Catalyst 4500 Series Switch Cisco IOS Command Reference, 12.2(53)SG

Cisco IOS Commands for the Catalyst 4500 Series Switches

This chapter contains an alphabetical listing of Cisco IOS commands for the Catalyst 4500 series switches. For information about Cisco IOS commands that are not included in this publication, refer to Cisco IOS Release 12.2 configuration guides and command references at this URL:

http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_product_indices_list.html

#macro keywords

To specify the help string for the macro keywords, use the #macro keywords command.

#macro keywords [keyword1] [keyword2] [keyword3]

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration mode

Command History

Usage Guidelines

If you do not specify the mandatory keywords for a macro, the macro is to be considered invalid and fails when you attempt to apply it. By entering the #macro keywords command, you will receive a message indicating what you need to include to make the syntax valid.

Examples

This example shows how to specify the help string for keywords associated with a macro named test:

Switch(config)# macro name test

macro name test

Enter macro commands one per line. End with the character '@'.

#macro keywords $VLAN $MAX

swichport

@

Switch(config)# int gi1/1

Switch(config-if)# macro apply test ?

  WORD  Keyword to replace with a value e.g $VLAN, $MAX   << It is shown as help

  <cr>

Related Commands

aaa accounting dot1x default start-stop group radius

To enable accounting for 802.1X authentication sessions, use the aaa accounting dot1x default start-stop group radius command. To disable accounting, use the no form of this command.

aaa accounting dot1x default start-stop group radius

no aaa accounting dot1x default start-stop group radius

Syntax Description

This command has no arguments or keywords.

Defaults

Accounting is disabled.

Command Modes

Global configuration mode

Command History

Usage Guidelines

802.1X accounting requires a RADIUS server.

This command enables the Authentication, Authorization, and Accounting (AAA) client's accounting feature to forward 802.1X update and watchdog packets from the 802.1X supplicant (workstation client) to the authentication (RADIUS) server. (Watchdog packets are defined as EAPOL-LOGON, EAPOL-LOGOFF, and EAPOL-INTERIM messages.) Successful authentication and authorization of the supplicant by the authentication server is required before these packets are considered valid and are forwarded. When the client is reauthenticated, an interim-update accounting notice is sent to the accounting server.

Examples

This example shows how to configure 802.1X accounting:

Switch(config)# aaa accounting dot1x default start-stop group radius

Note The RADIUS authentication server must be properly configured to accept and log update or watchdog packets from the AAA client.

Related Commands

aaa accounting system default start-stop group radius

To receive the session termination messages after the switch reboots, use the aaa accounting system default start-stop group radius command. To disable accounting, use the no form of this command.

aaa accounting system default start-stop group radius

no aaa accounting system default start-stop group radius

Syntax Description

This command has no arguments or keywords.

Defaults

Accounting is disabled.

Command Modes

Global configuration mode

Command History

Usage Guidelines

802.1X accounting requires the RADIUS server.

This command enables the AAA client's accounting feature to forward 802.1X update and watchdog packets from the 802.1X supplicant (workstation client) to the authentication (RADIUS) server. (Watchdog packets are defined as EAPOL-LOGON, EAPOL-LOGOFF, and EAPOL-INTERIM messages.) Successful authentication and authorization of the supplicant by the authentication server is required before these packets are considered valid and are forwarded. When the client is reauthenticated, an interim-update accounting notice is sent to the accounting server.

Examples

This example shows how to generate a logoff after a switch reboots:

Switch(config)# aaa accounting system default start-stop group radius

Note The RADIUS authentication server must be properly configured to accept and log update or watchdog packets from the AAA client.

Related Commands

access-group mode

To specify the override modes (for example, VACL overrides PACL) and the non-override modes (for example, merge or strict mode), use the access-group mode command. To return to preferred port mode, use the no form of this command.

access-group mode {prefer {port | vlan} | merge}

no access-group mode {prefer {port | vlan} | merge}

Syntax Description

Defaults

PACL override mode

Command Modes

Interface configuration mode

Command History

Usage Guidelines

On the Layer 2 interface, prefer port, prefer VLAN, and merge modes are supported. A Layer 2 interface can have one IP ACL applied in either direction (one inbound and one outbound).

Examples

This example shows how to make the PACL mode on the switch take effect:

(config-if)# access-group mode prefer port

This example shows how to merge applicable ACL features:

(config-if)# access-group mode merge

Related Commands

access-list hardware capture mode

To select the mode of capturing control packets, use the access-list hardware capture mode command.

access-list hardware capture mode {global | vlan}

Syntax Description

Defaults

The control packets are globally captured.

Command Modes

Global configuration mode

Command History

Usage Guidelines

Before configuring the capture mode, it is best to examine and modify your configuration to globally disable features such as DHCP snooping or IGMP snooping, and instead enable them on specific VLANs.

When changing to path managed mode, be aware that control traffic may be bridged in hardware or dropped initially until the per-vlan CAM entries are programmed in hardware.

You must ensure that any access control configuration on a member port or VLAN does not deny or drop the control packets from being forwarded to the CPU for the features which are enabled on the VLAN. If control packets are not permitted then the specific feature does not function.

Examples

This example shows how to configure the switch to capture control packets on VLANs that are configured to enable capturing control packets:

Switch# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# access-list hardware capture mode vlan

Switch(config)# end

Switch#

This example shows how to configure the switch to capture control packets globally across all VLANs (using a static ACL):

Switch# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# access-list hardware capture mode global

Switch(config)# end

Switch#

This example shows another way to configure the switch to capture control packets globally across all VLANs:

Switch# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# no access-list hardware capture mode vlan

Switch(config)# end

Switch#

access-list hardware entries

To designate how ACLs are programmed into the switch hardware, use the access-list hardware entries command.

access-list hardware entries {packed | scattered}

Syntax Description

Defaults

The ACLs are programmed as packed.

Command Modes

Global configuration mode

Command History

Usage Guidelines

Two types of hardware resources are used when ACLs are programmed: entries and masks. If one of these resources is consumed, no additional ACLs can be programmed into the hardware. If the masks are consumed, but the entries are available, change the programming algorithm from packed to scattered to make the masks available. This action allows additional ACLs to be programmed into the hardware.

The goal is to use TCAM resources more efficiently; that is, to minimize the number of masks per ACL entries. To compare TCAM utilization when using the scattered or packed algorithms, use the
show platform hardware acl statistics utilization brief command. To change the algorithm from packed to scattered, use the access-list hardware entries command.

Examples

This example shows how to program ACLs into the hardware as packed. After they are programmed, you will need 89 percent of the masks to program only 49 percent of the ACL entries.

Switch# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# access-list hardware entries packed

Switch(config)# end

Switch#

01:15:34: %SYS-5-CONFIG_I: Configured from console by console

Switch#

Switch# show platform hardware acl statistics utilization brief

Entries/Total(%)  Masks/Total(%)

                                       -----------------  ---------------

            Input  Acl(PortAndVlan)  2016 / 4096 ( 49)   460 /  512 ( 89)

            Input  Acl(PortOrVlan)      6 / 4096 (  0)     4 /  512 (  0)

            Input  Qos(PortAndVlan)     0 / 4096 (  0)     0 /  512 (  0)

            Input  Qos(PortOrVlan)      0 / 4096 (  0)     0 /  512 (  0)

            Output Acl(PortAndVlan)     0 / 4096 (  0)     0 /  512 (  0)

            Output Acl(PortOrVlan)      0 / 4096 (  0)     0 /  512 (  0)

            Output Qos(PortAndVlan)     0 / 4096 (  0)     0 /  512 (  0)

            Output Qos(PortOrVlan)      0 / 4096 (  0)     0 /  512 (  0)

            L4Ops: used 2 out of 64

Switch# 

This example shows how to reserve space (scatter) between ACL entries in the hardware. The 
number of masks required to program 49 percent of the entries has decreased to 49 percent.

