Catalyst 4500 Series Switch Cisco IOS Command Reference, 12.2(46)SG

snmp ifindex clear

To clear any previously configured snmp ifindex commands that were entered for a specific interface, use the snmp ifindex clear command.

snmp ifindex clear

Syntax Description

This command has no arguments or keywords.

Defaults

This command has no default settings.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

Interface index persistence occurs when ifIndex values in the interface MIB (IF-MIB) persist across reboots and allow for consistent identification of specific interfaces using SNMP.

Use the snmp ifindex clear command on a specific interface when you want that interface to use the global configuration setting for ifIndex persistence. This command clears any ifIndex configuration commands previously entered for that specific interface.

Examples

This example shows how to enable ifIndex persistence for all interfaces:

Router(config)# snmp-server ifindex persist

This example shows how to disable IfIndex persistence for FastEthernet 1/1 only:

Router(config)# interface fastethernet 1/1

Router(config-if)# no snmp ifindex persist

Router(config-if)# exit

This example shows how to clear the ifIndex configuration from the FastEthernet 1/1 configuration:

Router(config)# interface fastethernet 1/1

Router(config-if)# snmp ifindex clear

Router(config-if)# exit

As a result of this sequence of commands, ifIndex persistence is enabled for all interfaces that are specified by the snmp-server ifindex persist global configuration command.

Related Commands

snmp ifindex persist

To enable ifIndex values in the Interfaces MIB (IF-MIB) that persist across reboots (ifIndex persistence) on a specific interface, use the snmp ifindex persist command. To disable ifIndex persistence only on a specific interface, use the no form of this command.

snmp ifindex persist

no snmp ifindex persist

Syntax Description

This command has no arguments or keywords.

Defaults

Disabled.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

Interface index persistence occurs when ifIndex values in the IF-MIB persist across reboots and allow for consistent identification of specific interfaces using SNMP.

The snmp ifindex persist interface configuration command enables and disables ifIndex persistence for individual entries (that correspond to individual interfaces) in the ifIndex table of the IF-MIB.

The snmp-server ifindex persist global configuration command enables and disables ifIndex persistence for all interfaces on the routing device. This action applies only to interfaces that have ifDescr and ifIndex entries in the ifIndex table of the IF-MIB.

Examples

This example shows how to enable ifIndex persistence for interface FastEthernet 1/1 only:

Router(config)# interface fastethernet 1/1

Router(config-if)# snmp ifindex persist

Router(config-if)# exit

This example shows how to enable ifIndex persistence for all interfaces, and then disable ifIndex persistence for interface FastEthernet 1/1 only:

Router(config)# snmp-server ifindex persist

Router(config)# interface fastethernet 1/1

Router(config-if)# no snmp ifindex persist

Router(config-if)# exit

Related Commands

snmp-server enable traps

To enable SNMP notifications (traps or informs), use the snmp-server enable traps command. To disable all SNMP notifications, use the no form of this command.

snmp-server enable traps [flash [insertion | removal] | fru-ctrl | port-security [trap-rate trap-rate] | removal | stpx | vlancreate | vlandelete | vtp] [mac-notification [change | move | threshold]

no snmp-server enable traps [flash [insertion | removal] | fru-ctrl | port-security [trap-rate trap-rate] | removal | stpx | vlancreate | vlandelete | vtp] [mac-notification]

Syntax Description

Defaults

SNMP notifications are disabled.

Command Modes

Global configuration mode

Command History

Usage Guidelines

If you enter this command without an option, all notification types controlled by this command are enabled.

SNMP notifications can be sent as traps or inform requests. This command enables both traps and inform requests for the specified notification types. To specify whether the notifications should be sent as traps or informs, use the snmp-server host [traps | informs] command.

The snmp-server enable traps command is used in conjunction with the snmp-server host command. Use the snmp-server host command to specify which host or hosts receive SNMP notifications. To send notifications, you must configure at least one snmp-server host command.

This list of the MIBs is used for the traps:

•flash—Controls SNMP FLASH traps from the CISCO-FLASH-MIB.

–insertion—Controls the SNMP Flash insertion trap notifications.

–removal—Controls the SNMP Flash removal trap notifications.

•fru-ctrl—Controls the FRU control traps from the CISCO-ENTITY-FRU-CONTROL-MIB.

•port-security—Controls the port-security traps from the CISCO-PORT-SECURITY-MIB.

•stpx—Controls all the traps from the CISCO-STP-EXTENSIONS-MIB.

•vlancreate—Controls SNMP VLAN created trap notifications.

•vlandelete—Controls SNMP VLAN deleted trap notifications.

•vtp—Controls the VTP traps from the CISCO-VTP-MIB.

Examples

This example shows how to send all traps to the host is specified by the name myhost.cisco.com using the community string defined as public:

Switch(config)# snmp-server enable traps 

Switch(config)# snmp-server host myhost.cisco.com public

Switch(config)#  

This example shows how to enable the MAC address change MIB notification:

Switch(config)# snmp-server enable traps mac-notification change

Switch(config)# 

SNMP traps can be enabled with a rate-limit to detect port-security violations due to restrict mode. The following example shows how to enable traps for port-security with a rate of 5 traps per second:

Switch(config)# snmp-server enable traps port-security trap-rate 5

Switch(config)#

Related Commands

snmp-server ifindex persist

To globally enable ifIndex values that will remain constant across reboots for use by SNMP, use the snmp-server ifindex persist command. To globally disable inIndex persistence, use the no form of this command.

snmp-server ifindex persist

no snmp-server ifindex persist

Syntax Description

This command has no arguments or keywords.

Defaults

Disabled.

Command Modes

Global configuration mode

Command History

Usage Guidelines

Interface index persistence occurs when ifIndex values in the IF-MIB persist across reboots and allow for consistent identification of specific interfaces using SNMP.

The snmp-server ifindex persist global configuration command does not override the interface-specific configuration. To override the interface-specific configuration of ifIndex persistence, enter the no snmp ifindex persist and snmp ifindex clear interface configuration commands.

Entering the no snmp-server ifindex persist global configuration command enables and disables ifIndex persistence for all interfaces on the routing device using ifDescr and ifIndex entries in the ifIndex table of the IF-MIB.

Examples

This example shows how to enable ifIndex persistence for all interfaces:

Router(config)# snmp-server ifindex persist

Related Commands

snmp-server ifindex persist compress

To configure the format of the ifIndex table in a compressed format, use the snmp-server ifindex persist compress command. To place the table in a decompressed format, use the no form of this command.

snmp-server ifindex persist compress

no snmp-server ifindex persist compress

Syntax Description

This command has no arguments or keywords.

Defaults

Disabled

Command Modes

Global configuration mode.

Command History

Usage Guidelines

This command is hidden on Supervisor Engine V and later supervisor engines because the ifIndex table is always in a compressed format on those supervisor engines.

At bootup, if the nvram:ifIndex-table.gz file (the ifIndex table ina compressed format) is present on a Supervisor Engine II+, Supervisor Engine III, or Supervisor Engine IV, the snmp-server ifindex persist compress command is automatically run even if the startup-config file does not have this configuration.

