Catalyst 4500 Series Switch Cisco IOS Command Reference, 12.2(25)SG

interface

To select an interface to configure and to enter interface configuration mode, use the interface command.

interface type number

Syntax Description

Defaults

No interface types are configured.

Command Modes

Global configuration

Command History

Usage Guidelines

Table 2-7 lists the valid values for type.

Examples

This example shows how to enter the interface configuration mode on the Fast Ethernet interface 2/4:

Switch(config)# interface fastethernet2/4

Switch(config)# 

Related Commands

show interfaces

interface port-channel

To access or create a port-channel interface, use the interface port-channel command.

interface port-channel channel-group

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration

Command History

Usage Guidelines

You do not have to create a port-channel interface before assigning a physical interface to a channel group. A port-channel interface is created automatically when the channel group gets its first physical interface, if it is not already created.

You can also create the port channels by entering the interface port-channel command. This will create a Layer 3 port channel. To change the Layer 3 port channel into a Layer 2 port channel, use the switchport command before you assign the physical interfaces to the channel group. A port channel cannot be changed from Layer 3 to Layer 2 or vice versa when it contains member ports.

Only one port channel in a channel group is allowed.

Caution The Layer 3 port-channel interface is the routed interface. Do not enable Layer 3 addresses on the physical Fast Ethernet interfaces.

If you want to use CDP, you must configure it only on the physical Fast Ethernet interface and not on the port-channel interface.

Examples

This example creates a port-channel interface with a channel-group number of 64:

Switch(config)# interface port-channel 64

Switch(config)# 

Related Commands

channel-group
show etherchannel

interface range

To run a command on multiple ports at the same time, use the interface range command.

interface range {vlan vlan_id - vlan_id} {port-range | macro name}

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration

Interface configuration

Command History

Usage Guidelines

You can use the interface range command on the existing VLAN SVIs only. To display the VLAN SVIs, enter the show running config command. The VLANs that are not displayed cannot be used in the interface range command.

The values that are entered with the interface range command are applied to all the existing VLAN SVIs.

Before you can use a macro, you must define a range using the define interface-range command.

All configuration changes that are made to a port range are saved to NVRAM, but the port ranges that are created with the interface range command do not get saved to NVRAM.

You can enter the port range in two ways:

•Specifying up to five port ranges

•Specifying a previously defined macro

You can either specify the ports or the name of a port-range macro. A port range must consist of the same port type, and the ports within a range cannot span the modules.

You can define up to five port ranges on a single command; separate each range with a comma.

When you define a range, you must enter a space between the first port and the hyphen (-):

interface range gigabitethernet 5/1 -20, gigabitethernet4/5 -20.

Use these formats when entering the port-range:

•interface-type {mod}/{first-port} - {last-port}

•interface-type {mod}/{first-port} - {last-port}

Valid values for interface-type are as follows:

•FastEthernet

•GigabitEthernet

•Vlan vlan_id

You cannot specify both a macro and an interface range in the same command. After creating a macro, you can enter additional ranges. If you have already entered an interface range, the CLI does not allow you to enter a macro.

You can specify a single interface in the port-range value. This makes the command similar to the interface interface-number command.

Examples

This example shows how to use the interface range command to interface to FE 5/18 - 20:

Switch(config)# interface range fastethernet 5/18 - 20

Switch(config-if)# 

This command shows how to run a port-range macro:

Switch(config)# interface range macro macro1

Switch(config-if)# 

Related Commands

define interface-range
show running config (refer to Cisco IOS documentation)

interface vlan

To create or access a Layer 3 switch virtual interface (SVI), use the interface vlan command. To delete an SVI, use the no form of this command.

interface vlan vlan_id

no interface vlan vlan_id

Syntax Description

Defaults

Fast EtherChannel is not specified.

Command Modes

Global configuration

Command History

Usage Guidelines

The SVIs are created the first time that you enter the interface vlan vlan_id command for a particular VLAN. The vlan_id value corresponds to the VLAN tag that is associated with the data frames on an ISL or 802.1Q-encapsulated trunk or the VLAN ID that is configured for an access port. A message is displayed whenever a VLAN interface is newly created, so you can check that you entered the correct VLAN number.

If you delete an SVI by entering the no interface vlan vlan_id command, the associated interface is forced into an administrative down state and marked as deleted. The deleted interface will no longer be visible in a show interface command.

You can reinstate a deleted SVI by entering the interface vlan vlan_id command for the deleted interface. The interface comes back up, but much of the previous configuration will be gone.

Examples

This example shows the output when you enter the interface vlan vlan_id command for a new VLAN number:

Switch(config)# interface vlan 23

% Creating new VLAN interface.

Switch(config)# 

ip arp inspection filter vlan

To permit ARPs from hosts that are configured for static IP when DAI is enabled and to define an ARP access list and apply it to a VLAN, use the ip arp inspection filter vlan command. To disable this application, use the no form of this command.

ip arp inspection filter arp-acl-name vlan vlan-range [static]

no ip arp inspection filter arp-acl-name vlan vlan-range [static]

Syntax Description

Defaults

No defined ARP ACLs are applied to any VLAN.

Command Modes

Configuration

Command History

Usage Guidelines

When an ARP access control list is applied to a VLAN for dynamic ARP inspection, the ARP packets containing only the IP-to-Ethernet MAC bindings are compared against the ACLs. All other packet types are bridged in the incoming VLAN without validation.

This command specifies that the incoming ARP packets are compared against the ARP access control list, and the packets are permitted only if the access control list permits them.

If the access control lists deny the packets because of explicit denies, the packets are dropped. If the packets are denied because of an implicit deny, they are then matched against the list of DHCP bindings if the ACL is not applied statically.

Examples

This example shows how to apply the ARP ACL "static-hosts" to VLAN 1 for DAI:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip arp inspection filter static-hosts vlan 1

Switch(config)# end

Switch#

Switch# show ip arp inspection vlan 1

Source Mac Validation      : Enabled

Destination Mac Validation : Disabled

IP Address Validation      : Disabled

 Vlan     Configuration    Operation   ACL Match          Static ACL

 ----     -------------    ---------   ---------          ----------

    1     Enabled          Active      static-hosts      No 

 Vlan     ACL Logging      DHCP Logging

 ----     -----------      ------------

    1     Acl-Match        Deny  

Switch#

Related Commands

arp access-list
show ip arp inspection

ip arp inspection limit (interface)

To limit the rate of incoming ARP requests and responses on an interface and prevent DAI from consuming all of the system's resources in the event of a DoS attack, use the ip arp inspection limit command. To release the limit, use the no form of this command.

ip arp inspection limit {rate pps | none} [burst interval seconds]

no ip arp inspection limit

Syntax Description

Defaults

The rate is set to 15 packets per second on the untrusted interfaces, assuming that the network is a switched network with a host connecting to as many as 15 new hosts per second.

The rate is unlimited on all the trusted interfaces.

The burst interval is set to 1 second by default.

Command Modes

Interface

Command History

Usage Guidelines

The trunk ports should be configured with higher rates to reflect their aggregation. When the rate of the incoming packets exceeds the user-configured rate, the interface is placed into an error-disabled state. The error-disable timeout feature can be used to remove the port from the error-disabled state. The rate applies to both the trusted and nontrusted interfaces. Configure appropriate rates on trunks to handle the packets across multiple DAI-enabled VLANs or use the none keyword to make the rate unlimited.

The rate of the incoming ARP packets onthe channel ports is equal to the sum of the incoming rate of packets from all the channel members. Configure the rate limit for the channel ports only after examining the rate of the incoming ARP packets on the channel members.

After a switch receives more than the configured rate of packets every second consecutively over a period of burst seconds, the interface is placed into an error-disabled state.

Examples

This example shows how to limit the rate of the incoming ARP requests to 25 packets per second:

Switch# config terminal

Switch(config)# interface fa6/3

Switch(config-if)# ip arp inspection limit rate 25

Switch(config-if)# end

Switch# show ip arp inspection interfaces fastEthernet 6/3

Interface        Trust State     Rate (pps)

 ---------------  -----------     ----------

 Fa6/3            Trusted                 25

Switch#

This example shows how to limit the rate of the incoming ARP requests to 20 packets per second and to set the interface monitoring interval to 5 consecutive seconds:

Switch# config terminal

Switch(config)# interface fa6/1

Switch(config-if)# ip arp inspection limit rate 20 burst interval 5

Switch(config-if)# end

Related Commands

show ip arp inspection

ip arp inspection log-buffer

To configure the parameters that are associated with the logging buffer, use the ip arp inspection log-buffer command. To disable the parameters, use the no form of this command.

ip arp inspection log-buffer {entries number | logs number interval seconds}

no ip arp inspection log-buffer {entries | logs}

Syntax Description

Defaults

When dynamic ARP inspection is enabled, denied, or dropped, the ARP packets are logged.

