Catalyst 4500 Series Switch Cisco IOS Command Reference, 12.2(20)EW

interface port-channel

To access or create a port channel interface, use the interface port-channel command.

interface port-channel channel-group

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration

Command History

Usage Guidelines

You do not have to create a port channel interface before assigning a physical interface to a channel group. A port channel interface is created automatically when the channel group gets its first physical interface, if it is not already created.

You can also create port channels by entering the interface port-channel command. This will create a Layer 3 port channel. To change the Layer 3 port channel into a Layer 2 port channel, use the switchport command before you assign physical interfaces to the channel group. A port channel cannot be changed from Layer 3 to Layer 2 or vice versa when it contains member ports.

Only one port channel in a channel group is allowed.

Caution The Layer 3 port channel interface is the routed interface. Do not enable Layer 3 addresses on the physical Fast Ethernet interfaces.

If you want to use CDP, you must configure it only on the physical Fast Ethernet interface and not on the port-channel interface.

Examples

This example creates a port channel interface with a channel group number of 64:

Switch(config)# interface port-channel 64

Switch(config)# 

Related Commands

channel-group
show etherchannel

interface range

To run a command on multiple ports at the same time, use the interface range command.

interface range {vlan vlan_id - vlan_id} {port-range | macro name}

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration

Interface configuration

Command History

Usage Guidelines

You can use the interface range command on existing VLAN SVIs only. To display VLAN SVIs, enter the show running config command. VLANs not displayed cannot be used in the interface range command.

The values entered with the interface range command are applied to all existing VLAN SVIs.

Before you can use a macro, you must define a range using the define interface-range command.

All configuration changes made to a port range are saved to NVRAM, but port ranges created with the interface range command do not get saved to NVRAM.

You can enter the port range in two ways:

•Specifying up to five port ranges

•Specifying a previously defined macro

You can either specify the ports or the name of a port-range macro. A port range must consist of the same port type, and the ports within a range cannot span modules.

You can define up to five port ranges on a single command; separate each range with a comma.

When you define a range, you must enter a space between the first port and the hyphen (-):

interface range gigabitethernet 5/1 -20, gigabitethernet4/5 -20.

Use these formats when entering the port-range:

•interface-type {mod}/{first-port} - {last-port}

•interface-type {mod}/{first-port} - {last-port}

Valid values for interface-type are as follows:

•FastEthernet

•GigabitEthernet

•Vlan vlan_id

You cannot specify both a macro and an interface range in the same command. After creating a macro, you can enter additional ranges. Likewise, if you have already entered an interface range, the CLI does not allow you to enter a macro.

You can specify a single interface in the port-range value. This makes the command similar to the interface interface-number command.

Examples

This example shows how to use the interface range command to interface to FE 5/18 - 20:

Switch(config)# interface range fastethernet 5/18 - 20

Switch(config-if)# 

This command shows how to run a port-range macro:

Switch(config)# interface range macro macro1

Switch(config-if)# 

Related Commands

define interface-range
show running config (refer to Cisco IOS documentation)

interface vlan

To create or access a Layer 3 switch virtual interface (SVI), use the interface vlan command. To delete an SVI, use the no form of this command.

interface vlan vlan_id

no interface vlan vlan_id

Syntax Description

Defaults

Fast EtherChannel is not specified.

Command Modes

Global configuration

Command History

Usage Guidelines

SVIs are created the first time you enter the interface vlan vlan_id command for a particular VLAN. The vlan_id value corresponds to the VLAN tag associated with data frames on an ISL or 802.1Q encapsulated trunk, or the VLAN ID configured for an access port. A message is displayed whenever a VLAN interface is newly created, so you can check that you entered the correct VLAN number.

If you delete an SVI by entering the no interface vlan vlan_id command, the associated interface is forced into an administrative down state and marked as deleted. The deleted interface will no longer be visible in a show interface command.

You can reinstate a deleted SVI by entering the interface vlan vlan_id command for the deleted interface. The interface comes back up, but much of the previous configuration will be gone.

Examples

This example shows the output when you enter the interface vlan vlan_id command for a new VLAN number:

Switch(config)# interface vlan 23

% Creating new VLAN interface.

Switch(config)# 

ip arp inspection filter vlan

To permit ARPs from hosts configured for static IP when DAI is enabled and to define an ARP access list and apply it to a VLAN, use the ip arp inspection filter vlan command. Use the no form of this command to disable this application.

ip arp inspection filter arp-acl-name vlan vlan-range [static]

no ip arp inspection filter arp-acl-name vlan vlan-range [static]

Syntax Description

Defaults

No defined ARP ACLs are applied to any VLAN.

Command Modes

Configuration

Command History

Usage Guidelines

When an ARP access control list is applied to a VLAN for dynamic ARP inspection, ARP packets containing only IP-to-Ethernet MAC bindings are compared against the ACLs. All other packet types are bridged in the incoming VLAN without validation.

This command specifies that incoming ARP packets are compared against the ARP access control list, and packets are permitted only if the access control list permits them.

If access control lists deny packets because of explicit denies, the packets are dropped. If packets are denied because of an implicit deny, they are then matched against the list of DHCP bindings if the ACL is not applied statically.

Examples

This example shows how to apply the ARP ACL "static-hosts" to VLAN 1 for DAI:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip arp inspection filter static-hosts vlan 1

Switch(config)# end

Switch#

Switch# show ip arp inspection vlan 1

Source Mac Validation      : Enabled

Destination Mac Validation : Disabled

IP Address Validation      : Disabled

 Vlan     Configuration    Operation   ACL Match          Static ACL

 ----     -------------    ---------   ---------          ----------

    1     Enabled          Active      static-hosts      No 

 Vlan     ACL Logging      DHCP Logging

 ----     -----------      ------------

    1     Acl-Match        Deny  

Switch#

Related Commands

arp access-list
show ip arp inspection

ip arp inspection limit (interface)

To limit the rate of incoming ARP requests and responses on an interface and prevent DAI from consuming all of the system's resources in event of a DOS attack, use the ip arp inspection limit command. Use the no form of this command to release the limit.

ip arp inspection limit {rate pps | none} [burst interval seconds]

no ip arp inspection limit

Syntax Description

Defaults

The rate is set to 15 packets per second on untrusted interfaces, assuming that the network is a switched network with a host connecting to as many as 15 new hosts per second.

The rate is unlimited on all trusted interfaces.

Burst interval is set to 1 second by default.

Command Modes

Interface

Command History

Usage Guidelines

Trunk ports should be configured with higher rates to reflect their aggregation. When the rate of incoming packets exceeds the user-configured rate, the interface is placed into an error-disabled state. The error-disable timeout feature can be used to remove the port from the error-disabled state. The rate applies to both trusted and nontrusted interfaces. Configure appropriate rates on trunks to handle packets across multiple DAI-enabled VLANs or use the none keyword to make the rate unlimited.

The rate of incoming ARP packets on channel ports is equal to the sum of the incoming rate of packets from all the channel members. Configure the rate limit for channel ports only after examining the rate of incoming ARP packets on the channel members.

After a switch receives more than the configured rate of packets every second consecutively over a period of burst seconds, the interface is placed into an error-disabled state.

Examples

This example shows how to limit the rate of incoming ARP requests to 25 packets per second:

Switch# config terminal

Switch(config)# interface fa6/3

Switch(config-if)# ip arp inspection limit rate 25

Switch(config-if)# end

Switch# show ip arp inspection interfaces fastEthernet 6/3

Interface        Trust State     Rate (pps)

 ---------------  -----------     ----------

 Fa6/3            Trusted                 25

Switch#

This example shows how to limit the rate of incoming ARP requests to 20 packets per second and to set the interface monitoring interval to 5 consecutive seconds:

Switch# config terminal

Switch(config)# interface fa6/1

Switch(config-if)# ip arp inspection limit rate 20 burst interval 5

Switch(config-if)# end

Related Commands

show ip arp inspection

ip arp inspection log-buffer

To configure parameters that are associated with the logging buffer, use the ip arp inspection log-buffer command. Use the no form of this command to disable the parameters.

ip arp inspection log-buffer {entries number | logs number interval seconds}

no ip arp inspection log-buffer {entries | logs}

Syntax Description

Defaults

When dynamic ARP inspection is enabled, denied, or dropped, ARP packets are logged.

The number of entries is set to 32.

The number of logging entries is limited to 5 per second.

The interval is set to 1.

Command Modes

Configuration

Command History

Usage Guidelines

The first dropped packet of a given flow is logged immediately. Subsequent packets for the same flow are registered but not logged immediately. Registering these packets is done in a log buffer that is shared by all VLANs. Entries from this buffer are logged on a rate-controlled basis.

Examples

This example shows how to configure the logging buffer to hold up to 45 entries:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip arp inspection log-buffer entries 45

Switch(config)# end

Switch# show ip arp inspection log 

Total Log Buffer Size : 45

Syslog rate : 5 entries per 1 seconds.

No entries in log buffer.

Switch#

This example shows how to configure the logging rate to 10 logs per 3 seconds:

Switch(config)# ip arp inspection log-buffer logs 10 interval 3

Switch(config)# end

Switch# show ip arp inspection log

Total Log Buffer Size : 45

Syslog rate : 10 entries per 3 seconds.

