanning-Tree Configuration Guidelines 19-10

Enabling Port Fast 19-10

Enabling BPDU Guard 19-11

Enabling BPDU Filtering 19-12

Enabling UplinkFast for Use with Redundant Links 19-13

Enabling BackboneFast 19-13

Enabling EtherChannel Guard 19-14

Enabling Root Guard 19-15

Enabling Loop Guard 19-15

Displaying the Spanning-Tree Status 19-16

CHAPTER

20 Configuring Flex Links and the MAC Address-Table Move Update Feature 20-1

Understanding Flex Links and the MAC Address-Table Move Update 20-1

Flex Links 20-1

VLAN Flex Link Load Balancing and Support 20-2

Contents

xx

Catalyst 3560 Switch Software Configuration Guide

OL-8553-06

Flex Link Multicast Fast Convergence 20-3

Learning the Other Flex Link Port as the mrouter Port 20-3

Generating IGMP Reports 20-3

Leaking IGMP Reports 20-4

Configuration Examples 20-4

MAC Address-Table Move Update 20-6

Configuring Flex Links and the MAC Address-Table Move Update 20-7

Default Configuration 20-8

Configuration Guidelines 20-8

Configuring Flex Links 20-9

Configuring VLAN Load Balancing on Flex Links 20-11

Configuring the MAC Address-Table Move Update Feature 20-12

Monitoring Flex Links and the MAC Address-Table Move Update 20-14

CHAPTER

21 Configuring DHCP Features and IP Source Guard 21-1

Understanding DHCP Snooping 21-1

DHCP Server 21-2

DHCP Relay Agent 21-2

DHCP Snooping 21-2

Option-82 Data Insertion 21-3

Cisco IOS DHCP Server Database 21-6

DHCP Snooping Binding Database 21-6

Configuring DHCP Snooping 21-8

Default DHCP Snooping Configuration 21-8

DHCP Snooping Configuration Guidelines 21-9

Configuring the DHCP Server 21-10

Configuring the DHCP Relay Agent 21-10

Specifying the Packet Forwarding Address 21-10

Enabling DHCP Snooping and Option 82 21-12

Enabling DHCP Snooping on Private VLANs 21-13

Enabling the Cisco IOS DHCP Server Database 21-14

Enabling the DHCP Snooping Binding Database Agent 21-14

Displaying DHCP Snooping Information 21-15

Understanding IP Source Guard 21-15

Source IP Address Filtering 21-16

Source IP and MAC Address Filtering 21-16

Page is loading ...

Cisco Catalyst 3560V2-48PS Switch User manual

Related papers

Other documents