The number of entries is set to 32.

The number of logging entries is limited to 5 per second.

The interval is set to 1.

Command Modes

Configuration

Command History

Usage Guidelines

The first dropped packet of a given flow is logged immediately. The subsequent packets for the same flow are registered but are not logged immediately. Registering these packets is done in a log buffer that is shared by all the VLANs. Entries from this buffer are logged on a rate-controlled basis.

Examples

This example shows how to configure the logging buffer to hold up to 45 entries:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip arp inspection log-buffer entries 45

Switch(config)# end

Switch# show ip arp inspection log 

Total Log Buffer Size : 45

Syslog rate : 5 entries per 1 seconds.

No entries in log buffer.

Switch#

This example shows how to configure the logging rate to 10 logs per 3 seconds:

Switch(config)# ip arp inspection log-buffer logs 10 interval 3

Switch(config)# end

Switch# show ip arp inspection log

Total Log Buffer Size : 45

Syslog rate : 10 entries per 3 seconds.

No entries in log buffer.

Switch# 

Related Commands

arp access-list
show ip arp inspection

ip arp inspection trust

To set a per-port configurable trust state that determines the set of interfaces where incoming ARP packets are inspected, use the ip arp inspection trust command. To make the interfaces untrusted, use the no form of this command.

ip arp inspection trust

no ip arp inspection trust

Syntax Description

This command has no arguments or keywords.

Defaults

None

Command Modes

Interface

Command History

Examples

This example shows how to configure an interface to be trusted:

Switch# config terminal

Switch(config)# interface fastEthernet 6/3

Switch(config-if)# ip arp inspection trust 

Switch(config-if)# end

To verify the configuration, use the show form of this command:

Switch# show ip arp inspection interfaces fastEthernet 6/3

 Interface        Trust State     Rate (pps)

 ---------------  -----------     ----------

 Fa6/3            Trusted               None

Switch#

Related Commands

show ip arp inspection

ip arp inspection validate

To perform specific checks for ARP inspection, use the ip arp inspection validate command. To disable checks, use the no form of this command.

ip arp inspection validate [src-mac] [dst-mac] [ip]

no ip arp inspection validate [src-mac] [dst-mac] [ip]

Syntax Description

Defaults

Checks are disabled.

Command Modes

Configuration

Command History

Usage Guidelines

When enabling the checks, specify at least one of the keywords (src-mac, dst-mac, and ip) on the command line. Each command overrides the configuration of the previous command. If a command enables src and dst mac validations, and a second command enables IP validation only, the src and dst mac validations are disabled as a result of the second command.

The no form of this command disables only the specified checks. If none of the check options are enabled, all the checks are disabled.

Examples

This example show how to enable the source MAC validation:

Switch(config)# ip arp inspection validate src-mac 

Switch(config)# end

Switch# show ip arp inspection vlan 1

Source Mac Validation      : Enabled

Destination Mac Validation : Disabled

IP Address Validation      : Disabled

 Vlan     Configuration    Operation   ACL Match          Static ACL

 ----     -------------    ---------   ---------          ----------

    1     Enabled          Active                        

 Vlan     ACL Logging      DHCP Logging

 ----     -----------      ------------

    1     Deny             Deny 

Switch#

Related Commands

arp access-list
show arp access-list

ip arp inspection vlan

To enable dynamic ARP inspection (DAI) on a per-VLAN basis, use the ip arp inspection vlan command. To disable DAI, use the no form of this command.

ip arp inspection vlan vlan-range

no ip arp inspection vlan vlan-range

Syntax Description

Defaults

ARP inspection is disabled on all VLANs.

Command Modes

Configuration

Command History

Usage Guidelines

You must specify on which VLANs to enable DAI. DAI may not function on the configured VLANs if they have not been created or if they are private.

Examples

This example shows how to enable DAI on VLAN 1:

Switch(config)# ip arp inspection vlan 1

Switch(config)# end

Switch# show ip arp inspection vlan 1

Source Mac Validation      : Disabled

Destination Mac Validation : Disabled

IP Address Validation      : Disabled

Vlan     Configuration    Operation   ACL Match          Static ACL

 ----     -------------    ---------   ---------          ----------

    1     Enabled          Active                        

Vlan     ACL Logging      DHCP Logging

 ----     -----------      ------------

    1     Deny             Deny  

Switch# 

Related Commands

arp access-list
show ip arp inspection

ip arp inspection vlan logging

To control the type of packets that are logged, use the ip arp inspection vlan logging command. To disable this logging control, use the no form of this command.

ip arp inspection vlan vlan-range logging {acl-match {matchlog | none} | dhcp-bindings {permit | all | none}}

no ip arp inspection vlan vlan-range logging {acl-match | dhcp-bindings}

Syntax Description

Defaults

All denied or dropped packets are logged.

Command Modes

Configuration

Command History

Usage Guidelines

The acl-match and dhcp-bindings keywords merge with each other. When you set an ACL match configuration, the DHCP bindings configuration is not disabled. You can use the no form of this command to reset some of the logging criteria to their defaults. If you do not specify either option, all the logging types are reset to log on when the ARP packets are denied. The two options that are available to you are as follows:

•acl-match—Logging on ACL matches is reset to log on deny

•dhcp-bindings—Logging on DHCP binding compared is reset to log on deny

Examples

This example shows how to configure an ARP inspection on VLAN 1 to add packets to a log on matching against the ACLs with the logging keyword:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip arp inspection vlan 1 logging acl-match matchlog 

Switch(config)# end

Switch# show ip arp inspection vlan 1

Source Mac Validation      : Enabled

Destination Mac Validation : Disabled

IP Address Validation      : Disabled

 Vlan     Configuration    Operation   ACL Match          Static ACL

 ----     -------------    ---------   ---------          ----------

    1     Enabled          Active                        

 Vlan     ACL Logging      DHCP Logging

 ----     -----------      ------------

    1     Acl-Match        Deny  

Switch#

Related Commands

arp access-list
show ip arp inspection

ip cef load-sharing algorithm

To configure the load-sharing hash function so that the source TCP/UDP port, the destination TCP/UDP port, or both ports can be included in the hash in addition to the source and destination IP addresses, use the ip cef load-sharing algorithm command. To revert back to the default, which does not include the ports, use the no form of this command.

ip cef load-sharing algorithm {include-ports {source source | destination dest} | original | tunnel | universal}

no ip cef load-sharing algorithm {include-ports {source source | destination dest} | original | tunnel | universal}

Syntax Description

Defaults

Default load-sharing algorithm is disabled.

Note This option does not include the source or destination port in the load-balancing hash.

Command Modes

Global configuration

Command History

Usage Guidelines

The original algorithm, tunnel algorithm, and universal algorithm are routed through the hardware. For software-routed packets, the algorithms are handled by the software. The include-ports option does not apply to the software-switched traffic.

Examples

This example shows how to configure the IP CEF load-sharing algorithm that includes Layer 4 ports:

Switch(config)# ip cef load-sharing algorithm include-ports

Switch(config)# 

This example shows how to configure the IP CEF load-sharing algorithm that includes Layer 4 tunneling ports:

Switch(config)# ip cef load-sharing algorithm include-ports tunnel

Switch(config)# 

Related Commands

show ip cef vlan

ip dhcp snooping

To enable DHCP snooping globally, use the ip dhcp snooping command. To disable DHCP snooping, use the no form of this command.

ip dhcp snooping

no ip dhcp snooping

Syntax Description

This command has no arguments or keywords.

Defaults

DHCP snooping is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

You must enable DHCP snooping globally before you can use DHCP snooping on a VLAN.