Switch# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# access-list hardware entries scattered

Switch(config)# end

Switch#

01:39:37: %SYS-5-CONFIG_I: Configured from console by console

Switch#

Switch# show platform hardware acl statistics utilization brief

Entries/Total(%)  Masks/Total(%)

                                       -----------------  ---------------

            Input  Acl(PortAndVlan)  2016 / 4096 ( 49)   252 /  512 ( 49)

            Input  Acl(PortOrVlan)      6 / 4096 (  0)     5 /  512 (  0)

            Input  Qos(PortAndVlan)     0 / 4096 (  0)     0 /  512 (  0)

            Input  Qos(PortOrVlan)      0 / 4096 (  0)     0 /  512 (  0)

            Output Acl(PortAndVlan)     0 / 4096 (  0)     0 /  512 (  0)

            Output Acl(PortOrVlan)      0 / 4096 (  0)     0 /  512 (  0)

            Output Qos(PortAndVlan)     0 / 4096 (  0)     0 /  512 (  0)

            Output Qos(PortOrVlan)      0 / 4096 (  0)     0 /  512 (  0)

            L4Ops: used 2 out of 64

Switch# 

access-list hardware region

To modify the balance between TCAM regions in hardware, use the access-list hardware region command.

access-list hardware region {feature | qos} {input | output} balance {bal-num}

Syntax Description

Defaults

The default region balance for each TCAM is 50.

Command Modes

Global configuration mode

Command History

Usage Guidelines

PandV is a TCAM region containing entries which mask in both the port and VLAN tag portions of the flow label.

PorV is a TCAM region containing entries which mask in either the port or VLAN tag portion of the flow label, but not both.

A balance of 1 allocates the minimum number of PandV region entries and the maximum number of PorV region entries. A balance of 99 allocates the maximum number of PandV region entries and the minimum number of PorV region entries. A balance of 50 allocates equal numbers of PandV and PorV region entries in the specified TCAM.

Balances for the four TCAMs can be modified independently.

Examples

This example shows how to enable the MAC notification trap when a MAC address is added to a port:

Switch# configure terminal

Switch(config)# access-list hardware region feature input balance 75

Switch(config)# 

action

To specify an action to be taken when a match occurs in a VACL, use the action command. To remove an action clause, use the no form of this command.

action {drop | forward}

no action {drop | forward}

Syntax Description

Defaults

This command has no default settings.

Command Modes

VLAN access-map mode

Command History

Usage Guidelines

In a VLAN access map, if at least one ACL is configured for a packet type (IP or MAC), the default action for the packet type is drop (deny).

If an ACL is not configured for a packet type, the default action for the packet type is forward (permit).

If an ACL for a packet type is configured and the ACL is empty or undefined, the configured action will be applied to the packet type.

Examples

This example shows how to define a drop action:

Switch(config-access-map)# action drop 

Switch(config-access-map)# 

This example shows how to define a forward action:

Switch(config-access-map)# action forward 

Switch(config-access-map)# 

Syntax Description

active

To enable the destination profile, use the active command.

active

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

cfg-call-home-profile

Command History

Usage Guidelines

By default the profile is enabled upon creation.

Examples

This example shows how to enable the destination profile:

Switch(config)# call-home

Switch(cfg-call-home)# profile cisco

Switch(cfg-call-home-profile)# active

Related Commands

ancp client port identifier

To create a mapping for an ANCP client to identify an interface on which ANCP should start or stop a multicast stream, use the ancp client port identifier command.

ancp client port identifier identifying name vlan vlan number interface interface

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration mode

Command History

Usage Guidelines

The ANCP server can use either the DHCP option 82 circuit ID or an identifier created with this commandto identify the port. Use only one of the two methods; do not interchange them. If you use the DHCP option 82, the port identifier used by the ANCP server should be (in hex) 0x01060004[vlan][intf]. For example, VLAN 19 and interface Fast Ethernet 2/3 will provide 0x0106000400130203. If you use the port identifier, however, use the exact string provided on the CLI.

Note This command is available only after you set the box in ANCP client mode with the ancp mode client configuration command.

Examples

This example shows how to identify interface FastEthernet 7/3 on VLAN 10 with the string NArmstrong:

Switch# ancp client port identifier NArmstrong vlan 10 interface FastEthernet 7/3

Related Commands

ancp client server

To set the IP address of the remote ANCP server, use the ancp client server command.

ancp client server ipaddr of server interface interface

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration mode

Command History

Usage Guidelines

The interface can be the direct interface connected towards the ANCP server (if only one) or a loopback interface if several interfaces are available for connecting to the server and proper routing is set. (An IP address must be configured on this interface and it should not be in shutdown state.) Along with the ancp mode client command, the ancp client server command is required in order to activate the ANCP client. Once you enter this command, the ANCP client tries to connect to the remote server.

Examples

This example shows how to indicate to the ANCP client the IP address of the ANCP server it needs to connect to:

Switch# ancp client server 10.1.2.31 interface FastEthernet 2/1

Related Commands

ancp mode client

To set the router to become an ANCP client, use the ancp mode client command.

ancp mode client

Syntax Description

No keywords

Defaults

This command has no default settings.

Command Modes

Global configuration mode

Command History

Usage Guidelines

To fully activate ANCP, the administrator must also set the ANCP server IP address to which the ANCP client must connect.

Examples

This example shows how to set the router to become an ANCP client:

Switch# ancp mode client

Related Commands

apply

To implement a new VLAN database, increment the configuration number, save the configuration number in NVRAM, and propagate the configuration number throughout the administrative domain, use the apply command.

apply

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

VLAN configuration mode

Command History

Usage Guidelines

The apply command implements the configuration changes that you made after you entered VLAN database mode and uses them for the running configuration. This command keeps you in VLAN database mode.

You cannot use this command when the switch is in the VTP client mode.

You can verify that the VLAN database changes occurred by entering the show vlan command from privileged EXEC mode.

Examples

This example shows how to implement the proposed new VLAN database and to recognize it as the current database:

Switch(config-vlan)# apply

Switch(config-vlan)# 

Related Commands

arp access-list

To define an ARP access list or add clauses at the end of a predefined list, use the arp access-list command.

arp access-list name

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration mode

Command History

Examples

This example shows how to define an ARP access list named static-hosts:

Switch(config)# arp access-list static-hosts

Switch(config)# 

Related Commands

attach module

To remotely connect to a specific module, use the attach module configuration command.

attach module mod

Syntax Description

Defaults

This command has no default settings.

Command Modes

Privileged EXEC mode

Command History

Usage Guidelines

This command applies only to the Access Gateway Module on Catalyst 4500 series switches.

The valid values for mod depend on the chassis that are used. For example, if you have a Catalyst 4506 chassis, valid values for the module are from 2 to 6. If you have a 4507R chassis, valid values are from 3 to 7.

When you execute the attach module mod command, the prompt changes to Gateway#.

This command is identical in the resulting action to the session module mod and the remote login module mod commands.

Examples

This example shows how to remotely log in to an Access Gateway Module:

Switch# attach module 5

Attaching console to module 5

Type 'exit' at the remote prompt to end the session

Gateway> 

Related Commands

authentication control-direction

To change the port control to unidirectional or bidirectional, use the authentication control-direction command in interface configuration mode. To return to the default setting, use the no form of this command.

authentication control-direction {both | in}

no authentication control-direction

Syntax Description

Command Default

both

Command Modes

Interface configuration mode

Command History

Usage Guidelines

The authentication control-direction command replaces the following dot1x command, which is deprecated in Cisco IOS Release 12.2(50)SG and later releases:

dot1x control-direction {both | in}

The IEEE 802.1X standard defines a client-server-based access control and authentication protocol that restricts unauthorized devices from connecting to a LAN through publicly accessible ports.