Examples

This example shows how to enable compression of the ifIndex table:

Router(config)# snmp-server ifindex persist compress

This example shows how to disable compression of the ifIndex table:

Router(config)# no snmp-server ifindex persist compress

Related Commands

snmp trap mac-notification change

To enable SNMP MAC address notifications, use the snmp trap mac-notification command. To return to the default setting, use the no form of this command.

snmp trap mac-notification change {added | removed}

no snmp trap mac-notification change {added | removed}

Syntax Description

Defaults

MAC address addition and removal are disabled.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

Even though you enable the change notification trap for a specific interface by using the
snmp trap mac-notification change command, the trap is generated only when you enable the
snmp-server enable traps mac-notification change and the mac address-table notification change global configuration commands.

Examples

This example shows how to enable the MAC notification trap when a MAC address is added to a port:

Switch(config)# interface gigabitethernet1/1 

Switch(config-if)# snmp trap mac-notification change added 

You can verify your settings by entering the show mac address-table notification change interface privileged EXEC command.

Related Commands

spanning-tree backbonefast

To enable BackboneFast on a spanning-tree VLAN, use the spanning-tree backbonefast command. To disable BackboneFast, use the no form of this command.

spanning-tree backbonefast

no spanning-tree backbonefast

Syntax Description

This command has no arguments or keywords.

Defaults

BackboneFast is disabled.

Command Modes

Global configuration mode

Command History

Usage Guidelines

BackboneFast should be enabled on all Catalyst 4506 series switches to allow the detection of indirect link failures. Enabling BackboneFast starts the spanning-tree reconfiguration more quickly.

Examples

This example shows how to enable BackboneFast on all VLANs:

Switch(config)# spanning-tree backbonefast

Switch(config)# 

Related Commands

spanning-tree bpdufilter

To enable BPDU filtering on an interface, use the spanning-tree bpdufilter command. To return to the default settings, use the no form of this command.

spanning-tree bpdufilter {enable | disable}

no spanning-tree bpdufilter

Syntax Description

Defaults

Disabled

Command Modes

Interface configuration mode

Command History

Usage Guidelines

Caution Use care when entering the spanning-tree bpdufilter enable command. Enabling BPDU filtering on an interface is approximately equivalent to disabling the spanning tree for this interface. It is possible to create bridging loops if this command is not correctly used.

When configuring Layer 2 protocol tunneling on all the service provider edge switches, you must enable spanning-tree BPDU filtering on the 802.1Q tunnel ports by entering the spanning-tree bpdufilter enable command.

BPDU filtering allows you to prevent a port from sending and receiving BPDUs. The configuration is applicable to the whole interface, whether it is trunking or not. This command has three states:

•spanning-tree bpdufilter enable—This state unconditionally enables the BPDU filter feature on the interface.

•spanning-tree bpdufilter disable—This state unconditionally disables the BPDU filter feature on the interface.

•no spanning-tree bpdufilter—This state enables the BPDU filter feature on the interface if the interface is in operational PortFast state and if the spanning-tree portfast bpdufilter default command is configured.

Examples

This example shows how to enable the BPDU filter feature on this interface:

Switch(config-if)# spanning-tree bpdufilter enable

Switch(config-if)# 

Related Commands

spanning-tree bpduguard

To enable BPDU guard on an interface, use the spanning-tree bpduguard command. To return to the default settings, use the no form of this command.

spanning-tree bpduguard {enable | disable}

no spanning-tree bpduguard

Syntax Description

Defaults

BPDU guard is disabled.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

BPDU guard is a feature that prevents a port from receiving BPDUs. This feature is typically used in a service provider environment where the administrator wants to prevent an access port from participating in the spanning tree. If the port still receives a BPDU, it is put in the ErrDisable state as a protective measure. This command has three states:

•spanning-tree bpduguard enable—This state unconditionally enables BPDU guard on the interface.

•spanning-tree bpduguard disable—This state unconditionally disables BPDU guard on the interface.

•no spanning-tree bpduguard—This state enables BPDU guard on the interface if it is in the operational PortFast state and if the spanning-tree portfast bpduguard default command is configured.

Examples

This example shows how to enable BPDU guard on this interface:

Switch(config-if)# spanning-tree bpduguard enable

Switch(config-if)# 

Related Commands

spanning-tree cost

To calculate the path cost of STP on an interface, use the spanning-tree cost command. To revert to the default, use the no form of this command.

spanning-tree cost cost

no spanning-tree cost cost

Syntax Description

Defaults

The default settings are as follows:

•FastEthernet—19

•GigabitEthernet—1

Command Modes

Interface configuration mode

Command History

Usage Guidelines

When you configure the cost, the higher values indicate higher costs. The range applies regardless of the protocol type that is specified. The path cost is calculated, based on the interface bandwidth.

Examples

This example shows how to access an interface and set a path cost value of 250 for the spanning-tree VLAN that is associated with that interface:

Switch(config)# interface fastethernet 2/1

Switch(config-if)# spanning-tree cost 250

Switch(config-if)# 

Related Commands

spanning-tree etherchannel guard misconfig

To display an error message when a loop due to a channel misconfiguration is detected, use the spanning-tree etherchannel guard misconfig command. To disable the feature, use the no form of this command.

spanning-tree etherchannel guard misconfig

no spanning-tree etherchannel guard misconfig

Syntax Description

This command has no arguments or keywords.

Defaults

Spanning-tree EtherChannel guard is enabled.

Command Modes

Global configuration mode

Command History

Usage Guidelines

When an EtherChannel guard misconfiguration is detected, this message is displayed:

%SPANTREE-2-CHNL_MISCFG:Detected loop due to etherchannel misconfig of interface 
Port-Channel1

To determine which local ports are involved in the misconfiguration, enter the show interfaces status err-disabled command. To verify the EtherChannel configuration on the remote device, enter the show etherchannel summary command on the remote device.

After you correct the configuration, enter the shutdown and the no shutdown commands on the associated port-channel interface.

Examples

This example shows how to enable the EtherChannel guard misconfiguration feature:

Switch(config)# spanning-tree etherchannel guard misconfig

Switch(config)# 

Related Commands

spanning-tree extend system-id

To enable the extended system ID feature on a chassis that supports 1024 MAC addresses, use the spanning-tree extend system-id command. To disable the feature, use the no form of this command.

spanning-tree extend system-id

no spanning-tree extend system-id

Syntax Description

This command has no arguments or keywords.

Defaults

Enabled on systems that do not provide 1024 MAC addresses.

Command Modes

Global configuration mode

Command History

Usage Guidelines

Releases 12.1(13)E and later support chassis with 64 or 1024 MAC addresses. For chassis with 64 MAC addresses, STP uses the extended system ID plus a MAC address to make the bridge ID unique for each VLAN.

You cannot disable the extended system ID on chassis that support 64 MAC addresses.

Enabling or disabling the extended system ID updates the bridge IDs of all active STP instances, which might change the spanning-tree topology.

Examples

This example shows how to enable the extended system ID:

Switch(config)# spanning-tree extend system-id 

Switch(config)# 

Related Commands

spanning-tree guard

To enable root guard, use the spanning-tree guard command. To disable root guard, use the no form of this command.

spanning-tree guard {loop | root | none}

no spanning-tree guard

Syntax Description

Defaults

Root guard is disabled.