Examples

This example shows how to enable DHCP snooping:

Switch(config)# ip dhcp snooping

Switch(config)# 

This example shows how to disable DHCP snooping:

Switch(config)# no ip dhcp snooping 

Switch(config)# 

Related Commands

ip dhcp snooping information option
ip dhcp snooping limit rate
ip dhcp snooping trust
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping binding

ip dhcp snooping binding

To set up and generate a DHCP binding configuration to restore bindings across reboots, use the ip dhcp snooping binding command. To disable the binding configuration, use the no form of this command.

ip dhcp snooping binding mac-address vlan vlan-# ip-address interface interface expiry seconds

no ip dhcp snooping binding mac-address vlan vlan-# ip-address interface interface

Syntax Description

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

Whenever a binding is added or removed using this command, the binding database is marked as changed and a write is initiated.

Examples

This example shows how to generate a DHCP binding configuration on interface gigabitethernet1/1 in VLAN 1 with an expiration time of 1000 seconds:

Switch# ip dhcp snooping binding 0001.1234.1234 vlan 1 172.20.50.5 interface gi1/1 expiry 1000

Switch#

Related Commands

ip dhcp snooping
ip dhcp snooping information option
ip dhcp snooping trust
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping binding

ip dhcp snooping database

To store the bindings that are generated by DHCP snooping, use the ip dhcp snooping database command. To either reset the timeout, reset the write-delay, or delete the agent specified by the URL, use the no form of this command.

ip dhcp snooping database {url | timeout seconds | write-delay seconds}

no ip dhcp snooping database {timeout | write-delay}

Syntax Description

Defaults

The timeout value is set to 300 seconds (5 minutes).

The write-delay value is set to 300 seconds.

Command Modes

Interface configuration

Command History

Usage Guidelines

You need to create an empty file at the configured URL on network-based URLs (such as TFTP and FTP) before the switch can write the set of bindings for the first time at the URL.

Note Because both NVRAM and bootflash have limited storage capacity, using TFTP or network-based files is recommended . If you use flash to store the database file, new updates (by the agent) result in the creation of new files (flash fills quickly). In addition, due to the nature of the filesystem used on the flash, a large number of files cause access to be considerably slowed. When a file is stored in a remote location accessible through TFTP, an RPR/SSO standby supervisor engine can take over the binding list when a switchover occurs.

Examples

This example shows how to store a database file with the IP address 10.1.1.1 within a directory called directory. A file named file must be present on the TFTP server.

Switch# config terminal

Switch(config)# ip dhcp snooping database tftp://10.1.1.1/directory/file

Switch(config)# end

Switch# show ip dhcp snooping database 

Agent URL : tftp://10.1.1.1/directory/file

Write delay Timer : 300 seconds

Abort Timer : 300 seconds

Agent Running : Yes

Delay Timer Expiry : Not Running

Abort Timer Expiry : Not Running

Last Succeded Time : None

Last Failed Time : None

Last Failed Reason : No failure recorded.

Total Attempts       :        1   Startup Failures :        0

Successful Transfers :        0   Failed Transfers :        0

Successful Reads     :        0   Failed Reads     :        0

Successful Writes    :        0   Failed Writes    :        0

Media Failures       :        0

Switch#

Related Commands

ip dhcp snooping
ip dhcp snooping binding
ip dhcp snooping information option
ip dhcp snooping trust
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping binding

ip dhcp snooping information option

To enable DHCP option 82 data insertion, use the ip dhcp snooping information option command. To disable DHCP option 82 data insertion, use the no form of this command.

ip dhcp snooping information option

no ip dhcp snooping information option

Syntax Description

This command has no arguments or keywords.

Defaults

DHCP option 82 data insertion is enabled.

Command Modes

Global configuration

Command History

Examples

This example shows how to enable DHCP option 82 data insertion:

Switch(config)# ip dhcp snooping information option

Switch(config)# 

This example shows how to disable DHCP option 82 data insertion:

Switch(config)# no ip dhcp snooping information option

Switch(config)# 

Related Commands

ip dhcp snooping
ip dhcp snooping limit rate
ip dhcp snooping trust
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping binding

ip dhcp snooping information option allow-untrusted

To allow DHCP packets with option 82 data inserted to be received from a snooping untrusted port, use the ip dhcp snooping information option allow-untrusted command. To disallow receipt of these DHCP packets, use the no form of this command.

ip dhcp snooping information option allow-untrusted

no ip dhcp snooping information option allow-untrusted

Syntax Description

This command has no arguments or keywords.

Defaults

DHCP packets with option 82 are not allowed on snooping untrusted ports.

Command Modes

Global configuration

Command History

Examples

This example shows how to allow DHCP packets with option 82 data inserted to be received from a snooping untrusted port:

Switch# configure terminal 

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# ip dhcp snooping information option allow-untrusted

Switch(config)# end

Switch#

Related Commands

ip dhcp snooping
ip dhcp snooping limit rate
ip dhcp snooping trust
ip dhcp snooping vlan
ip dhcp snooping information option
show ip dhcp snooping
show ip dhcp snooping binding

ip dhcp snooping limit rate

To configure the number of the DHCP messages that an interface can receive per second, use the ip dhcp snooping limit rate command. To disable the DHCP snooping rate limiting, use the no form of this command.

ip dhcp snooping limit rate rate

no ip dhcp snooping limit rate

Syntax Description

Defaults

DHCP snooping rate limiting is disabled.

Command Modes

Interface configuration

Command History

Usage Guidelines

Typically, the rate limit applies to the untrusted interfaces. If you want to set up rate limiting for the trusted interfaces, note that the trusted interfaces aggregate all DHCP traffic in the switch, and you will need to adjust the rate limit of the interfaces to a higher value.

Examples

This example shows how to enable the DHCP message rate limiting:

Switch(config-if)# ip dhcp snooping limit rate 150

Switch(config)# 

This example shows how to disable the DHCP message rate limiting:

Switch(config-if)# no ip dhcp snooping limit rate

Switch(config)# 

Related Commands

ip dhcp snooping
ip dhcp snooping information option
ip dhcp snooping trust
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping binding

ip dhcp snooping trust

To configure an interface as trusted for DHCP snooping purposes, use the ip dhcp snooping trust command. To configure an interface as untrusted, use the no form of this command.

ip dhcp snooping trust

no ip dhcp snooping trust

Syntax Description

This command has no arguments or keywords.

Defaults

DHCP snooping trust is disabled.

Command Modes

Interface configuration

Command History

Examples

This example shows how to enable DHCP snooping trust on an interface:

Switch(config-if)# ip dhcp snooping trust

Switch(config)# 

This example shows how to disable DHCP snooping trust on an interface:

Switch(config-if)# no ip dhcp snooping trust

Switch(config)# 

Related Commands

ip dhcp snooping
ip dhcp snooping information option
ip dhcp snooping limit rate
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping binding

ip dhcp snooping vlan

Use the ip dhcp snooping vlan command to enable DHCP snooping on a VLAN. To disable DHCP snooping on a VLAN, use the no form of this command.

ip dhcp snooping [vlan number]

no ip dhcp snooping [vlan number]

Syntax Description

Defaults

DHCP snooping is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

DHCP snooping is enabled on a VLAN only if both the global snooping and the VLAN snooping are enabled.

Examples

This example shows how to enable DHCP snooping on a VLAN:

Switch(config)# ip dhcp snooping vlan 10

Switch(config)# 

This example shows how to disable DHCP snooping on a VLAN:

Switch(config)# no ip dhcp snooping vlan 10

Switch(config)# 

This example shows how to enable DHCP snooping on a group of VLANs:

Switch(config)# ip dhcp snooping vlan 10 55

Switch(config)# 

This example shows how to disable DHCP snooping on a group of VLANs:

Switch(config)# no ip dhcp snooping vlan 10 55

Switch(config)# 

Related Commands

ip dhcp snooping
ip dhcp snooping information option
ip dhcp snooping limit rate
ip dhcp snooping trust
show ip dhcp snooping
show ip dhcp snooping binding

ip igmp filter

To control whether all hosts on a Layer 2 interface can join one or more IP multicast groups by applying an IGMP profile to the interface, use the ip igmp filter command. To remove a profile from the interface, use the no form of this command.

ip igmp filter profile number

no ip igmp filter

Syntax Description

Defaults

Profiles are not applied.

Command Modes

Interface configuration

Command History

Usage Guidelines

You can apply IGMP filters only to Layer 2 physical interfaces; you cannot apply IGMP filters to routed ports, switch virtual interfaces (SVIs), or ports that belong to an EtherChannel group.

An IGMP profile can be applied to one or more switch port interfaces, but one port can have only one profile applied to it.

Examples

This example shows how to apply IGMP profile 22 to an interface.