IEEE 802.1X controls network access by creating two distinct virtual access points at each port. One access point is an uncontrolled port; the other is a controlled port. All traffic through the single port is available to both access points. IEEE 802.1X authenticates each user device that connects to a switch port and assigns the port to a VLAN before making available any services that are offered by the switch or the LAN. Until the device authenticates, 802.1X access control allows only Extensible Authentication Protocol (EAP) over LAN (EAPOL) traffic through the port to which the device connects. After authentication succeeds, normal traffic can pass through the port.

•Unidirectional state—When you configure a port as unidirectional with the
dot1x control-direction interface configuration command, the port changes to the spanning-tree forwarding state.

When the unidirectional controlled port is enabled, the connected host is in sleeping mode or power-down state. The host does not exchange traffic with other devices in the network. If the host connected to the unidirectional port that cannot send traffic to the network, the host can only receive traffic from other devices in the network.

•Bidirectional state—When you configure a port as bidirectional with the dot1x control-direction interface configuration command, the port is access-controlled in both directions. In this state, the switch port sends only EAPOL.

Using the both keyword or using the no form of this command changes the port to its bidirectional default setting.

Setting the port as bidirectional enables 802.1X authentication with Wake-on-LAN (WoL).

You can verify your settings by entering the show authentication privileged EXEC command.

Examples

The following example shows how to enable unidirectional control:

Switch(config-if)# authentication control-direction in

Switch(config-if)# 

The following example shows how to enable bidirectional control:

Switch(config-if)# authentication control-direction both

Switch(config-if)# 

The following example shows how to return to the default settings:

Switch(config-if)# no authentication control-direction

Switch(config-if)# 

Related Commands

authentication critical recovery delay

To configure the 802.1X critical authentication parameters, use the
authentication critical recovery delay command in global configuration mode. To return to the default settings, use the no form of this command.

authentication critical recovery delay milliseconds

no authentication critical recovery delay

Syntax Description

Command Default

10000 milliseconds

Command Modes

Global configuration mode

Command History

Usage Guidelines

The authentication critical recovery delay command replaces the following dot1x command, which is deprecated in Cisco IOS Release 12.2(50)SG and later releases:

dot1x critical recovery delay milliseconds

You can verify your settings by entering the show authentication privileged EXEC command.

Examples

This example shows how to set the recovery delay period that the switch waits to reinitialize a critical port when an unavailable RADIUS server becomes available:

Switch(config)# authentication critical recovery delay 1500

Switch(config)#

Related Commands

authentication event

To configure the actions for authentication events, use the authentication event interface configuration command. To return to the default settings, use the no form of this command.

authentication event fail [retry count] action [authorize vlan vlan | next-method}

authentication event server {alive action reinitialize | dead action authorize [vlan vlan]}

authentication event no-response action authorize vlan vlan]}

no authentication event {fail} | {server {alive | dead}} | {no-response}

Syntax Description

Command Default

The default settings are as follows:

•The count is 2 by default.

•The current authentication method is retried indefinitely (and fails each time) until the AAA server becomes reachable.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

The authentication event fail command replaces the following dot1x commands, which are deprecated in Cisco IOS Release 12.2(50)SG and later releases:

•[no] dot1x auth-fail max-attempts count

•[no] dot1x auth-fail vlan vlan

The authentication event fail command is supported only for dot1x to signal authentication failures. By default, this type of failure causes the authentication method to be retried. You can configure to either authorize the port in the configured VLAN or failover to the next authentication method. Optionally, you can specify the number of authentication retries before performing this action.

The authentication event server command replaces the following dot1x commands, which are deprecated in Cisco IOS Release 12.2(50)SG and later releases:

•[no] dot1x critical

•[no] dot1x critical vlan vlan

•[no] dot1x critical recover action initialize

The authentication event server command specifies the behavior when the AAA server becomes unreachable, ports are authorized in the specified VLAN.

The authentication server alive action command specifies the action to be taken once the AAA server becomes reachable again.

You can verify your settings by entering the show authentication privileged EXEC command.

The authentication event no-response command replaces the following dot1x command, which is deprecated in Cisco IOS Release 12.2(50)SG and later releases:

•[no] dot1x guest-vlan vlan

The authentication event no-response command specifies the action to be taken when the client does not support 802.1X.

Examples

The following example shows how to specify that when an authentication fails due to bad user credentials, the process advances to the next authentication method:

Switch(config-if)# authentication event fail action next-method

Switch(config-if)# 

The following example shows how to specify the AAA server alive actions as reinitialize all authorized clients for authentication events:

Switch(config-if)# authentication event server alive action reinitialize

Switch(config-if)#

The following example shows how to specify the AAA server dead actions that authorize the port for authentication events:

Switch(config-if)# authentication event server dead action authorize

Switch(config-if)#

The following example shows how to specify the conditions when a client doesn't support 802.1X to authorize the port for authentication events:

Switch(config-if)# authentication event authentication event no-response action authorize 
vlan 10

Switch(config-if)#

Related Commands

authentication fallback

To enable WebAuth fallback and to specify the fallback profile to use when failing over to WebAuth, use the authentication fallback interface command. To return to the default setting, use the no form of this command.

authentication fallback profile

Syntax Description

Command Default

Disabled

Command Modes

Interface configuration mode

Command History

Usage Guidelines

By default, if 802.1X times out and if MAB fails, WebAuth is enabled.

The authentication fallback command replaces the following dot1x command, which is deprecated in Cisco IOS Release 12.2(50)SG and later releases:

[no] dot1x fallback profile

The Webauth fallback feature allows you to have those clients that do not have an 802.1X supplicant and are not managed devices to fall back to the WebAuth method.

You can verify your settings with the show authentication privileged EXEC command.

Examples

This example shows how to enable WebAuth fallback and specify the fallback profile to use when failing over to WebAuth:

Switch(config-if)# authentication fallback fallbacktest1

Switch(config-if)#

This example shows how to disable WebAuth fallback:

Switch(config-if)# no authentication fallback fallbacktest1

Switch(config-if)#

Related Commands

authentication host-mode

To define the classification of a session that will be used to apply the access-policies in host-mode configuration, use the authentication host-mode command in interface configuration mode. To return to the default settings, use the no form of this command.

authentication host-mode {single-host | multi-auth | multi-domain | multi-host} [open]

[no] authentication host-mode {single-host | multi-auth | multi-domain | multi-host} [open]

Syntax Description

Command Default

This command has no default settings.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

Single-host mode classifies the session as an interface session (for example, one MAC per interface). Only one client is allowed on the port, and any policies that are downloaded for the client are applied to the whole port. A security violation is triggered if more than one client is detected.

Multi-host mode classifies the session as an interface session, but the difference with this host-mode is that it allows more than one client to attach to the port. Only the first client that is detected on the port will be authenticated and the rest will inherit the same access as the first client. The policies that are downloaded for the first client will be applied to the whole port.

Multi-domain mode classifies the session based on a combination of MAC address and domain, with the restriction that only one MAC is allowed per domain. The domain in the switching environment refers to the VLAN, and the two supported domains are the DATA domain and the voice domain. Only one client is allowed on a particular domain. So, only two clients (MACs) per port are supported. Each one is required to authenticate separately. Any policies that are downloaded for the client will be applied for that client's MAC/IP only and will not affect the other on the same port. The clients can be authenticated using different methods (such as 802.1X for PC, MAB for IP phone, or vice versa). No restriction exists on the authentication order.

The only caveat with the above statement is that web-based authentication is only available for data devices because a user is probably operating the device and HTTP capability exists. Also, if web-based authentication is configured in MDA mode, the only form of enforcement for all types of devices is downloadable ACLs (dACL). The restriction is in place because VLAN assignment is not supported for web-based authentication. Furthermore, if you use dACLs for data devices and not for voice devices, when the user's data falls back to webauth, voice traffic is affected by the ACL that is applied based on the fallback policy. Therefore if webauth is configured as a fallback on an MDA enabled port, dACL is the only supported enforcement method.