Command Modes

Interface configuration mode

Command History

Examples

This example shows how to enable root guard:

Switch(config-if)# spanning-tree guard root

Switch(config-if)# 

Related Commands

spanning-tree link-type

To configure a link type for a port, use the spanning-tree link-type command. To return to the default settings, use the no form of this command.

spanning-tree link-type {point-to-point | shared}

no spanning-tree link-type

Syntax Description

Defaults

Link type is derived from the duplex mode.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

RSTP+ fast transition works only on point-to-point links between two bridges.

By default, the switch derives the link type of a port from the duplex mode. A full-duplex port is considered as a point-to-point link while a half-duplex configuration is assumed to be on a shared link.

If you designate a port as a shared link, RSTP+ fast transition is forbidden, regardless of the duplex setting.

Examples

This example shows how to configure the port as a shared link:

Switch(config-if)# spanning-tree link-type shared

Switch(config-if)# 

Related Commands

spanning-tree loopguard default

To enable loop guard as the default on all ports of a specific bridge, use the spanning-tree loopguard default command. To disable loop guard, use the no form of this command.

spanning-tree loopguard default

no spanning-tree loopguard default

Syntax Description

This command has no keywords or arguments.

Defaults

Loop guard is disabled.

Command Modes

Global configuration mode

Command History

Usage Guidelines

Loop guard provides an additional security in the bridge network. Loop guard prevents alternate or root ports from becoming the designated port because of a failure leading to a unidirectional link.

Loop guard operates only on ports that are considered point-to-point by the spanning tree.

Individual loop-guard port configuration overrides this global default.

Examples

This example shows how to enable loop guard:

Switch(config)# spanning-tree loopguard default

Switch(config)# 

Related Commands

spanning-tree mode

To switch between PVST+ and MST modes, use the spanning-tree mode command. To return to the default settings, use the no form of this command.

spanning-tree mode {pvst | mst | rapid-pvst}

no spanning-tree mode {pvst | mst | rapid-pvst}

Syntax Description

Defaults

PVST+ mode

Command Modes

Configuration

Command History

Usage Guidelines

Caution Be careful when using the spanning-tree mode command to switch between PVST+ and MST modes. When you enter the command, all spanning-tree instances are stopped for the previous mode and restarted in the new mode. Using this command may cause disruption of user traffic.

Examples

This example shows how to switch to MST mode:

Switch(config)# spanning-tree mode mst

Switch(config)# 

This example shows how to return to the default mode (PVST):

Switch(config)# no spanning-tree mode

Switch(config)# 

Related Commands

spanning-tree mst

To set the path cost and port-priority parameters for any MST instance (including the CIST with instance ID 0), use the spanning-tree mst command. To return to the default settings, use the no form of this command.

spanning-tree mst instance-id [cost cost] | [port-priority prio]

no spanning-tree mst instance-id {cost | port-priority}

Syntax Description

Defaults

Port priority is 128.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

The higher cost cost values indicate higher costs. When entering the cost value, do not include a comma in the entry; for example, enter 1000, not 1,000.

The higher port-priority prio values indicate smaller priorities.

By default, the cost depends on the port speed; faster interface speeds indicate smaller costs. MST always uses long path costs.

Examples

This example shows how to set the interface path cost:

Switch(config-if)# spanning-tree mst 0 cost 17031970

Switch(config-if)# 

This example shows how to set the interface priority:

Switch(config-if)# spanning-tree mst 0 port-priority 64

Switch(config-if)# 

Related Commands

spanning-tree mst configuration

To enter the MST configuration submode, use the spanning-tree mst configuration command. To return to the default MST configuration, use the no form of this command.

spanning-tree mst configuration

no spanning-tree mst configuration

Syntax Description

This command has no arguments or keywords.

Defaults

The default settings are as follows:

•No VLANs are mapped to any MST instance.

•All VLANs are mapped to the CIST instance.

•The region name is an empty string.

•The revision number is 0.

Command Modes

Global configuration mode

Command History

Usage Guidelines

The MST configuration consists of three main parameters:

•Instance VLAN mapping (see the instance command)

•Region name (see the name command)

•Configuration revision number (see the revision command)

By default, the value for the MST configuration is the default value for all its parameters.

The abort and exit commands allow you to exit the MST configuration submode. The difference between the two commands depends on whether you want to save your changes or not.

The exit command commits all the changes before leaving MST configuration submode. If you do not map the secondary VLANs to the same instance as the associated primary VLAN, when you exit the MST configuration submode, a message displays and lists the secondary VLANs that are not mapped to the same instance as the associated primary VLAN. The message is as follows:

These secondary vlans are not mapped to the same instance as their primary:

->3

The abort command leaves the MST configuration submode without committing any changes.

Whenever you change an MST configuration submode parameter, it can cause a loss of connectivity. To reduce the number of service disruptions, when you enter the MST configuration submode, you are changing a copy of the current MST configuration. When you are done editing the configuration, you can apply all the changes at once by using the exit keyword, or you can exit the submode without committing any change to the configuration by using the abort keyword.

In the unlikely event that two users enter a new configuration at exactly at the same time, this message is displayed:

Switch(config-mst)# exit

% MST CFG:Configuration change lost because of concurrent access

Switch(config-mst)# 

Examples

This example shows how to enter the MST configuration submode:

Switch(config)# spanning-tree mst configuration

Switch(config-mst)# 

This example shows how to reset the MST configuration to the default settings:

Switch(config)# no spanning-tree mst configuration

Switch(config)# 

Related Commands

spanning-tree mst forward-time

To set the forward delay timer for all the instances, use the spanning-tree mst forward-time command. To return to the default settings, use the no form of this command.

spanning-tree mst forward-time seconds

no spanning-tree mst forward-time

Syntax Description

Defaults

The forward delay timer is set for 15 seconds.

Command Modes

Global configuration mode

Command History

Examples

This example shows how to set the forward-delay timer:

Switch(config)# spanning-tree mst forward-time 20

Switch(config)# 

Related Commands

spanning-tree mst hello-time

To set the hello-time delay timer for all the instances, use the spanning-tree mst hello-time command. To return to the default settings, use the no form of this command.

spanning-tree mst hello-time seconds

no spanning-tree mst hello-time

Syntax Description

Defaults

The hello-time delay timer is set for 2 seconds.

Command Modes

Global configuration mode

Command History

Usage Guidelines

If you do not specify the hello-time value, the value is calculated from the network diameter.

Examples

This example shows how to set the hello-time delay timer:

Switch(config)# spanning-tree mst hello-time 3

Switch(config)# 

Related Commands

spanning-tree mst max-age

To set the max-age timer for all the instances, use the spanning-tree mst max-age command. To return to the default settings, use the no form of this command.

spanning-tree mst max-age seconds

no spanning-tree mst max-age

Syntax Description

Defaults

The max-age timer is set for 20 seconds.

Command Modes

Global configuration mode

Command History

Examples

This example shows how to set the max-age timer:

Switch(config)# spanning-tree mst max-age 40

Switch(config)# 

Related Commands

spanning-tree mst max-hops

To specify the number of possible hops in the region before a BPDU is discarded, use the spanning-tree mst max-hops command. To return to the default settings, use the no form of this command.

spanning-tree mst max-hops hopnumber

no spanning-tree mst max-hops

Syntax Description

Defaults

Number of hops is 20.