No entries in log buffer.

Switch# 

Related Commands

arp access-list
show ip arp inspection

ip arp inspection trust

To set a per-port configurable trust state that determines the set of interfaces where incoming ARP packets are inspected, use the ip arp inspection trust command. Use the no form of this command to make interfaces untrusted.

ip arp inspection trust

no ip arp inspection trust

Syntax Description

This command has no arguments or keywords.

Defaults

None

Command Modes

Interface

Command History

Examples

This example shows how to configure an interface to be trusted:

Switch# config terminal

Switch(config)# interface fastEthernet 6/3

Switch(config-if)# ip arp inspection trust 

Switch(config-if)# end

To verify the configuration, use the show form of the command:

Switch# show ip arp inspection interfaces fastEthernet 6/3

 Interface        Trust State     Rate (pps)

 ---------------  -----------     ----------

 Fa6/3            Trusted               None

Switch#

Related Commands

show ip arp inspection

ip arp inspection validate

To perform specific checks for ARP inspection, use the ip arp inspection validate command. Use the no form of this command to disable the checks.

ip arp inspection validate [src-mac] [dst-mac] [ip]

no ip arp inspection validate [src-mac] [dst-mac] [ip]

Syntax Description

Defaults

Checks are disabled.

Command Modes

Configuration

Command History

Usage Guidelines

When enabling the checks, specify at least one of the keywords (src-mac, dst-mac, and ip) on the command line. Each command overrides the configuration of the previous command; that is, if a command enables src and dst mac validations, and a second command enables IP validation only, the src and dst mac validations are disabled as a result of the second command.

The no form of the command disables only the specified checks. If none of the check options are enabled, all checks are disabled.

Examples

This example show how to enable source MAC validation:

Switch(config)# ip arp inspection validate src-mac 

Switch(config)# end

Switch# show ip arp inspection vlan 1

Source Mac Validation      : Enabled

Destination Mac Validation : Disabled

IP Address Validation      : Disabled

 Vlan     Configuration    Operation   ACL Match          Static ACL

 ----     -------------    ---------   ---------          ----------

    1     Enabled          Active                        

 Vlan     ACL Logging      DHCP Logging

 ----     -----------      ------------

    1     Deny             Deny 

Switch#

Related Commands

arp access-list
show arp access-list

ip arp inspection vlan

To enable dynamic ARP inspection (DAI) on a per-VLAN basis, use the ip arp inspection vlan command. Use the no form of this command to disable DAI.

ip arp inspection vlan vlan-range

no ip arp inspection vlan vlan-range

Syntax Description

Defaults

ARP inspection is disabled on all VLANs.

Command Modes

Configuration

Command History

Usage Guidelines

You must specify on which VLANs to enable DAI. DAI may not function on the configured VLANs if they have not been created or if they are private.

Examples

This example shows how to enable DAI on VLAN 1:

Switch(config)# ip arp inspection vlan 1

Switch(config)# end

Switch# show ip arp inspection vlan 1

Source Mac Validation      : Disabled

Destination Mac Validation : Disabled

IP Address Validation      : Disabled

Vlan     Configuration    Operation   ACL Match          Static ACL

 ----     -------------    ---------   ---------          ----------

    1     Enabled          Active                        

Vlan     ACL Logging      DHCP Logging

 ----     -----------      ------------

    1     Deny             Deny  

Switch# 

Related Commands

arp access-list
show ip arp inspection

ip arp inspection vlan logging

To control the type of packets that are logged, use the ip arp inspection vlan logging command. Use the no form of this command to disable this logging control.

ip arp inspection vlan vlan-range logging {acl-match {matchlog | none} | dhcp-bindings {permit | all | none}}

no ip arp inspection vlan vlan-range logging {acl-match | dhcp-bindings}

Syntax Description

Defaults

All denied or dropped packets are logged.

Command Modes

Configuration

Command History

Usage Guidelines

The acl-match and dhcp-bindings keywords merge with each other; that is, when you set an ACL match configuration, the DHCP bindings configuration is not disabled. The no form of the command can be used to reset some of the logging criteria to their defaults. If neither option is specified, all types of logging are reset to log on when ARP packets are denied. The two options available to you are:

•acl-match—Logging on ACL matches is reset to log on deny

•dhcp-bindings—Logging on DHCP binding compared is reset to log on deny

Examples

This example shows how to configure ARP inspection on VLAN 1 to log packets on matching against ACLs with the logging keyword:

Switch# config terminal

Enter configuration commands, one per line.  End with CNTL/Z.

Switch(config)# ip arp inspection vlan 1 logging acl-match matchlog 

Switch(config)# end

Switch# show ip arp inspection vlan 1

Source Mac Validation      : Enabled

Destination Mac Validation : Disabled

IP Address Validation      : Disabled

 Vlan     Configuration    Operation   ACL Match          Static ACL

 ----     -------------    ---------   ---------          ----------

    1     Enabled          Active                        

 Vlan     ACL Logging      DHCP Logging

 ----     -----------      ------------

    1     Acl-Match        Deny  

Switch#

Related Commands

arp access-list
show ip arp inspection

ip cef load-sharing algorithm

To configure the load-sharing hash function so that the source TCP/UDP port, or the destination TCP/UDP port, or both can be included in the hash in addition to the source and destination IP addresses, use the ip cef load-sharing algorithm command. To revert back to the default, which does not include the ports, use the no form of this command.

ip cef load-sharing algorithm {include-ports {source source | destination dest} | original | tunnel | universal}

no ip cef load-sharing algorithm {include-ports {source source | destination dest} | original | tunnel | universal}

Syntax Description

Defaults

Default load-sharing algorithm is disabled.

Note This option does not include the source or destination port in the load-balancing hash.

Command Modes

Global configuration

Command History

Usage Guidelines

The original algorithm, tunnel algorithm, and universal algorithm are routed through hardware. For software-routed packets, the algorithms are handled by the software. The include-ports option does not apply to software-switched traffic.

Examples

This example shows how to configure the IP CEF load-sharing algorithm that includes Layer 4 ports:

Switch(config)# ip cef load-sharing algorithm include-ports

Switch(config)# 

Related Commands

show ip cef vlan

ip dhcp snooping

To enable DHCP snooping globally, use the ip dhcp snooping command. To disable DHCP snooping, use the no form of this command.

ip dhcp snooping

no ip dhcp snooping

Syntax Description

This command has no arguments or keywords.

Defaults

DHCP snooping is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

You must enable DHCP snooping globally before you can use DHCP snooping on a VLAN.

Examples

This example shows how to enable DHCP snooping:

Switch(config)# ip dhcp snooping

Switch(config)# 

This example shows how to disable DHCP snooping:

Switch(config)# no ip dhcp snooping 

Switch(config)# 

Related Commands

ip dhcp snooping information option
ip dhcp snooping limit rate
ip dhcp snooping trust
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping binding

ip dhcp snooping binding

To set up and generate a DHCP binding configuration to restore bindings across reboots, use the ip dhcp snooping binding command. To disable the binding configuration, use the no form of this command.

ip dhcp snooping binding mac-address vlan vlan-# ip-address interface interface expiry seconds

no ip dhcp snooping binding mac-address vlan vlan-# ip-address interface interface

Syntax Description

Defaults

This command has no default settings.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

Whenever a binding is added or removed using this command, the binding database is marked as changed and a write is initiated.

Examples

This example shows how to generate DHCP binding configuration on interface gi1/1 in VLAN 1 with an expiration time of 1000 seconds:

Switch# ip dhcp snooping binding 0001.1234.1234 vlan 1 172.20.50.5 interface gi1/1 expiry 1000

Related Commands

ip dhcp snooping
ip dhcp snooping information option
ip dhcp snooping trust
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping binding

ip dhcp snooping database

To store the bindings generated by DHCP snooping, use the ip dhcp snooping database command. Use the no form of this command to either reset the timeout, reset the write-delay, or delete the agent specified by the URL.

ip dhcp snooping database {url | timeout seconds | write-delay seconds}

no ip dhcp snooping database {timeout | write-delay}

Syntax Description

Defaults

The timeout value is set to 300 seconds (5 minutes).

The write-delay value is set to 300 seconds.

Command Modes

Interface configuration

Command History

Usage Guidelines

Because both NVRAM and bootflash have limited storage capacity, we recommend that you store a file on an TFTP server. When a file is stored in a remote location that is accessible through TFTP, an RPR redundant supervisor engine can take over the binding list when a switchover occurs.

You need to create an empty file at the configured URL on network-based URLs (such as TFTP and FTP) before the switch can write the set of bindings for the first time at the URL.

Examples

This example shows how to store a database file with the IP address 10.1.1.1 within a directory called directory. A file named file must be present on the TFTP server.