Multi-auth mode classifies the session as a MAC-based. No limit exists for the number of clients allowed on a port data domain. Only one client is allowed in a voice domain and each one is required to authenticate separately. Any policies that are downloaded for the client are applied for that client's MAC or IP only and do not affect others on the same port.

The optional pre-authentication open access mode allows you to gain network access before authentication is performed.This is primarily required for the PXE boot scenario, but not limited to just that use case, where a device needs to access the network before PXE times out and downloads a bootable image possibly containing a supplicant.

The configuration related to this feature is attached to the host-mode configuration whereby the host-mode itself is significant for the control plane, while the open access configuration is significant for the data plane. Open-access configuration has absolutely no bearing on the session classification. The host-mode configuration still controls this. If the open-access is defined for single-host mode, the port still allows only one MAC address. The port forwards traffic from the start and is only restricted by what is configured on the port. Such configurations are independent of 802.1X. So, if there is no form of access-restriction configured on the port, the client devices have full access on the configured VLAN.

You can verify your settings with the show authentication privileged EXEC command.

Examples

This example shows how to define the classification of a session that are used to apply the access-policies using the host-mode configuration:

Switch(config-if)# authentication host-mode single-host

Switch(config-if)#

Related Commands

authentication open

To enable open access on this port, use the authentication open command in interface configuration mode. To disable open access on this port, use the no form of this command.

Note With Cisco IOS Release 12.2(50)SG, the authentication open command operates on a per-port rather than global basis.

authentication open

no authentication open

Syntax Description

This command has no arguments or keywords.

Command Default

Disabled.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

Open Access allows clients or devices to gain network access before authentication is performed.

You can verify your settings with the show authentication privileged EXEC command.

This command overrides the authentication host-mode session-type open global configuration mode command for the port only.

Examples

The following example shows how to enable open access to a port:

Switch(config-if)# authentication open

Switch(config-if)#

The following example shows how to enable open access to a port:

Switch(config-if)# no authentication open

Switch(config-if)#

Related Commands

authentication order

To specify the order in which authentication methods should be attempted for a client on an interface, use the authentication order command in interface configuration mode. To return to the default settings, use the no form of this command.

authentication order method1 [method2] [method3]

no authentication order

Syntax Description

Command Default

The default order is dot1x, MAB, then WebAuth.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

Once you enter the authentication order command, only those methods explicitly listed will run. Each method may be entered only once in the run list and no methods may be entered after you enter the webauth keyword.

Authentication methods are applied in the configured (or default) order until authentication succeeds. For authentication fails, failover to the next authentication method occurs (subject to the configuration of authentication event handling).

You can verify your settings with the show authentication privileged EXEC command.

Examples

The following example shows how to specify the order in which authentication methods should be attempted for a client on an interface:

Switch(config-if)# authentication order mab dot1x webauth

Switch(config-if)#

Related Commands

authentication periodic

To enable reauthentication for this port, use the authentication periodic command in interface configuration mode. To disable reauthentication for this port, use the no form of this command.

authentication periodic

no authentication periodic

Syntax Description

This command has no arguments or keywords.

Command Default

Disabled.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

The authentication periodic command replaces the following dot1x command, which is deprecated in Cisco IOS Release 12.2(50)SG and later releases:

[no] dot1x reauthentication

The reauthentication period can be set using the authentication timer command.

You can verify your settings by entering the show authentication privileged EXEC command.

Examples

The following example shows how to enable reauthentication for this port:

Switch(config-if)# authentication reauthentication

Switch(config-if)#

The following example shows how to disable reauthentication for this port:

Switch(config-if)# no authentication reauthentication

Switch(config-if)#

Related Commands

authentication port-control

To configure the port-control value, use the authentication port-control command in interface configuration mode. To return to the default setting, use the no form of this command.

authentication port-control [auto | force-authorized | force-unauthorized]

no authentication port-control

Syntax Description

Command Default

force-authorized

Command Modes

Interface configuration mode

Command History

Usage Guidelines

The authentication port-control command replaces the following dot1x command, which is deprecated in Cisco IOS Release 12.2(50)SG and later releases:

[no] dot1x port-control [auto | force-authorized | force-unauthorized]

The following guidelines apply to Ethernet switch network modules:

•The 802.1X protocol is supported on Layer 2 static-access ports.

•You can use the auto keyword only if the port is not configured as one of the following types:

–Trunk port—If you try to enable 802.1X on a trunk port, an error message appears, and 802.1X is not enabled. If you try to change the mode of an 802.1X-enabled port to trunk, the port mode is not changed.

–EtherChannel port—Before enabling 802.1X on the port, you must first remove it from the EtherChannel. If you try to enable 802.1X on an EtherChannel or on an active port in an EtherChannel, an error message appears, and 802.1X is not enabled. If you enable 802.1X on a not-yet active port of an EtherChannel, the port does not join the EtherChannel.

–Switch Port Analyzer (SPAN) destination port—You can enable 802.1X on a port that is a SPAN destination port; however, 802.1X is disabled until the port is removed as a SPAN destination. You can enable 802.1X on a SPAN source port.

To globally disable 802.1X on the device, you must disable it on each port. There is no global configuration command for this task.

You can verify your settings with the show authentication privileged EXEC command.

The auto keyword allows you to send and receive only Extensible Authentication Protocol over LAN (EAPOL) frames through the port. The authentication process begins when the link state of the port transitions from down to up or when an EAPOL-start frame is received. The system requests the identity of the client and begins relaying authentication messages between the client and the authentication server. Each client attempting to access the network is uniquely identified by the system through the client's MAC address.

Examples

The following example shows that the authentication status of the client PC will be determined by the authentication process:

Switch(config-if)# authentication port-control auto

Switch(config-if)#

Related Commands

authentication priority

To specify the priority of authentication methods on an interface, use the authentication priority command in interface configuration mode. To return to the default settings, use the no form of this command.

authentication priority method1 [method2] [method3]

no authentication priority

Syntax Description

Command Default

The default order is dot1x, MAB, then webauth.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

Configuring priorities for authentication methods allows a higher priority method (not currently running) to interrupt an authentication in progress with a lower priority method. Alternatively, if the client is already authenticated, an interrupt from a higher priority method can cause a client, which was previously authenticated using a lower priority method, to reauthenticate.

The default priority of a method is equivalent to its position in the order of execution list. If you do not configure a priority, the relative priorities (highest first) are dot1x, MAB and then webauth. If you enter the authentication order command, the default priorities are the same as the configured order.

You can verify your settings with the show authentication privileged EXEC command.

Examples

The following example shows how to specify the priority in which authentication methods should be attempted for a client on an interface:

Switch(config-if)# authentication priority mab dot1x webauth

Switch(config-if)#

Related Commands

authentication timer

To configure the authentication timer, use the authentication timer command in interface configuration mode. To return to the default settings, use the no form of this command.

authentication timer {{inactivity value} | {reauthenticate {server | value}} | {restart value}}

no authentication timer {{inactivity value} | {reauthenticate value} | {restart value}}

Syntax Description

Command Default

•inactivity value—Off.

•reauthenticate value—3600

•restart value—Off

Command Modes

Interface configuration mode

Command History

Usage Guidelines

Reauthentication only occurs if it is enabled on the interface.

The authentication timer reauthenticate value command replaces the following dot1x command that is deprecated in Cisco IOS Release 12.2(50)SG and later releases:

[no] dot1x timeout {reauth-period seconds | quiet-period seconds | tx-period seconds | supp-timeout seconds | server-timeout seconds}

Note You should change the default values of this command only to adjust for unusual circumstances such as unreliable links or specific behavioral problems with certain clients or authentication servers.