Command Modes

Global configuration mode

Command History

Examples

This example shows how to set the number of possible hops in the region before a BPDU is discarded to 25:

Switch(config)# spanning-tree mst max-hops 25

Switch(config)# 

Related Commands

spanning-tree mst root

To designate the primary root, secondary root, bridge priority, and timer value for an instance, use the spanning-tree mst root command. To return to the default settings, use the no form of this command.

spanning-tree mst instance-id root {primary | secondary} | {priority prio} [diameter dia [hello-time hello]]

no spanning-tree mst root

Syntax Description

Defaults

Bridge priority is 32768.

Command Modes

Global configuration mode

Command History

Usage Guidelines

The bridge priority can be set in increments of 4096 only. When you set the priority, valid values are 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768, 36864, 40960, 45056, 49152, 53248, 57344, and 61440.

You can set the priority to 0 to make the switch root.

The spanning-tree root secondary bridge priority value is 16384.

The diameter dia and hello-time hello options are available for instance 0 only.

If you do not specify the hello_time value, the value is calculated from the network diameter.

Examples

This example shows how to set the priority and timer values for the bridge:

Switch(config)# spanning-tree mst 0 root primary diameter 7 hello-time 2

Switch(config)# spanning-tree mst 5 root primary

Switch(config)# 

Related Commands

spanning-tree pathcost method

To set the path cost calculation method, use the spanning-tree pathcost method command. To revert to the default setting, use the no form of this command.

spanning-tree pathcost method {long | short}

no spanning-tree pathcost method

Syntax Description

Defaults

Port path cost has 16-bit-based values.

Command Modes

Global configuration mode

Command History

Usage Guidelines

This command applies to all the spanning-tree instances on the switch.

The long path cost calculation method uses all the 32 bits for path cost calculation and yields values in the range of 1 through 200,000,000.

The short path cost calculation method (16 bits) yields values in the range of 1 through 65,535.

Examples

This example shows how to set the path cost calculation method to long:

Switch(config) spanning-tree pathcost method long

Switch(config)

This example shows how to set the path cost calculation method to short:

Switch(config) spanning-tree pathcost method short

Switch(config)

Related Commands

spanning-tree portfast (interface configuration mode)

To enable PortFast mode, where the interface is immediately put into the forwarding state upon linkup without waiting for the timer to expire, use the spanning-tree portfast command. To return to the default setting, use the no form of this command.

spanning-tree portfast {disable | trunk}

no spanning-tree portfast

Syntax Description

Defaults

PortFast mode is disabled.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

You should use this feature only with interfaces that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt the Catalyst 4500 series switch and network operation.

An interface with PortFast mode enabled is moved directly to the spanning-tree forwarding state when linkup occurs without waiting for the standard forward-time delay.

Be careful when using the no spanning-tree portfast command. This command does not disable PortFast if the spanning-tree portfast default command is enabled.

This command has four states:

•spanning-tree portfast—This command enables PortFast unconditionally on the given port.

•spanning-tree portfast disable—This command explicitly disables PortFast for the given port. The configuration line shows up in the running-configuration as it is not the default.

•spanning-tree portfast trunk—This command allows you to configure PortFast on trunk ports.

Note If you enter the spanning-tree portfast trunk command, the port is configured for PortFast even when in the access mode.

•no spanning-tree portfast—This command implicitly enables PortFast if the spanning-tree portfast default command is defined in global configuration and if the port is not a trunk port. If you do not configure PortFast globally, the no spanning-tree portfast command is equivalent to the spanning-tree portfast disable command.

Examples

This example shows how to enable PortFast mode:

Switch(config-if)# spanning-tree portfast

Switch(config-if)

Related Commands

spanning-tree portfast bpdufilter default

To enable the BPDU filtering by default on all PortFast ports, use the spanning-tree portfast bpdufilter default command. To return to the default settings, use the no form of this command.

spanning-tree portfast bpdufilter default

no spanning-tree portfast bpdufilter default

Syntax Description

This command has no keywords or arguments.

Defaults

BPDU filtering is disabled.

Command Modes

Global configuration mode

Command History

Usage Guidelines

The spanning-tree portfast bpdufilter default command enables BPDU filtering globally on the Catalyst 4500 series switch. BPDU filtering prevents a port from sending or receiving any BPDUs.

You can override the effects of the spanning-tree portfast bpdufilter default command by configuring BPDU filtering at the interface level.

Note Be careful when enabling BPDU filtering. Functionality is different when enabling on a per-port basis or globally. When enabled globally, BPDU filtering is applied only on ports that are in an operational PortFast state. Ports still send a few BPDUs at linkup before they effectively filter outbound BPDUs. If a BPDU is received on an edge port, it immediately loses its operational PortFast status and BPDU filtering is disabled.

When enabled locally on a port, BPDU filtering prevents the Catalyst 4500 series switch from receiving or sending BPDUs on this port.

Caution Be careful when using this command. This command can cause bridging loops if not used correctly.

Examples

This example shows how to enable BPDU filtering by default:

Switch(config)# spanning-tree portfast bpdufilter default

Switch(config)# 

Related Commands

spanning-tree portfast bpduguard default

To enable BPDU guard by default on all the PortFast ports, use the spanning-tree portfast bpduguard default command. To return to the default settings, use the no form of this command.

spanning-tree portfast bpduguard default

no spanning-tree portfast bpduguard default

Syntax Description

This command has no keywords or arguments.

Defaults

BPDU guard is disabled.

Command Modes

Global configuration mode

Command History

Usage Guidelines

Caution Be careful when using this command. You should use this command only with the interfaces that connect to the end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt the Catalyst 4500 series switch and network operation.

BPDU guard disables a port if it receives a BPDU. BPDU guard is applied only on ports that are PortFast enabled and are in an operational PortFast state.

Examples

This example shows how to enable BPDU guard by default:

Switch(config)# spanning-tree portfast bpduguard default

Switch(config)# 

Related Commands

spanning-tree portfast default

To globally enable PortFast by default on all access ports, use the spanning-tree portfast default command. To disable PortFast as default on all access ports, use the no form of this command.

spanning-tree portfast default

no spanning-tree portfast default

Syntax Description

This command has no arguments or keywords.

Defaults

PortFast is disabled.

Command Modes

Global configuration mode

Command History

Usage Guidelines

Caution Be careful when using this command. You should use this command only with the interfaces that connect to end stations; otherwise, an accidental topology loop could cause a data packet loop and disrupt the Catalyst 4500 series switch and network operation.

An interface with PortFast mode enabled is moved directly to the spanning-tree forwarding state when linkup occurs without waiting for the standard forward-time delay.

You can enable PortFast mode on individual interfaces using the spanning-tree portfast (interface configuration mode) command.

Examples

This example shows how to globally enable PortFast by default on all access ports:

Switch(config)# spanning-tree portfast default

Switch(config)# 

Related Commands

spanning-tree port-priority

To prioritize an interface when two bridges compete for position as the root bridge, use the spanning-tree port-priority command. The priority you set breaks the tie. To revert to the default setting, use the no form of this command.

spanning-tree port-priority port_priority

no spanning-tree port-priority

Syntax Description

Defaults

Port priority value is set to 128.