Switch# config terminal

Switch(config)# ip dhcp snooping database tftp://10.1.1.1/directory/file

Switch(config)# end

Switch# show ip dhcp snooping database 

Agent URL : tftp://10.1.1.1/directory/file

Write delay Timer : 300 seconds

Abort Timer : 300 seconds

Agent Running : Yes

Delay Timer Expiry : Not Running

Abort Timer Expiry : Not Running

Last Succeded Time : None

Last Failed Time : None

Last Failed Reason : No failure recorded.

Total Attempts       :        1   Startup Failures :        0

Successful Transfers :        0   Failed Transfers :        0

Successful Reads     :        0   Failed Reads     :        0

Successful Writes    :        0   Failed Writes    :        0

Media Failures       :        0

Switch#

Related Commands

ip dhcp snooping
ip dhcp snooping binding
ip dhcp snooping information option
ip dhcp snooping trust
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping binding

ip dhcp snooping information option

To enable DHCP option 82 data insertion, use the ip dhcp snooping information option command. To disable DHCP option 82 data insertion, use the no form of this command.

ip dhcp snooping information option

no ip dhcp snooping information option

Syntax Description

This command has no arguments or keywords.

Defaults

DHCP option 82 data insertion is enabled.

Command Modes

Global configuration

Command History

Examples

This example shows how to enable DHCP option 82 data insertion:

Switch(config)# ip dhcp snooping information option

Switch(config)# 

This example shows how to disable DHCP option 82 data insertion:

Switch(config)# no ip dhcp snooping information option

Switch(config)# 

Related Commands

ip dhcp snooping
ip dhcp snooping limit rate
ip dhcp snooping trust
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping binding

ip dhcp snooping limit rate

To configure the number of DHCP messages an interface can receive per second, use the ip dhcp snooping limit rate command. To disable DHCP snooping rate limiting, use the no form of this command.

ip dhcp snooping limit rate rate

no ip dhcp snooping limit rate

Syntax Description

Defaults

DHCP snooping rate limiting is disabled.

Command Modes

Interface configuration

Command History

Usage Guidelines

Normally, the rate limit applies to untrusted interfaces. If you want to set up rate limiting for trusted interfaces, keep in mind that trusted interfaces aggregate all DHCP traffic in the switch, and you will need to adjust the interfaces rate limit to a higher value.

Examples

This example shows how to enable DHCP message rate limiting:

Switch(config-if)# ip dhcp snooping limit rate 150

Switch(config)# 

This example shows how to disable DHCP message rate limiting:

Switch(config-if)# no ip dhcp snooping limit rate

Switch(config)# 

Related Commands

ip dhcp snooping
ip dhcp snooping information option
ip dhcp snooping trust
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping binding

ip dhcp snooping trust

To configure an interface as trusted for DHCP snooping purposes, use the ip dhcp snooping trust command. To configure an interface as untrusted, use the no form of this command.

ip dhcp snooping trust

no ip dhcp snooping trust

Syntax Description

This command has no arguments or keywords.

Defaults

DHCP snooping trust is disabled.

Command Modes

Interface configuration

Command History

Examples

This example shows how to enable DHCP snooping trust on an interface:

Switch(config-if)# ip dhcp snooping trust

Switch(config)# 

This example shows how to disable DHCP snooping trust on an interface:

Switch(config-if)# no ip dhcp snooping trust

Switch(config)# 

Related Commands

ip dhcp snooping
ip dhcp snooping information option
ip dhcp snooping limit rate
ip dhcp snooping vlan
show ip dhcp snooping
show ip dhcp snooping binding

ip dhcp snooping vlan

Use the ip dhcp snooping vlan command to enable DHCP snooping on a VLAN. To disable DHCP snooping on a VLAN, use the no form of this command.

ip dhcp snooping [vlan number]

no ip dhcp snooping [vlan number]

Syntax Description

Defaults

DHCP snooping is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

DHCP snooping is enabled on a VLAN only if both the global snooping and the VLAN snooping are enabled.

Examples

This example shows how to enable DHCP snooping on a VLAN:

Switch(config)# ip dhcp snooping vlan 10

Switch(config)# 

This example shows how to disable DHCP snooping on a VLAN:

Switch(config)# no ip dhcp snooping vlan 10

Switch(config)# 

This example shows how to enable DHCP snooping on a group of VLANs:

Switch(config)# ip dhcp snooping vlan 10 55

Switch(config)# 

This example shows how to disable DHCP snooping on a group of VLANs:

Switch(config)# no ip dhcp snooping vlan 10 55

Switch(config)# 

Related Commands

ip dhcp snooping
ip dhcp snooping information option
ip dhcp snooping limit rate
ip dhcp snooping trust
show ip dhcp snooping
show ip dhcp snooping binding

ip igmp filter

To control whether all hosts on a Layer 2 interface can join one or more IP multicast groups by applying an IGMP profile to the interface, use the ip igmp filter command. To remove a profile from the interface, use the no form of this command

ip igmp filter profile number

no ip igmp filter

Syntax Description

Defaults

Profiles are not applied.

Command Modes

Interface configuration

Command History

Usage Guidelines

You can apply IGMP filters only to Layer 2 physical interfaces; you cannot apply IGMP filters to routed ports, switch virtual interfaces (SVIs), or ports that belong to an EtherChannel group.

An IGMP profile can be applied to one or more switch port interfaces, but one port can have only one profile applied to it.

Examples

This example shows how to apply IGMP profile 22 to an interface.

Switch(config)# interface gigabitethernet1/1

Switch(config-if)# ip igmp filter 22

Switch(config-if)# 

Related Commands

ip igmp profile
show ip igmp profile

ip igmp max-groups

To set the maximum number of IGMP groups that a Layer 2 interface can join, use the ip igmp max-groups command. To set the maximum back to the default, use the no form of this command.

ip igmp max-groups number

no ip igmp max-groups

Syntax Description

Defaults

No maximum limit.

Command Modes

Interface configuration

Command History

Usage Guidelines

You can use ip igmp max-groups command only on Layer 2 physical interfaces; you cannot set IGMP maximum groups for routed ports, switch virtual interfaces (SVIs), or ports that belong to an EtherChannel group.

Examples

This example shows how to limit the number of IGMP groups that an interface can join to 25.

Switch(config)# interface gigabitethernet1/1

Switch(config-if)# ip igmp max-groups 25

Switch(config-if)

ip igmp profile

To create an IGMP profile, use the ip igmp profile command. To delete the IGMP profile, use the no form of this command.

ip igmp profile profile number

no ip igmp profile profile number

Syntax Description

Defaults

No profile created.

Command Modes

Global configuration

IGMP profile configuration

Command History

Usage Guidelines

When entering a range, enter the low IP multicast address, a space, and the high IP multicast address.

You can apply an IGMP profile to one or more Layer 2 interfaces, but each interface can have only one profile applied to it.

Examples

This example shows how to configure IGMP profile 40 that permits the specified range of IP multicast addresses.

Switch # config terminal

Switch(config)# ip igmp profile 40

Switch(config-igmp-profile)# permit

Switch(config-igmp-profile)# range 233.1.1.1 233.255.255.255

Switch(config-igmp-profile)# 

Related Commands

ip igmp filter
show ip igmp profile

ip igmp query-interval

To configure the frequency that the switch sends IGMP host-query messages, use the ip igmp query-interval command. To return to the default frequency, use the no form of this command.

ip igmp query-interval seconds

no ip igmp query-interval

Syntax Description

Defaults

The query interval is set to 60 seconds.

Command Modes

Interface configuration

Command History

Usage Guidelines

If you use the default IGMP snooping configuration, the valid query interval values are from 1 to 65535 seconds. If you have changed the default configuration to support CGMP as the IGMP snooping learning method, the valid query interval values are from 1 to 300 seconds.

The designated switch for a LAN is the only switch that sends IGMP host query messages. For IGMP version 1, the designated switch is elected according to the multicast routing protocol that runs on the LAN. For IGMP version 2, the designated querier is the lowest IP-addressed multicast switch on the subnet.

If no queries are heard for the timeout period (controlled by the ip igmp query-timeout command), the switch becomes the querier.

Note Changing the timeout period may severely impact multicast forwarding.

Examples

This example shows how to change the frequency at which the designated switch sends IGMP host query messages:

Switch(config-if)# ip igmp query-interval 120

Switch(config-if)# 

Related Commands

ip igmp query-timeout (refer to Cisco IOS documentation)
ip pim query-interval (refer to Cisco IOS documentation)
show ip igmp groups (refer to Cisco IOS documentation)

ip igmp snooping

To enable IGMP snooping, use the ip igmp snooping command. To disable IGMP snooping, use the no form of this command.

ip igmp snooping [tcn {flood query count count | query solicit}]

no ip igmp snooping [tcn {flood query count count | query solicit}]

Syntax Description

Defaults

IGMP snooping is enabled.

Command Modes

Global configuration

Interface configuration

Command History

Usage Guidelines

The tcn flood option applies only to Layer 2 switch ports and EtherChannels; it does not apply to routed ports, VLAN interfaces, or Layer 3 channels.

The ip igmp snooping command is disabled by default on multicast routers.

Note You can use the tcn flood option in Interface configuration mode.

Examples

This example shows how to enable IGMP snooping:

Switch(config)# ip igmp snooping

Switch(config)# 

This example shows how to disable IGMP snooping:

Switch(config)# no ip igmp snooping

Switch(config)# 

This example shows how to enable flooding the spanning-tree table to the network after 9 topology changes have occurred:

Switch(config)# ip igmp snooping tcn flood query count 9

Switch(config)# 

This example shows how to disable flooding the spanning-tree table to the network:

Switch(config)# no ip igmp snooping tcn flood

Switch(config)# 

This example shows how to enable an IGMP general query:

Switch(config)# ip igmp snooping tcn query solicit

Switch(config)# 

This example shows how to disable an IGMP general query:

Switch(config)# no ip igmp snooping tcn query solicit

Switch(config)# 

Related Commands

ip igmp snooping vlan immediate-leave
ip igmp snooping vlan mrouter
ip igmp snooping vlan static

ip igmp snooping report-suppression

To enable report suppression, use the ip igmp snooping report-suppression command. To disable report suppression and forward reports to multicast devices, use the no form of this command.

ip igmp snooping report-suppression

no igmp snooping report-suppression

Syntax Description

This command has no arguments or keywords.

Defaults

IGMP snooping report-suppression is enabled.

Command Modes

Global configuration

Command History

Usage Guidelines

If the ip igmp snooping report-suppression command is disabled, all IGMP reports are forwarded to the multicast devices.

If the command is enabled, report suppression is done by IGMP snooping.

Examples

This example shows how to enable report suppression:

Switch(config)# ip igmp snooping report-suppression

Switch(config)# 

This example shows how to disable report suppression:

Switch(config)# no ip igmp snooping report-suppression

Switch(config)# 

This example shows how to display the system status for report suppression:

Switch# show ip igmp snoop

vlan 1

----------

 IGMP snooping is globally enabled

 IGMP snooping TCN solicit query is globally disabled

 IGMP snooping global TCN flood query count is 2

 IGMP snooping is enabled on this Vlan

 IGMP snooping immediate-leave is disabled on this Vlan

 IGMP snooping mrouter learn mode is pim-dvmrp on this Vlan

 IGMP snooping is running in IGMP_ONLY mode on this Vlan

 IGMP snooping report suppression is enabled on this Vlan 

Switch# 

Related Commands

ip igmp snooping vlan immediate-leave
ip igmp snooping vlan mrouter
ip igmp snooping vlan static

ip igmp snooping vlan

To enable IGMP snooping for a VLAN, use the ip igmp snooping vlan command. To disable IGMP snooping, use the no form of this command.

ip igmp snooping vlan vlan-id

no ip igmp snooping vlan vlan-id

Syntax Description

Defaults

IGMP snooping is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

Before you can enable IGMP snooping on the Catalyst 4006 switches, you must configure the VLAN interface for multicast routing.

This command is entered in VLAN interface configuration mode only.

The ip igmp snooping vlan command is disabled by default on multicast routers.

Examples

This example shows how to enable IGMP snooping on a VLAN:

Switch(config)# ip igmp snooping vlan 200

Switch(config)# 

This example shows how to disable IGMP snooping on a VLAN:

Switch(config)# no ip igmp snooping vlan 200

Switch(config)# 

Related Commands

ip igmp snooping vlan immediate-leave
ip igmp snooping vlan mrouter
ip igmp snooping vlan static

ip igmp snooping vlan explicit-tracking

To enable per-VLAN explicit host tracking, use the ip igmp snooping vlan explicit-tracking command. To disable explicit host tracking, use the no form of this command.

ip igmp snooping vlan vlan-id explicit-tracking

no ip igmp snooping vlan vlan-id explicit-tracking

Syntax Description

Defaults

Explicit host tracking is enabled.

Command Modes

Configuration

Command History

Examples

This example shows how to disable IGMP explicit host tracking on interface VLAN 200 and how to verify the configuration:

Switch(config)# no ip igmp snooping vlan 200 explicit-tracking 

Switch(config)# end 

Switch# show ip igmp snooping vlan 200 | include explicit tracking

Global IGMP Snooping configuration:

-----------------------------------

IGMP snooping             : Enabled

IGMPv3 snooping           : Enabled

Report suppression        : Enabled

TCN solicit query         : Disabled

TCN flood query count     : 2

Vlan 2:

--------

IGMP snooping                  : Enabled

IGMPv2 immediate leave         : Disabled

Explicit host tracking         : Disabled

Multicast router learning mode : pim-dvmrp

CGMP interoperability mode     : IGMP_ONLY

Explicit host tracking         : Disabled

Switch#

Related Commands

clear ip igmp snooping statistics vlan (refer to Cisco IOS documentation)
show ip igmp snooping membership
show ip igmp snooping statistics vlan (refer to Cisco IOS documentation)

ip igmp snooping vlan immediate-leave

To enable IGMP immediate-leave processing, use the ip igmp snooping vlan immediate-leave command. To disable immediate-leave processing, use the no form of this command.

ip igmp snooping vlan vlan_num immediate-leave

no ip igmp snooping vlan vlan_num immediate-leave

Syntax Description

Defaults

Immediate leave processing is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

You enter this command in global configuration mode only.

Use the immediate-leave feature only when there is a single receiver for the MAC group for a specific VLAN.

The immediate-leave feature is supported only with IGMP version 2 hosts.

Examples

This example shows how to enable IGMP immediate-leave processing on VLAN 4:

Switch(config)# ip igmp snooping vlan 4 immediate-leave

Switch(config)# 

This example shows how to disable IGMP immediate-leave processing on VLAN 4:

Switch(config)# no ip igmp snooping vlan 4 immediate-leave

Switch(config)# 

Related Commands

ip igmp snooping
ip igmp snooping vlan mrouter
ip igmp snooping vlan static
show ip igmp interface (refer to Cisco IOS documentation)
show mac-address-table multicast

ip igmp snooping vlan mrouter

To statically configure an Layer 2 interface as a multicast router interface for a VLAN, use the ip igmp snooping vlan mrouter command. To remove the configuration, use the no form of this command.

ip igmp snooping vlan vlan-id mrouter {interface {{FastEthernet slot/port} |
{GigabitEthernet slot/port} | {port-channel number}} |
{learn {cgmp | pim-dvmrp}}

no ip igmp snooping vlan vlan-id mrouter {interface {FastEthernet slot/port} |
{GigabitEthernet slot/port} | {port-channel number}} |
{learn {cgmp | pim-dvmrp}}

Syntax Description

Defaults

Multicast switch snooping PIM-DVMRP packets are specified.

Command Modes

Interface configuration

Command History

Usage Guidelines

You enter this command in VLAN interface configuration mode only.

The interface to the switch must be in the VLAN where you are entering the command. It must be both administratively up and line protocol up.

The CGMP learning method can decrease control traffic.

The learning method you configure is saved in NVRAM.

Static connections to multicast interfaces are supported only on switch interfaces.

Examples

This example shows how to specify the next-hop interface to multicast switch:

Switch(config-if)# ip igmp snooping 400 mrouter interface fastethernet 5/6

Switch(config-if)# 

This example shows how to specify the multicast switch learning method:

Switch(config-if)# ip igmp snooping 400 mrouter learn cgmp

Switch(config-if)# 

Related Commands

ip igmp snooping
ip igmp snooping vlan immediate-leave
ip igmp snooping vlan static
show ip igmp snooping
show ip igmp snooping mrouter

ip igmp snooping vlan static

To configure an Layer 2 interface as a member of a group, use the ip igmp snooping vlan static command. To remove the configuration, use the no form of this command.

ip igmp snooping vlan vlan_num static mac-address {interface {FastEthernet slot/port} | {GigabitEthernet slot/port} | {port-channel number}}

no ip igmp snooping vlan vlan_num static {{interface {FastEthernet slot/port} |
{GigabitEthernet slot/port} | {port-channel number}}

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration

Command History

Examples

This example shows how to configure a host statically on an interface:

Switch(config)# ip igmp snooping vlan 4 static 0100.5e02.0203 interface fastethernet 5/11

Configuring port FastEthernet5/11 on group 0100.5e02.0203 vlan 4

Switch(config)# 

Related Commands

ip igmp snooping
ip igmp snooping vlan immediate-leave
ip igmp snooping vlan mrouter
show mac-address-table multicast

ip local-proxy-arp

To enable the local proxy ARP feature, use the ip local-proxy-arp command. To disable the local proxy ARP feature, use the no form of this command.

ip local-proxy-arp

no ip local-proxy-arp

Syntax Description

This command has no arguments or keywords.

Defaults

Local proxy ARP is disabled.

Command Modes

Interface configuration

Command History

Usage Guidelines

Use this feature only on subnets where hosts are intentionally prevented from communicating directly to the switch on which they are connected.

ICMP redirect is disabled on interfaces where the local proxy ARP feature is enabled.

Examples

This example shows how to enable the local proxy ARP feature:

Switch(config-if)# ip local-proxy-arp

Switch(config-if)# 

ip mfib fastdrop

To enable MFIB fast drop, use the ip mfib fastdrop command. To disable MFIB fast drop, use the no form of this command.

ip mfib fastdrop

no ip mfib fastdrop

Syntax Description

This command has no arguments or keywords.

Defaults

MFIB fast drop is enabled.

Command Modes

EXEC

Command History

Examples

This example shows how to enable MFIB fast drops:

Switch# ip mfib fastdrop

Switch#

Related Commands

clear ip mfib fastdrop
show ip mfib fastdrop

ip route-cache flow

To enable NetFlow statistics for IP routing, use the ip route-cache flow command. To disable NetFlow statistics, use the no form of this command.

ip route-cache flow [infer-fields]

no ip route-cache flow [infer-fields]

Syntax Description

Defaults

NetFlow statistics is disabled.

Inferred information is excluded.

Command Modes

Configuration

Command History

Usage Guidelines

To use these commands, you need to install the Supervisor Engine IV and the NetFlow Service Card.

The NetFlow statistics feature captures a set of traffic statistics. These traffic statistics include source IP address, destination IP address, layer 4 port information, protocol, input and output identifiers, and other routing information that can be used for network analysis, planning, accounting, billing and identifying DOS attacks.

NetFlow switching is supported on IP and IP-encapsulated traffic over all interface types.

If you enter ip route-cache flow infer-fields after ip route-cache flow, you will purge the existing cache, and vice versa. This is done to avoid having flows with and without inferred fields in the cache simultaneously.

For additional information on NetFlow switching, refer to the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide.

Note NetFlow consumes additional memory and CPU resources compared to other switching modes. You need to know the resources required on your switch before enabling NetFlow.

Examples

This example shows how to enable NetFlow switching on the switch:

Switch# config terminal

Switch(config)# ip route-cache flow

Switch(config)# exit

Switch# 

Note This command does not work on a per-interface basis.

ip source binding

To add or delete a static IP source binding entry, use the ip source binding command. Use the no form of this command to delete the corresponding IP source binding entry.

ip source binding ip-address mac-address vlan vlan-id interface interface-name

no ip source binding ip-address mac-address vlan vlan-id interface interface-name

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration

Command History

Usage Guidelines

The ip source binding command is used to add a static IP source binding entry only.

The no form of this command deletes the corresponding IP source binding entry. For the deletion to succeed, all required parameters must match.

Each static IP binding entry is keyed by a MAC address and VLAN number. This implies that if the CLI contains an existing MAC and VLAN, the existing binding entry will be updated with the new parameters; a separate binding entry will not be created.

Examples

This example shows how to configure the static IP source binding:

Switch# config terminal

Switch(config)# ip source binding 11.0.0.1 0000.000A.000B vlan 10 interface 
fastethernet6/10

Switch(config)#

Related Commands

show ip source binding

ip sticky-arp

To enable sticky ARP, use the ip sticky-arp command. Use the no form of this command to disable sticky ARP.

ip sticky-arp

no ip sticky-arp

Syntax Description

This command has no arguments or keywords.

Defaults

Enabled

Command Modes

Global configuration

Command History

Usage Guidelines

This command is supported on PVLANs only.

ARP entries that are learned on Layer3 PVLAN interfaces are sticky ARP entries. (You should display and verify ARP entries on the PVLAN interface using the show arp command).

For security reasons, sticky ARP entries on the PVLAN interface do not age out. Connecting new equipment with the same IP address generates a message and the ARP entry is not created.

Because the ARP entries on the PVLAN interface do not age out, you must manually remove ARP entries on the PVLAN interface if a MAC address changes.

Unlike static entries, sticky-ARP entries are not stored and restored when you enter the reboot and restart commands.

Examples

This example shows how to enable sticky ARP:

Switch# configure terminal 

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config) ip sticky-arp

Switch(config)# end

Switch#

This example shows how to disable sticky ARP:

Switch# configure terminal 

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config) no ip sticky-arp

Switch(config)# end

Switch#

Related Commands

arp (refer to Cisco IOS documentation)
show arp (refer to Cisco IOS documentation)

ip verify header vlan all

To enable IP header validation for Layer 2-switched IPv4 packets, use the ip verify header vlan all command. To disable the IP header validation, use the no form of this command.

ip verify header vlan all

no ip verify header vlan all

Syntax Description

This command has no default settings.

Defaults

The IP header is validated for bridged and routed IPv4 packets.

Command Modes

Configuration

Command History

Usage Guidelines

This command does not apply to Layer 3-switched (routed) packets

The Catalyst 4500 series switch checks the validity of the following fields in the IPv4 header for all switched IPv4 packets:

•Version must be 4.

•Header length must be greater than or equal to 20 bytes.

•Total length must be greater than or equal to four times the header length, and greater than the Layer 2 packet size minus the Layer 2 encapsulation size.

If an IPv4 packet fails the IP header validation, the packet is dropped. If you disable header validation, packets with invalid IP headers are bridged but not routed even if routing was intended. IPv4 access lists also are not applied to IP headers.

Examples

This example shows how to disable IP header validation for Layer 2-switched IPv4 packets:

Switch# config t

Switch(config)# no ip verify header vlan all

Switch(config)# end

Switch#

ip verify source vlan dhcp-snooping

To enable IP source guard on DHCP snooping untrusted Layer 2 interfaces, use the ip verify source vlan dhcp-snooping command. Use the no form of this command to disable IP source guard on DHCP snooping untrusted Layer 2 interfaces.

ip verify source vlan dhcp-snooping [port-security]

no ip verify source vlan dhcp-snooping [port-security]

Syntax Description

Defaults

IP source guard is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

Interface configuration

Examples

This example shows how to enable DHCP snooping security on VLANs 10 through 20:

Switch# config terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# ip dhcp snooping

Switch(config)# ip dhcp snooping vlan 10 20

Switch(config)# configure interface fastethernet6/1

Switch(config-if)# switchport trunk encapsulation dot1q

Switch(config-if)# switchport mode trunk

Switch(config-if)# switchport access vlan 10

Switch(config-if)# no ip dhcp snooping trust

Switch(config-if)# ip verify source vlan dhcp-snooping

Switch(config)# end

Switch# show ip dhcp snooping security interface fastethernet6/1

Interface  Filter-type  Filter-mode  IP-address       Mac-address     Vlan

---------  -----------  -----------  ---------------  --------------  ---------

fa6/1      ip           active       10.0.0.2                         10

fa6/1      ip           active       deny-all                         11-20

Switch# 

The output shows that there is one valid DHCP binding to VLAN 10.

Related Commands

debug ip verify source packet (refer to Cisco IOS documentation)
ip dhcp snooping
ip dhcp snooping limit rate
ip dhcp snooping information option
ip dhcp snooping trust
ip source binding (refer to Cisco IOS documentation)
show ip dhcp snooping
show ip dhcp snooping binding
show ip verify source (refer to Cisco IOS documentation)
show ip source binding (refer to Cisco IOS documentation)

l2protocol-tunnel

To enable protocol tunneling on an interface, use the l2protocol-tunnel command. You can enable tunneling for Cisco Discovery Protocol (CDP), Spanning Tree Protocol (STP), or VLAN Trunking Protocol (VTP) packets. Use the no form of this command to disable tunneling on the interface.

l2protocol-tunnel [cdp | stp | vtp]

no l2protocol-tunnel [cdp | stp | vtp]

Syntax Description

Defaults

The default is no Layer 2 protocol packets are tunneled.

Command Modes

Interface configuration

Command History

Usage Guidelines

You must enter this command, with or without protocol types, to tunnel Layer 2 packets.

Layer 2 protocol tunneling across a service-provider network ensures that Layer 2 information is propagated across the network to all customer locations. When protocol tunneling is enabled, protocol packets are encapsulated with a well known Cisco multicast address for transmission across the network. When the packets reach their destination, the well known MAC address is replaced by the Layer 2 protocol MAC address.

You can enable Layer 2 protocol tunneling for CDP, STP, and VTP individually or for all three protocols.

Examples

This example shows how to enable protocol tunneling for CDP packets:

Switch(config-if)# l2protocol-tunnel cdp

Switch(config-if)# 

Related Commands

l2protocol-tunnel cos
l2protocol-tunnel drop-threshold
l2protocol-tunnel shutdown-threshold

l2protocol-tunnel cos

To configure the class of service (CoS) value for all tunneled Layer 2 protocol packets, use the l2protocol-tunnel cos command. Use the no form of this command to return to the default value of zero.

l2protocol-tunnel cos value

no l2protocol-tunnel cos

Syntax Description

Defaults

The default is to use the CoS value configured for data on the interface. If no CoS value is configured, the default is 5 for all tunneled Layer 2 protocol packets.

Command Modes

Global configuration

Command History

Usage Guidelines

When enabled, the tunneled Layer 2 protocol packets use this CoS value.

The value is saved in NVRAM.

Examples

This example shows how to configure a Layer-2 protocol tunnel CoS value of 7:

Switch(config)# l2protocol-tunnel cos 7

Switch(config)# 

Related Commands

l2protocol-tunnel
l2protocol-tunnel drop-threshold
l2protocol-tunnel shutdown-threshold

l2protocol-tunnel drop-threshold

To set a drop threshold for the maximum rate of Layer 2 protocol packets per second to be received before an interface drops packets, use the I2protocol-tunnel drop-threshold command. You can set the drop threshold for Cisco Discovery Protocol (CDP), Spanning Tree Protocol (STP), or VLAN Trunking Protocol (VTP) packets. Use the no form of this command to disable the drop threshold on the interface.

l2protocol-tunnel drop-threshold [cdp | stp | vtp] value

no l2protocol-tunnel drop-threshold [cdp | stp | vtp] value

Syntax Description

Defaults

The default is no drop threshold for the number of Layer 2 protocol packets.

Command Modes

Interface configuration

Command History

Usage Guidelines

Enter the drop-threshold keyword to control the number of protocol packets per second that are received on an interface before it drops packets. When no protocol option is specified with a keyword, the threshold is applied to each of the tunneled Layer 2 protocol types. If you also set a shutdown threshold on the interface, the drop-threshold value must be less than or equal to the shutdown-threshold value.

When the drop threshold is reached, the interface drops Layer 2 protocol packets until the rate at which they are received is below the drop threshold.

Examples

This example shows how to configure the drop threshold rate:

Switch(config-if)# l2protocol-tunnel drop-threshold cdp 50

Switch(config-if)#

Related Commands

l2protocol-tunnel
l2protocol-tunnel cos
l2protocol-tunnel shutdown-threshold

l2protocol-tunnel shutdown-threshold

To configure the protocol tunneling encapsulation rate, use the I2protocol-tunnel shutdown-threshold command. You can set the encapsulation rate for Cisco Discovery Protocol (CDP), Spanning Tree Protocol (STP), or VLAN Trunking Protocol (VTP) packets. Use the no form of this command to disable the encapsulation rate on the interface.

l2protocol-tunnel shutdown-threshold [cdp | stp | vtp] value

no l2protocol-tunnel shutdown-threshold [cdp | stp | vtp] value

Syntax Description

Defaults

The default is no shutdown threshold for the number of Layer 2 protocol packets.

Command Modes

Interface configuration

Command History

Usage Guidelines

Enter the shutdown-threshold keyword to control the number of protocol packets per second that are received on an interface before it shuts down. When no protocol option is specified with the keyword, the threshold is applied to each of the tunneled Layer 2 protocol types. If you also set a drop threshold on the interface, the shutdown-threshold value must be greater than or equal to the drop-threshold value.

When the shutdown threshold is reached, the interface is error disabled. If you enable error recovery by entering the errdisable recovery cause l2ptguard command, the interface is brought out of the error-disabled state and allowed to retry the operation again when all the causes have timed out. If the error recovery feature generation is not enabled for l2ptguard, the interface stays in the error-disabled state until you enter the shutdown and no shutdown commands.

Examples

This example shows how to configure the maximum rate:

Switch(config-if)# l2protocol-tunnel shutdown-threshold cdp 50

Switch(config-if)#

Related Commands

l2protocol-tunnel
l2protocol-tunnel cos
l2protocol-tunnel shutdown-threshold

lacp port-priority

To set the LACP priority for physical interfaces, use the lacp port-priority command.

lacp port-priority priority

Syntax Description

Defaults

Priority is set to 32768.

Command Modes

Interface configuration

Command History

Usage Guidelines

This command is not supported on systems configured with a Supervisor Engine 1.

You must assign each port in the switch a port priority that can be specified automatically or by entering the lacp port-priority command. The port priority is used with the port number to form the port identifier. The port priority is used to decide which ports should be put in standby mode when there is a hardware limitation that prevents all compatible ports from aggregating.

Although this command is a global configuration command, the priority value is supported only on port channels with LACP-enabled physical interfaces.This command is supported on LACP-enabled interfaces.

When setting the priority, the higher the number, the lower the priority.

Examples

This example shows how to set the priority for the interface:

Switch(config-if)# lacp port-priority 23748

Switch(config-if)# 

Related Commands

channel-group
channel-protocol
lacp system-priority
show lacp

lacp system-priority

To set the priority of the system for LACP, use the lacp system-priority command.

lacp system-priority priority

Syntax Description

Defaults

Priority is set to 32768.

Command Modes

Global configuration mode

Command History

Usage Guidelines

This command is not supported on systems configured with a Supervisor Engine 1.

You must assign each switch running LACP a system priority that can be specified automatically or by entering the lacp system-priority command. The system priority is used with the switch MAC address to form the system ID and is also used during negotiation with other systems.

Although this command is a global configuration command, the priority value is supported on port channels with LACP-enabled physical interfaces.

When setting the priority, the higher the number, the lower the priority.

You can also enter the lacp system-priority command in interface configuration mode. After you enter the command, the system defaults to global configuration mode.

Examples

This example shows how to set the system priority:

Switch(config)# lacp system-priority 23748

Switch(config)# 

Related Commands

channel-group
channel-protocol
lacp port-priority
show lacp

mac access-list extended

To define extended MAC access lists, use the mac access-list extended command. To remove MAC access lists, use the no form of this command.

mac access-list extended name

no mac access-list extended name

Syntax Description

Defaults

MAC access lists are not defined.

Command Modes

Global configuration

Command History

Usage Guidelines

When you enter the ACL name, follow these naming conventions:

•Maximum of 31 characters long and can include a-z, A-Z, 0-9, the dash character (-), the underscore character (_), and the period character (.)

•Must start with an alpha character and must be unique across all ACLs of all types

•Case sensitive

•Cannot be a number

•Must not be a keyword; keywords to avoid are all, default-action, map, help, and editbuffer

When you enter the mac access-list extended name command, you use the [no] {permit | deny} {{src-mac mask | any} [dest-mac mask]} [protocol-family {appletalk | arp-non-ipv4 | decnet | ipx | ipv6 | rarp-ipv4 | rarp-non-ipv4 | vines | xns}] subset to create or delete entries in a MAC layer access list.

Table 2-7 describes the syntax of the mac access-list extended subcommands.

Table 2-8 describes mapping an Ethernet packet to a protocol family.

When you enter the src-mac mask or dest-mac mask value, follow these guidelines:

•Enter MAC addresses as three 4-byte values in dotted hexadecimal format; for example, 0030.9629.9f84.

•Enter MAC address masks as three 4-byte values in dotted hexadecimal format. Use 1 bit as a wildcard. For example, to match an address exactly, use 0000.0000.0000 (can be entered as 0.0.0).

•For the optional protocol parameter, you can enter either the ethertype or the keyword.

•Entries without a protocol parameter match any protocol.

•Access lists entries are scanned in the order you enter them. The first matching entry is used. To improve performance, place the most commonly used entries near the beginning of the access list.

•An implicit deny any any entry exists at the end of an access list unless you include an explicit permit any any entry at the end of the list.

•All new entries to an existing list are placed at the end of the list. You cannot add entries to the middle of a list.

Examples

This example shows how to create a MAC layer access list named mac_layer that denies traffic from 0000.4700.0001, which is going to 0000.4700.0009, and permits all other traffic:

Switch(config)# mac access-list extended mac_layer 

Switch(config-ext-macl)# deny 0000.4700.0001 0.0.0 0000.4700.0009 0.0.0 protocol-family appletalk

Switch(config-ext-macl)# permit any any 

Related Commands

show vlan access-map

mac-address-table aging-time

To configure aging time for entries in the Layer 2 table, use the mac-address-table aging-time command. To reset the seconds value to the default setting, use the no form of this command.

mac-address-table aging-time seconds [vlan vlan_id]

no mac-address-table aging-time seconds [vlan vlan_id]

Syntax Description

Defaults

Aging time is set to 300 seconds.

Command Modes

Global configuration

Command History

Usage Guidelines

If you do not enter a VLAN, the change is applied to all routed-port VLANs.

Enter 0 seconds to disable aging.

Examples

This example shows how to configure the aging time to 400 seconds:

Switch(config)# mac-address-table aging-time 400

Switch(config)# 

This example shows how to disable aging:

Switch(config)# mac-address-table aging-time 0

Switch(config)

Related Commands

show mac-address-table aging-time

mac-address-table dynamic group protocols

To enable the learning of MAC addresses in both the "ip" and "other" protocol buckets, even though the incoming packet may belong to only one of the protocol buckets, use the
mac-address-table dynamic group protocols command. To disable grouped learning, use the no form of this command.

mac-address-table dynamic group protocols {ip | other} {ip | other}

[no] mac-address-table dynamic group protocols {ip | other} {ip | other}

Syntax Description

Defaults

The group learning feature is disabled.

Command Modes

global configuration

Command History

Usage Guidelines

The entries within the "ip" and "other" protocol buckets are created according to the protocol of the incoming traffic.

When you use the mac-address-table dynamic group protocols command, an incoming MAC address that might belong to either the "ip" or the "other" protocol bucket, is learned on both protocol buckets. Therefore, any traffic destined to this MAC address and belonging to any of the protocol buckets is unicasted to that MAC address, rather than flooded. This reduces the unicast Layer 2 flooding that might be caused if the incoming traffic from a host belongs to a different protocol bucket than the traffic that is destined to the sending host.

Examples

This example shows that the MAC addresses are initially assigned to either the "ip" or the "other" protocol bucket:

Switch# show mac-address-table dynamic

Unicast Entries

 vlan   mac address     type        protocols               port

-------+---------------+--------+---------------------+--------------------

   1    0000.0000.5000   dynamic other                  GigabitEthernet1/1

   1    0001.0234.6616   dynamic ip                     GigabitEthernet3/1

   1    0003.3178.ec0a   dynamic assigned               GigabitEthernet3/1

   1    0003.4700.24c3   dynamic ip                     GigabitEthernet3/1

   1    0003.4716.f475   dynamic ip                     GigabitEthernet3/1

   1    0003.4748.75c5   dynamic ip                     GigabitEthernet3/1

   1    0003.47f0.d6a3   dynamic ip                     GigabitEthernet3/1

   1    0003.47f6.a91a   dynamic ip                     GigabitEthernet3/1

   1    0003.ba06.4538   dynamic ip                     GigabitEthernet3/1

   1    0003.fd63.3eb4   dynamic ip                     GigabitEthernet3/1

   1    0004.2326.18a1   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5d.de53   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5e.6ecc   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5e.f60e   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5f.06f7   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5f.072f   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5f.08f6   dynamic ip                     GigabitEthernet3/1

   1    0004.5a5f.090b   dynamic ip                     GigabitEthernet3/1

   1    0004.5a88.b075   dynamic ip                     GigabitEthernet3/1

   1    0004.c1bd.1b40   dynamic ip                     GigabitEthernet3/1

   1    0004.c1d8.b3c0   dynamic ip                     GigabitEthernet3/1

   1    0004.c1d8.bd00   dynamic ip                     GigabitEthernet3/1

   1    0007.e997.74dd   dynamic ip                     GigabitEthernet3/1

   1    0007.e997.7e8f   dynamic ip                     GigabitEthernet3/1

   1    0007.e9ad.5e24   dynamic ip                     GigabitEthernet3/1

   1    000b.5f0a.f1d8   dynamic ip                     GigabitEthernet3/1

   1    000b.fdf3.c498   dynamic ip                     GigabitEthernet3/1

   1    0010.7be8.3794   dynamic assigned               GigabitEthernet3/1

   1    0012.436f.c07f   dynamic ip                     GigabitEthernet3/1

   1    0050.0407.5fe1   dynamic ip                     GigabitEthernet3/1

   1    0050.6901.65af   dynamic ip                     GigabitEthernet3/1

   1    0050.da6c.81cb   dynamic ip                     GigabitEthernet3/1

   1    0050.dad0.af07   dynamic ip                     GigabitEthernet3/1

   1    00a0.ccd7.20ac   dynamic ip                     GigabitEthernet3/1

   1    00b0.64fd.1c23   dynamic ip                     GigabitEthernet3/1

   1    00b0.64fd.2d8f   dynamic assigned               GigabitEthernet3/1

   1    00d0.b775.c8bc   dynamic ip                     GigabitEthernet3/1

   1    00d0.b79e.de1d   dynamic ip                     GigabitEthernet3/1

   1    00e0.4c79.1939   dynamic ip                     GigabitEthernet3/1

   1    00e0.4c7b.d765   dynamic ip                     GigabitEthernet3/1

   1    00e0.4c82.66b7   dynamic ip                     GigabitEthernet3/1

   1    00e0.4c8b.f83e   dynamic ip                     GigabitEthernet3/1

   1    00e0.4cbc.a04f   dynamic ip                     GigabitEthernet3/1

   1    0800.20cf.8977   dynamic ip                     GigabitEthernet3/1

   1    0800.20f2.82e5   dynamic ip                     GigabitEthernet3/1

Switch#

This example shows how to assign MAC addresses that belong to either the "ip" or the "other" bucket to both buckets:

Switch(config)# mac-address-table dynamic group protocols ip other

Switch(config)# exit

Switch# show mac address-table dynamic

Unicast Entries

 vlan   mac address     type        protocols               port

-------+---------------+--------+---------------------+--------------------

   1    0000.0000.5000   dynamic ip,other               GigabitEthernet1/1

   1    0001.0234.6616   dynamic ip,other               GigabitEthernet3/1

   1    0003.4700.24c3   dynamic ip,other               GigabitEthernet3/1

   1    0003.4716.f475   dynamic ip,other               GigabitEthernet3/1

   1    0003.4748.75c5   dynamic ip,other               GigabitEthernet3/1

   1    0003.47c4.06c1   dynamic ip,other               GigabitEthernet3/1

   1    0003.47f0.d6a3   dynamic ip,other               GigabitEthernet3/1

   1    0003.47f6.a91a   dynamic ip,other               GigabitEthernet3/1

   1    0003.ba0e.24a1   dynamic ip,other               GigabitEthernet3/1

   1    0003.fd63.3eb4   dynamic ip,other               GigabitEthernet3/1

   1    0004.2326.18a1   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a5d.de53   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a5d.de55   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a5e.6ecc   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a5e.f60e   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a5f.08f6   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a5f.090b   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a64.f813   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a66.1a77   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a6b.56b2   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a6c.6a07   dynamic ip,other               GigabitEthernet3/1

   1    0004.5a88.b075   dynamic ip,other               GigabitEthernet3/1

   1    0004.c1bd.1b40   dynamic ip,other               GigabitEthernet3/1

   1    0004.c1d8.b3c0   dynamic ip,other               GigabitEthernet3/1

   1    0004.c1d8.bd00   dynamic ip,other               GigabitEthernet3/1

   1    0005.dce0.7c0a   dynamic assigned               GigabitEthernet3/1

   1    0007.e997.74dd   dynamic ip,other               GigabitEthernet3/1

   1    0007.e997.7e8f   dynamic ip,other               GigabitEthernet3/1

   1    0007.e9ad.5e24   dynamic ip,other               GigabitEthernet3/1

   1    0007.e9c9.0bc9   dynamic ip,other               GigabitEthernet3/1

   1    000b.5f0a.f1d8   dynamic ip,other               GigabitEthernet3/1

   1    000b.fdf3.c498   dynamic ip,other               GigabitEthernet3/1

   1    0012.436f.c07f   dynamic ip,other               GigabitEthernet3/1

   1    0050.0407.5fe1   dynamic ip,other               GigabitEthernet3/1

   1    0050.6901.65af   dynamic ip,other               GigabitEthernet3/1

   1    0050.da6c.81cb   dynamic ip,other               GigabitEthernet3/1

   1    0050.dad0.af07   dynamic ip,other               GigabitEthernet3/1

   1    00a0.ccd7.20ac   dynamic ip,other               GigabitEthernet3/1

   1    00b0.64fd.1b84   dynamic assigned               GigabitEthernet3/1

   1    00d0.b775.c8bc   dynamic ip,other               GigabitEthernet3/1

   1    00d0.b775.c8ee   dynamic ip,other               GigabitEthernet3/1

   1    00d0.b79e.de1d   dynamic ip,other               GigabitEthernet3/1

   1    00e0.4c79.1939   dynamic ip,other               GigabitEthernet3/1

   1    00e0.4c7b.d765   dynamic ip,other               GigabitEthernet3/1

   1    00e0.4c82.66b7   dynamic ip,other               GigabitEthernet3/1

   1    00e0.4c8b.f83e   dynamic ip,other               GigabitEthernet3/1

   1    00e0.4c8c.0861   dynamic ip,other               GigabitEthernet3/1

   1    0800.20d1.bf09   dynamic ip,other               GigabitEthernet3/1

Switch#

Related Commands

mac-address-table dynamic (refer to Cisco IOS documentation)

mac-address-table static

To configure static MAC addresses for a VLAN interface or drop unicast traffic for a MAC address for a VLAN interface, use the mac-address-table static command. To remove static MAC address configurations, use the no form of this command.

mac-address-table static mac-addr {vlan vlan-id} {interface type | drop}

no mac-address-table static mac-addr {vlan vlan-id} {interface type} {drop}

Syntax Description

Defaults

This command has no default settings.

Command Modes

Global configuration

Command History

Usage Guidelines

When a static MAC address is installed, it is associated with a port.

The output interface specified must be a Layer 2 interface and not an SVI.

If you do not enter a protocol type, an entry is automatically created for each of the four protocol types.

Entering the no form of this command does not remove system MAC addresses.

When removing a MAC address, entering interface int is optional. For unicast entries, the entry is removed automatically. For multicast entries, if you do not specify an interface, the entire entry is removed. You can specify the selected ports to be removed by specifying the interface.

Examples

This example shows how to add static entries to the MAC address table:

Switch(config)# mac-address-table static 0050.3e8d.6400 vlan 100 interface fastethernet5/7 

Switch(config)# 

This example shows how to configure a static MAC address with IGMP snooping disabled for a specified address:

Switch(config)# mac-address-table static 0050.3e8d.6400 vlan 100 interface fastethernet5/7 disable-snooping

Switch(config)# 

Related Commands

show mac-address-table static

macro apply cisco-desktop

To enable Cisco-recommended features and settings that are suitable for connecting a switch port to a standard desktop, use the macro apply cisco-desktop command.

macro apply cisco-desktop $AVID access_vlanid

Syntax Description

Defaults

This command has no default settings.

Command Modes

Interface configuration

Command History

Usage Guidelines

This command can only be viewed and applied; it cannot be modified.

Ensure that the existing configuration on the interface does not conflict with the intended macro configuration. Before you apply the macro, clear the configuration on the interface with the default interface command.

Examples

This example shows how to enable the Cisco-recommended features and settings on port fa2/1:

Switch(config)# interface FastEthernet2/1

Switch(config-if)# macro apply cisco-desktop $AVID 50

Switch(config-if)# 

This contents of this macro are as follows:

# Basic interface - Enable data VLAN only

# Recommended value for access vlan (AVID) should not be 1

switchport access vlan $AVID [access_vlanid]

switchport mode access

# Enable port security limiting port to a single

# MAC address -- that of desktop

switchport port-security

# Ensure port-security age is greater than one minute

# and use inactivity timer

# "Port-security maximum 1" is the default and will not

# Show up in the config

switchport port-security violation restrict

switchport port-security aging time 2

switchport port-security aging type inactivity

# Configure port as an edge network port

spanning-tree portfast

spanning-tree bpduguard enable

Related Commands

macro apply cisco-phone
macro apply cisco-router
macro apply cisco-switch

macro apply cisco-phone

To enable Cisco-recommended features and settings that are suitable for connecting a switch port to a standard desktop and a Cisco IP phone, use the macro apply cisco-phone command.

macro apply cisco-phone $AVID access_vlanid $VVID voice_vlanid

Syntax Description

Defaults

This command has no default settings.

Command Modes

Interface configuration

Command History

Usage Guidelines

This command can only be viewed and applied; it cannot be modified.

Ensure that the existing configuration on the interface does not conflict with the intended macro configuration. Before you apply the macro, clear the configuration on the interface with the default interface command.

Examples

This example shows how to enable the Cisco-recommended features and settings on port fa2/1:

Switch(config)# interface FastEthernet2/1

Switch(config-if)# macro apply cisco-phone $AVID 10 $VVID 50

Switch(config-if)# 

This contents of this macro are as follows:

# VoIP enabled interface - Enable data VLAN

# and voice VLAN (VVID)

# Recommended value for access vlan (AVID) should not be 1\

switchport access vlan $AVID [access_vlan_id]

switchport mode access

# Update the Voice VLAN (VVID) value which should be

# different from data VLAN 

# Recommended value for voice vlan (VVID) should not be 1

switchport voice vlan $VVID [voice_vlan_id]

# Enable port security limiting port to a 3 MAC

# addressees -- One for desktop and two for phone

switchport port-security

switchport port-security maximum 3

# Ensure port-security age is greater than one minute

# and use inactivity timer

switchport port-security violation restrict

switchport port-security aging time 2

switchport port-security aging type inactivity

# Enable auto-qos to extend trust to attached Cisco phone

auto qos voip cisco-phone

# Configure port as an edge network port

spanning-tree portfast

spanning-tree bpduguard enable@

Related Commands

macro apply cisco-desktop
macro apply cisco-router
macro apply cisco-switch

macro apply cisco-router

To enable Cisco-recommended features and settings that are suitable for connecting a switch port to a router, use the macro apply cisco-router command.

macro apply cisco-router $NVID native_vlanid

Syntax Description

Defaults

This command has no default settings.

Command Modes

Interface configuration

Command History

Usage Guidelines

This command can only be viewed and applied; it cannot be modified.

Ensure that the existing configuration on the interface does not conflict with the intended macro configuration. Before you apply macro apply cisco-router, clear the configuration on the interface with the default interface command.

Examples

This example shows how to enable the Cisco-recommended features and settings on port fa2/1:

Switch(config)# interface FastEthernet2/1

Switch(config-if)# macro apply cisco-router $NVID 80

Switch(config-if)# 

This contents of this macro are as follows:

# Access Uplink to Distribution

switchport trunk encapsulation dot1q 

# Define unique Native VLAN on trunk ports

# Recommended value for native vlan (NVID) should not be 1

switchport trunk native vlan $NVID [native_vlan_id]

# Update the allowed VLAN range (VRANGE) such that it

# includes data, voice and native VLANs

# switchport trunk allowed vlan $VRANGE [vlan_range]

# Hardcode trunk and disable negotiation to

# speed up convergence

# Hardcode speed and duplex to router

switchport mode trunk

switchport nonegotiate

speed 100

duplex full 

# Configure qos to trust this interface

auto qos voip trust

qos trust dscp

# Ensure fast access to the network when enabling the interface.

# Ensure that switch devices cannot become active on the interface.

spanning-tree portfast

spanning-tree bpduguard enable 

Related Commands

macro apply cisco-desktop
macro apply cisco-phone
macro apply cisco-switch

macro apply cisco-switch

To enable Cisco-recommended features and settings that are suitable for connecting a switch port to another switch, use the macro apply cisco-switch command.

macro apply cisco-switch $NVID native_vlanid

Syntax Description

Defaults

This command has no default settings.

Command Modes

Interface configuration

Command History

Usage Guidelines

This command can only be viewed and applied; it cannot be modified.

Ensure that the existing configuration on the interface does not conflict with the intended macro configuration. Before you apply this macro, clear the configuration on the interface with the default interface command.

Examples

This example shows how to enable the Cisco-recommended features and settings on port fa2/1:

Switch(config)# interface FastEthernet2/1

Switch(config-if)# macro apply cisco-switch $NVID 45

Switch(config-if)# 

This contents of this macro are as follows:

# Access Uplink to Distribution

switchport trunk encapsulation dot1q

# Define unique Native VLAN on trunk ports

# Recommended value for native vlan (NVID) should not be 1

switchport trunk native vlan $NVID [native_vlan_id]

# Update the allowed VLAN range (VRANGE) such that it

# includes data, voice and native VLANs

# switchport trunk allowed vlan $VRANGE

# Hardcode trunk and disable negotiation to

# speed up convergence

switchport mode trunk

switchport nonegotiate

# Configure qos to trust this interface

auto qos voip trust

# 802.1w defines the link as pt-pt for rapid convergence

spanning-tree link-type point-to-point

Related Commands

macro apply cisco-desktop
macro apply cisco-phone
macro apply cisco-router

main-cpu

To enter the main CPU submode and manually synchronize the configurations on the two supervisor engines, use the main-cpu command.

main-cpu

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

Redundancy

Command History

Usage Guidelines

The main CPU submode is used to manually synchronize the configurations on the two supervisor engines.

From the main CPU submode, use the auto-sync command to enable automatic synchronization of the configuration files in NVRAM.

Note After you enter the main CPU submode, you can use the auto-sync command to automatically synchronize the configuration between the primary and secondary route processors based on the primary configuration. In addition, you can use all of the redundancy commands that are applicable to the main CPU.

Examples

This example shows how to reenable the default automatic synchronization feature using the auto-sync standard command to synchronize the startup-config and config-register configuration of the active supervisor engine with the standby supervisor engine. Updates for the boot variables are automatic and cannot be disabled.

Switch(config)# redundancy

Switch(config-red)# main-cpu

Switch(config-r-mc)# auto-sync standard

Switch(config-r-mc)# end

Switch# copy running-config startup-config 

Switch# 

Related Commands

auto-sync

match

To specify a match clause by selecting one or more ACLs for a VLAN access-map sequence, use the match subcommand. To remove the match clause, use the no form of this command.

match {ip address {acl-number | acl-name}} | {mac address acl-name}

no match {ip address {acl-number | acl-name}} | {mac address acl-name}

Note If a match clause is not specified, the action for the VLAN access-map sequence is applied to all packets. All packets are matched against that sequence in the access-map.

Syntax Description

Defaults

This command has no default settings.

Command Modes

VLAN access-map

Command History

Usage Guidelines

The match clause specifies the IP or MAC ACL for traffic filtering.

The MAC sequence is not effective for IP packets. IP packets should be access controlled by IP match clauses.

Refer to the Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide for additional configuration guidelines and restrictions.

Refer to the Cisco IOS Command Reference publication for additional match command information.

Examples

This example shows how to define a match clause for a VLAN access map:

Switch(config)# vlan access-map ganymede 10

Switch(config-access-map)# match ip address 13 

Switch(config-access-map)# 

Related Commands

show vlan access-map
vlan access-map

monitor session

To enable SPAN sessions on interfaces or VLANs, use the monitor session command. To remove one or more source or destination interfaces from a SPAN session, or a source VLAN from a SPAN session, use the no form of this command.

monitor session session {destination interface {FastEthernet interface-number | GigabitEthernet interface-number} [encapsulation {isl | dot1q}] [ingress [vlan vlan_id] [learning]]} | {remote vlan vlan_id} | {source {interface {FastEthernet interface-number | GigabitEthernet interface-number | Port-channel interface-number}} | [vlan vlan_id] |{remote vlan vlan_id} | {cpu [queue queue_id]} [ , | - | rx | tx | both]} | {filter {ip access-group [name | id]}{vlan vlan_id [ , | - ]} | {packet-type {good | bad}} | {address-type {unicast | multicast | broadcast} [rx | tx | both]}