During the inactivity period, the Ethernet switch network module does not accept or initiate any authentication requests. If you want to provide a faster response time to the user, enter a number less than the default.

The reauthenticate keyword affects the behavior of the Ethernet switch network module only if you have enabled periodic reauthentication with the authentication reauthentication global configuration command.

Examples

The following example shows how to specify that the reauthentication period value for the client should be obtained from the authentication, authorization, and accounting (AAA) server as Session-Timeout (RADIUS Attribute 27):

Switch(config-if)# authentication timer reauthenticate server 

Switch(config-if)#

Related Commands

authentication violation

Use the authentication violation interface configuration command to configure the violation modes: restrict and shutdown.

In single-host mode, a security violation is triggered when more than one device are detected on the data vlan. In multidomain authentication mode, a security violation is triggered when more than one device are detected on the data or voice VLAN.

Security violation cannot be triggered in multiplehost or multiauthentication mode.

authentication violation { restrict | shutdown}

no authentication violation {restrict | shutdown}

Syntax Description

Defaults

Shut down the port. If the restrict keyword is configured, the port does not shutdown.

Command Modes

Interface configuration

Command History

Examples

This example shows how to configure violation mode shutdown on a switch:

Switch# configure terminal

Switch(config)# authentication violation shutdown

A port is error-disabled when a security violation triggers on shutdown mode. The following syslog messages displays:

%AUTHMGR-5-SECURITY_VIOLATION: Security violation on the interface <interface name>, new 
MAC address <mac-address> is seen.

%PM-4-ERR_DISABLE: security-violation error detected on <interface name>, putting 
<interface name> in err-disable state

auto qos voip

To automatically configure quality of service (auto-QoS) for voice over IP (VoIP) within a QoS domain, use the auto qos voip interface configuration command. To change the auto-QoS configuration settings to the standard QoS defaults, use the no form of this command.

auto qos voip {cisco-phone | trust}

no auto qos voip {cisco-phone | trust}

Syntax Description

Defaults

Auto-QoS is disabled on all interfaces.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

Use this command to configure the QoS that is appropriate for VoIP traffic within the QoS domain. The QoS domain includes the switch, the interior of the network, and the edge devices that can classify incoming traffic for QoS.

Use the cisco-phone keyword on the ports at the edge of the network that are connected to Cisco IP phones. The switch detects the telephone through the Cisco Discovery Protocol (CDP) and trusts the CoS labels in packets that are received from the telephone.

Use the trust keyword on the ports that are connected to the interior of the network. Because it is assumed that the traffic has already been classified by the other edge devices, the CoS/DSCP labels in these packets are trusted.

When you enable the auto-QoS feature on the specified interface, these actions automatically occur:

•QoS is globally enabled (qos global configuration command).

•DBL is enabled globally (qos dbl global configuration command).

•When you enter the auto qos voip cisco-phone interface configuration command, the trusted boundary feature is enabled. It uses the Cisco Discovery Protocol (CDP) to detect the presence or absence of a Cisco IP phone. When a Cisco IP phone is detected, the ingress classification on the specific interface is set to trust the CoS label that is received in the packet because some old phones do not mark DSCP. When a Cisco IP phone is absent, the ingress classification is set to not trust the CoS label in the packet.

•When you enter the auto qos voip trust interface configuration command, the ingress classification on the specified interface is set to trust the CoS label that is received in the packet if the specified interface is configured as Layer 2 (and is set to trust DSCP if the interface is configured as Layer 3).

You can enable auto-QoS on static, dynamic-access, voice VLAN access, and trunk ports.

To display the QoS configuration that is automatically generated when auto-QoS is enabled, enable debugging before you enable auto-QoS. Use the debug auto qos privileged EXEC command to enable auto-QoS debugging.

To disable auto-QoS on an interface, use the no auto qos voip interface configuration command. When you enter this command, the switch enables standard QoS and changes the auto-QoS settings to the standard QoS default settings for that interface. This action will not change any global configuration performed by auto-QoS; the global configuration remains the same.

Examples

This example shows how to enable auto-QoS and to trust the CoS and DSCP labels that are received in the incoming packets when the switch or router that is connected to Gigabit Ethernet interface 1/1 is a trusted device:

Switch(config)# interface gigabitethernet1/1

Switch(config-if)# auto qos voip trust

This example shows how to enable auto-QoS and to trust the CoS labels that are received in incoming packets when the device connected to Fast Ethernet interface 2/1 is detected as a Cisco IP phone:

Switch(config)# interface fastethernet2/1

Switch(config-if)# auto qos voip cisco-phone

This example shows how to display the QoS configuration that is automatically generated when auto-QoS is enabled on an interface on Supervisor Engines other than a Supervisor Engine 6-E:

Switch# debug auto qos

AutoQoS debugging is on

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# interface gigabitethernet1/1

Switch(config-if)# auto qos voip trust

Switch(config-if)#

00:00:56:qos

00:00:57:qos map cos 3 to dscp 26

00:00:57:qos map cos 5 to dscp 46

00:00:58:qos map dscp 32 to tx-queue 1

00:00:58:qos dbl

00:01:00:policy-map autoqos-voip-policy

00:01:00:  class class-default

00:01:00:   dbl

00:01:00:interface GigabitEthernet1/1

00:01:00: qos trust cos

00:01:00: tx-queue 3

00:01:00:  priority high

00:01:00:  shape percent 33

00:01:00:  service-policy output autoqos-voip-policy

Switchconfig-if)# interface gigabitethernet1/1

Switch(config-if)# auto qos voip cisco-phone

Switch(config-if)#

00:00:55:qos

00:00:56:qos map cos 3 to dscp 26

00:00:57:qos map cos 5 to dscp 46

00:00:58:qos map dscp 32 to tx-queue 1

00:00:58:qos dbl

00:00:59:policy-map autoqos-voip-policy

00:00:59:  class class-default

00:00:59:   dbl

00:00:59:interface GigabitEthernet1/1

00:00:59: qos trust device cisco-phone

00:00:59: qos trust cos

00:00:59: tx-queue 3

00:00:59:  priority high

00:00:59:  shape percent 33

00:00:59:  bandwidth percent 33

00:00:59:  service-policy output autoqos-voip-policy

This example shows how to display the QoS configuration that is automatically generated when auto-QoS is enabled on an interface on a Supervisor Engine 6-E:

Switch#configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)#interface gigabitethernet3/10

Switch(config-if)#auto qos voip trust

Switch(config-if)#

1d03h:  service-policy input AutoQos-VoIP-Input-Cos-Policy

1d03h:  service-policy output AutoQos-VoIP-Output-Policy 

Switch(config-if)#intface gigabitethernet3/11 

Switch(config-if)#auto qos voip 

cisco-phone 

Switch(config-if)#

1d03h:  qos trust device cisco-phone

1d03h:  service-policy input AutoQos-VoIP-Input-Cos-Policy

1d03h:  service-policy output AutoQos-VoIP-Output-Policy 

Switch(config-if)#end 

Switch#

You can verify your settings by entering the show auto qos interface command.

Related Commands

auto-sync

To enable automatic synchronization of the configuration files in NVRAM, use the auto-sync command. To disable automatic synchronization, use the no form of this command.

auto-sync {startup-config | config-register | bootvar | standard}

no auto-sync {startup-config | config-register | bootvar | standard}

Syntax Description

Defaults

Standard automatic synchronization of all configuration files

Command Modes

Redundancy main-cpu mode

Command History

Usage Guidelines

If you enter the no auto-sync standard command, no automatic synchronizations occur.