Command Modes

Interface configuration mode

Command History

Examples

This example shows how to increase the possibility that the spanning-tree instance 20 will be chosen as the root-bridge on interface FastEthernet 2/1:

Switch(config-if)# spanning-tree port-priority 0

Switch(config-if)# 

Related Commands

spanning-tree uplinkfast

To enable the UplinkFast feature, use the spanning-tree uplinkfast command. To disable UplinkFast, use the no form of this command.

spanning-tree uplinkfast [max-update-rate packets-per-second]

no spanning-tree uplinkfast [max-update-rate]

Syntax Description

Defaults

The default settings are as follows:

•Disabled.

•Maximum update rate is 150.

Command Modes

Global configuration mode

Command History

Usage Guidelines

This command should be used only on access switches.

When UplinkFast is configured, the bridge priority is changed to 49,152 so that this switch will not be selected as root. All interface path costs of all spanning-tree interfaces belonging to the specified spanning-tree instances are also increased by 3000.

When spanning tree detects that the root interface has failed, the UplinkFast feature causes an immediate switchover to an alternate root interface, transitioning the new root interface directly to the forwarding state. During this time, a topology change notification is sent. To minimize the disruption caused by the topology change, a multicast packet is sent to 01-00-0C-CD-CD-CD for each station address in the forwarding bridge except for those associated with the old root interface.

Use the spanning-tree uplinkfast max-update-rate command to enable UplinkFast (if not already enabled) and change the rate at which the update packets are sent. Use the no form of this command to return the default rate of 150 packets per second.

Examples

This example shows how to enable UplinkFast and set the maximum rate to 200 packets per second:

Switch(config)# spanning-tree uplinkfast 

Switch(config)# spanning-tree uplinkfast max-update-rate 200

Related Commands

spanning-tree vlan

To configure STP on a per-VLAN basis, use the spanning-tree vlan command. To return to the default value, use the no form of this command.

spanning-tree vlan vlan_id [forward-time seconds | hello-time seconds | max-age seconds | priority priority | protocol protocol | root {primary | secondary} [diameter net-diameter [hello-time seconds]]]

no spanning-tree vlan vlan_id [forward-time | hello-time | max-age | priority | root]

Syntax Description

Defaults

The default settings are as follows:

•Forward-time—15 seconds

•Hello-time—2 seconds

•Max-age—20 seconds

•Priority—32768 with STP enabled; 128 with MST enabled

•Root—No STP root

Command Modes

Global configuration mode

Command History

Usage Guidelines

When you are setting the max-age seconds value, if a bridge does not hear BPDUs from the root bridge within the specified interval, it assumes that the network has changed and recomputes the spanning-tree topology.

The spanning-tree root primary command alters the switch bridge priority to 8192. If you enter the spanning-tree root primary command and the switch does not become root, then the bridge priority is changed to 100 less than the bridge priority of the current bridge. If the switch does not become root, an error will result.

The spanning-tree root secondary command alters the switch bridge priority to 16384. If the root switch fails, this switch becomes the next root switch.

Use the spanning-tree root commands on backbone switches only.

Examples

This example shows how to enable spanning tree on VLAN 200:

Switch(config)# spanning-tree vlan 200 

Switch(config)# 

This example shows how to configure the switch as the root switch for VLAN 10 with a network diameter of 4:

Switch(config)# spanning-tree vlan 10 root primary diameter 4

Switch(config)# 

This example shows how to configure the switch as the secondary root switch for VLAN 10 with a network diameter of 4:

Switch(config)# spanning-tree vlan 10 root secondary diameter 4 

Switch(config)# 

Related Commands

speed

To configure the interface speed, use the speed command. To disable a speed setting, use the no form of this command.

speed {10 | 100 | 1000 | auto [10 | 100 | 1000] | nonegotiate}

no speed

Syntax Description

Defaults

The default values are shown in the following table:

Command Modes

Interface configuration mode

Command History

Usage Guidelines

Table 2-28 lists the supported command options by interface.

If you configure the interface speed and duplex commands manually and enter a value other than
speed auto (for example, 10 or 100 Mbps), make sure that you configure the connecting interface speed command to a matching speed but do not use the auto parameter.

When manually configuring the interface speed to either 10 or 100 Mbps, the switch prompts you to also configure duplex mode on the interface.

Note Catalyst 45006 switches cannot automatically negotiate the interface speed and the duplex mode if either connecting interface is configured to a value other than auto.

Caution Changing the interface speed and the duplex mode configuration might shut down and reenable the interface during the reconfiguration.

Table 2-29 describes the system's performance for different combinations of the duplex and speed modes. The specified duplex command that is configured with the specified speed command produces the resulting system action.

Examples

This example shows how to set the interface speed to 100 Mbps on the Fast Ethernet interface 5/4:

Switch(config)# interface fastethernet 5/4

Switch(config-if)# speed 100

This example shows how to allow Fast Ethernet interface 5/4 to autonegotiate the speed and duplex mode:

Switch(config)# interface fastethernet 5/4

Switch(config-if)# speed auto

Note The speed auto 10 100 command is similar to the speed auto command on a Fast Ethernet interface.

This example shows how to limit the interface speed to 10 and 100 Mbps on the Gigabit Ethernet interface 1/1 in auto-negotiation mode:

Switch(config)# interface gigabitethernet 1/1

Switch(config-if)# speed auto 10 100

This example shows how to limit the speed negotiation to 100 Mbps on the Gigabit Ethernet interface 1/1:

Switch(config)# interface gigabitethernet 1/1

Switch(config-if)# speed auto 100

Related Commands

storm-control

To enable broadcast storm control on a port and to specify what to do when a storm occurs on a port, use the storm-control interface configuration command. To disable storm control for the broadcast traffic and to disable a specified storm-control action, use the no form of this command.

storm-control {broadcast level high level [lower level]} | action {shutdown | trap}}

no storm-control {broadcast level level [lower level]} | action {shutdown | trap}}

Syntax Description

Defaults

Broadcast storm control is disabled.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

Enter the storm-control broadcast level command to enable traffic storm control on the interface, configure the traffic storm control level, and apply the traffic storm control level to the broadcast traffic on the interface.

The Catalyst 4500 series switch supports broadcast traffic storm control on all LAN ports.

The period is required when you enter the fractional suppression level.

The suppression level is entered as a percentage of the total bandwidth. A threshold value of 100 percent indicates that no limit is placed on traffic. A value of 0.0 means that all specified traffic on that port is blocked.

Enter the show interfaces counters storm-control command to display the discard count.

Enter the show running-config command to display the enabled suppression mode and level setting.

To turn off suppression for the specified traffic type, you can do one of the following:

•Set the high-level value to 100 percent for the specified traffic type.

•Use the no form of this command.

The lower level is ignored for the interfaces that perform storm control in the hardware.

Note The lower level keyword does not apply to the Supervisor Engine 6-E and Catalyst 4900M chassis implementations.

Examples

This example shows how to enable broadcast storm control on a port with a 75.67 percent rising suppression level:

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# interface fastethernet 3/1

Switch(config-if)# storm-control broadcast level 75.67

Switch(config-if)# end

This example shows how to disable the port during a storm:

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# interface fastethernet 3/1

Switch(config-if)# storm-control action shutdown

Switch(config-if)# end

This example shows how to disable storm control on a port:

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# interface fastethernet 3/1

Switch(config-if)# no storm-control broadcast level

Switch(config-if)# end

This example shows how to disable storm control by setting the high level to 100 percent:

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# interface fastethernet 3/1

Switch(config-if)# storm-control broadcast level 100

Switch(config-if)# end

Related Commands

storm-control broadcast include multicast

To enable multicast storm control on a port, use the storm-control broadcast include multicast command. To disable multicast storm control, use the no form of this command.

storm-control broadcast include multicast

no storm-control broadcast include multicast

Syntax Description

This command has no arguments or keywords.

Defaults

Multicast storm control is disabled.

Command Modes

Global configuration mode
Interface configuration mode on a Supervisor Engine 6-E or Catalyst 4900M chassis

Command History

Usage Guidelines

This command prompts the hardware to filter multicast packets if it is already filtering broadcast packets.

The Supervisor Engine 6-E and Catalyst 4900M chassis supports per-interface multicast suppression. When you enable multicast suppression on an interface you subject incoming multicast and broadcast traffic on that interface to suppression.

Examples

This example shows how to enable multicast storm control globally:

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# storm-control broadcast include multicast

Switch(config)# end

This example shows how to enable per-port Multicast storm control on a Supervisor Engine 6-E:

Switch# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

Switch(config)# interface fastethernet2/4

Switch(config-if)# storm-control broadcast include multicast

Switch(config)# end

Related Commands

switchport

To modify the switching characteristics of a Layer 2 switch interface, use the switchport command. To return the interface to the routed-interface status and cause all further Layer 2 configuration to be erased, use the no form of this command without parameters.

switchport [access vlan vlan_num] | [nonegotiate] | [voice vlan {vlan_id | dot1p | none | untagged}]

no switchport [access | nonegotiate | voice vlan]

Syntax Description

Defaults

The default settings are as follows:

•Switchport trunking mode is enabled.

•Dynamic negotiation parameter is set to auto.

•Access VLANs and trunk interface native VLANs are a default VLAN corresponding to the platform or interface hardware.

•All VLAN lists include all VLANs.

•No voice VLAN is enabled.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

The no switchport command shuts the port down and then reenables it, which may generate messages on the device to which the port is connected.

The no form of the switchport access command resets the access mode VLAN to the appropriate default VLAN for the device. The no form of the switchport nonegotiate command removes the nonegotiate status.

When you are using the nonegotiate keyword, DISL/DTP negotiation packets will not be sent on the interface. The device will trunk or not trunk according to the mode parameter given: access or trunk. This command will return an error if you attempt to execute it in dynamic (auto or desirable) mode.

The voice VLAN is automatically set to VLAN 1 unless you use one of the optional keywords.

If you use the switch port voice vlan command for an interface, the interface cannot join a port channel.

When you use the switchport voice vlan command, the output for the show running-config command changes to show the voice VLAN set.

Examples

This example shows how to cause the port interface to stop operating as a Cisco-routed port and convert to a Layer 2-switched interface:

Switch(config-if)# switchport

Switch(config-if)# 

This example shows how to cause a port interface in access mode, which is configured as a switched interface, to operate in VLAN 2:

Switch(config-if)# switchport access vlan 2

Switch(config-if)# 

This example shows how to cause a port interface, which is configured as a switched interface, to refrain from negotiating in trunking mode and act as a trunk or access port (depending on the mode set):

Switch(config-if)# switchport nonegotiate

Switch(config-if)# 

This example shows how to set the voice VLAN for the interface to VLAN 2:

Switch(config-if)# switchport voice vlan 2

switchport voice vlan 2

Switch(config-if)# 

Related Commands

switchport access vlan

To set the VLAN when an interface is in access mode, use the switchport access vlan command. To reset the access mode VLAN to the appropriate default VLAN for the device, use the no form of this command.

switchport access [vlan {vlan-id | dynamic}]

no switchport access vlan

Syntax Description

Defaults

The default settings are as follows:

•The access VLAN and trunk interface native VLAN are default VLANs that correspond to the platform or the interface hardware.

•All VLAN lists include all VLANs.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

You must enter the switchport command without any keywords to configure the LAN interface as a Layer 2 interface before you can enter the switchport access vlan command. This action is required only if you have not already entered the switchport command for the interface.

Entering the no switchport command shuts the port down and then reenables it, which could generate messages on the device to which the port is connected.

The no form of the switchport access vlan command resets the access mode VLAN to the appropriate default VLAN for the device.

If your system is configured with a Supervisor Engine I, valid values for vlan-id are from 1 to 1005. If your system is configured with a Supervisor Engine II, valid values for vlan-id are from 1 to 4094. Extended-range VLANs are not supported on systems configured with a Supervisor Engine I.

Examples

This example shows how to cause the port interface to stop operating as a Cisco-routed port and convert to a Layer 2-switched interface:

Switch(config-if)# switchport

Switch(config-if)# 

Note This command is not used on platforms that do not support Cisco-routed ports. All physical ports on such platforms are assumed to be Layer 2-switched interfaces.

This example shows how to cause a port interface that has already been configured as a switched interface to operate in VLAN 2 instead of the platform's default VLAN when in access mode:

Switch(config-if)# switchport access vlan 2

Switch(config-if)# 

Related Commands

switchport autostate exclude

To exclude a port from the VLAN interface link-up calculation, use the switchport autostate exclude command. To return to the default settings, use the no form of this command.

switchport autostate exclude

no switchport autostate exclude

Syntax Description

This command has no keywords or arguments.

Defaults

All ports are included in the VLAN interface link-up calculation.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

You must enter the switchport command without any keywords to configure the LAN interface as a Layer 2 interface before you can enter the switchport autostate exclude command. This action is required only if you have not entered the switchport command for the interface.

Note The switchport command is not used on platforms that do not support Cisco-routed ports. All physical ports on such platforms are assumed to be Layer 2-switched interfaces.

The switchport autostate exclude command marks the port to be excluded from the interface VLAN up calculation when there are multiple ports in the VLAN.

The show interface interface switchport command displays the autostate mode if the mode has been set. If the mode has not been set, the autostate mode is not displayed.

Examples

This example shows how to exclude a port from the VLAN interface link-up calculation:

Switch(config-if)# switchport autostate exclude

Switch(config-if)#

This example shows how to include a port in the VLAN interface link-up calculation:

Switch(config-if)# no switchport autostate exclude

Switch(config-if)#

You can verify your settings by entering the show interfaces switchport privileged EXEC command.

Related Commands

switchport block

To prevent the unknown multicast or unicast packets from being forwarded, use the switchport block interface configuration command. To allow the unknown multicast or unicast packets to be forwarded, use the no form of this command.

switchport block {multicast | unicast}

no switchport block {multicast | unicast}

Syntax Description

Defaults

Unknown multicast and unicast traffic are not blocked.

All traffic with unknown MAC addresses is sent to all ports.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

You can block the unknown multicast or unicast traffic on the switch ports.

Blocking the unknown multicast or unicast traffic is not automatically enabled on the switch ports; you must explicitly configure it.

Note For more information about blocking the packets, refer to the software configuration guide for this release.

Examples

This example shows how to block the unknown multicast traffic on an interface:

Switch(config-if)# switchport block multicast

You can verify your setting by entering the show interfaces interface-id switchport privileged EXEC command.

Related Commands

switchport mode

To set the interface type, use the switchport mode command. To reset the mode to the appropriate default mode for the device, use the no form of this command.

switchport mode {access | dot1q-tunnel | trunk | dynamic {auto | desirable}}

switchport mode private-vlan {host | promiscuous | trunk promiscuous | trunk [secondary]}

no switchport mode dot1q-tunnel

no switchport mode private-vlan

Syntax Description

Defaults

Link converts to a trunk link.

dot1q tunnel ports are disabled.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

If you enter access mode, the interface goes into permanent nontrunking mode and negotiates to convert the link into a nontrunk link even if the neighboring interface does not approve the change.

If you enter trunk mode, the interface goes into permanent trunking mode and negotiates to convert the link into a trunk link even if the neighboring interface does not approve the change.

If you enter dynamic auto mode, the interface converts the link to a trunk link if the neighboring interface is set to trunk or desirable mode.

If you enter dynamic desirable mode, the interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode.

If you specify the dot1q-tunnel keyword, the port is set unconditionally as an 802.1Q tunnel port.

The port becomes inactive if you configure it as a private VLAN trunk port and one of the following applies:

•The port does not have a valid PVLAN association.

•The port does not have valid allowed normal VLANs.

If a private port PVLAN association or mapping is deleted, or if a private port is configured as a SPAN destination, it becomes inactive.

Examples

This example shows how to set the interface to dynamic desirable mode:

Switch(config-if)# switchport mode dynamic desirable

Switch(config-if)# 

This example shows how to set a port to PVLAN host mode:

Switch(config-if)# switchport mode private-vlan host

Switch(config-if)# 

This example shows how to set a port to private VLAN trunk:

Switch(config-if)# switchport mode private-vlan trunk

Switch(config-if)# 

This example shows how to configure a port for an 802.1Q tunnel port:

Switch(config-if)# switchport mode dot1q-tunnel 

Switch(config-if)# 

This example shows how to configure a promiscuous trunk port:

Switch(config-if)# switchport mode private-vlan trunk promiscuous

Switch(config-if)# 

This example shows how to configure an isolated trunk port:

Switch(config-if)# switchport mode private-vlan trunk

OR

Switch(config-if)# switchport mode private-vlan trunk secondary

Switch(config-if)# 

You can verify your settings by entering the show interfaces switchport command and examining information in the Administrative Mode and Operational Mode rows.

This example shows how to configure interface FastEthernet 5/2 as a PVLAN promiscuous port, map it to a PVLAN, and verify the configuration:

Switch# configure terminal 

Switch(config)# interface fastethernet 5/2 

Switch(config-if)# switchport mode private-vlan promiscuous 

Switch(config-if)# switchport private-vlan mapping 200 2

Switch(config-if)# end 

Switch# show interfaces fastethernet 5/2 switchport

Name:Fa5/2

Switchport:Enabled

Administrative Mode:private-vlan promiscuous

Operational Mode:private-vlan promiscuous

Administrative Trunking Encapsulation:negotiate

Operational Trunking Encapsulation:native

Negotiation of Trunking:Off

Access Mode VLAN:1 (default)

Trunking Native Mode VLAN:1 (default)

Voice VLAN:none

Administrative Private VLAN Host Association:none

Administrative Private VLAN Promiscuous Mapping:200 (VLAN0200) 2 (VLAN0002)

Private VLAN Trunk Native VLAN:none

Administrative Private VLAN Trunk Encapsulation:dot1q

Administrative Private VLAN Trunk Normal VLANs:none

Administrative Private VLAN Trunk Private VLANs:none

Operational Private VLANs:

  200 (VLAN0200) 2 (VLAN0002)

Trunking VLANs Enabled:ALL

Pruning VLANs Enabled:2-1001

Capture Mode Disabled

Capture VLANs Allowed:ALL

This example shows how to configure interface FastEthernet 5/1 as a PVLAN host port and verify the configuration:

Switch# configure terminal 

Switch(config)# interface fastethernet 5/1 

Switch(config-if)# switchport mode private-vlan host 

Switch(config-if)# switchport private-vlan host-association 202 440

Switch(config-if)# end

Switch# show interfaces fastethernet 5/1 switchport

Name: Fa5/1

Switchport: Enabled

Administrative Mode: private-vlan host

Operational Mode: private-vlan host

Administrative Trunking Encapsulation: negotiate

Operational Trunking Encapsulation: native

Negotiation of Trunking: Off

Access Mode VLAN: 1 (default)

Trunking Native Mode VLAN: 1 (default)

Voice VLAN: none

Appliance trust: none

Administrative Private Vlan 

  Host Association: 202 (VLAN0202) 440 (VLAN0440)

  Promiscuous Mapping: none 

  Trunk encapsulation : dot1q

  Trunk vlans:

Operational private-vlan(s): 

  202 (VLAN0202) 440 (VLAN0440) 

Trunking VLANs Enabled: ALL

Pruning VLANs Enabled: 2-1001

Capture Mode Disabled

Capture VLANs Allowed: ALL

This example shows how to configure interface FastEthernet 5/2 as a secondary trunk port, and verify the configuration:

Switch# configure terminal 

Switch(config)# interface fastethernet 5/2 

Switch(config-if)# switchport mode private-vlan trunk secondary

Switch(config-if)# switchport private-vlan trunk native vlan 10

Switch(config-if)# switchport private-vlan trunk allowed vlan 10. 3-4

Switch(config-if)# switchport private-vlan association trunk 3 301

Switch(config-if)# end 

Switch# show interfaces fastethernet 5/2 switchport

Name: Fa5/2

Switchport: Enabled

Administrative Mode: private-vlan trunk secondary 

Operational Mode: private-vlan trunk secondary 

Administrative Trunking Encapsulation: negotiate 

Operational Trunking Encapsulation: dot1q 

Negotiation of Trunking: On 

Access Mode VLAN: 1 (default) 

Trunking Native Mode VLAN: 1 (default) 

Administrative Native VLAN tagging: enabled 

Voice VLAN: none 

Administrative private-vlan host-association: none A

dministrative private-vlan mapping: none 

Administrative private-vlan trunk native VLAN: 10 

Administrative private-vlan trunk Native VLAN tagging: enabled 

Administrative private-vlan trunk encapsulation: dot1q 

Administrative private-vlan trunk normal VLANs: none 

Administrative private-vlan trunk associations: 

    3 (VLAN0003) 301 (VLAN0301)

Administrative private-vlan trunk mappings: none 

Operational private-vlan: none 

Operational Normal VLANs: none 

Trunking VLANs Enabled: ALL 

Pruning VLANs Enabled: 2-1001 

Capture Mode Disabled Capture VLANs Allowed: ALL

Unknown unicast blocked: disabled

Unknown multicast blocked: disabled

Appliance trust: none

Switch(config-if)# 

This example shows how to configure interface FastEthernet 5/2 as a promiscuous trunk port and to verify the configuration:

Switch# configure terminal 

Switch(config)# interface fastethernet 5/2 

Switch(config-if)# switchport mode private-vlan trunk promiscuous

Switch(config-if)# switchport private-vlan trunk native vlan 10

Switch(config-if)# switchport private-vlan trunk allowed vlan 10, 3-4

Switch(config-if)# switchport private-vlan mapping trunk 3 301, 302

Switch(config-if)# end 

Switch# show interfaces fastethernet 5/2 switchport

Name: Fa5/2

Switchport: Enabled

Administrative Mode: private-vlan trunk promiscuous 

Operational Mode: private-vlan trunk promiscuous 

Administrative Trunking Encapsulation: negotiate 

Operational Trunking Encapsulation: dot1q 

Negotiation of Trunking: On 

Access Mode VLAN: 1 (default) 

Trunking Native Mode VLAN: 1 (default) 

Administrative Native VLAN tagging: enabled 

Voice VLAN: none 

Administrative private-vlan host-association: none 

Administrative private-vlan mapping: none 

Administrative private-vlan trunk native VLAN: 10 

Administrative private-vlan trunk Native VLAN tagging: enabled 

Administrative private-vlan trunk encapsulation: dot1q 

Administrative private-vlan trunk normal VLANs: 3-4,10 

Administrative private-vlan trunk associations: none 

Administrative private-vlan trunk mappings: 

    3 (VLAN0003) 301 (VLAN0301)  302 (VLAN0302) 

Operational private-vlan: 

  3 (VLAN0003) 301 (VLAN0301) 302 (VLAN0302) 

Trunking VLANs Enabled: ALL 

Pruning VLANs Enabled: 2-1001 

Capture Mode Disabled 

Capture VLANs Allowed: ALL

Unknown unicast blocked: disabled

Unknown multicast blocked: disabled

Appliance trust: none

Switch(config-if)# 

Related Commands

switchport port-security

To enable port security on an interface, use the switchport port-security command. To disable port security and set parameters to their default states, use the no form of this command.

switchport port-security [aging {static | time time | type {absolute | inactivity}} |
limit rate invalid-source-mac [N | none] | mac-address mac-address [vlan {access | voice} | mac-address sticky [mac-address] [vlan access | voice] | maximum value [vlan {access | voice} | violation {restrict | shutdown}]

no switchport port-security [aging {static | time time | type {absolute | inactivity}} |
limit rate invalid-source-mac [N | none] | mac-address mac-address [vlan {access | voice} | mac-address sticky [mac-address] [vlan access | voice] | maximum value [vlan {access | voice} | violation {restrict | shutdown}]

Syntax Description

Defaults

The default settings are as follows:

•Port security is disabled.

•When port security is enabled and no keywords are entered, the default maximum number of secure MAC addresses is 1.

•Aging is disabled.

•Aging time is 0 minutes.

•All secure addresses on this port age out immediately after they are removed from the secure address list.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

After you set the maximum number of secure MAC addresses that are allowed on a port, you can add secure addresses to the address table by manually configuring them, by allowing the port to dynamically configure them, or by configuring some MAC addresses and allowing the rest to be dynamically configured.

The packets are dropped into the hardware when the maximum number of secure MAC addresses are in the address table and a station that does not have a MAC address in the address table attempts to access the interface.

If you enable port security on a voice VLAN port and if there is a PC connected to the IP phone, you set the maximum allowed secure addresses on the port to more than 1.

You cannot configure static secure MAC addresses in the voice VLAN.

A secure port has the following limitations:

•A secure port cannot be a dynamic access port or a trunk port.

•A secure port cannot be a routed port.

•A secure port cannot be a protected port.

•A secure port cannot be a destination port for Switched Port Analyzer (SPAN).

•A secure port cannot belong to a Fast EtherChannel or Gigabit EtherChannel port group.

•A secure port cannot be an 802.1X port.

•If you try to enable 802.1X on a secure port, an error message appears, and 802.1X is not enabled. If you try to change an 802.1X-enabled port to a secure port, an error message appears, and the security settings are not changed.

When a secure port is in the error-disabled state, you can remove it from this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually reenable it by entering the shutdown and no shut down interface configuration commands.

To enable secure address aging for a particular port, set the aging time to a value other than 0 for that port.

To allow limited time access to particular secure addresses, set the aging type as absolute. When the aging time lapses, the secure addresses are deleted.

To allow continuous access to a limited number of secure addresses, set the aging type as inactivity. This action removes the secure address when it becomes inactive, and other addresses can become secure.

To allow unlimited access to a secure address, configure it as a secure address, and disable aging for the statically configured secure address by using the no switchport port-security aging static interface configuration command.

If the sticky command is executed without a MAC address specified, all MAC addresses that are learned on that port will be made sticky. You can also specify a specific MAC address to be a sticky address by entering the sticky keyword next to it.

You can configure the sticky feature even when port security is not enabled on the interface. The feature becomes operational when you enable port security on the interface.

You can use the no form of the sticky command only if the sticky feature is already enabled on the interface.

Examples

This example shows how to set the aging time to 2 hours (120 minutes) for the secure addresses on the Fast Ethernet port 12:

Switch(config)# interface fastethernet 0/12 

Switch(config-if)# switchport port-security aging time 120

Switch(config-if)#

This example shows how to set the aging timer type to Inactivity for the secure addresses on the Fast Ethernet port 12:

Switch(config)# interface fastethernet 0/12

Switch(config-if)# switch port-security aging type inactivity

Switch(config-if)# 

The following example shows how to configure rate limit for invalid source packets on Fast Ethernet port 12:

Switch(config)# interface fastethernet 0/12

Switch(config-if)# switchport port-security limit rate invalid-source-mac 100

Switch(config-if)# 

The following example shows how to configure rate limit for invalid source packets on Fast Ethernet port 12:

Switch(config)# interface fastethernet 0/12

Switch(config-if)# switchport port-security limit rate invalid-source-mac none

Switch(config-if)# 

You can verify the settings for all secure ports or the specified port by using the show port-security privileged EXEC command.

This example shows how to remove all sticky and static addresses that are configured on the interface:

Switch(config)# interface fastethernet 2/12

Switch(config-if)# no switchport port-security mac-address

Switch(config-if)

This example shows how to configure a secure MAC address on Fast Ethernet port 12:

Switch(config)# interface fastethernet 0/12

Switch(config-if)# switchport mode access

Switch(config-if)# switchport port-security

Switch(config-if)# switchport port-security mac-address 1000.2000.3000

Switch(config-if)

This example shows how to make all MAC addresses learned on Fast Ethernet port 12 sticky:

Switch(config)# interface fastethernet 2/12

SSwitch(config-if)# switchport port-security mac-address sticky

Switch(config-if)

This example shows how to make MAC address 1000.2000.3000 sticky on Fast Ethernet port 12:

Switch(config)# interface fastethernet 2/12

Switch(config-if)# switchport port-security mac-address sticky 1000.2000.3000

Switch(config-if)

This example shows how to disable the sticky feature on Fast Ethernet port 12:

Switch(config)# interface fastethernet 2/12

Switch(config-if)# no switchport port-security mac-address sticky