Switch(config)# interface gigabitethernet1/1

Switch(config-if)# ip igmp filter 22

Switch(config-if)# 

Related Commands

ip igmp profile
show ip igmp profile

ip igmp max-groups

To set the maximum number of IGMP groups that a Layer 2 interface can join, use the ip igmp max-groups command. To set the maximum back to the default, use the no form of this command.

ip igmp max-groups number

no ip igmp max-groups

Syntax Description

Defaults

No maximum limit.

Command Modes

Interface configuration

Command History

Usage Guidelines

You can use the ip igmp max-groups command only on Layer 2 physical interfaces; you cannot set the IGMP maximum groups for the routed ports, the switch virtual interfaces (SVIs), or the ports that belong to an EtherChannel group.

Examples

This example shows how to limit the number of IGMP groups that an interface can join to 25:

Switch(config)# interface gigabitethernet1/1

Switch(config-if)# ip igmp max-groups 25

Switch(config-if)

ip igmp profile

To create an IGMP profile, use the ip igmp profile command. To delete the IGMP profile, use the no form of this command.

ip igmp profile profile number

no ip igmp profile profile number

Syntax Description

Defaults

No profile created.

Command Modes

Global configuration

IGMP profile configuration

Command History

Usage Guidelines

When entering a range, enter the low IP multicast address, a space, and the high IP multicast address.

You can apply an IGMP profile to one or more Layer 2 interfaces, but each interface can have only one profile applied to it.

Examples

This example shows how to configure IGMP profile 40 that permits the specified range of IP multicast addresses:

Switch # config terminal

Switch(config)# ip igmp profile 40

Switch(config-igmp-profile)# permit

Switch(config-igmp-profile)# range 233.1.1.1 233.255.255.255

Switch(config-igmp-profile)# 

Related Commands

ip igmp filter
show ip igmp profile

ip igmp query-interval

To configure the frequency that the switch sends the IGMP host-query messages, use the ip igmp query-interval command. To return to the default frequency, use the no form of this command.

ip igmp query-interval seconds

no ip igmp query-interval

Syntax Description

Defaults

The query interval is set to 60 seconds.

Command Modes

Interface configuration

Command History

Usage Guidelines

If you use the default IGMP snooping configuration, the valid query interval values are from 1 to 65535 seconds. If you have changed the default configuration to support CGMP as the IGMP snooping learning method, the valid query interval values are from 1 to 300 seconds.

The designated switch for a LAN is the only switch that sends the IGMP host-query messages. For IGMP version 1, the designated switch is elected according to the multicast routing protocol that runs on the LAN. For IGMP version 2, the designated querier is the lowest IP-addressed multicast switch on the subnet.

If no queries are heard for the timeout period (controlled by the ip igmp query-timeout command), the switch becomes the querier.

Note Changing the timeout period may severely impact multicast forwarding.

Examples

This example shows how to change the frequency at which the designated switch sends the IGMP host-query messages:

Switch(config-if)# ip igmp query-interval 120

Switch(config-if)# 

Related Commands

ip igmp query-timeout (refer to Cisco IOS documentation)
ip pim query-interval (refer to Cisco IOS documentation)
show ip igmp groups (refer to Cisco IOS documentation)

ip igmp snooping

To enable IGMP snooping, use the ip igmp snooping command. To disable IGMP snooping, use the no form of this command.

ip igmp snooping [tcn {flood query count count | query solicit}]

no ip igmp snooping [tcn {flood query count count | query solicit}]

Syntax Description

Defaults

IGMP snooping is enabled.

Command Modes

Global configuration

Interface configuration

Command History

Usage Guidelines

The tcn flood option applies only to Layer 2 switch ports and EtherChannels; it does not apply to routed ports, VLAN interfaces, or Layer 3 channels.

The ip igmp snooping command is disabled by default on multicast routers.

Note You can use the tcn flood option in interface configuration mode.

Examples

This example shows how to enable IGMP snooping:

Switch(config)# ip igmp snooping

Switch(config)# 

This example shows how to disable IGMP snooping:

Switch(config)# no ip igmp snooping

Switch(config)# 

This example shows how to enable the flooding of the spanning-tree table to the network after nine topology changes have occurred:

Switch(config)# ip igmp snooping tcn flood query count 9

Switch(config)# 

This example shows how to disable the flooding of the spanning-tree table to the network:

Switch(config)# no ip igmp snooping tcn flood

Switch(config)# 

This example shows how to enable an IGMP general query:

Switch(config)# ip igmp snooping tcn query solicit

Switch(config)# 

This example shows how to disable an IGMP general query:

Switch(config)# no ip igmp snooping tcn query solicit

Switch(config)# 

Related Commands

ip igmp snooping vlan immediate-leave
ip igmp snooping vlan mrouter
ip igmp snooping vlan static

ip igmp snooping report-suppression

To enable report suppression, use the ip igmp snooping report-suppression command. To disable report suppression and forward the reports to the multicast devices, use the no form of this command.

ip igmp snooping report-suppression

no igmp snooping report-suppression

Syntax Description

This command has no arguments or keywords.

Defaults

IGMP snooping report-suppression is enabled.

Command Modes

Global configuration

Command History

Usage Guidelines

If the ip igmp snooping report-suppression command is disabled, all the IGMP reports are forwarded to the multicast devices.

If the command is enabled, report suppression is done by IGMP snooping.

Examples

This example shows how to enable report suppression:

Switch(config)# ip igmp snooping report-suppression

Switch(config)# 

This example shows how to disable report suppression:

Switch(config)# no ip igmp snooping report-suppression

Switch(config)# 

This example shows how to display the system status for report suppression:

Switch# show ip igmp snoop

vlan 1

----------

 IGMP snooping is globally enabled

 IGMP snooping TCN solicit query is globally disabled

 IGMP snooping global TCN flood query count is 2

 IGMP snooping is enabled on this Vlan

 IGMP snooping immediate-leave is disabled on this Vlan

 IGMP snooping mrouter learn mode is pim-dvmrp on this Vlan

 IGMP snooping is running in IGMP_ONLY mode on this Vlan

 IGMP snooping report suppression is enabled on this Vlan 

Switch# 

Related Commands

ip igmp snooping vlan immediate-leave
ip igmp snooping vlan mrouter
ip igmp snooping vlan static

ip igmp snooping vlan

To enable IGMP snooping for a VLAN, use the ip igmp snooping vlan command. To disable IGMP snooping, use the no form of this command.

ip igmp snooping vlan vlan-id

no ip igmp snooping vlan vlan-id

Syntax Description

Defaults

IGMP snooping is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

Before you can enable IGMP snooping on the Catalyst 4006 switches, you must configure the VLAN interface for multicast routing.

This command is entered in VLAN interface configuration mode only.

The ip igmp snooping vlan command is disabled by default on multicast routers.

Examples

This example shows how to enable IGMP snooping on a VLAN:

Switch(config)# ip igmp snooping vlan 200

Switch(config)# 

This example shows how to disable IGMP snooping on a VLAN:

Switch(config)# no ip igmp snooping vlan 200

Switch(config)# 

Related Commands

ip igmp snooping vlan immediate-leave
ip igmp snooping vlan mrouter
ip igmp snooping vlan static

ip igmp snooping vlan explicit-tracking

To enable per-VLAN explicit host tracking, use the ip igmp snooping vlan explicit-tracking command. To disable explicit host tracking, use the no form of this command.

ip igmp snooping vlan vlan-id explicit-tracking

no ip igmp snooping vlan vlan-id explicit-tracking

Syntax Description

Defaults

Explicit host tracking is enabled.

Command Modes

Configuration

Command History

Examples

This example shows how to disable IGMP explicit host tracking on interface VLAN 200 and how to verify the configuration:

Switch(config)# no ip igmp snooping vlan 200 explicit-tracking 

Switch(config)# end 

Switch# show ip igmp snooping vlan 200 | include explicit tracking

Global IGMP Snooping configuration:

-----------------------------------

IGMP snooping             : Enabled

IGMPv3 snooping           : Enabled

Report suppression        : Enabled

TCN solicit query         : Disabled

TCN flood query count     : 2

Vlan 2:

--------

IGMP snooping                  : Enabled

IGMPv2 immediate leave         : Disabled

Explicit host tracking         : Disabled

Multicast router learning mode : pim-dvmrp

CGMP interoperability mode     : IGMP_ONLY

Explicit host tracking         : Disabled

Switch#

Related Commands

show ip igmp snooping membership
clear ip igmp snooping statistics vlan (refer to Cisco IOS documentation)
show ip igmp snooping statistics vlan (refer to Cisco IOS documentation)

ip igmp snooping vlan immediate-leave

To enable IGMP immediate-leave processing, use the ip igmp snooping vlan immediate-leave command. To disable immediate-leave processing, use the no form of this command.

ip igmp snooping vlan vlan_num immediate-leave

no ip igmp snooping vlan vlan_num immediate-leave

Syntax Description

Defaults

Immediate leave processing is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

You enter this command in global configuration mode only.

Use the immediate-leave feature only when there is a single receiver for the MAC group for a specific VLAN.

The immediate-leave feature is supported only with IGMP version 2 hosts.

Examples

This example shows how to enable IGMP immediate-leave processing on VLAN 4:

Switch(config)# ip igmp snooping vlan 4 immediate-leave

Switch(config)# 

This example shows how to disable IGMP immediate-leave processing on VLAN 4:

Switch(config)# no ip igmp snooping vlan 4 immediate-leave

Switch(config)# 

Related Commands

ip igmp snooping
ip igmp snooping vlan mrouter
ip igmp snooping vlan static
show ip igmp interface (refer to Cisco IOS documentation)
show mac-address-table multicast

ip igmp snooping vlan mrouter

To statically configure an Layer 2 interface as a multicast router interface for a VLAN, use the
ip igmp snooping vlan mrouter command. To remove the configuration, use the no form of this command.

ip igmp snooping vlan vlan-id mrouter {interface {{fastethernet slot/port} | {gigabitethernet slot/port} | {tengigabitethernet slot/port} | {port-channel number}} |
{learn {cgmp | pim-dvmrp}}

noip igmp snooping vlan vlan-id mrouter {interface {{fastethernet slot/port} | {gigabitethernet slot/port} | {tengigabitethernet slot/port} | {port-channel number}} |
{learn {cgmp | pim-dvmrp}}

Syntax Description

Defaults

Multicast switch snooping PIM-DVMRP packets are specified.

Command Modes

Interface configuration

Command History

Usage Guidelines

You enter this command in VLAN interface configuration mode only.

The interface to the switch must be in the VLAN where you are entering the command. It must be both administratively up and line protocol up.

The CGMP learning method can decrease control traffic.

The learning method that you configure is saved in NVRAM.

The static connections to multicast interfaces are supported only on switch interfaces.

Examples

This example shows how to specify the next-hop interface to a multicast switch:

Switch(config-if)# ip igmp snooping 400 mrouter interface fastethernet 5/6

Switch(config-if)# 

This example shows how to specify the multicast switch learning method:

Switch(config-if)# ip igmp snooping 400 mrouter learn cgmp

Switch(config-if)# 

Related Commands

ip igmp snooping
ip igmp snooping vlan immediate-leave
ip igmp snooping vlan static
show ip igmp snooping
show ip igmp snooping mrouter

ip igmp snooping vlan static

To configure a Layer 2 interface as a member of a group, use the ip igmp snooping vlan static command. To remove the configuration, use the no form of this command.

ip igmp snooping vlan vlan_num static mac-address {interface {fastethernet slot/port} | {gigabitethernet slot/port} | {tengigabitethernet slot/port} | {port-channel number}}

no ip igmp snooping vlan vlan_num static mac-address {interface {fastethernet slot/port} | {gigabitethernet slot/port} | {tengigabitethernet mod/interface-number} | {port-channel number}}

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration

Command History

Examples

This example shows how to configure a host statically on an interface:

Switch(config)# ip igmp snooping vlan 4 static 0100.5e02.0203 interface fastethernet 5/11

Configuring port FastEthernet5/11 on group 0100.5e02.0203 vlan 4

Switch(config)# 

Related Commands

ip igmp snooping
ip igmp snooping vlan immediate-leave
ip igmp snooping vlan mrouter
show mac-address-table multicast

ip local-proxy-arp

To enable the local proxy ARP feature, use the ip local-proxy-arp command. To disable the local proxy ARP feature, use the no form of this command.

ip local-proxy-arp

no ip local-proxy-arp

Syntax Description

This command has no arguments or keywords.

Defaults

Local proxy ARP is disabled.

Command Modes

Interface configuration

Command History

Usage Guidelines

Use this feature only on subnets where hosts are intentionally prevented from communicating directly to the switch on which they are connected.

ICMP redirect is disabled on interfaces where the local proxy ARP feature is enabled.

Examples

This example shows how to enable the local proxy ARP feature:

Switch(config-if)# ip local-proxy-arp

Switch(config-if)# 

ip mfib fastdrop

To enable MFIB fast drop, use the ip mfib fastdrop command. To disable MFIB fast drop, use the no form of this command.

ip mfib fastdrop

no ip mfib fastdrop

Syntax Description

This command has no arguments or keywords.

Defaults

MFIB fast drop is enabled.

Command Modes

EXEC

Command History

Examples

This example shows how to enable MFIB fast drops:

Switch# ip mfib fastdrop

Switch#

Related Commands

clear ip mfib fastdrop
show ip mfib fastdrop

ip route-cache flow

To enable NetFlow statistics for IP routing, use the ip route-cache flow command. To disable NetFlow statistics, use the no form of this command.

ip route-cache flow [infer-fields]

no ip route-cache flow [infer-fields]

Syntax Description

Defaults

NetFlow statistics is disabled.

Inferred information is excluded.

Command Modes

Configuration

Command History

Usage Guidelines

To use these commands, you need to install the Supervisor Engine IV and the NetFlow Service Card.

The NetFlow statistics feature captures a set of traffic statistics. These traffic statistics include the source IP address, destination IP address, Layer 4 port information, protocol, input and output identifiers, and other routing information that can be used for network analysis, planning, accounting, billing and identifying DoS attacks.

NetFlow switching is supported on IP and IP-encapsulated traffic over all interface types.

If you enter the ip route-cache flow infer-fields command after the ip route-cache flow command, you will purge the existing cache, and vice versa. This action is done to avoid having flows with and without inferred fields in the cache simultaneously.

For additional information on NetFlow switching, refer to the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.

Note NetFlow consumes additional memory and CPU resources compared to other switching modes. You need to know the resources required on your switch before enabling NetFlow.

Examples

This example shows how to enable NetFlow switching on the switch:

Switch# config terminal

Switch(config)# ip route-cache flow

Switch(config)# exit

Switch# 

Note This command does not work on a per-interface basis.

ip source binding

To add or delete a static IP source binding entry, use the ip source binding command. To delete the corresponding IP source binding entry, use the no form of this command.

ip source binding ip-address mac-address vlan vlan-id interface interface-name

no ip source binding ip-address mac-address vlan vlan-id interface interface-name

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration

Command History

Usage Guidelines

The ip source binding command is used to add a static IP source binding entry only.

The no form of this command deletes the corresponding IP source binding entry. For the deletion to succeed, all required parameters must match.

Each static IP binding entry is keyed by a MAC address and VLAN number. If the CLI contains an existing MAC and VLAN, the existing binding entry will be updated with the new parameters; a separate binding entry will not be created.

Examples

This example shows how to configure the static IP source binding:

Switch# config terminal

Switch(config)# ip source binding 11.0.0.1 0000.000A.000B vlan 10 interface 
fastethernet6/10

Switch(config)#

Related Commands

show ip source binding

ip sticky-arp

To enable sticky ARP, use the ip sticky-arp command. Use the no form of this command to disable sticky ARP.

ip sticky-arp

no ip sticky-arp

Syntax Description

This command has no arguments or keywords.

Defaults

Enabled

Command Modes

Global configuration

Command History

Usage Guidelines

This command is supported on PVLANs only.

ARP entries that are learned on Layer3 PVLAN interfaces are sticky ARP entries. (You should display and verify ARP entries on the PVLAN interface using the show arp command).

For security reasons, sticky ARP entries on the PVLAN interface do not age out. Connecting new equipment with the same IP address generates a message and the ARP entry is not created.

Because the ARP entries on the PVLAN interface do not age out, you must manually remove ARP entries on the PVLAN interface if a MAC address changes.

Unlike static entries, sticky-ARP entries are not stored and restored when you enter the reboot and restart commands.

Examples

This example shows how to enable sticky ARP:

Switch# configure terminal 

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config) ip sticky-arp

Switch(config)# end

Switch#

This example shows how to disable sticky ARP:

Switch# configure terminal 

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config) no ip sticky-arp

Switch(config)# end

Switch#

Related Commands

arp (refer to Cisco IOS documentation)
show arp (refer to Cisco IOS documentation)

ip verify header vlan all

To enable IP header validation for Layer 2-switched IPv4 packets, use the ip verify header vlan all command. To disable the IP header validation, use the no form of this command.

ip verify header vlan all

no ip verify header vlan all

Syntax Description

This command has no default settings.

Defaults

The IP header is validated for bridged and routed IPv4 packets.

Command Modes

Configuration

Command History

Usage Guidelines

This command does not apply to Layer 3-switched (routed) packets.

The Catalyst 4500 series switch checks the validity of the following fields in the IPv4 header for all switched IPv4 packets:

•The version must be 4.

•The header length must be greater than or equal to 20 bytes.

•The total length must be greater than or equal to four times the header length and greater than the Layer 2 packet size minus the Layer 2 encapsulation size.

If an IPv4 packet fails the IP header validation, the packet is dropped. If you disable the header validation, the packets with the invalid IP headers are bridged but are not routed even if routing was intended. The IPv4 access lists also are not applied to the IP headers.

Examples

This example shows how to disable the IP header validation for the Layer 2-switched IPv4 packets:

Switch# config terminal

Switch(config)# no ip verify header vlan all

Switch(config)# end

Switch#

ip verify source vlan dhcp-snooping

To enable IP source guard on DHCP snooping on untrusted Layer 2 interfaces, use the ip verify source vlan dhcp-snooping command. To disable IP source guard on DHCP snooping on untrusted Layer 2 interfaces, use the no form of this command.

ip verify source vlan dhcp-snooping [port-security]

no ip verify source vlan dhcp-snooping [port-security]

Syntax Description

Defaults

IP source guard is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

Interface configuration

Examples

This example shows how to enable DHCP snooping security on VLANs 10 through 20:

Switch# config terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# ip dhcp snooping

Switch(config)# ip dhcp snooping vlan 10 20

Switch(config)# configure interface fastethernet6/1

Switch(config-if)# switchport trunk encapsulation dot1q

Switch(config-if)# switchport mode trunk

Switch(config-if)# switchport access vlan 10

Switch(config-if)# no ip dhcp snooping trust

Switch(config-if)# ip verify source vlan dhcp-snooping

Switch(config)# end

Switch# show ip dhcp snooping security interface fastethernet6/1

Interface  Filter-type  Filter-mode  IP-address       Mac-address     Vlan

---------  -----------  -----------  ---------------  --------------  ---------

fa6/1      ip           active       10.0.0.2                         10

fa6/1      ip           active       deny-all                         11-20

Switch# 

The output shows that there is one valid DHCP binding to VLAN 10.

Related Commands

debug ip verify source packet (refer to Cisco IOS documentation)
ip dhcp snooping
ip dhcp snooping limit rate
ip dhcp snooping information option
ip dhcp snooping trust
ip source binding (refer to Cisco IOS documentation)
show ip dhcp snooping
show ip dhcp snooping binding
show ip verify source (refer to Cisco IOS documentation)
show ip source binding (refer to Cisco IOS documentation)

l2protocol-tunnel

To enable protocol tunneling on an interface, use the l2protocol-tunnel command. You can enable tunneling for the Cisco Discovery Protocol (CDP), Spanning Tree Protocol (STP), or VLAN Trunking Protocol (VTP) packets. To disable tunneling on the interface, use the no form of this command.

l2protocol-tunnel [cdp | stp | vtp]

no l2protocol-tunnel [cdp | stp | vtp]

Syntax Description

Defaults

The default is no Layer 2 protocol packets are tunneled.

Command Modes

Interface configuration

Command History

Usage Guidelines

You must enter this command, with or without protocol types, to tunnel Layer 2 packets.

Layer 2 protocol tunneling across a service-provider network ensures that Layer 2 information is propagated across the network to all customer locations. When protocol tunneling is enabled, protocol packets are encapsulated with a well known Cisco multicast address for transmission across the network. When the packets reach their destination, the well-known MAC address is replaced by the Layer 2 protocol MAC address.

You can enable Layer 2 protocol tunneling for CDP, STP, and VTP individually or for all three protocols.

Examples

This example shows how to enable protocol tunneling for the CDP packets:

Switch(config-if)# l2protocol-tunnel cdp

Switch(config-if)# 

Related Commands

l2protocol-tunnel cos
l2protocol-tunnel drop-threshold
l2protocol-tunnel shutdown-threshold

l2protocol-tunnel cos

To configure the class of service (CoS) value for all tunneled Layer 2 protocol packets, use the l2protocol-tunnel cos command. To return to the default value of zero, use the no form of this command.

l2protocol-tunnel cos value

no l2protocol-tunnel cos

Syntax Description

Defaults

The default is to use the CoS value that is configured for data on the interface. If no CoS value is configured, the default is 5 for all tunneled Layer 2 protocol packets.

Command Modes

Global configuration

Command History

Usage Guidelines

When enabled, the tunneled Layer 2 protocol packets use this CoS value.

The value is saved in NVRAM.

Examples

This example shows how to configure a Layer-2 protocol tunnel CoS value of 7:

Switch(config)# l2protocol-tunnel cos 7

Switch(config)# 

Related Commands

l2protocol-tunnel
l2protocol-tunnel drop-threshold
l2protocol-tunnel shutdown-threshold

l2protocol-tunnel drop-threshold

To set a drop threshold for the maximum rate of Layer 2 protocol packets per second to be received before an interface drops packets, use the I2protocol-tunnel drop-threshold command. You can set the drop threshold for the Cisco Discovery Protocol (CDP), Spanning Tree Protocol (STP), or VLAN Trunking Protocol (VTP) packets. To disable the drop threshold on the interface, use the no form of this command.

l2protocol-tunnel drop-threshold [cdp | stp | vtp] value

no l2protocol-tunnel drop-threshold [cdp | stp | vtp] value

Syntax Description

Defaults

The default is no drop threshold for the number of the Layer 2 protocol packets.

Command Modes

Interface configuration

Command History

Usage Guidelines

The l2protocol-tunnel drop-threshold command controls the number of protocol packets per second that are received on an interface before it drops packets. When no protocol option is specified with a keyword, the threshold is applied to each of the tunneled Layer 2 protocol types. If you also set a shutdown threshold on the interface, the drop-threshold value must be less than or equal to the shutdown-threshold value.

When the drop threshold is reached, the interface drops the Layer 2 protocol packets until the rate at which they are received is below the drop threshold.

Examples

This example shows how to configure the drop threshold rate:

Switch(config-if)# l2protocol-tunnel drop-threshold cdp 50

Switch(config-if)#

Related Commands

l2protocol-tunnel
l2protocol-tunnel cos
l2protocol-tunnel shutdown-threshold

l2protocol-tunnel shutdown-threshold

To configure the protocol tunneling encapsulation rate, use the I2protocol-tunnel shutdown-threshold command. You can set the encapsulation rate for the Cisco Discovery Protocol (CDP), Spanning Tree Protocol (STP), or VLAN Trunking Protocol (VTP) packets. To disable the encapsulation rate on the interface, use the no form of this command.

l2protocol-tunnel shutdown-threshold [cdp | stp | vtp] value

no l2protocol-tunnel shutdown-threshold [cdp | stp | vtp] value

Syntax Description

Defaults

The default is no shutdown threshold for the number of Layer 2 protocol packets.

Command Modes

Interface configuration

Command History

Usage Guidelines

The l2-protocol-tunnel shutdown-threshold command controls the number of protocol packets per second that are received on an interface before it shuts down. When no protocol option is specified with the keyword, the threshold is applied to each of the tunneled Layer 2 protocol types. If you also set a drop threshold on the interface, the shutdown-threshold value must be greater than or equal to the drop-threshold value.

When the shutdown threshold is reached, the interface is error disabled. If you enable error recovery by entering the errdisable recovery cause l2ptguard command, the interface is brought out of the error-disabled state and allowed to retry the operation again when all the causes have timed out. If the error recovery feature generation is not enabled for l2ptguard, the interface stays in the error-disabled state until you enter the shutdown and no shutdown commands.

Examples

This example shows how to configure the maximum rate:

Switch(config-if)# l2protocol-tunnel shutdown-threshold cdp 50

Switch(config-if)#

Related Commands

l2protocol-tunnel
l2protocol-tunnel cos
l2protocol-tunnel shutdown-threshold

lacp port-priority

To set the LACP priority for the physical interfaces, use the lacp port-priority command.

lacp port-priority priority

Syntax Description

Defaults

Priority is set to 32768.

Command Modes

Interface configuration

Command History

Usage Guidelines

This command is not supported on the systems that are configured with a Supervisor Engine I.

You must assign each port in the switch a port priority that can be specified automatically or by entering the lacp port-priority command. The port priority is used with the port number to form the port identifier. The port priority is used to decide which ports should be put in standby mode when there is a hardware limitation that prevents all compatible ports from aggregating.

Although this command is a global configuration command, the priority value is supported only on port channels with LACP-enabled physical interfaces.This command is supported on LACP-enabled interfaces.

When setting the priority, the higher numbers indicate lower priorities.

Examples

This example shows how to set the priority for the interface:

Switch(config-if)# lacp port-priority 23748

Switch(config-if)# 

Related Commands

channel-group
channel-protocol
lacp system-priority
show lacp

lacp system-priority

To set the priority of the system for LACP, use the lacp system-priority command.

lacp system-priority priority

Syntax Description

Defaults

Priority is set to 32768.

Command Modes

Global configuration mode

Command History

Usage Guidelines

This command is not supported on systems that are configured with a Supervisor Engine I.

You must assign each switch that is running LACP a system priority that can be specified automatically or by entering the lacp system-priority command. The system priority is used with the switch MAC address to form the system ID and is also used during negotiation with other systems.

Although this command is a global configuration command, the priority value is supported on port channels with LACP-enabled physical interfaces.

When setting the priority, tthe higher numbers indicate lower priorities.

You can also enter the lacp system-priority command in interface configuration mode. After you enter the command, the system defaults to global configuration mode.

Examples

This example shows how to set the system priority:

Switch(config)# lacp system-priority 23748

Switch(config)# 

Related Commands

channel-group
channel-protocol
lacp port-priority
show lacp

logging event link-status global (global configuration)

To change the default switch-wide global link-status event messaging settings, use the
logging event link-status global command. Use the no form of this command to disable the link-status event messaging.

logging event link-status global

no logging event link-status global

Syntax Description

This command has no arguments or keywords.

Defaults

The global link-status messaging is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

If link-status logging event is not configured at the interface level, this global link-status setting takes effect for each interface.

Examples

This example shows how to globally enable link status message on each interface:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# logging event link-status global

Switch(config)# end

Switch#

Related Commands

logging event link-status global (global configuration)

logging event link-status (interface configuration)

To enable the link-status event messaging on an interface, use the logging event link-status command. Use the no form of this command to disable link-status event messaging. Use the
logging event link-status use-global command to apply the global link-status setting.

logging event link-status

no logging event link-status

logging event link-status use-global

Defaults

Global link-status messaging is enabled.

Command Modes

Interface configuration

Command History

Usage Guidelines

To enable system logging of interface state-change events on a specific interface, enter the
logging event link-status command in interface configuration mode.

To enable system logging of interface state-change events on all interfaces in the system, enter the logging event link-status global command in global configuration mode. All interfaces without the state change event configuration use the global setting.

Examples

This example shows how to enable logging event state-change events on interface gi11/1:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# interface gi11/1

Switch(config-if)# logging event link-status

Switch(config-if)# end

Switch#

This example shows how to turn off logging event link status regardless of the global setting:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# interface gi11/1

Switch(config-if)# no logging event link-status

Switch(config-if)# end

Switch#

This example shows how to enable the global event link-status setting on interface gi11/1:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# interface gi11/1

Switch(config-if)# logging event link-status use-global

Switch(config-if)# end

Switch#

Related Commands

logging event link-status global (global configuration)

logging event trunk-status global (global configuration)

To enable the trunk-status event messaging globally, use the logging event trunk-status global command. Use the no form of this command to disable trunk-status event messaging.

logging event trunk-status global

no logging event trunk-status global

Syntax Description

This command has no arguments or keywords.

Defaults

Global trunk-status messaging is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

If trunk-status logging event is not configured at the interface level, the global trunk-status setting takes effect for each interface.

Examples

This example shows how to globally enable link status messaging on each interface:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# logging event trunk-status global

Switch(config)# end

Switch#

Related Commands

logging event trunk-status global (global configuration)

logging event trunk-status (interface configuration)

To enable the trunk-status event messaging on an interface, use the logging event trunk-status command. Use the no form of this command to disable the trunk-status event messaging. Use the
logging event trunk-status use-global command to apply the global trunk-status setting.

logging event trunk-status

no logging event trunk-status

logging event trunk-status use-global

Defaults

Global trunk-status messaging is enabled.

Command Modes

Interface configuration

Command History

Usage Guidelines

To enable system logging of interface state-change events on a specific interface, enter the
logging event trunk-status command in interface configuration mode.

To enable system logging of interface state-change events on all interfaces in the system, enter the logging event trunk-status use-global command in global configuration mode. All interfaces without the state change event configuration use the global setting.

Examples

This example shows how to enable logging event state-change events on interface gi11/1:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# interface gi11/1

Switch(config-if)# logging event trunk-status

Switch(config-if)# end

Switch#

This example shows how to turn off logging event trunk status regardless of the global setting:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# interface gi11/1

Switch(config-if)# no logging event trunk-status

Switch(config-if)# end

Switch#

This example shows how to enable the global event trunk-status setting on interface gi11/1:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# interface gi11/1

Switch(config-if)# logging event trunk-status use-global

Switch(config-if)# end

Switch#

Related Commands

logging event trunk-status global (global configuration)

mac access-list extended

To define the extended MAC access lists, use the mac access-list extended command. To remove the MAC access lists, use the no form of this command.

mac access-list extended name

no mac access-list extended name

Syntax Description

Defaults

MAC access lists are not defined.

Command Modes

Global configuration

Command History

Usage Guidelines

When you enter the ACL name, follow these naming conventions:

•Maximum of 31 characters long and can include a-z, A-Z, 0-9, the dash character (-), the underscore character (_), and the period character (.)

•Must start with an alpha character and must be unique across all ACLs of all types

•Case sensitive

•Cannot be a number

•Must not be a keyword; keywords to avoid are all, default-action, map, help, and editbuffer

When you enter the mac access-list extended name command, you use the [no] {permit | deny} {{src-mac mask | any} [dest-mac mask]} [protocol-family {appletalk | arp-non-ipv4 | decnet | ipx | ipv6 | rarp-ipv4 | rarp-non-ipv4 | vines | xns}] subset to create or delete entries in a MAC layer access list.

Table 2-8 describes the syntax of the mac access-list extended subcommands.

Table 2-9 describes mapping an Ethernet packet to a protocol family.

When you enter the src-mac mask or dest-mac mask value, follow these guidelines:

•Enter the MAC addresses as three 4-byte values in dotted hexadecimal format such as 0030.9629.9f84.

•Enter the MAC address masks as three 4-byte values in dotted hexadecimal format. Use 1 bit as a wildcard. For example, to match an address exactly, use 0000.0000.0000 (can be entered as 0.0.0).

•For the optional protocol parameter, you can enter either the EtherType or the keyword.

•Entries without a protocol parameter match any protocol.

•The access list entries are scanned in the order that you enter them. The first matching entry is used. To improve performance, place the most commonly used entries near the beginning of the access list.

•An implicit deny any any entry exists at the end of an access list unless you include an explicit permit any any entry at the end of the list.

•All new entries to an existing list are placed at the end of the list. You cannot add entries to the middle of a list.

Examples

This example shows how to create a MAC layer access list named mac_layer that denies traffic from 0000.4700.0001, which is going to 0000.4700.0009, and permits all other traffic:

Switch(config)# mac access-list extended mac_layer 

Switch(config-ext-macl)# deny 0000.4700.0001 0.0.0 0000.4700.0009 0.0.0 protocol-family appletalk

Switch(config-ext-macl)# permit any any 

Switch(config-ext-macl)# end

Switch#

Related Commands

show vlan access-map

mac-address-table aging-time

To configure the aging time for the entries in the Layer 2 table, use the mac-address-table aging-time command. To reset the seconds value to the default setting, use the no form of this command.

mac-address-table aging-time seconds [vlan vlan_id]

no mac-address-table aging-time seconds [vlan vlan_id]

Syntax Description

Defaults

Aging time is set to 300 seconds.

Command Modes

Global configuration

Command History

Usage Guidelines

If you do not enter a VLAN, the change is applied to all routed-port VLANs.

Enter 0 seconds to disable aging.

Examples

This example shows how to configure the aging time to 400 seconds:

Switch(config)# mac-address-table aging-time 400

Switch(config)# 

This example shows how to disable aging:

Switch(config)# mac-address-table aging-time 0

Switch(config)

Related Commands

show mac-address-table aging-time

mac-address-table dynamic group protocols

To enable the learning of MAC addresses in both the "ip" and "other" protocol buckets, even though the incoming packet may belong to only one of the protocol buckets, use the
mac-address-table dynamic group protocols command. To disable grouped learning, use the no form of this command.

mac-address-table dynamic group protocols {ip | other} {ip | other}

[no] mac-address-table dynamic group protocols {ip | other} {ip | other}

Syntax Description

Defaults

The group learning feature is disabled.

Command Modes

global configuration

Command History

Usage Guidelines

The entries within the "ip" and "other" protocol buckets are created according to the protocol of the incoming traffic.

When you use the mac-address-table dynamic group protocols command, an incoming MAC address that might belong to either the "ip" or the "other" protocol bucket, is learned on both protocol buckets. Therefore, any traffic destined to this MAC address and belonging to any of the protocol buckets is unicasted to that MAC address, rather than flooded. This reduces the unicast Layer 2 flooding that might be caused if the incoming traffic from a host belongs to a different protocol bucket than the traffic that is destined to the sending host.

Examples

This example shows that the MAC addresses are initially assigned to either the "ip" or the "other" protocol bucket:

Switch# show mac-address-table dynamic

Unicast Entries

 vlan   mac address     type        protocols               port

-------+---------------+--------+---------------------+--------------------

   1    0000.0000.5000   dynamic other                  GigabitEthernet1/1

   1    0001.0234.6616   dynamic ip                     GigabitEthernet3/1

   1    0003.3178.ec0a   dynamic assigned               GigabitEthernet3/1

   1    0003.4700.24c3   dynamic ip                     GigabitEthernet3/1

   1    0003.4716.f475   dynamic ip                     GigabitEthernet3/1

   1    0003.4748.75c5   dynamic ip                     GigabitEthernet3/1

   1    0003.47f0.d6a3   dynamic ip                     GigabitEthernet3/1

   1    0003.47f6.a91a   dynamic ip                     GigabitEthernet3/1

   1    0003.ba06.4538   dynamic ip                     GigabitEthernet3/1

   1    0003.fd63.3eb4   dynamic ip                     GigabitEthernet3/1

   1    0004.2326.18a1   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5d.de53   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5e.6ecc   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5e.f60e   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5f.06f7   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5f.072f   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5f.08f6   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5f.090b   dynamic ip                     GigabitEthernet3/1

   1    0004.5a88.b075   dynamic ip                     GigabitEthernet3/1

   1    0004.c1bd.1b40   dynamic ip                     GigabitEthernet3/1

   1    0004.c1d8.b3c0   dynamic ip                     GigabitEthernet3/1

   1    0004.c1d8.bd00   dynamic ip                     GigabitEthernet3/1

   1    0007.e997.74dd   dynamic ip                     GigabitEthernet3/1

   1    0007.e997.7e8f   dynamic ip                     GigabitEthernet3/1

   1    0007.e9ad.5e24   dynamic ip                     GigabitEthernet3/1

   1    000b.5f0a.f1d8   dynamic ip                     GigabitEthernet3/1

   1    000b.fdf3.c498   dynamic ip                     GigabitEthernet3/1

   1    0010.7be8.3794   dynamic assigned               GigabitEthernet3/1

   1    0012.436f.c07f   dynamic ip                     GigabitEthernet3/1

   1    0050.0407.5fe1   dynamic ip                     GigabitEthernet3/1

   1    0050.6901.65af   dynamic ip                     GigabitEthernet3/1

   1    0050.da6c.81cb   dynamic ip                     GigabitEthernet3/1

   1    0050.dad0.af07   dynamic ip                     GigabitEthernet3/1

   1    00a0.ccd7.20ac   dynamic ip                     GigabitEthernet3/1

   1    00b0.64fd.1c23   dynamic ip                     GigabitEthernet3/1

   1    00b0.64fd.2d8f   dynamic assigned               GigabitEthernet3/1

   1    00d0.b775.c8bc   dynamic ip                     GigabitEthernet3/1

   1    00d0.b79e.de1d   dynamic ip                     GigabitEthernet3/1

   1    00e0.4c79.1939   dynamic ip                     GigabitEthernet3/1

   1    00e0.4c7b.d765   dynamic ip                     GigabitEthernet3/1

   1    00e0.4c82.66b7   dynamic ip                     GigabitEthernet3/1

   1    00e0.4c8b.f83e   dynamic ip                     GigabitEthernet3/1

   1    00e0.4cbc.a04f   dynamic ip                     GigabitEthernet3/1

   1    0800.20cf.8977   dynamic ip                     GigabitEthernet3/1

   1    0800.20f2.82e5   dynamic ip                     GigabitEthernet3/1

Switch#

This example shows how to assign MAC addresses that belong to either the "ip" or the "other" bucket to both buckets:

Switch(config)# mac-address-table dynamic group protocols ip other

Switch(config)# exit

Switch# show mac address-table dynamic

Unicast Entries

 vlan   mac address     type        protocols               port

-------+---------------+--------+---------------------+--------------------

   1    0000.0000.5000   dynamic ip,other               GigabitEthernet1/1

   1    0001.0234.6616   dynamic ip,other               GigabitEthernet3/1

   1    0003.4700.24c3   dynamic ip,other               GigabitEthernet3/1

   1    0003.4716.f475   dynamic ip,other               GigabitEthernet3/1

   1    0003.4748.75c5   dynamic ip,other               GigabitEthernet3/1

   1    0003.47c4.06c1   dynamic ip,other               GigabitEthernet3/1

   1    0003.47f0.d6a3   dynamic ip,other               GigabitEthernet3/1

   1    0003.47f6.a91a   dynamic ip,other               GigabitEthernet3/1

   1    0003.ba0e.24a1   dynamic ip,other               GigabitEthernet3/1

   1    0003.fd63.3eb4   dynamic ip,other               GigabitEthernet3/1

   1    0004.2326.18a1   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a5d.de53   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a5d.de55   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a5e.6ecc   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a5e.f60e   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a5f.08f6   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a5f.090b   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a64.f813   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a66.1a77   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a6b.56b2   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a6c.6a07   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a88.b075   dynamic ip,other               GigabitEthernet3/1

   1    0004.c1bd.1b40   dynamic ip,other               GigabitEthernet3/1

   1    0004.c1d8.b3c0   dynamic ip,other               GigabitEthernet3/1

   1    0004.c1d8.bd00   dynamic ip,other               GigabitEthernet3/1

   1    0005.dce0.7c0a   dynamic assigned               GigabitEthernet3/1

   1    0007.e997.74dd   dynamic ip,other               GigabitEthernet3/1

   1    0007.e997.7e8f   dynamic ip,other               GigabitEthernet3/1

   1    0007.e9ad.5e24   dynamic ip,other               GigabitEthernet3/1

   1    0007.e9c9.0bc9   dynamic ip,other               GigabitEthernet3/1

   1    000b.5f0a.f1d8   dynamic ip,other               GigabitEthernet3/1

   1    000b.fdf3.c498   dynamic ip,other               GigabitEthernet3/1

   1    0012.436f.c07f   dynamic ip,other               GigabitEthernet3/1

   1    0050.0407.5fe1   dynamic ip,other               GigabitEthernet3/1

   1    0050.6901.65af   dynamic ip,other               GigabitEthernet3/1

   1    0050.da6c.81cb   dynamic ip,other               GigabitEthernet3/1

   1    0050.dad0.af07   dynamic ip,other               GigabitEthernet3/1

   1    00a0.ccd7.20ac   dynamic ip,other               GigabitEthernet3/1

   1    00b0.64fd.1b84   dynamic assigned               GigabitEthernet3/1

   1    00d0.b775.c8bc   dynamic ip,other               GigabitEthernet3/1

   1    00d0.b775.c8ee   dynamic ip,other               GigabitEthernet3/1

   1    00d0.b79e.de1d   dynamic ip,other               GigabitEthernet3/1

   1    00e0.4c79.1939   dynamic ip,other               GigabitEthernet3/1