Examples

This example shows how (from the default configuration) to enable automatic synchronization of the configuration register in the main CPU:

Switch# config terminal

Switch (config)# redundancy

Switch (config-r)# main-cpu

Switch (config-r-mc)# no auto-sync standard

Switch (config-r-mc)# auto-sync configure-register

Switch (config-r-mc)# 

Related Commands

bandwidth

To specify or modify the minimum bandwidth provided to a class belonging to a policy map attached to a physical port, use the bandwidth policy-map class command. To return to the default setting, use the no form of this command.

bandwidth {bandwidth-kbps | percent percent | remaining percent percent}

no bandwidth

Syntax Description

Defaults

No bandwidth is specified.

Command Modes

Policy-map class configuration mode

Command History

Usage Guidelines

Use the bandwidth command only in a policy map attached to a physical port.

The bandwidth command specifies the minimum bandwidth for traffic in that class when there is traffic congestion in the switch. If the switch is not congested, the class receives more bandwidth than you specify with this command.

When queuing class is configured without any explicit bandwidth configuration, since the queue is not guaranteed any minimum bandwidth, this queue will get a share of any unallocated bandwidth on the port.

If there is no unallocated bandwidth for the new queue or if the unallocated bandwidth is not sufficient to meet the minimum configurable rate for all queues which do not have any explicit bandwidth configuration, then the policy association is rejected.

These restrictions apply to the bandwidth command:

•If the percent keyword is used, the sum of the class bandwidth percentages within a single policy map cannot exceed 100 percent. Percentage calculations are based on the bandwidth available on the port.

•The amount of bandwidth configured should be large enough to accommodate Layer 2 overhead.

•A policy map can have all the class bandwidths specified in either kbps or in percentages, but not a mix of both.

Examples

This example shows how to set the minimum bandwidth to 2000 kbps for a class called silver-class. The class already exists in the switch configuration.

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# policy-map polmap6 

Switch(config-pmap)# class silver-class

Switch(config-pmap-c)# bandwidth 2000

Switch(config-pmap-c)# end

This example shows how to guarantee 30 percent of the bandwidth for class1 and 25 percent of the bandwidth for class2 when CBWFQ is configured. A policy map with two classes is created and is then attached to a physical port.

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# policy-map policy1 

Switch(config-pmap)# class class1 

Switch(config-pmap-c)# bandwidth percent 50 

Switch(config-pmap-c)# exit 

Switch(config-pmap)# class class2 

Switch(config-pmap-c)# bandwidth percent 25 

Switch(config-pmap-c)# exit 

Switch(config-pmap)# end 

Switch(config)# interface gigabitethernet1/1

Switch(config-if)# service-policy input policy1 

Switch(config-if)# end 

This example shows how bandwidth is guaranteed if low-latency queueing (LLQ) and bandwidth are configured. In this example, LLQ is enabled in a class called voice1.

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# policy-map policy1 

Switch(config-pmap)# class class1 

Switch(config-pmap-c)# bandwidth remaining percent 50 

Switch(config-pmap-c)# exit 

Switch(config-pmap)# class class2 

Switch(config-pmap-c)# bandwidth remaining percent 25 

Switch(config-pmap-c)# exit 

Switch(config-pmap)# class voice1 

Switch(config-pmap-c)# priority

Switch(config-pmap-c)# exit 

Switch(config-pmap)# end 

Switch(config)# interface gigabitethernet1/1

Switch(config-if)# service-policy output policy1 

Switch(config-if)# end 

You can verify your settings by entering the show policy-map privileged EXEC command.

Related Commands

call-home (global configuration)

To enter call home configuration submode, use the call-home command in global configuration mode.

call-home

Syntax Description

This command has no arguments or keywords.

Command Default

This command has no default settings.

Command Modes

Global configuration mode

Command History

Usage Guidelines

Once you enter the call-home command, the prompt changes to Switch (cfg-call-home)#, and you have access to the call home configuration commands as follows:

•alert-group—Enables or disables an alert group. See the alert-group command.

•contact-email-addr email-address—Assigns the system contact's e-mail address. You can enter up to 128 alphanumeric characters in e-mail address format with no spaces.

•contract-id alphanumeric—Specifies the customer contract identification for Cisco AutoNotification. You can enter up to 64 alphanumeric characters. If you include spaces, you must enclose your entry in quotes (" ").

•copy profile source-profile target-profile—Creates a new destination profile (target-profile) with the same configuration settings as the existing profile (source-profile).

•customer-id name—Provides customer identification for Cisco AutoNotify. You can enter up to 256 alphanumeric characters. If you include spaces, you must enclose your entry in quotes (" ").

•default—Sets a command to its defaults.

•exit—Exits call home configuration mode and returns to global configuration mode.

•mail-server {ipv4-address | name} priority priority—Assigns the customer's e-mail server address and relative priority. You can enter an IP address or a fully qualified domain name (FQDN), and assign a priority from 1 (highest) to 100 (lowest).

You can define backup e-mail servers by repeating the mail-server command and entering different priority numbers.

•no—Negates a command or set its defaults.

•phone-number +phone-number—Specifies the phone number of the contact person. The phone-number value must begin with a plus (+) prefix, and may contain only dashes (-) and numbers. You can enter up to 16 characters. If you include spaces, you must enclose your entry in quotes (" ").

•profile name—Enters call-home profile configuration mode. See the profile command.

•rate-limit threshold—Configures the call-home message rate-limit threshold; valid values are from 1 to 60 messages per minute.

•sender {from | reply-to} email-address—Specifies the call-home message sender's e-mail addresses. You can enter up to 128 alphanumeric characters in e-mail address format with no spaces.

•site-id alphanumeric—Specifies the site identification for Cisco AutoNotify. You can enter up to 256 alphanumeric characters. If you include spaces, you must enclose your entry in quotes (" ").

•street-address street-address—Specifies the street address for the RMA part shipments. You can enter up to 256 alphanumeric characters. If you include spaces, you must enclose your entry in quotes (" ").

•vrf—Specifies the VPN routing or forwarding instance name; limited to 32 characters.

Examples

This example show how to configure the contact information:

Switch# configure terminal 

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# call-home

Switch(cfg-call-home)# contact-email-addr username@example.com

Switch(cfg-call-home)# phone-number +1-800-555-4567

Switch(cfg-call-home)# street-address "1234 Picaboo Street, Any city, Any state, 12345"

Switch(cfg-call-home)# customer-id Customer1234

Switch(cfg-call-home)# site-id Site1ManhattanNY

Switch(cfg-call-home)# contract-id Company1234

Switch(cfg-call-home)# exit

Switch(config)#

This example shows how to configure the call-home message rate-limit threshold:

Switch(config)# call-home

Switch(cfg-call-home)# rate-limit 50

This example shows how to set the call-home message rate-limit threshold to the default setting:

Switch(config)# call-home

Switch(cfg-call-home)# default rate-limit

This example shows how to create a new destination profile with the same configuration settings as an existing profile:

Switch(config)# call-home

Switch(cfg-call-home)# copy profile profile1 profile1a

This example shows how to configure the general e-mail parameters, including a primary and secondary e-mail server:

Switch# configure terminal 

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# call-home

Switch(cfg-call-home)# mail-server smtp.example.com priority 1

Switch(cfg-call-home)# mail-server 192.168.0.1 priority 2

Switch(cfg-call-home)# sender from username@example.com

Switch(cfg-call-home)# sender reply-to username@example.com

Switch(cfg-call-home)# exit

Switch(config)#

This example shows how to specify MgmtVrf as the vrf name where the call-home email message is forwarded:

Switch(cfg-call-home)# vrf MgmtVrf

Related Commands

call-home request

To submit information about your system to Cisco for report and analysis information from the Cisco Output Interpreter tool, use the call-home request command in privileged EXEC mode. An analysis report is sent by Cisco to a configured contact e-mail address.

call-home request {output-analysis "show-command" | config-sanity | bugs-list | command-reference | product-advisory} [profile name] [ccoid user-id]

Syntax Description

Command Default

This command has no default settings.

Command Modes

Privileged EXEC mode

Command History

Usage Guidelines

The recipient profile does not need to be enabled for the call-home request. The profile should specify the e-mail address where the transport gateway is configured so that the request message can be forwarded to the Cisco TAC and the user can receive the reply from the Smart Call Home service.

Based on the keyword specifying the type of report requested, the following information is returned in response to the request:

•config-sanity—Information on best practices as related to the current running configuration.

•bugs-list—Known bugs in the running version and in the currently applied features.

•command-reference—Reference links to all commands in the running configuration.

•product-advisory—Product Security Incident Response Team (PSIRT) notices, End of Life (EOL) or End of Sales (EOS) notices, or field notices (FN) that may affect devices in your network.

Examples

This example shows a request for analysis of a user-specified show command:

Switch# call-home request output-analysis "show diagnostic result module all" profile TG

Related Commands

call-home send

To execute a CLI command and e-mail the command output, use the call-home send command in privileged EXEC mode.

call-home send "cli-command" {email email-addr [service-number SR] | service-number SR}

Syntax Description

Command Default

This command has no default settings.

Command Modes

Privileged EXEC mode

Command History

Usage Guidelines

This command causes the specified CLI command to be executed on the system. The specified CLI command must be enclosed in quotes (""), and can be any run or show command, including commands for all modules.

The command output is then sent by e-mail to the specified e-mail address. If no e-mail address is specified, the command output is sent to the Cisco TAC at attach@cisco.com. The e-mail is sent in long text format with the service number, if specified, in the subject line.

Examples

This example shows how to send a CLI command and have the command output e-mailed:

Switch# call-home send "show diagnostic result module all" email support@example.com

Related Commands

call-home send alert-group

To send a specific alert group message, use the call-home send alert-group command in privileged EXEC mode.

call-home send alert-group {configuration | diagnostic module number | inventory} [profile profile-name]

Syntax Description

Command Default

This command has no default settings.

Command Modes

Privileged EXEC mode

Command History

Usage Guidelines

When you enter the module number, you can enter the number of the module.

If you do not specify the profile profile-name, the message is sent to all subscribed destination profiles.

Only the configuration, diagnostic, and inventory alert groups can be manually sent. The destination profile need not be subscribed to the alert group.

Examples

This example shows how to send the configuration alert-group message to the destination profile:

Switch# call-home send alert-group configuration

This example shows how to send the diagnostic alert-group message to the destination profile for a specific module number:

Switch# call-home send alert-group diagnostic module 3

This example shows how to send the diagnostic alert-group message to all destination profiles for a specific module number:

Switch# call-home send alert-group diagnostic module 3 profile Ciscotac1

This example shows how to send the inventory call-home message:

Switch# call-home send alert-group inventory 

Related Commands

call-home test

To manually send a Call Home test message, use the call-home test command in privileged EXEC mode.

call-home test ["test-message"] profile profile-name

Syntax Description

Command Default

This command has no default settings.

Command Modes

Privileged EXEC mode

Command History

Usage Guidelines

This command sends a test message to the specified destination profile. If you enter test message text, you must enclose the text in quotes ("") if it contains spaces. If you do not enter a message, a default message is sent.

Examples

This example shows how to manually send a Call Home test message:

Switch# call-home test "test of the day" profile Ciscotac1

Related Commands

channel-group

To assign and configure an EtherChannel interface to an EtherChannel group, use the channel-group command. To remove a channel group configuration from an interface, use the no form of this command.

channel-group number mode {active | on | auto [non-silent]} | {passive | desirable [non-silent]}

no channel-group

Syntax Description

Defaults

No channel groups are assigned.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

You do not have to create a port-channel interface before assigning a physical interface to a channel group. If a port-channel interface has not been created, it is automatically created when the first physical interface for the channel group is created.

If a specific channel number is used for the PAgP-enabled interfaces of a channel group, that same channel number cannot be used for configuring a channel that has LACP-enabled interfaces or vice versa.

You can also create port channels by entering the interface port-channel command. This will create a Layer 3 port channel. To change the Layer 3 port channel into a Layer 2 port channel, use the switchport command before you assign physical interfaces to the channel group. A port channel cannot be changed from Layer 3 to Layer 2 or vice versa when it contains member ports.

You do not have to disable the IP address that is assigned to a physical interface that is part of a channel group, but we recommend that you do so.

Any configuration or attribute changes that you make to the port-channel interface are propagated to all interfaces within the same channel group as the port channel (for example, configuration changes are also propagated to the physical interfaces that are not part of the port channel, but are part of the channel group).

You can create in on mode a usable EtherChannel by connecting two port groups together.

Caution Do not enable Layer 3 addresses on the physical EtherChannel interfaces. Do not assign bridge groups on the physical EtherChannel interfaces because it creates loops.

Examples

This example shows how to add Gigabit Ethernet interface 1/1 to the EtherChannel group that is specified by port-channel 45:

Switch(config-if)# channel-group 45 mode on 

Creating a port-channel interface Port-channel45

Switch(config-if)# 

Related Commands

channel-protocol

To enable LACP or PAgP on an interface, use the channel-protocol command. To disable the protocols, use the no form of this command.

channel-protocol {lacp | pagp}

no channel-protocol {lacp | pagp}

Syntax Description

Defaults

PAgP

Command Modes

Interface configuration mode

Command History

Usage Guidelines

This command is not supported on systems that are configured with a Supervisor Engine I.

You can also select the protocol using the channel-group command.

If the interface belongs to a channel, the no form of this command is rejected.

All ports in an EtherChannel must use the same protocol; you cannot run two protocols on one module.

PAgP and LACP are not compatible; both ends of a channel must use the same protocol.

You can manually configure a switch with PAgP on one side and LACP on the other side in the on mode.

You can change the protocol at any time, but this change causes all existing EtherChannels to reset to the default channel mode for the new protocol. You can use the channel-protocol command to restrict anyone from selecting a mode that is not applicable to the selected protocol.

Configure all ports in an EtherChannel to operate at the same speed and duplex mode (full duplex only for LACP mode).

For a complete list of guidelines, refer to the "Configuring EtherChannel" section of the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.

Examples

This example shows how to select LACP to manage channeling on the interface:

Switch(config-if)# channel-protocol lacp

Switch(config-if)# 

Related Commands

class

To specify the name of the class whose traffic policy you want to create or change, use the class policy-map configuration command. To delete an existing class from a policy map, use the no form of this command.

class class-name

no class class-name

Syntax Description

Defaults

No classes are defined; except for the class-default.

Command Modes

Policy-map configuration mode

Command History

Usage Guidelines

Before using the class command, you must create a class map for matching packets to the class by using the class-map global configuration command. You also must use the policy-map global configuration command to identify the policy map and to enter policy-map configuration mode. After specifying a policy map, you can configure a traffic policy for new classes or modify a traffic policy for any existing classes in that policy map. The class name that you specify with the class command in the policy map ties the characteristics for that class (its policy) to the class map and its match criteria, as configured through the class-map global configuration command. You attach the policy map to a port by using the service-policy (interface configuration) configuration command.

After you enter the class command, the switch enters policy-map class configuration mode, and these configuration commands are available:

•bandwidth Specifies or modifies the minimum bandwidth provided to a class belonging to a policy map. For more information, see the bandwidth command. This command is available on the Supervisor Engine 6-E and the Catalyst 4900M chassis.

•dbl Enables dynamic buffer limiting for traffic hitting this class. For details on dbl parameters refer to the show qos dbl command.

•exit Exits policy-map class configuration mode and returns to policy-map configuration mode.

•no Returns a command to its default setting.

•police Configures a single-rate policer, an aggregate policer, or a two-rate traffic policer that uses the committed information rate (CIR) and the peak information rate (PIR) for a class of traffic. The policer specifies the bandwidth limitations and the action to take when the limits are exceeded. For more information, see the police command. For more information about the two-rate policer, see the police (two rates) and the police (percent) command. The two-rate traffic policer is supported on a Supervisor Engine 6-E and the Catalyst 4900M chassis.

•priority Enables the strict priority queue for a class of traffic. For more information, see the priority command. This command is supported on the Supervisor Engine 6-E and the Catalyst 4900M chassis.

•service-policy (policy-map class) Creates a service policy as a quality of service (QoS) policy within a policy map (called a hierarchical service policy). For more information, see the service-policy (policy-map class) command. This command is effective only in a hierarchical policy map attached to an interface.

•set Classifies IP traffic by setting a class of service (CoS), a Differentiated Services Code Point (DSCP) or IP-precedence in the packet. For more information, see the set command.

•shape (class-based queueing) Sets the token bucket committed information rate (CIR) in a policy map. For more information, see the shape (class-based queueing) command. This command is supported on the Supervisor Engine 6-E and the Catalyst 4900M chassis.

•trust Defines a trust state for a traffic class. For more information, see the trust command. This command is not supported on the Supervisor Engine 6-E and the Catalyst 4900M chassis.

The switch supports up to 256 classes, including the default class, in a policy map. Packets that fail to meet any of the matching criteria are classified as members of the default traffic class. You configure the default traffic class by specifying class-default as the class name in the class policy-map class configuration command. You can manipulate the default traffic class (for example, set policies to police or to shape it) just like any other traffic class, but you cannot delete it.

To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command.

Examples

This example shows how to create a policy map called policy1. When attached to an ingress port, the policy matches all the inbound traffic defined in class1, sets the IP DSCP to 10, and polices the traffic at an average rate of 1 Mbps and bursts of 20 KB. Traffic exceeding the profile is marked down to a Traffic exceeding the profile is marked down to a DSCP value obtained from the policed-DSCP map and then sent.

Switch# configure terminal

Switch(config)# class-map class1

Switch(config-cmap)# exit

Switch(config)# policy-map policy1

Switch(config-pmap)# class class1

Switch(config-pmap-c)# set ip dscp 10

Switch(config-pmap-c)# police 1000000 20000 exceed-action policed-dscp-transmit

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet1/0/4

Switch(config-if)# service-policy input policy1

Switch# 

You can verify your settings by entering the show policy-map privileged EXEC command.

Related Commands

class-map

To create a class map to be used for matching packets to the class whose name you specify and to enter class-map configuration mode, use the class-map global configuration command. To delete an existing class map and to return to global configuration mode, use the no form of this command.

class-map [match-all | match-any] class-map-name

no class-map [match-all | match-any] class-map-name

Syntax Description

Defaults

No class maps are defined.

If neither the match-all nor the match-any keyword is specified, the default is match-all.

Command Modes

Global configuration mode

Command History

Usage Guidelines

Use this command to specify the name of the class for which you want to create or modify class-map match criteria and to enter class-map configuration mode. Packets are checked against the match criteria configured for a class map to decide if the packet belongs to that class. If a packet matches the specified criteria, the packet is considered a member of the class and is forwarded according to the quality of service (QoS) specifications set in the traffic policy.

After you enter the class-map command, the switch enters class-map configuration mode, and these configuration commands are available:

•description Describes the class map (up to 200 characters). The show class-map privileged EXEC command displays the description and the name of the class map.

•exit Exits from QoS class-map configuration mode.

•match Configures classification criteria. For more information, see the match (class-map configuration) command.

•no Removes a match statement from a class map.

Examples

This example shows how to configure the class map called class1 with one match criterion, which is an access list called 103:

Switch# configure terminal

Switch(config)# access-list 103 permit any any dscp 10

Switch(config)# class-map class1

Switch(config-cmap)# match access-group 103

Switch(config-cmap)# exit

Switch# 

This example shows how to delete the class1 class map:

Switch# configure terminal

Switch(config)# no class-map class1

Switch# 

You can verify your settings by entering the show class-map privileged EXEC command.

Related Commands

clear counters

To clear the interface counters, use the clear counters command.

clear counters [{FastEthernet interface_number} | {GigabitEthernet interface_number} |
{null interface_number} | {port-channel number} | {vlan vlan_id}]

Syntax Description

Defaults

This command has no default settings.

Command Modes

Privileged EXEC mode

Command History

Usage Guidelines

This command clears all the current interface counters from all the interfaces unless you specify an interface.

Note This command does not clear the counters that are retrieved using SNMP, but only those seen when you enter the show interface counters command.

Examples

This example shows how to clear all the interface counters:

Switch# clear counters

Clear "show interface" counters on all interfaces [confirm] y

Switch# 

This example shows how to clear the counters on a specific interface:

Switch# clear counters vlan 200

Clear "show interface" counters on this interface [confirm]y

Switch# 

Related Commands

clear energywise neighbors

Use the clear energywise neighbors privileged EXEC command to delete the EnergyWise neighbor tables.

clear energywise neighbors

Syntax Description

This command has no arguments or keywords.

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Examples

This example shows how to delete the neighbor tables:

Switch# clear energywise neighbors

Cleared all non static energywise neighbors

You can verify that the tables were deleted by entering the show energywise neighbors privileged EXEC command.

Note The clear energywise neighbors command clears all discovered neighbors.

Related Commands

clear errdisable

To re-enable error-disabled VLANs on an interface, use the clear errdisable command.

clear errdisable interface {name} vlan [range]

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration mode

Command History

Usage Guidelines

If a VLAN range is not specified, all VLANs on the specified interface are re-enabled. The clear errdisable command recovers the disabled VLANs on an interface.

Clearing the error-disabled state from a virtual port does not change the link state of the physical port, and it does not affect other VLAN ports on the physical port. It does post an event to STP, and spanning tree goes through its normal process of bringing that VLAN port to the appropriate blocking or forwarding state.

Examples

This example shows how to re-enable a range of disabled VLANs on an interaface:

Switch# clear errdisable interface ethernet2 vlan 10-15

Switch# 

Related Commands

clear hw-module slot password

To clear the password on an intelligent line module, use the clear hw-module slot password command.

clear hw-module slot slot_num password

Syntax Description

Defaults

The password is not cleared.

Command Modes

Privileged EXEC mode

Command History

Usage Guidelines

You only need to change the password once unless the password is reset.

Examples

This example shows how to clear the password from slot 5 on a line module:

Switch# clear hw-module slot 5 password

Switch# 

Related Commands

clear interface gigabitethernet

To clear the hardware logic from a Gigabit Ethernet IEEE 802.3z interface, use the clear interface gigabitethernet command.

Note On a Catalyst 4500 series switch, this command does not increment interface resets as displayed with the show interface gigabitethernet mod/port command.

clear interface gigabitethernet mod/port

Syntax Description

Defaults

This command has no default settings.

Command Modes

Privileged EXEC mode

Command History

Examples

This example shows how to clear the hardware logic from a Gigabit Ethernet IEEE 802.3z interface:

Switch# clear interface gigabitethernet 1/1

Switch# 

Related Commands

clear interface vlan

To clear the hardware logic from a VLAN, use the clear interface vlan command.

clear interface vlan number

Syntax Description

Defaults

This command has no default settings.

Command Modes

Privileged EXEC mode

Command History

Examples

This example shows how to clear the hardware logic from a specific VLAN:

Switch# clear interface vlan 5

Switch# 

Related Commands

clear ip access-template

To clear the statistical information in access lists, use the clear ip access-template command.

clear ip access-template access-list

Syntax Description

Defaults

This command has no default settings.

Command Modes

Privileged EXEC mode

Command History

Examples

This example shows how to clear the statistical information for an access list:

Switch# clear ip access-template 201

Switch# 

clear ip arp inspection log

To clear the status of the log buffer, use the clear ip arp inspection log command.

clear ip arp inspection log

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

Privileged EXEC mode

Command History

Examples

This example shows how to clear the contents of the log buffer: