Dell EMC Networking CLI
Using the CLI
Layer 2 Switching Commands
Security Commands
Audio Visual Bridging Commands
Data Center Technology Commands
Layer 3 Routing Commands
Switch Management Commands
Appendix A: List of Commands

DELL N1148P-ON User Manual

Displayed below is the user manual for N1148P-ON by DELL which is a product in the Network Switches category. This manual has pages.

Related Manuals

Origin Storage DELL-BDRW-SATA Manual

DELL R820 Manual

DELL P2414H Manual

DELL 1815dn Manual

DELL R7610 Manual

DELL E7240 Manual

DELL 3440 Manual

Dell EMC Networking N-Series

N1100-ON, N1500, N2000,

N2100-ON, N3000, N3100-ON,

and N4000 Switches

CLI Reference Guide

Version 6.3.0.x—N2000/N3000/

N4000 Series Switches

Version 6.3.5.x—N3100-ON Series

Switches

Version 6.3.6.x—N2100-ON/N3100-

ON Series Switches

Version 6.4.x.x—N1100-ON Series

Switches

Regulatory Model: E17W/E18W/E15W/E16W/E05W/E04W/

E06W/E07W/PowerConnect 8132/PowerConnect 8132F/

PowerConnect 8164/PowerConnect 8164F

Notes

NOTE: A NOTE indicates important information that helps you make better use of

your computer.

CAUTION: A CAUTION indicates potential damage to hardware or loss of data if

instructions are not followed.

____________________

Information in this publication is subject to change without notice.

international copyright and intellectual property laws. Dell EMC® and the Dell EMC logo are

trademarks of Dell EMC Inc. in the United States and/or other jurisdictions. All other marks and names

mentioned herein may be trademarks of their respective companies.

Regulatory Model E17W/E18W/E15W/E16W/E05W/E04W/E06W/E07W/PowerConnect 8132/

PowerConnect 8132F/PowerConnect 8164/PowerConnect 8164F

2017 - June Rev. A03

Contents 5

Contents

1 Dell EMC Networking CLI . . . . . . . . . . . . 95

Introduction. . . . . . . . . . . . . . . . . . . . . 95

Command Groups. . . . . . . . . . . . . . . . . . 96

Mode Types. . . . . . . . . . . . . . . . . . . . . 101

2 Using the CLI . . . . . . . . . . . . . . . . . . . . . 217

Introduction. . . . . . . . . . . . . . . . . . . . . 217

Entering and Editing CLI Commands . . . . . . . . 217

CLI Command Modes . . . . . . . . . . . . . . . . 230

Starting the CLI . . . . . . . . . . . . . . . . . . . 244

Using CLI Functions and Tools . . . . . . . . . . . 245

3 Layer 2 Switching Commands . . . . . . . . 259

ACL Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .260

ACL Logging . . . . . . . . . . . . . . . . . . . . 260

Commands in this Section . . . . . . . . . . . . . 263

ip access-list . . . . . . . . . . . . . . . . . . . . 263

deny | permit (IP ACL). . . . . . . . . . . . . . . . 264

Contents 6

deny | permit (Mac-Access-List-Configuration) . . 270

ip access-group . . . . . . . . . . . . . . . . . . 273

mac access-group . . . . . . . . . . . . . . . . . 275

mac access-list extended . . . . . . . . . . . . . 277

mac access-list extended rename . . . . . . . . . 277

remark . . . . . . . . . . . . . . . . . . . . . . . 278

service-acl input . . . . . . . . . . . . . . . . . . 280

show service-acl interface . . . . . . . . . . . . . 281

show access-lists interface . . . . . . . . . . . . 282

show ip access-lists . . . . . . . . . . . . . . . . 282

show mac access-lists . . . . . . . . . . . . . . . 285

MAC Address Table Commands . . . . . . . . . . . . . . . .287

Commands in this Section . . . . . . . . . . . . . 288

clear mac address-table . . . . . . . . . . . . . . 288

mac address-table aging-time . . . . . . . . . . . 289

mac address-table multicast forbidden address. . 290

mac address-table static vlan . . . . . . . . . . . 291

switchport port-security (Global Configuration) . . 292

switchport port-security (Interface Configuration) 295

show mac address-table multicast. . . . . . . . . 300

show mac address-table . . . . . . . . . . . . . . 301

Contents 7

show mac address-table address . . . . . . . . . 302

show mac address-table count . . . . . . . . . . 303

show mac address-table dynamic . . . . . . . . . 304

show mac address-table interface. . . . . . . . . 305

show mac address-table static. . . . . . . . . . . 306

show mac address-table vlan . . . . . . . . . . . 307

show port-security . . . . . . . . . . . . . . . . . 308

Auto-VoIP Commands . . . . . . . . . . . . . . . . . . . . . . . . .311

Commands in this Section . . . . . . . . . . . . . 311

show switchport voice . . . . . . . . . . . . . . . 312

switchport voice detect auto . . . . . . . . . . . . 314

CDP Interoperability Commands . . . . . . . . . . . . . . . .315

Commands in this Section . . . . . . . . . . . . . 315

clear isdp counters . . . . . . . . . . . . . . . . . 315

clear isdp table . . . . . . . . . . . . . . . . . . . 316

isdp advertise-v2 . . . . . . . . . . . . . . . . . . 316

isdp enable . . . . . . . . . . . . . . . . . . . . . 317

isdp holdtime . . . . . . . . . . . . . . . . . . . . 318

isdp timer . . . . . . . . . . . . . . . . . . . . . . 319

show isdp . . . . . . . . . . . . . . . . . . . . . . 319

show isdp entry . . . . . . . . . . . . . . . . . . . 320

show isdp interface. . . . . . . . . . . . . . . . . 321

Contents 8

show isdp neighbors . . . . . . . . . . . . . . . . 322

show isdp traffic . . . . . . . . . . . . . . . . . . 323

DHCP Layer 2 Relay Commands . . . . . . . . . . . . . . . . .325

Commands in this Section . . . . . . . . . . . . . 325

dhcp l2relay (Global Configuration) . . . . . . . . 326

dhcp l2relay (Interface Configuration) . . . . . . . 326

dhcp l2relay circuit-id . . . . . . . . . . . . . . . 327

dhcp l2relay remote-id . . . . . . . . . . . . . . . 328

dhcp l2relay trust . . . . . . . . . . . . . . . . . . 328

dhcp l2relay vlan . . . . . . . . . . . . . . . . . . 329

show dhcp l2relay all . . . . . . . . . . . . . . . . 330

show dhcp l2relay interface . . . . . . . . . . . . 331

show dhcp l2relay stats interface . . . . . . . . . 331

show dhcp l2relay agent-option vlan. . . . . . . . 332

show dhcp l2relay vlan . . . . . . . . . . . . . . . 333

show dhcp l2relay circuit-id vlan. . . . . . . . . . 334

show dhcp l2relay remote-id vlan . . . . . . . . . 335

clear dhcp l2relay statistics interface . . . . . . . 335

DHCP Snooping Commands . . . . . . . . . . . . . . . . . . . .337

Commands in this Section . . . . . . . . . . . . . 338

clear ip dhcp snooping binding. . . . . . . . . . . 338

clear ip dhcp snooping statistics . . . . . . . . . . 339

Contents 9

ip dhcp snooping . . . . . . . . . . . . . . . . . . 339

ip dhcp snooping binding . . . . . . . . . . . . . . 340

ip dhcp snooping database. . . . . . . . . . . . . 341

ip dhcp snooping database write-delay . . . . . . 342

ip dhcp snooping limit . . . . . . . . . . . . . . . 343

ip dhcp snooping log-invalid . . . . . . . . . . . . 344

ip dhcp snooping trust . . . . . . . . . . . . . . . 345

ip dhcp snooping verify mac-address . . . . . . . 346

show ip dhcp snooping . . . . . . . . . . . . . . . 346

show ip dhcp snooping binding . . . . . . . . . . 347

show ip dhcp snooping database . . . . . . . . . 348

show ip dhcp snooping interfaces . . . . . . . . . 349

show ip dhcp snooping statistics. . . . . . . . . . 350

DHCPv6 Snooping Commands . . . . . . . . . . . . . . . . . .352

clear ipv6 dhcp snooping binding . . . . . . . . . 352

clear ipv6 dhcp snooping statistics . . . . . . . . 353

ipv6 dhcp snooping . . . . . . . . . . . . . . . . . 353

ipv6 dhcp snooping vlan . . . . . . . . . . . . . . 354

ipv6 dhcp snooping binding . . . . . . . . . . . . 355

ipv6 dhcp snooping database . . . . . . . . . . . 356

ipv6 dhcp snooping database write-delay . . . . . 357

Contents 10

ipv6 dhcp snooping limit . . . . . . . . . . . . . . 358

ipv6 dhcp snooping log-invalid . . . . . . . . . . . 359

ipv6 dhcp snooping trust . . . . . . . . . . . . . . 360

ipv6 dhcp snooping verify mac-address . . . . . . 360

ipv6 verify binding . . . . . . . . . . . . . . . . . 361

ipv6 verify source . . . . . . . . . . . . . . . . . . 362

show ipv6 dhcp snooping. . . . . . . . . . . . . . 363

show ipv6 dhcp snooping binding . . . . . . . . . 364

show ipv6 dhcp snooping database . . . . . . . . 365

show ipv6 dhcp snooping interfaces . . . . . . . . 366

show ipv6 dhcp snooping statistics . . . . . . . . 366

show ipv6 source binding . . . . . . . . . . . . . 368

show ipv6 verify. . . . . . . . . . . . . . . . . . . 368

show ipv6 verify source . . . . . . . . . . . . . . 369

Dynamic ARP Inspection Commands . . . . . . . . . . . .371

Commands in this Section . . . . . . . . . . . . . 371

arp access-list . . . . . . . . . . . . . . . . . . . 371

clear ip arp inspection statistics . . . . . . . . . . 372

ip arp inspection filter . . . . . . . . . . . . . . . 373

ip arp inspection limit. . . . . . . . . . . . . . . . 373

ip arp inspection trust . . . . . . . . . . . . . . . 374

Contents 11

ip arp inspection validate. . . . . . . . . . . . . . 375

ip arp inspection vlan. . . . . . . . . . . . . . . . 376

permit ip host mac host. . . . . . . . . . . . . . . 377

show arp access-list . . . . . . . . . . . . . . . . 377

show ip arp inspection . . . . . . . . . . . . . . . 378

Ethernet Configuration Commands . . . . . . . . . . . . . .382

Commands in this Section . . . . . . . . . . . . . 383

clear counters . . . . . . . . . . . . . . . . . . . 383

description . . . . . . . . . . . . . . . . . . . . . 384

duplex. . . . . . . . . . . . . . . . . . . . . . . . 385

flowcontrol . . . . . . . . . . . . . . . . . . . . . 386

interface . . . . . . . . . . . . . . . . . . . . . . 387

interface range . . . . . . . . . . . . . . . . . . . 388

link debounce time . . . . . . . . . . . . . . . . . 390

rate-limit cpu . . . . . . . . . . . . . . . . . . . . 391

show interfaces. . . . . . . . . . . . . . . . . . . 393

show interfaces advertise . . . . . . . . . . . . . 396

show interfaces configuration . . . . . . . . . . . 398

show interfaces counters . . . . . . . . . . . . . 399

show interfaces debounce . . . . . . . . . . . . . 403

show interfaces description . . . . . . . . . . . . 403

Contents 12

show interfaces detail . . . . . . . . . . . . . . . 404

show interfaces status . . . . . . . . . . . . . . . 406

show interfaces transceiver . . . . . . . . . . . . 408

show statistics . . . . . . . . . . . . . . . . . . . 409

show statistics switchport . . . . . . . . . . . . . 412

show storm-control. . . . . . . . . . . . . . . . . 414

show storm-control action . . . . . . . . . . . . . 415

shutdown . . . . . . . . . . . . . . . . . . . . . . 416

speed . . . . . . . . . . . . . . . . . . . . . . . . 416

switchport protected . . . . . . . . . . . . . . . . 419

switchport protected name. . . . . . . . . . . . . 420

show switchport protected. . . . . . . . . . . . . 420

show system mtu . . . . . . . . . . . . . . . . . . 421

system jumbo mtu . . . . . . . . . . . . . . . . . 422

Ethernet CFM Commands . . . . . . . . . . . . . . . . . . . . . .424

Commands in this Section . . . . . . . . . . . . . 424

ethernet cfm domain . . . . . . . . . . . . . . . . 425

service . . . . . . . . . . . . . . . . . . . . . . . 426

ethernet cfm cc level . . . . . . . . . . . . . . . . 426

ethernet cfm mep level . . . . . . . . . . . . . . . 427

ethernet cfm mep enable . . . . . . . . . . . . . . 428

Contents 13

ethernet cfm mep active . . . . . . . . . . . . . . 429

ethernet cfm mep archive-hold-time . . . . . . . . 429

ethernet cfm mip level . . . . . . . . . . . . . . . 430

ping ethernet cfm . . . . . . . . . . . . . . . . . . 431

traceroute ethernet cfm . . . . . . . . . . . . . . 432

show ethernet cfm errors . . . . . . . . . . . . . 433

show ethernet cfm domain . . . . . . . . . . . . . 434

show ethernet cfm maintenance-points local . . . 435

show ethernet cfm maintenance-points remote . . 436

show ethernet cfm statistics . . . . . . . . . . . . 437

Green Ethernet Commands . . . . . . . . . . . . . . . . . . . . .440

Energy-Detect Mode . . . . . . . . . . . . . . . . 440

Energy Efficient Ethernet . . . . . . . . . . . . . . 440

Commands in this Section . . . . . . . . . . . . . 440

green-mode energy-detect. . . . . . . . . . . . . 441

green-mode eee . . . . . . . . . . . . . . . . . . 442

green-mode eee { tx-idle-time | tx-wake-time}. . . 443

clear green-mode statistics . . . . . . . . . . . . 444

green-mode eee-lpi-history . . . . . . . . . . . . 444

show green-mode interface-id . . . . . . . . . . . 446

show green-mode . . . . . . . . . . . . . . . . . 449

Contents 14

show green-mode eee-lpi-history interface . . . . 451

GMRP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . .453

Commands in this Section . . . . . . . . . . . . . 454

gmrp enable . . . . . . . . . . . . . . . . . . . . 454

clear gmrp statistics . . . . . . . . . . . . . . . . 455

show gmrp configuration . . . . . . . . . . . . . . 455

GVRP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . .457

Commands in this Section . . . . . . . . . . . . . 457

clear gvrp statistics. . . . . . . . . . . . . . . . . 457

garp timer . . . . . . . . . . . . . . . . . . . . . . 458

gvrp enable (Global Configuration) . . . . . . . . . 459

gvrp enable (Interface Configuration) . . . . . . . 460

gvrp registration-forbid. . . . . . . . . . . . . . . 461

gvrp vlan-creation-forbid . . . . . . . . . . . . . . 462

show gvrp configuration . . . . . . . . . . . . . . 463

show gvrp error-statistics . . . . . . . . . . . . . 464

show gvrp statistics . . . . . . . . . . . . . . . . 465

IGMP Snooping Commands . . . . . . . . . . . . . . . . . . . .467

Commands in this Section . . . . . . . . . . . . . 468

ip igmp snooping . . . . . . . . . . . . . . . . . . 468

show ip igmp snooping . . . . . . . . . . . . . . . 470

show ip igmp snooping groups . . . . . . . . . . . 471

Contents 15

show ip igmp snooping mrouter . . . . . . . . . . 472

ip igmp snooping vlan immediate-leave . . . . . . 473

ip igmp snooping vlan groupmembership-interval . 474

ip igmp snooping vlan last-member-query-interval 475

ip igmp snooping vlan mcrtrexpiretime . . . . . . 476

ip igmp snooping report-suppression . . . . . . . 476

ip igmp snooping unregistered floodall . . . . . . 477

ip igmp snooping vlan mrouter . . . . . . . . . . . 478

IGMP Snooping Querier Commands . . . . . . . . . . . . .480

Commands in this Section . . . . . . . . . . . . . 480

ip igmp snooping querier . . . . . . . . . . . . . . 480

ip igmp snooping querier election participate . . . 482

ip igmp snooping querier query-interval . . . . . . 483

ip igmp snooping querier timer expiry . . . . . . . 484

ip igmp snooping querier version. . . . . . . . . . 485

show ip igmp snooping querier. . . . . . . . . . . 485

Interface Error Disable and Auto Recovery . . . . . . .489

Commands in this Section . . . . . . . . . . . . . 489

errdisable recovery cause . . . . . . . . . . . . . 489

errdisable recovery interval . . . . . . . . . . . . 491

show errdisable recovery . . . . . . . . . . . . . 492

show interfaces status err-disabled . . . . . . . . 494

Contents 16

IPv6 Access List Commands . . . . . . . . . . . . . . . . . . . .497

Commands in this Section . . . . . . . . . . . . . 497

deny | permit (IPv6 ACL) . . . . . . . . . . . . . . 498

ipv6 access-list . . . . . . . . . . . . . . . . . . . 504

ipv6 access-list rename . . . . . . . . . . . . . . 505

ipv6 traffic-filter. . . . . . . . . . . . . . . . . . . 506

show ipv6 access-lists . . . . . . . . . . . . . . . 507

IPv6 MLD Snooping Commands . . . . . . . . . . . . . . . . .510

Commands in this Section . . . . . . . . . . . . . 510

ipv6 mld snooping vlan groupmembership-interval 511

ipv6 mld snooping vlan immediate-leave. . . . . . 511

ipv6 mld snooping listener-message-suppression . 512

ipv6 mld snooping vlan last-listener-query-interval 513

ipv6 mld snooping vlan mcrtrexpiretime . . . . . . 514

ipv6 mld snooping vlan mrouter . . . . . . . . . . 515

ipv6 mld snooping (Global) . . . . . . . . . . . . . 515

show ipv6 mld snooping . . . . . . . . . . . . . . 516

show ipv6 mld snooping groups . . . . . . . . . . 518

show ipv6 mld snooping mrouter . . . . . . . . . . 519

IPv6 MLD Snooping Querier Commands . . . . . . . . .521

Commands in this Section . . . . . . . . . . . . . 521

ipv6 mld snooping querier . . . . . . . . . . . . . 521

Contents 17

ipv6 mld snooping querier (VLAN mode) . . . . . . 522

ipv6 mld snooping querier address. . . . . . . . . 523

ipv6 mld snooping querier election participate . . 523

ipv6 mld snooping querier query-interval . . . . . 524

ipv6 mld snooping querier timer expiry. . . . . . . 525

show ipv6 mld snooping querier . . . . . . . . . . 526

IP Source Guard Commands . . . . . . . . . . . . . . . . . . . .528

Commands in this Section . . . . . . . . . . . . . 528

ip verify source . . . . . . . . . . . . . . . . . . . 528

ip verify binding . . . . . . . . . . . . . . . . . . . 530

show ip verify . . . . . . . . . . . . . . . . . . . . 530

show ip verify source. . . . . . . . . . . . . . . . 531

show ip source binding. . . . . . . . . . . . . . . 532

iSCSI Optimization Commands . . . . . . . . . . . . . . . . .534

Commands in this Section . . . . . . . . . . . . . 535

iscsi aging time . . . . . . . . . . . . . . . . . . . 535

iscsi cos. . . . . . . . . . . . . . . . . . . . . . . 536

iscsi enable . . . . . . . . . . . . . . . . . . . . . 538

iscsi target port . . . . . . . . . . . . . . . . . . . 539

show iscsi. . . . . . . . . . . . . . . . . . . . . . 540

show iscsi sessions . . . . . . . . . . . . . . . . 541

Link Dependency Commands . . . . . . . . . . . . . . . . . . .544

Contents 18

Commands in this Section . . . . . . . . . . . . . 544

action . . . . . . . . . . . . . . . . . . . . . . . . 544

link-dependency group . . . . . . . . . . . . . . . 545

add . . . . . . . . . . . . . . . . . . . . . . . . . 546

depends-on . . . . . . . . . . . . . . . . . . . . . 546

show link-dependency . . . . . . . . . . . . . . . 547

LLDP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .549

Commands in this Section . . . . . . . . . . . . . 550

clear lldp remote-data . . . . . . . . . . . . . . . 550

clear lldp statistics . . . . . . . . . . . . . . . . . 551

dcb enable . . . . . . . . . . . . . . . . . . . . . 552

lldp med . . . . . . . . . . . . . . . . . . . . . . . 552

lldp med confignotification . . . . . . . . . . . . . 553

lldp med faststartrepeatcount . . . . . . . . . . . 553

lldp med transmit-tlv . . . . . . . . . . . . . . . . 554

lldp notification . . . . . . . . . . . . . . . . . . . 555

lldp notification-interval . . . . . . . . . . . . . . 556

lldp receive . . . . . . . . . . . . . . . . . . . . . 556

lldp timers. . . . . . . . . . . . . . . . . . . . . . 557

lldp transmit. . . . . . . . . . . . . . . . . . . . . 558

lldp transmit-mgmt . . . . . . . . . . . . . . . . . 559

Contents 19

lldp transmit-tlv . . . . . . . . . . . . . . . . . . . 560

show lldp . . . . . . . . . . . . . . . . . . . . . . 561

show lldp interface . . . . . . . . . . . . . . . . . 561

show lldp local-device . . . . . . . . . . . . . . . 562

show lldp med . . . . . . . . . . . . . . . . . . . 564

show lldp med interface . . . . . . . . . . . . . . 564

show lldp med local-device detail . . . . . . . . . 565

show lldp med remote-device . . . . . . . . . . . 567

show lldp remote-device . . . . . . . . . . . . . . 569

show lldp statistics . . . . . . . . . . . . . . . . . 570

Loop Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .573

Commands in this Section . . . . . . . . . . . . . 573

keepalive (Interface Config) . . . . . . . . . . . . 573

keepalive (Global Config) . . . . . . . . . . . . . . 575

keepalive action . . . . . . . . . . . . . . . . . . 576

show keepalive . . . . . . . . . . . . . . . . . . . 577

show keepalive statistics. . . . . . . . . . . . . . 578

MLAG Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . .580

Commands in this Section . . . . . . . . . . . . . 580

clear vpc statistics . . . . . . . . . . . . . . . . . 580

feature vpc . . . . . . . . . . . . . . . . . . . . . 581

peer detection enable . . . . . . . . . . . . . . . 582

Contents 20

peer detection interval . . . . . . . . . . . . . . . 582

peer-keepalive destination . . . . . . . . . . . . . 583

peer-keepalive enable . . . . . . . . . . . . . . . 585

peer-keepalive timeout . . . . . . . . . . . . . . . 586

role priority . . . . . . . . . . . . . . . . . . . . . 587

show vpc . . . . . . . . . . . . . . . . . . . . . . 588

show vpc brief . . . . . . . . . . . . . . . . . . . 589

show vpc consistency-parameters . . . . . . . . 591

show vpc consistency-features . . . . . . . . . . 593

show vpc peer-keepalive. . . . . . . . . . . . . . 594

show vpc role. . . . . . . . . . . . . . . . . . . . 595

show vpc statistics . . . . . . . . . . . . . . . . . 596

system-mac. . . . . . . . . . . . . . . . . . . . . 598

system-priority . . . . . . . . . . . . . . . . . . . 599

vpc . . . . . . . . . . . . . . . . . . . . . . . . . 600

vpc domain . . . . . . . . . . . . . . . . . . . . . 601

vpc peer-link . . . . . . . . . . . . . . . . . . . . 602

Multicast VLAN Registration Commands . . . . . . . .604

Commands in this Section . . . . . . . . . . . . . 605

mvr . . . . . . . . . . . . . . . . . . . . . . . . . 605

mvr group . . . . . . . . . . . . . . . . . . . . . . 605

Contents 21

mvr mode . . . . . . . . . . . . . . . . . . . . . . 606

mvr querytime. . . . . . . . . . . . . . . . . . . . 607

mvr vlan . . . . . . . . . . . . . . . . . . . . . . . 608

mvr immediate . . . . . . . . . . . . . . . . . . . 609

mvr type. . . . . . . . . . . . . . . . . . . . . . . 610

mvr vlan group . . . . . . . . . . . . . . . . . . . 611

show mvr . . . . . . . . . . . . . . . . . . . . . . 612

show mvr members. . . . . . . . . . . . . . . . . 613

show mvr interface . . . . . . . . . . . . . . . . . 614

show mvr traffic . . . . . . . . . . . . . . . . . . 616

Port Channel Commands . . . . . . . . . . . . . . . . . . . . . . .618

Static LAGS . . . . . . . . . . . . . . . . . . . . . 619

VLANs and LAGs . . . . . . . . . . . . . . . . . . 620

LAG Thresholds . . . . . . . . . . . . . . . . . . . 620

LAG Hashing . . . . . . . . . . . . . . . . . . . . 620

Enhanced LAG Hashing. . . . . . . . . . . . . . . 621

Manual Aggregation of LAGs. . . . . . . . . . . . 621

Flexible Assignment of Ports to LAGs . . . . . . . 622

Commands in this Section . . . . . . . . . . . . . 622

channel-group . . . . . . . . . . . . . . . . . . . 622

interface port-channel . . . . . . . . . . . . . . . 623

Contents 22

interface range port-channel. . . . . . . . . . . . 624

hashing-mode. . . . . . . . . . . . . . . . . . . . 625

lacp port-priority . . . . . . . . . . . . . . . . . . 626

lacp system-priority . . . . . . . . . . . . . . . . 627

lacp timeout. . . . . . . . . . . . . . . . . . . . . 628

port-channel local-preference . . . . . . . . . . . 629

port-channel min-links . . . . . . . . . . . . . . . 630

show interfaces port-channel . . . . . . . . . . . 631

show lacp . . . . . . . . . . . . . . . . . . . . . . 632

show statistics port-channel . . . . . . . . . . . . 634

Port Monitor Commands . . . . . . . . . . . . . . . . . . . . . . .637

Commands in this Section . . . . . . . . . . . . . 638

monitor capture (Global Configuration) . . . . . . 638

monitor capture (Privileged Exec) . . . . . . . . . 640

monitor capture mode . . . . . . . . . . . . . . . 640

monitor session . . . . . . . . . . . . . . . . . . . 645

remote-span . . . . . . . . . . . . . . . . . . . . 650

show monitor capture . . . . . . . . . . . . . . . 651

show monitor session . . . . . . . . . . . . . . . 653

show vlan remote-span. . . . . . . . . . . . . . . 655

QoS Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .657

Access Control Lists . . . . . . . . . . . . . . . . 657

Contents 23

Layer 2 ACLs . . . . . . . . . . . . . . . . . . . . 658

Layer 3/4 IPv4 ACLs. . . . . . . . . . . . . . . . . 658

Class of Service (CoS) . . . . . . . . . . . . . . . 658

Queue Mapping. . . . . . . . . . . . . . . . . . . 659

DiffServ . . . . . . . . . . . . . . . . . . . . . . . 660

Commands in this Section . . . . . . . . . . . . . 660

assign-queue . . . . . . . . . . . . . . . . . . . . 661

class . . . . . . . . . . . . . . . . . . . . . . . . 662

class-map. . . . . . . . . . . . . . . . . . . . . . 663

class-map rename . . . . . . . . . . . . . . . . . 663

classofservice dot1p-mapping . . . . . . . . . . . 664

classofservice ip-dscp-mapping . . . . . . . . . . 665

classofservice trust. . . . . . . . . . . . . . . . . 669

conform-color. . . . . . . . . . . . . . . . . . . . 670

cos-queue min-bandwidth . . . . . . . . . . . . . 672

cos-queue random-detect . . . . . . . . . . . . . 673

cos-queue strict . . . . . . . . . . . . . . . . . . 676

diffserv . . . . . . . . . . . . . . . . . . . . . . . 677

drop . . . . . . . . . . . . . . . . . . . . . . . . . 678

mark cos . . . . . . . . . . . . . . . . . . . . . . 678

mark ip-dscp . . . . . . . . . . . . . . . . . . . . 679

Contents 24

mark ip-precedence . . . . . . . . . . . . . . . . 680

match class-map . . . . . . . . . . . . . . . . . . 681

match cos. . . . . . . . . . . . . . . . . . . . . . 682

match destination-address mac . . . . . . . . . . 683

match dstip . . . . . . . . . . . . . . . . . . . . . 684

match dstip6 . . . . . . . . . . . . . . . . . . . . 685

match dstl4port . . . . . . . . . . . . . . . . . . . 686

match ethertype . . . . . . . . . . . . . . . . . . 686

match ip6flowlbl . . . . . . . . . . . . . . . . . . 687

match ip dscp. . . . . . . . . . . . . . . . . . . . 688

match ip precedence . . . . . . . . . . . . . . . . 689

match ip tos. . . . . . . . . . . . . . . . . . . . . 690

match protocol . . . . . . . . . . . . . . . . . . . 691

match source-address mac . . . . . . . . . . . . 692

match srcip . . . . . . . . . . . . . . . . . . . . . 693

match srcip6 . . . . . . . . . . . . . . . . . . . . 693

match srcl4port . . . . . . . . . . . . . . . . . . . 694

match vlan . . . . . . . . . . . . . . . . . . . . . 695

mirror . . . . . . . . . . . . . . . . . . . . . . . . 696

police-simple . . . . . . . . . . . . . . . . . . . . 696

police-single-rate. . . . . . . . . . . . . . . . . . 698

Contents 25

police-two-rate . . . . . . . . . . . . . . . . . . . 699

policy-map . . . . . . . . . . . . . . . . . . . . . 701

random-detect queue-parms. . . . . . . . . . . . 702

random-detect exponential-weighting-constant. . 707

redirect . . . . . . . . . . . . . . . . . . . . . . . 708

service-policy. . . . . . . . . . . . . . . . . . . . 709

show class-map . . . . . . . . . . . . . . . . . . 710

show classofservice dot1p-mapping. . . . . . . . 711

show classofservice ip-dscp-mapping. . . . . . . 713

show classofservice trust . . . . . . . . . . . . . 715

show diffserv . . . . . . . . . . . . . . . . . . . . 715

show diffserv service interface . . . . . . . . . . 716

show diffserv service brief . . . . . . . . . . . . . 717

show interfaces cos-queue . . . . . . . . . . . . 718

show interfaces random-detect . . . . . . . . . . 720

show policy-map . . . . . . . . . . . . . . . . . . 722

show policy-map interface . . . . . . . . . . . . . 723

show service-policy . . . . . . . . . . . . . . . . 724

traffic-shape . . . . . . . . . . . . . . . . . . . . 725

vlan priority . . . . . . . . . . . . . . . . . . . . . 726

Spanning Tree Commands . . . . . . . . . . . . . . . . . . . . .727

Contents 26

Commands in this Section . . . . . . . . . . . . . 728

clear spanning-tree detected-protocols . . . . . . 729

exit (mst) . . . . . . . . . . . . . . . . . . . . . . 730

instance (mst). . . . . . . . . . . . . . . . . . . . 730

name (mst) . . . . . . . . . . . . . . . . . . . . . 732

revision (mst) . . . . . . . . . . . . . . . . . . . . 733

show spanning-tree . . . . . . . . . . . . . . . . 734

show spanning-tree summary . . . . . . . . . . . 742

show spanning-tree vlan . . . . . . . . . . . . . . 743

spanning-tree. . . . . . . . . . . . . . . . . . . . 744

spanning-tree auto-portfast . . . . . . . . . . . . 745

spanning-tree backbonefast . . . . . . . . . . . . 746

spanning-tree bpdu flooding . . . . . . . . . . . . 747

spanning-tree bpdu-protection. . . . . . . . . . . 747

spanning-tree cost . . . . . . . . . . . . . . . . . 748

spanning-tree disable . . . . . . . . . . . . . . . 750

spanning-tree forward-time . . . . . . . . . . . . 750

spanning-tree guard . . . . . . . . . . . . . . . . 751

spanning-tree loopguard . . . . . . . . . . . . . . 752

spanning-tree max-age. . . . . . . . . . . . . . . 753

spanning-tree max-hops . . . . . . . . . . . . . . 754

Contents 27

spanning-tree mode . . . . . . . . . . . . . . . . 754

spanning-tree mst configuration . . . . . . . . . . 756

spanning-tree mst cost . . . . . . . . . . . . . . . 757

spanning-tree mst port-priority. . . . . . . . . . . 758

spanning-tree mst priority . . . . . . . . . . . . . 759

spanning-tree portfast . . . . . . . . . . . . . . . 760

spanning-tree portfast bpdufilter default. . . . . . 761

spanning-tree portfast default . . . . . . . . . . . 762

spanning-tree port-priority (Interface Configuration) 763

spanning-tree priority. . . . . . . . . . . . . . . . 764

spanning-tree tcnguard . . . . . . . . . . . . . . 765

spanning-tree transmit hold-count . . . . . . . . . 766

spanning-tree uplinkfast . . . . . . . . . . . . . . 766

spanning-tree vlan . . . . . . . . . . . . . . . . . 768

spanning-tree vlan forward-time . . . . . . . . . . 769

spanning-tree vlan hello-time . . . . . . . . . . . 770

spanning-tree vlan max-age . . . . . . . . . . . . 771

spanning-tree vlan root. . . . . . . . . . . . . . . 772

spanning-tree vlan priority . . . . . . . . . . . . . 773

UDLD Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . .775

Detecting Unidirectional Links on a Device Port. . 775

Contents 28

Processing UDLD Traffic from Neighbors . . . . . 776

UDLD in Normal-mode . . . . . . . . . . . . . . . 776

UDLD in Aggressive-mode . . . . . . . . . . . . . 776

Commands in this Section . . . . . . . . . . . . . 777

udld enable (Global Configuration) . . . . . . . . . 777

udld reset . . . . . . . . . . . . . . . . . . . . . . 778

udld message time . . . . . . . . . . . . . . . . . 779

udld timeout interval . . . . . . . . . . . . . . . . 780

udld enable (Interface Configuration) . . . . . . . 780

udld port . . . . . . . . . . . . . . . . . . . . . . 781

show udld . . . . . . . . . . . . . . . . . . . . . . 782

VLAN Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . .784

Double VLAN Mode. . . . . . . . . . . . . . . . . 785

Independent VLAN Learning . . . . . . . . . . . . 785

Protocol Based VLANs . . . . . . . . . . . . . . . 786

IP Subnet Based VLANs . . . . . . . . . . . . . . 786

MAC-Based VLANs. . . . . . . . . . . . . . . . . 786

Private VLAN Commands . . . . . . . . . . . . . . 787

Commands in this Section . . . . . . . . . . . . . 789

interface vlan . . . . . . . . . . . . . . . . . . . . 790

interface range vlan . . . . . . . . . . . . . . . . 791

Contents 29

name (VLAN Configuration) . . . . . . . . . . . . 792

private-vlan . . . . . . . . . . . . . . . . . . . . . 793

protocol group . . . . . . . . . . . . . . . . . . . 795

protocol vlan group . . . . . . . . . . . . . . . . . 796

protocol vlan group all . . . . . . . . . . . . . . . 797

show dot1q-tunnel . . . . . . . . . . . . . . . . . 798

show interfaces switchport . . . . . . . . . . . . 799

show port protocol . . . . . . . . . . . . . . . . . 800

show switchport ethertype . . . . . . . . . . . . . 801

show vlan . . . . . . . . . . . . . . . . . . . . . . 802

show vlan association mac. . . . . . . . . . . . . 804

show vlan association subnet . . . . . . . . . . . 805

show vlan private-vlan . . . . . . . . . . . . . . . 806

switchport access vlan. . . . . . . . . . . . . . . 807

switchport dot1q ethertype (Global Configuration) 808

switchport dot1q ethertype (Interface Configuration) 810

switchport general forbidden vlan . . . . . . . . . 812

switchport general acceptable-frame-type tagged-only 813

switchport general allowed vlan . . . . . . . . . . 813

switchport general ingress-filtering disable . . . . 814

switchport general pvid . . . . . . . . . . . . . . 815

Contents 30

switchport mode . . . . . . . . . . . . . . . . . . 816

switchport mode dot1q-tunnel . . . . . . . . . . . 817

switchport mode private-vlan . . . . . . . . . . . 819

switchport private-vlan. . . . . . . . . . . . . . . 820

switchport trunk . . . . . . . . . . . . . . . . . . 821

switchport trunk encapsulation dot1q . . . . . . . 823

vlan . . . . . . . . . . . . . . . . . . . . . . . . . 824

vlan association mac . . . . . . . . . . . . . . . . 825

vlan association subnet . . . . . . . . . . . . . . 825

vlan makestatic . . . . . . . . . . . . . . . . . . . 826

vlan protocol group . . . . . . . . . . . . . . . . . 827

vlan protocol group add protocol. . . . . . . . . . 828

vlan protocol group name . . . . . . . . . . . . . 829

vlan protocol group remove . . . . . . . . . . . . 829

Voice VLAN Commands . . . . . . . . . . . . . . . . . . . . . . . .831

Commands in this Section . . . . . . . . . . . . . 832

voice vlan . . . . . . . . . . . . . . . . . . . . . . 832

voice vlan (Interface) . . . . . . . . . . . . . . . . 832

voice vlan data priority . . . . . . . . . . . . . . . 834

show voice vlan. . . . . . . . . . . . . . . . . . . 835

Contents 31

4 Security Commands. . . . . . . . . . . . . . . . 837

AAA Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .838

Administrative Authentication . . . . . . . . . . . 838

Administrative Accounting . . . . . . . . . . . . . 839

Accounting Method Lists . . . . . . . . . . . . . . 840

Access Line Modes. . . . . . . . . . . . . . . . . 840

Command Authorization . . . . . . . . . . . . . . 841

Network Authentication . . . . . . . . . . . . . . 841

Local 802.1x Authentication Server . . . . . . . . 841

MAC Authentication Bypass . . . . . . . . . . . . 842

Guest VLAN . . . . . . . . . . . . . . . . . . . . . 843

Unauthenticated VLAN . . . . . . . . . . . . . . . 843

Commands in this Section . . . . . . . . . . . . . 844

aaa accounting . . . . . . . . . . . . . . . . . . . 844

aaa authentication dot1x default . . . . . . . . . . 847

aaa authentication enable . . . . . . . . . . . . . 848

aaa authentication login . . . . . . . . . . . . . . 850

aaa authorization . . . . . . . . . . . . . . . . . . 852

aaa authorization network default radius . . . . . 855

aaa ias-user username . . . . . . . . . . . . . . . 856

aaa new-model . . . . . . . . . . . . . . . . . . . 857

Contents 32

aaa server radius dynamic-author . . . . . . . . . 857

authentication enable . . . . . . . . . . . . . . . 859

authentication order . . . . . . . . . . . . . . . . 860

authentication priority . . . . . . . . . . . . . . . 861

authentication restart . . . . . . . . . . . . . . . 862

clear (IAS) . . . . . . . . . . . . . . . . . . . . . 862

clear authentication statistics . . . . . . . . . . . 863

clear authentication authentication-history . . . . 864

enable password . . . . . . . . . . . . . . . . . . 864

ip http authentication . . . . . . . . . . . . . . . . 865

ip https authentication . . . . . . . . . . . . . . . 866

password (AAA IAS User Configuration). . . . . . 868

password (User Exec) . . . . . . . . . . . . . . . 869

show aaa ias-users. . . . . . . . . . . . . . . . . 870

show aaa statistics . . . . . . . . . . . . . . . . . 870

show accounting methods . . . . . . . . . . . . . 871

show authentication . . . . . . . . . . . . . . . . 872

show authentication authentication-history . . . . 873

show authentication methods . . . . . . . . . . . 874

show authentication statistics . . . . . . . . . . . 875

show authorization methods . . . . . . . . . . . . 876

Contents 33

show users accounts. . . . . . . . . . . . . . . . 877

show users login-history . . . . . . . . . . . . . . 878

username . . . . . . . . . . . . . . . . . . . . . . 879

username unlock . . . . . . . . . . . . . . . . . . 881

Administrative Profiles Commands . . . . . . . . . . . . .883

Commands in this Section . . . . . . . . . . . . . 884

admin-profile . . . . . . . . . . . . . . . . . . . . 884

description (Administrative Profile Configuration) . 885

rule . . . . . . . . . . . . . . . . . . . . . . . . . 886

show admin-profiles . . . . . . . . . . . . . . . . 887

show admin-profiles brief . . . . . . . . . . . . . 888

show cli modes . . . . . . . . . . . . . . . . . . . 889

E-mail Alerting Commands . . . . . . . . . . . . . . . . . . . . .890

Commands in this Section . . . . . . . . . . . . . 890

logging email . . . . . . . . . . . . . . . . . . . . 891

logging email urgent . . . . . . . . . . . . . . . . 892

logging email message-type to-addr . . . . . . . . 893

logging email from-addr . . . . . . . . . . . . . . 894

logging email message-type subject . . . . . . . . 895

logging email logtime . . . . . . . . . . . . . . . . 896

logging email test message-type . . . . . . . . . . 897

show logging email statistics. . . . . . . . . . . . 897

Contents 34

clear logging email statistics . . . . . . . . . . . . 898

security . . . . . . . . . . . . . . . . . . . . . . . 899

mail-server ip-address | hostname. . . . . . . . . 899

port (Mail Server Configuration Mode). . . . . . . 900

username (Mail Server Configuration Mode) . . . 901

password (Mail Server Configuration Mode) . . . 902

show mail-server . . . . . . . . . . . . . . . . . . 903

RADIUS Commands . . . . . . . . . . . . . . . . . . . . . . . . . . .905

RADIUS-based Dynamic VLAN Assignment . . . . 905

RADIUS Change of Authorization. . . . . . . . . . 906

Commands in this Section . . . . . . . . . . . . . 907

acct-port . . . . . . . . . . . . . . . . . . . . . . 908

attribute 6 . . . . . . . . . . . . . . . . . . . . . . 909

attribute 8 . . . . . . . . . . . . . . . . . . . . . . 910

attribute 25 . . . . . . . . . . . . . . . . . . . . . 911

attribute 31 . . . . . . . . . . . . . . . . . . . . . 911

authentication event fail retry . . . . . . . . . . . 913

auth-port . . . . . . . . . . . . . . . . . . . . . . 914

deadtime . . . . . . . . . . . . . . . . . . . . . . 915

key . . . . . . . . . . . . . . . . . . . . . . . . . 916

msgauth. . . . . . . . . . . . . . . . . . . . . . . 917

Contents 35

name (RADIUS server) . . . . . . . . . . . . . . . 918

primary . . . . . . . . . . . . . . . . . . . . . . . 919

priority . . . . . . . . . . . . . . . . . . . . . . . 920

radius-server attribute 4 . . . . . . . . . . . . . . 921

radius-server attribute 6 . . . . . . . . . . . . . . 922

radius-server attribute 8 . . . . . . . . . . . . . . 923

radius-server attribute 25. . . . . . . . . . . . . . 924

radius-server attribute 31. . . . . . . . . . . . . . 924

radius-server deadtime. . . . . . . . . . . . . . . 926

radius-server host . . . . . . . . . . . . . . . . . 927

radius-server key . . . . . . . . . . . . . . . . . . 928

radius-server retransmit . . . . . . . . . . . . . . 929

radius-server source-ip . . . . . . . . . . . . . . 930

radius-server source-interface. . . . . . . . . . . 931

radius-server timeout. . . . . . . . . . . . . . . . 932

retransmit . . . . . . . . . . . . . . . . . . . . . . 932

show aaa servers. . . . . . . . . . . . . . . . . . 933

show radius statistics . . . . . . . . . . . . . . . 936

source-ip . . . . . . . . . . . . . . . . . . . . . . 940

timeout . . . . . . . . . . . . . . . . . . . . . . . 940

usage . . . . . . . . . . . . . . . . . . . . . . . . 941

Contents 36

TACACS+ Commands . . . . . . . . . . . . . . . . . . . . . . . . . .943

Commands in this Section . . . . . . . . . . . . . 943

key . . . . . . . . . . . . . . . . . . . . . . . . . 944

port . . . . . . . . . . . . . . . . . . . . . . . . . 945

priority . . . . . . . . . . . . . . . . . . . . . . . 946

show tacacs . . . . . . . . . . . . . . . . . . . . 946

tacacs-server host . . . . . . . . . . . . . . . . . 947

tacacs-server key . . . . . . . . . . . . . . . . . 948

tacacs-server source-interface . . . . . . . . . . 949

tacacs-server timeout . . . . . . . . . . . . . . . 950

timeout . . . . . . . . . . . . . . . . . . . . . . . 951

802.1x Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . .953

802.1x Monitor Mode . . . . . . . . . . . . . . . . 953

Commands in this Section . . . . . . . . . . . . . 954

dot1x dynamic-vlan enable . . . . . . . . . . . . . 955

dot1x eapolflood . . . . . . . . . . . . . . . . . . 956

dot1x initialize. . . . . . . . . . . . . . . . . . . . 956

dot1x mac-auth-bypass. . . . . . . . . . . . . . . 957

dot1x max-req. . . . . . . . . . . . . . . . . . . . 958

dot1x max-users . . . . . . . . . . . . . . . . . . 959

dot1x port-control. . . . . . . . . . . . . . . . . . 959

dot1x re-authenticate. . . . . . . . . . . . . . . . 961

Contents 37

dot1x reauthentication . . . . . . . . . . . . . . . 962

dot1x system-auth-control . . . . . . . . . . . . . 962

dot1x system-auth-control monitor. . . . . . . . . 963

dot1x timeout quiet-period . . . . . . . . . . . . . 964

dot1x timeout re-authperiod . . . . . . . . . . . . 965

dot1x timeout server-timeout. . . . . . . . . . . . 966

dot1x timeout supp-timeout . . . . . . . . . . . . 967

dot1x timeout tx-period . . . . . . . . . . . . . . . 968

auth-type . . . . . . . . . . . . . . . . . . . . . . 969

client . . . . . . . . . . . . . . . . . . . . . . . . 970

ignore . . . . . . . . . . . . . . . . . . . . . . . . 972

port . . . . . . . . . . . . . . . . . . . . . . . . . 973

server-key . . . . . . . . . . . . . . . . . . . . . 973

show dot1x . . . . . . . . . . . . . . . . . . . . . 975

show dot1x authentication-history . . . . . . . . . 977

show dot1x clients . . . . . . . . . . . . . . . . . 979

show dot1x interface . . . . . . . . . . . . . . . . 980

show dot1x interface statistics. . . . . . . . . . . 982

show dot1x users . . . . . . . . . . . . . . . . . . 983

clear dot1x authentication–history . . . . . . . . . 984

dot1x guest-vlan . . . . . . . . . . . . . . . . . . 985

Contents 38

dot1x timeout guest-vlan-period . . . . . . . . . . 986

dot1x unauth-vlan. . . . . . . . . . . . . . . . . . 987

show dot1x advanced . . . . . . . . . . . . . . . 988

Captive Portal Commands . . . . . . . . . . . . . . . . . . . . . .990

Commands in this Section . . . . . . . . . . . . . 990

authentication timeout . . . . . . . . . . . . . . . 992

captive-portal. . . . . . . . . . . . . . . . . . . . 992

enable. . . . . . . . . . . . . . . . . . . . . . . . 993

http port . . . . . . . . . . . . . . . . . . . . . . . 994

https port . . . . . . . . . . . . . . . . . . . . . . 994

show captive-portal . . . . . . . . . . . . . . . . 995

show captive-portal status . . . . . . . . . . . . . 996

block . . . . . . . . . . . . . . . . . . . . . . . . 997

configuration . . . . . . . . . . . . . . . . . . . . 997

enable. . . . . . . . . . . . . . . . . . . . . . . . 998

group . . . . . . . . . . . . . . . . . . . . . . . . 999

interface . . . . . . . . . . . . . . . . . . . . . . 999

locale . . . . . . . . . . . . . . . . . . . . . . . 1000

name (Captive Portal). . . . . . . . . . . . . . . 1001

protocol . . . . . . . . . . . . . . . . . . . . . . 1001

redirect . . . . . . . . . . . . . . . . . . . . . . 1002

Contents 39

redirect-url . . . . . . . . . . . . . . . . . . . . 1002

session-timeout. . . . . . . . . . . . . . . . . . 1003

verification . . . . . . . . . . . . . . . . . . . . 1004

captive-portal client deauthenticate . . . . . . . 1005

show captive-portal client status . . . . . . . . 1005

show captive-portal configuration client status . 1006

show captive-portal interface client status . . . 1007

show captive-portal interface configuration status 1008

clear captive-portal users . . . . . . . . . . . . 1009

no user . . . . . . . . . . . . . . . . . . . . . . 1010

show captive-portal user . . . . . . . . . . . . . 1010

user group . . . . . . . . . . . . . . . . . . . . 1011

user-logout . . . . . . . . . . . . . . . . . . . . 1012

user name. . . . . . . . . . . . . . . . . . . . . 1013

user password . . . . . . . . . . . . . . . . . . 1014

user session-timeout . . . . . . . . . . . . . . . 1014

show captive-portal configuration . . . . . . . . 1015

show captive-portal configuration interface. . . 1016

show captive-portal configuration locales. . . . 1017

show captive-portal configuration status . . . . 1018

user group . . . . . . . . . . . . . . . . . . . . 1019

Contents 40

user group moveusers . . . . . . . . . . . . . . 1019

user group name . . . . . . . . . . . . . . . . . 1020

Denial of Service Commands . . . . . . . . . . . . . . . . . .1021

Commands in this Section . . . . . . . . . . . . 1022

dos-control firstfrag . . . . . . . . . . . . . . . 1023

dos-control icmp . . . . . . . . . . . . . . . . . 1023

dos-control l4port. . . . . . . . . . . . . . . . . 1024

dos-control sipdip . . . . . . . . . . . . . . . . 1025

dos-control tcpflag . . . . . . . . . . . . . . . . 1026

dos-control tcpfrag . . . . . . . . . . . . . . . . 1026

rate-limit cpu . . . . . . . . . . . . . . . . . . . 1027

show dos-control . . . . . . . . . . . . . . . . . 1029

show system internal pktmgr. . . . . . . . . . . 1030

storm-control broadcast . . . . . . . . . . . . . 1031

storm-control multicast. . . . . . . . . . . . . . 1032

storm-control unicast. . . . . . . . . . . . . . . 1034

Management ACL Commands . . . . . . . . . . . . . . . . .1036

Commands in this Section . . . . . . . . . . . . 1036

deny (management) . . . . . . . . . . . . . . . 1037

management access-class. . . . . . . . . . . . 1038

management access-list . . . . . . . . . . . . . 1039

permit (management). . . . . . . . . . . . . . . 1041

Contents 41

show management access-class . . . . . . . . 1042

show management access-list. . . . . . . . . . 1043

Password Management Commands . . . . . . . . . . . .1045

Configurable Minimum Password Length . . . . 1045

Password History . . . . . . . . . . . . . . . . . 1045

Password Aging . . . . . . . . . . . . . . . . . 1045

User Lockout . . . . . . . . . . . . . . . . . . . 1045

Password Strength . . . . . . . . . . . . . . . . 1046

Commands in this Section . . . . . . . . . . . . 1047

passwords aging . . . . . . . . . . . . . . . . . 1048

passwords history . . . . . . . . . . . . . . . . 1048

passwords lock-out. . . . . . . . . . . . . . . . 1049

passwords min-length . . . . . . . . . . . . . . 1050

passwords strength-check . . . . . . . . . . . . 1051

passwords strength minimum uppercase-letters 1052

passwords strength minimum lowercase-letters 1053

passwords strength minimum numeric-characters 1054

passwords strength minimum special-characters 1054

passwords strength max-limit consecutive-characters 1055

passwords strength max-limit repeated-characters 1056

passwords strength minimum character-classes 1057

Contents 42

passwords strength exclude-keyword . . . . . . 1058

enable password encrypted . . . . . . . . . . . 1059

show passwords configuration. . . . . . . . . . 1059

show passwords result. . . . . . . . . . . . . . 1061

SSH Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1063

Commands in this Section . . . . . . . . . . . . 1063

crypto key generate dsa . . . . . . . . . . . . . 1063

crypto key generate rsa . . . . . . . . . . . . . 1064

crypto key pubkey-chain ssh . . . . . . . . . . . 1065

crypto key zeroize pubkey-chain . . . . . . . . . 1066

crypto key zeroize {rsa|dsa} . . . . . . . . . . . 1067

ip ssh port. . . . . . . . . . . . . . . . . . . . . 1068

ip ssh pubkey-auth . . . . . . . . . . . . . . . . 1069

ip ssh server . . . . . . . . . . . . . . . . . . . 1070

key-string . . . . . . . . . . . . . . . . . . . . . 1071

show crypto key mypubkey. . . . . . . . . . . . 1072

show crypto key pubkey-chain ssh . . . . . . . 1073

show ip ssh . . . . . . . . . . . . . . . . . . . . 1074

5 Audio Visual Bridging Commands . . . . 1075

Multiple MAC Registration Protocol Commands .1076

Commands in this Section . . . . . . . . . . . . 1076

Contents 43

clear mmrp statistics . . . . . . . . . . . . . . . 1076

mmrp . . . . . . . . . . . . . . . . . . . . . . . 1077

mmrp global. . . . . . . . . . . . . . . . . . . . 1078

mmrp periodic state machine . . . . . . . . . . 1079

show mmrp . . . . . . . . . . . . . . . . . . . . 1080

show mmrp statistics . . . . . . . . . . . . . . . 1081

Multiple VLAN Registration Protocol Commands 1083

Commands in this Section . . . . . . . . . . . . 1083

clear mvrp statistics . . . . . . . . . . . . . . . 1083

mvrp. . . . . . . . . . . . . . . . . . . . . . . . 1084

mvrp global . . . . . . . . . . . . . . . . . . . . 1085

mvrp periodic state machine . . . . . . . . . . . 1086

show mvrp . . . . . . . . . . . . . . . . . . . . 1087

show mvrp statistics . . . . . . . . . . . . . . . 1088

Multiple Stream Reservation Protocol Commands 1090

Commands in this Section . . . . . . . . . . . . 1090

clear msrp statistics . . . . . . . . . . . . . . . 1090

msrp (Interface). . . . . . . . . . . . . . . . . . 1091

msrp boundary-propagate . . . . . . . . . . . . 1092

msrp delta-bw . . . . . . . . . . . . . . . . . . 1093

msrp global . . . . . . . . . . . . . . . . . . . . 1094

msrp max-fan-in-ports . . . . . . . . . . . . . . 1095

Contents 44

msrp srclass-pvid. . . . . . . . . . . . . . . . . 1096

msrp srclassqav . . . . . . . . . . . . . . . . . 1097

msrp talker-pruning. . . . . . . . . . . . . . . . 1099

show msrp . . . . . . . . . . . . . . . . . . . . 1100

show msrp reservations . . . . . . . . . . . . . 1103

show msrp statistics . . . . . . . . . . . . . . . 1104

show msrp stream . . . . . . . . . . . . . . . . 1106

802.1AS Timesync Commands . . . . . . . . . . . . . . . . .1109

Commands in this Section . . . . . . . . . . . . 1109

clear dot1as statistics . . . . . . . . . . . . . . 1109

dot1as (Global Configuration) . . . . . . . . . . 1110

dot1as (Interface Configuration) . . . . . . . . . 1111

dot1as priority. . . . . . . . . . . . . . . . . . . 1112

dot1as interval announce. . . . . . . . . . . . . 1113

dot1as interval sync . . . . . . . . . . . . . . . 1115

dot1as interval pdelay . . . . . . . . . . . . . . 1116

dot1as timeout announce. . . . . . . . . . . . . 1117

dot1as timeout sync . . . . . . . . . . . . . . . 1119

dot1as pdelay-threshold . . . . . . . . . . . . . 1120

dot1as interval pdelay-loss . . . . . . . . . . . . 1121

show dot1as . . . . . . . . . . . . . . . . . . . 1123

Contents 45

show dot1as statistics . . . . . . . . . . . . . . 1126

6 Data Center Technology Commands . . 1129

Data Center Bridging Commands . . . . . . . . . . . . . .1130

Data Center Bridging Exchange Protocol . . . . 1130

Interoperability with IEEE DCBX . . . . . . . . . 1134

Port Roles . . . . . . . . . . . . . . . . . . . . . 1134

Commands in this Section . . . . . . . . . . . . 1138

Data Center Bridging Capability Exchange Commands 1138

datacenter-bridging . . . . . . . . . . . . . . . 1138

lldp dcbx version . . . . . . . . . . . . . . . . . 1139

lldp tlv-select dcbxp (dcb enable) . . . . . . . . 1140

lldp dcbx port-role . . . . . . . . . . . . . . . . 1142

show lldp tlv-select . . . . . . . . . . . . . . . . 1143

show lldp dcbx . . . . . . . . . . . . . . . . . . 1144

Enhanced Transmission Selection (ETS) Commands 1148

classofservice traffic-class-group . . . . . . . . 1148

traffic-class-group max-bandwidth . . . . . . . 1150

traffic-class-group min-bandwidth. . . . . . . . 1151

traffic-class-group strict . . . . . . . . . . . . . 1152

traffic-class-group weight . . . . . . . . . . . . 1154

show classofservice traffic-class-group. . . . . 1155

Contents 46

show interfaces traffic . . . . . . . . . . . . . . 1156

show interfaces traffic-class-group . . . . . . . 1158

OpenFlow Commands . . . . . . . . . . . . . . . . . . . . . . . .1160

Commands in this Section . . . . . . . . . . . . 1160

controller . . . . . . . . . . . . . . . . . . . . . 1160

hardware profile openflow . . . . . . . . . . . . 1162

ipv4 address . . . . . . . . . . . . . . . . . . . 1163

mode . . . . . . . . . . . . . . . . . . . . . . . 1165

openflow . . . . . . . . . . . . . . . . . . . . . 1167

passive . . . . . . . . . . . . . . . . . . . . . . 1168

protocol-version . . . . . . . . . . . . . . . . . 1169

show openflow . . . . . . . . . . . . . . . . . . 1171

Priority Flow Control Commands . . . . . . . . . . . . . . .1179

Commands in this Section . . . . . . . . . . . . 1180

priority-flow-control mode . . . . . . . . . . . . 1180

priority-flow-control priority . . . . . . . . . . . 1181

clear priority-flow-control statistics . . . . . . . 1182

show interfaces priority-flow-control . . . . . . 1183

7 Layer 3 Routing Commands . . . . . . . . . 1187

ARP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1188

ARP Aging . . . . . . . . . . . . . . . . . . . . 1189

Contents 47

Commands in this Section . . . . . . . . . . . . 1189

arp . . . . . . . . . . . . . . . . . . . . . . . . 1189

arp cachesize. . . . . . . . . . . . . . . . . . . 1191

arp dynamicrenew . . . . . . . . . . . . . . . . 1192

arp purge . . . . . . . . . . . . . . . . . . . . . 1193

arp resptime . . . . . . . . . . . . . . . . . . . 1194

arp retries. . . . . . . . . . . . . . . . . . . . . 1195

arp timeout . . . . . . . . . . . . . . . . . . . . 1195

clear arp-cache. . . . . . . . . . . . . . . . . . 1196

clear arp-cache management . . . . . . . . . . 1197

ip local-proxy-arp. . . . . . . . . . . . . . . . . 1198

ip proxy-arp . . . . . . . . . . . . . . . . . . . . 1198

show arp . . . . . . . . . . . . . . . . . . . . . 1199

Bidirectional Forwarding Detection Commands .1201

Commands in this Section . . . . . . . . . . . . 1201

feature bfd . . . . . . . . . . . . . . . . . . . . 1201

bfd echo. . . . . . . . . . . . . . . . . . . . . . 1202

bfd interval . . . . . . . . . . . . . . . . . . . . 1203

bfd slow-timer . . . . . . . . . . . . . . . . . . 1205

ip ospf bfd. . . . . . . . . . . . . . . . . . . . . 1206

ipv6 ospf bfd . . . . . . . . . . . . . . . . . . . 1207

Contents 48

neighbor fall-over bfd. . . . . . . . . . . . . . . 1208

show bfd neighbor . . . . . . . . . . . . . . . . 1208

Border Gateway Protocol Commands . . . . . . . . . .1212

Commands in this Section . . . . . . . . . . . . 1212

router bgp. . . . . . . . . . . . . . . . . . . . . 1215

address-family . . . . . . . . . . . . . . . . . . 1216

address-family ipv4 vrf . . . . . . . . . . . . . . 1218

address-family ipv6 . . . . . . . . . . . . . . . . 1219

address-family vpnv4 unicast . . . . . . . . . . 1219

aggregate-address . . . . . . . . . . . . . . . . 1221

bgp aggregate-different-meds (BGP Router Configuration) 1222

bgp aggregate-different-meds (IPv6 Address Family

Configuration). . . . . . . . . . . . . . . . . . . 1223

bgp always-compare-med . . . . . . . . . . . . 1224

bgp client-to-client reflection (BGP Router Configuration) 1225

bgp client-to-client reflection (IPv6 Address Family

Configuration). . . . . . . . . . . . . . . . . . . 1226

bgp cluster-id . . . . . . . . . . . . . . . . . . . 1227

bgp default local-preference . . . . . . . . . . . 1228

bgp fast-external-fallover . . . . . . . . . . . . 1229

bgp fast-internal-fallover . . . . . . . . . . . . . 1230

bgp listen . . . . . . . . . . . . . . . . . . . . . 1231

Contents 49

bgp log-neighbor-changes . . . . . . . . . . . . 1233

bgp maxas-limit . . . . . . . . . . . . . . . . . . 1233

bgp router-id . . . . . . . . . . . . . . . . . . . 1234

clear ip bgp . . . . . . . . . . . . . . . . . . . . 1235

clear ip bgp counters . . . . . . . . . . . . . . . 1237

default-information originate (BGP Router Configuration) 1237

default-information originate (IPv6 Address Family Configuration)

1238

default metric (BGP Router Configuration) . . . . 1239

default metric (IPv6 Address Family Configuration) 1240

distance. . . . . . . . . . . . . . . . . . . . . . 1241

distance bgp (BGP Router Configuration) . . . . 1242

distance bgp (IPv6 Address Family Configuration) 1243

distribute-list prefix in . . . . . . . . . . . . . . 1245

distribute-list prefix out (BGP Router Configuration) 1245

distribute-list prefix out (IPv6 Address Family Configuration)

1246

enable. . . . . . . . . . . . . . . . . . . . . . . 1247

ip as-path access-list. . . . . . . . . . . . . . . 1248

ip bgp-community new-format . . . . . . . . . . 1251

ip bgp fast-external-fallover . . . . . . . . . . . 1251

ip community-list . . . . . . . . . . . . . . . . . 1252

Contents 50

ip extcommunity-list . . . . . . . . . . . . . . . 1254

match extcommunity . . . . . . . . . . . . . . . 1256

maximum-paths (BGP Router Configuration). . . 1257

maximum-paths (IPv6 Address Family Configuration) 1259

maximum-paths ibgp (BGP Router Configuration) 1260

maximum-paths ibgp (IPv6 Address Family Configuration) 1261

neighbor activate . . . . . . . . . . . . . . . . . 1262

neighbor advertisement-interval (BGP Router Configuration)

1263

neighbor advertisement-interval (IPv6 Address Family

Configuration). . . . . . . . . . . . . . . . . . . 1264

neighbor allowas-in . . . . . . . . . . . . . . . 1265

neighbor connect-retry-interval . . . . . . . . . 1267

neighbor default-originate (BGP Router Configuration) 1268

neighbor default-originate (IPv6 Address Family Configuration)

1269

neighbor description . . . . . . . . . . . . . . . 1271

neighbor ebgp-multihop . . . . . . . . . . . . . 1272

neighbor filter-list (BGP Router Configuration). . 1274

neighbor filter-list (IPv6 Address Family Configuration) 1276

neighbor inherit peer . . . . . . . . . . . . . . . 1277

neighbor local-as . . . . . . . . . . . . . . . . . 1278

neighbor maximum-prefix (BGP Router Configuration) 1280

Contents 51

neighbor maximum-prefix (IPv6 Address Family Configuration)

1282

neighbor next-hop-self (BGP Router Configuration) 1283

neighbor next-hop-self (IPv6 Address Family Configuration) 1284

neighbor password . . . . . . . . . . . . . . . . 1285

neighbor prefix-list (BGP Router Configuration) . 1287

neighbor prefix-list (IPv6 Address Family Configuration) 1288

neighbor remote-as. . . . . . . . . . . . . . . . 1289

neighbor remove-private-as . . . . . . . . . . . 1290

neighbor rfc5549-support. . . . . . . . . . . . . 1291

neighbor route-map (BGP Router Configuration) 1293

neighbor route-map (IPv6 Address Family Configuration) 1294

neighbor route-reflector-client (BGP Router Configuration) 1295

neighbor route-reflector-client (IPv6 Address Family

Configuration). . . . . . . . . . . . . . . . . . . 1296

neighbor send-community (BGP Router Configuration) 1298

neighbor send-community (IPv6 Address Family Configuration)

1299

neighbor shutdown . . . . . . . . . . . . . . . . 1300

neighbor timers . . . . . . . . . . . . . . . . . . 1301

neighbor update-source . . . . . . . . . . . . . 1302

network (BGP Router Configuration) . . . . . . . 1304

network (IPv6 Address Family Configuration) . . 1306

Contents 52

rd . . . . . . . . . . . . . . . . . . . . . . . . . 1308

redistribute (BGP). . . . . . . . . . . . . . . . . 1309

redistribute (BGP IPv6) . . . . . . . . . . . . . . 1311

route-target . . . . . . . . . . . . . . . . . . . . 1313

set extcommunity rt. . . . . . . . . . . . . . . . 1314

set extcommunity soo . . . . . . . . . . . . . . 1316

show bgp ipv6. . . . . . . . . . . . . . . . . . . 1317

show bgp ipv6 aggregate-address . . . . . . . . 1319

show bgp ipv6 community . . . . . . . . . . . . 1320

show bgp ipv6 community-list . . . . . . . . . . 1322

show bgp ipv6 listen range . . . . . . . . . . . . 1323

show bgp ipv6 neighbors . . . . . . . . . . . . . 1324

show bgp ipv6 neighbors advertised-routes . . . 1330

show bgp ipv6 neighbors policy . . . . . . . . . 1332

show bgp ipv6 neighbors received-routes . . . . 1333

show bgp ipv6 statistics . . . . . . . . . . . . . 1335

show bgp ipv6 summary . . . . . . . . . . . . . 1336

show bgp ipv6 update-group . . . . . . . . . . . 1339

show bgp ipv6 route-reflection. . . . . . . . . . 1342

show ip bgp . . . . . . . . . . . . . . . . . . . . 1343

show ip bgp aggregate-address . . . . . . . . . 1345

Contents 53

show ip bgp community . . . . . . . . . . . . . 1346

show ip bgp community-list . . . . . . . . . . . 1347

show ip bgp extcommunity-list . . . . . . . . . . 1348

show ip bgp listen range . . . . . . . . . . . . . 1349

show ip bgp neighbors . . . . . . . . . . . . . . 1350

show ip bgp neighbors advertised-routes . . . . 1357

show ip bgp neighbors received-routes . . . . . 1359

show ip bgp neighbors policy . . . . . . . . . . 1361

show ip bgp route-reflection . . . . . . . . . . . 1362

show ip bgp statistics. . . . . . . . . . . . . . . 1363

show ip bgp summary . . . . . . . . . . . . . . 1365

show ip bgp template. . . . . . . . . . . . . . . 1368

show ip bgp traffic . . . . . . . . . . . . . . . . 1369

show ip bgp update-group . . . . . . . . . . . . 1371

show ip bgp vpn4 . . . . . . . . . . . . . . . . . 1375

show router-capability . . . . . . . . . . . . . . 1379

template peer . . . . . . . . . . . . . . . . . . . 1380

timers bgp. . . . . . . . . . . . . . . . . . . . . 1382

BGP Routing Policy . . . . . . . . . . . . . . . . . . . . . . . . . .1384

Commands in this Section . . . . . . . . . . . . 1384

ip as-path access-list. . . . . . . . . . . . . . . 1385

Contents 54

ip bgp-community new-format . . . . . . . . . . 1387

ip community-list . . . . . . . . . . . . . . . . . 1388

ip prefix-list . . . . . . . . . . . . . . . . . . . . 1389

ip prefix-list description . . . . . . . . . . . . . 1391

ipv6 prefix-list. . . . . . . . . . . . . . . . . . . 1392

match as-path . . . . . . . . . . . . . . . . . . 1395

match community. . . . . . . . . . . . . . . . . 1396

match ip address prefix-list . . . . . . . . . . . 1397

match ipv6 address prefix-list . . . . . . . . . . 1398

show ip as-path-access-list . . . . . . . . . . . 1399

show ip community-list . . . . . . . . . . . . . . 1400

show ip prefix-list. . . . . . . . . . . . . . . . . 1401

show ipv6 prefix-list . . . . . . . . . . . . . . . 1403

clear ip prefix-list . . . . . . . . . . . . . . . . . 1405

clear ipv6 prefix-list. . . . . . . . . . . . . . . . 1406

clear ip community-list . . . . . . . . . . . . . . 1407

set as-path . . . . . . . . . . . . . . . . . . . . 1408

set comm-list delete . . . . . . . . . . . . . . . 1409

set community . . . . . . . . . . . . . . . . . . 1410

set ipv6 next-hop (BGP). . . . . . . . . . . . . . 1411

set local-preference . . . . . . . . . . . . . . . 1412

Contents 55

set metric . . . . . . . . . . . . . . . . . . . . . 1413

DVMRP Commands . . . . . . . . . . . . . . . . . . . . . . . . . .1415

Commands in this Section . . . . . . . . . . . . 1415

ip dvmrp. . . . . . . . . . . . . . . . . . . . . . 1415

ip dvmrp metric . . . . . . . . . . . . . . . . . . 1416

show ip dvmrp . . . . . . . . . . . . . . . . . . 1417

show ip dvmrp interface . . . . . . . . . . . . . 1418

show ip dvmrp neighbor . . . . . . . . . . . . . 1418

show ip dvmrp nexthop. . . . . . . . . . . . . . 1419

show ip dvmrp prune . . . . . . . . . . . . . . . 1420

show ip dvmrp route . . . . . . . . . . . . . . . 1421

IGMP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . .1422

Commands in this Section . . . . . . . . . . . . 1423

ip igmp last-member-query-count . . . . . . . . 1423

ip igmp last-member-query-interval . . . . . . . 1424

ip igmp mroute-proxy . . . . . . . . . . . . . . . 1425

ip igmp query-interval . . . . . . . . . . . . . . 1426

ip igmp query-max-response-time . . . . . . . . 1427

ip igmp robustness . . . . . . . . . . . . . . . . 1428

ip igmp startup-query-count . . . . . . . . . . . 1428

ip igmp startup-query-interval . . . . . . . . . . 1429

ip igmp version . . . . . . . . . . . . . . . . . . 1430

Contents 56

show ip igmp . . . . . . . . . . . . . . . . . . . 1431

show ip igmp groups . . . . . . . . . . . . . . . 1431

show ip igmp interface . . . . . . . . . . . . . . 1432

show ip igmp membership . . . . . . . . . . . . 1433

show ip igmp interface stats . . . . . . . . . . . 1434

IGMP Proxy Commands . . . . . . . . . . . . . . . . . . . . . . .1436

Commands in this Section . . . . . . . . . . . . 1436

ip igmp proxy-service. . . . . . . . . . . . . . . 1436

ip igmp proxy-service reset-status . . . . . . . . 1437

ip igmp proxy-service unsolicit-rprt-interval . . . 1438

show ip igmp proxy-service . . . . . . . . . . . 1439

show ip igmp proxy-service interface . . . . . . 1440

show ip igmp-proxy groups. . . . . . . . . . . . 1440

show ip igmp proxy-service groups detail . . . . 1441

IP Helper/DHCP Relay Commands . . . . . . . . . . . . .1443

Commands in this Section . . . . . . . . . . . . 1445

bootpdhcprelay maxhopcount . . . . . . . . . . 1446

bootpdhcprelay minwaittime . . . . . . . . . . . 1447

clear ip helper statistics . . . . . . . . . . . . . 1448

ip dhcp relay information check . . . . . . . . . 1448

ip dhcp relay information check-reply . . . . . . 1449

ip dhcp relay information option . . . . . . . . . 1450

Contents 57

ip dhcp relay information option-insert . . . . . 1451

ip helper-address (global configuration) . . . . . 1452

ip helper-address (interface configuration) . . . 1454

ip helper enable. . . . . . . . . . . . . . . . . . 1456

show ip helper-address . . . . . . . . . . . . . 1457

show ip dhcp relay . . . . . . . . . . . . . . . . 1458

show ip helper statistics . . . . . . . . . . . . . 1459

IP Routing Commands . . . . . . . . . . . . . . . . . . . . . . . .1462

Static Routes/ECMP Static Routes . . . . . . . . 1462

Static Reject Routes . . . . . . . . . . . . . . . 1463

Default Routes . . . . . . . . . . . . . . . . . . 1463

Commands in this Section . . . . . . . . . . . . 1463

encapsulation. . . . . . . . . . . . . . . . . . . 1464

ip icmp echo-reply . . . . . . . . . . . . . . . . 1464

ip icmp error-interval . . . . . . . . . . . . . . . 1465

ip netdirbcast . . . . . . . . . . . . . . . . . . . 1466

ip policy route-map . . . . . . . . . . . . . . . . 1467

ip redirects . . . . . . . . . . . . . . . . . . . . 1469

ip route . . . . . . . . . . . . . . . . . . . . . . 1469

ip route default . . . . . . . . . . . . . . . . . . 1474

ip route distance . . . . . . . . . . . . . . . . . 1476

Contents 58

ip routing . . . . . . . . . . . . . . . . . . . . . 1477

ip unnumbered . . . . . . . . . . . . . . . . . . 1478

ip unnumbered gratuitous-arp accept . . . . . . 1479

ip unreachables. . . . . . . . . . . . . . . . . . 1480

match ip address . . . . . . . . . . . . . . . . . 1481

match length . . . . . . . . . . . . . . . . . . . 1484

match mac-list . . . . . . . . . . . . . . . . . . 1485

route-map. . . . . . . . . . . . . . . . . . . . . 1485

set interface null0. . . . . . . . . . . . . . . . . 1487

set ip default next-hop . . . . . . . . . . . . . . 1488

set ip next-hop . . . . . . . . . . . . . . . . . . 1489

set ip precedence . . . . . . . . . . . . . . . . 1490

show ip brief . . . . . . . . . . . . . . . . . . . 1491

show ip interface . . . . . . . . . . . . . . . . . 1492

show ip policy. . . . . . . . . . . . . . . . . . . 1494

show ip protocols. . . . . . . . . . . . . . . . . 1494

show ip route . . . . . . . . . . . . . . . . . . . 1498

show ip route static. . . . . . . . . . . . . . . . 1501

show ip route preferences . . . . . . . . . . . . 1502

show ip route summary. . . . . . . . . . . . . . 1503

show ip traffic. . . . . . . . . . . . . . . . . . . 1504

Contents 59

show ip vlan . . . . . . . . . . . . . . . . . . . 1506

show route-map . . . . . . . . . . . . . . . . . 1507

show routing heap summary . . . . . . . . . . . 1509

IPv6 Routing Commands . . . . . . . . . . . . . . . . . . . . . .1511

IPv6 Limitations & Restrictions . . . . . . . . . . 1511

Commands in this Section . . . . . . . . . . . . 1511

clear ipv6 neighbors . . . . . . . . . . . . . . . 1512

clear ipv6 statistics . . . . . . . . . . . . . . . . 1513

ipv6 address . . . . . . . . . . . . . . . . . . . 1514

ipv6 enable . . . . . . . . . . . . . . . . . . . . 1515

ipv6 hop-limit . . . . . . . . . . . . . . . . . . . 1516

ipv6 host . . . . . . . . . . . . . . . . . . . . . 1516

ipv6 icmp error-interval. . . . . . . . . . . . . . 1517

ipv6 mld last-member-query-count. . . . . . . . 1518

ipv6 mld last-member-query-interval. . . . . . . 1519

ipv6 mld host-proxy . . . . . . . . . . . . . . . . 1519

ipv6 mld host-proxy reset-status . . . . . . . . . 1520

ipv6 mld host-proxy unsolicit-rprt-interval . . . . 1521

ipv6 mld query-interval . . . . . . . . . . . . . . 1521

ipv6 mld query-max-response-time . . . . . . . 1522

ipv6 nd dad attempts . . . . . . . . . . . . . . . 1523

Contents 60

ipv6 nd ra hop-limit unspecified . . . . . . . . . 1524

ipv6 nd managed-config-flag . . . . . . . . . . . 1524

ipv6 nd ns-interval . . . . . . . . . . . . . . . . 1525

ipv6 nd nud max-multicast-solicits . . . . . . . . 1526

ipv6 nd nud max-unicast-solicits . . . . . . . . . 1527

ipv6 nd nud retry . . . . . . . . . . . . . . . . . 1528

ipv6 nd other-config-flag . . . . . . . . . . . . . 1529

ipv6 nd prefix . . . . . . . . . . . . . . . . . . . 1530

ipv6 nd raguard attach-policy . . . . . . . . . . 1531

ipv6 nd ra-interval . . . . . . . . . . . . . . . . 1532

ipv6 nd ra-lifetime. . . . . . . . . . . . . . . . . 1533

ipv6 nd reachable-time . . . . . . . . . . . . . . 1534

ipv6 nd suppress-ra. . . . . . . . . . . . . . . . 1535

ipv6 route . . . . . . . . . . . . . . . . . . . . . 1535

ipv6 route distance . . . . . . . . . . . . . . . . 1537

ipv6 unicast-routing . . . . . . . . . . . . . . . 1538

ipv6 unreachables . . . . . . . . . . . . . . . . 1538

show ipv6 brief . . . . . . . . . . . . . . . . . . 1539

show ipv6 interface. . . . . . . . . . . . . . . . 1540

show ipv6 mld groups. . . . . . . . . . . . . . . 1542

show ipv6 mld interface . . . . . . . . . . . . . 1544

Contents 61

show ipv6 mld host-proxy . . . . . . . . . . . . 1547

show ipv6 mld host-proxy groups . . . . . . . . 1548

show ipv6 mld host-proxy groups detail . . . . . 1549

show ipv6 mld host-proxy interface . . . . . . . 1551

show ipv6 mld traffic . . . . . . . . . . . . . . . 1552

show ipv6 nd raguard policy . . . . . . . . . . . 1553

show ipv6 neighbors . . . . . . . . . . . . . . . 1555

show ipv6 protocols . . . . . . . . . . . . . . . 1555

show ipv6 route . . . . . . . . . . . . . . . . . . 1557

show ipv6 route preferences . . . . . . . . . . . 1558

show ipv6 route summary . . . . . . . . . . . . 1559

show ipv6 snooping counters . . . . . . . . . . 1560

show ipv6 traffic . . . . . . . . . . . . . . . . . 1561

show ipv6 vlan . . . . . . . . . . . . . . . . . . 1562

traceroute ipv6 . . . . . . . . . . . . . . . . . . 1563

Loopback Interface Commands . . . . . . . . . . . . . . . .1565

Commands in this Section . . . . . . . . . . . . 1565

interface loopback . . . . . . . . . . . . . . . . 1565

show interfaces loopback . . . . . . . . . . . . 1566

IP Multicast Commands . . . . . . . . . . . . . . . . . . . . . .1568

Commands in this Section . . . . . . . . . . . . 1569

clear ip mroute . . . . . . . . . . . . . . . . . . 1569

Contents 62

ip multicast boundary. . . . . . . . . . . . . . . 1571

ip mroute . . . . . . . . . . . . . . . . . . . . . 1571

ip multicast-routing . . . . . . . . . . . . . . . . 1572

ip multicast ttl-threshold . . . . . . . . . . . . . 1574

ip pim . . . . . . . . . . . . . . . . . . . . . . . 1574

ip pim bsr-border . . . . . . . . . . . . . . . . . 1575

ip pim bsr-candidate . . . . . . . . . . . . . . . 1576

ip pim dense-mode . . . . . . . . . . . . . . . . 1577

ip pim dr-priority . . . . . . . . . . . . . . . . . 1578

ip pim hello-interval. . . . . . . . . . . . . . . . 1578

ip pim join-prune-interval. . . . . . . . . . . . . 1579

ip pim rp-address . . . . . . . . . . . . . . . . . 1580

ip pim rp-candidate . . . . . . . . . . . . . . . . 1581

ip pim sparse-mode. . . . . . . . . . . . . . . . 1581

ip pim ssm. . . . . . . . . . . . . . . . . . . . . 1582

show ip mfc . . . . . . . . . . . . . . . . . . . . 1583

show ip multicast . . . . . . . . . . . . . . . . . 1584

show ip pim boundary . . . . . . . . . . . . . . 1585

show ip multicast interface. . . . . . . . . . . . 1586

show ip mroute . . . . . . . . . . . . . . . . . . 1587

show ip mroute group . . . . . . . . . . . . . . 1587

Contents 63

show ip mroute source . . . . . . . . . . . . . . 1588

show ip mroute static. . . . . . . . . . . . . . . 1589

show ip pim . . . . . . . . . . . . . . . . . . . . 1590

show ip pim bsr-router . . . . . . . . . . . . . . 1590

show ip pim interface. . . . . . . . . . . . . . . 1592

show ip pim neighbor. . . . . . . . . . . . . . . 1593

show ip pim rp-hash . . . . . . . . . . . . . . . 1594

show ip pim rp mapping . . . . . . . . . . . . . 1595

show ip pim statistics. . . . . . . . . . . . . . . 1596

IPv6 Multicast Commands . . . . . . . . . . . . . . . . . . . .1599

clear ipv6 mroute . . . . . . . . . . . . . . . . . 1599

ipv6 pim (VLAN Interface config) . . . . . . . . . 1600

ipv6 pim bsr-border . . . . . . . . . . . . . . . . 1601

ipv6 pim bsr-candidate . . . . . . . . . . . . . . 1602

ipv6 pim dense-mode . . . . . . . . . . . . . . . 1603

ipv6 pim dr-priority . . . . . . . . . . . . . . . . 1603

ipv6 pim hello-interval . . . . . . . . . . . . . . 1604

ipv6 pim join-prune-interval . . . . . . . . . . . 1605

ipv6 pim register-threshold . . . . . . . . . . . . 1605

ipv6 pim rp-address. . . . . . . . . . . . . . . . 1606

ipv6 pim rp-candidate. . . . . . . . . . . . . . . 1607

Contents 64

ipv6 pim sparse-mode . . . . . . . . . . . . . . 1608

ipv6 pim ssm . . . . . . . . . . . . . . . . . . . 1609

show ipv6 pim. . . . . . . . . . . . . . . . . . . 1609

show ipv6 pim bsr-router . . . . . . . . . . . . . 1610

show ipv6 mroute group . . . . . . . . . . . . . 1614

show ipv6 mroute source. . . . . . . . . . . . . 1615

show ipv6 pim interface . . . . . . . . . . . . . 1616

show ipv6 pim neighbor . . . . . . . . . . . . . 1617

show ipv6 pim rp-hash . . . . . . . . . . . . . . 1618

show ipv6 pim rp mapping . . . . . . . . . . . . 1618

show ipv6 pim statistics . . . . . . . . . . . . . 1619

OSPF Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1622

Route Preferences . . . . . . . . . . . . . . . . 1623

OSPF Equal Cost Multipath (ECMP) . . . . . . . 1623

Forwarding of OSPF Opaque LSAs Enabled by Default 1624

Passive Interfaces . . . . . . . . . . . . . . . . 1624

Graceful Restart . . . . . . . . . . . . . . . . . 1625

Commands in this Section . . . . . . . . . . . . 1625

area default-cost (Router OSPF) . . . . . . . . . 1626

area nssa (Router OSPF) . . . . . . . . . . . . . 1627

area nssa default-info-originate (Router OSPF Config) 1629

Contents 65

area nssa no-redistribute. . . . . . . . . . . . . 1630

area nssa no-summary . . . . . . . . . . . . . . 1630

area nssa translator-role . . . . . . . . . . . . . 1631

area nssa translator-stab-intv . . . . . . . . . . 1632

area range (Router OSPF) . . . . . . . . . . . . 1633

area stub . . . . . . . . . . . . . . . . . . . . . 1635

area stub no-summary . . . . . . . . . . . . . . 1636

area virtual-link . . . . . . . . . . . . . . . . . . 1637

area virtual-link authentication. . . . . . . . . . 1639

area virtual-link dead-interval . . . . . . . . . . 1641

area virtual-link hello-interval . . . . . . . . . . 1642

area virtual-link retransmit-interval . . . . . . . 1643

area virtual-link transmit-delay. . . . . . . . . . 1644

auto-cost . . . . . . . . . . . . . . . . . . . . . 1644

bandwidth. . . . . . . . . . . . . . . . . . . . . 1645

bfd. . . . . . . . . . . . . . . . . . . . . . . . . 1646

capability opaque. . . . . . . . . . . . . . . . . 1647

clear ip ospf. . . . . . . . . . . . . . . . . . . . 1648

clear ip ospf stub-router . . . . . . . . . . . . . 1649

compatible rfc1583 . . . . . . . . . . . . . . . . 1650

default-information originate (Router OSPF Configuration) 1650

Contents 66

default-metric. . . . . . . . . . . . . . . . . . . 1652

distance ospf . . . . . . . . . . . . . . . . . . . 1652

distribute-list out . . . . . . . . . . . . . . . . . 1653

enable. . . . . . . . . . . . . . . . . . . . . . . 1654

exit-overflow-interval. . . . . . . . . . . . . . . 1655

external-lsdb-limit . . . . . . . . . . . . . . . . 1656

ip ospf area . . . . . . . . . . . . . . . . . . . . 1657

ip ospf authentication . . . . . . . . . . . . . . 1658

ip ospf cost . . . . . . . . . . . . . . . . . . . . 1659

ip ospf database-filter all out . . . . . . . . . . . 1659

ip ospf dead-interval . . . . . . . . . . . . . . . 1660

ip ospf hello-interval . . . . . . . . . . . . . . . 1661

ip ospf mtu-ignore . . . . . . . . . . . . . . . . 1661

ip ospf network . . . . . . . . . . . . . . . . . . 1662

ip ospf priority. . . . . . . . . . . . . . . . . . . 1663

ip ospf retransmit-interval . . . . . . . . . . . . 1664

ip ospf transmit-delay. . . . . . . . . . . . . . . 1665

log adjacency-changes. . . . . . . . . . . . . . 1665

max-metric router-lsa . . . . . . . . . . . . . . 1666

maximum-paths. . . . . . . . . . . . . . . . . . 1668

network area . . . . . . . . . . . . . . . . . . . 1669

Contents 67

nsf. . . . . . . . . . . . . . . . . . . . . . . . . 1670

nsf helper . . . . . . . . . . . . . . . . . . . . . 1671

nsf helper strict-lsa-checking . . . . . . . . . . 1672

nsf restart-interval . . . . . . . . . . . . . . . . 1672

passive-interface default . . . . . . . . . . . . . 1673

passive-interface . . . . . . . . . . . . . . . . . 1674

redistribute (OSPF) . . . . . . . . . . . . . . . . 1675

router-id. . . . . . . . . . . . . . . . . . . . . . 1676

router ospf . . . . . . . . . . . . . . . . . . . . 1677

show ip ospf . . . . . . . . . . . . . . . . . . . 1678

show ip ospf abr . . . . . . . . . . . . . . . . . 1685

show ip ospf area. . . . . . . . . . . . . . . . . 1685

show ip ospf asbr . . . . . . . . . . . . . . . . . 1687

show ip ospf database . . . . . . . . . . . . . . 1688

show ip ospf database database-summary . . . 1691

show ip ospf interface . . . . . . . . . . . . . . 1693

show ip ospf interface brief . . . . . . . . . . . 1695

show ip ospf interface stats . . . . . . . . . . . 1696

show ip ospf lsa-group . . . . . . . . . . . . . . 1697

show ip ospf neighbor . . . . . . . . . . . . . . 1698

show ip ospf range . . . . . . . . . . . . . . . . 1702

Contents 68

show ip ospf statistics . . . . . . . . . . . . . . 1703

show ip ospf stub table . . . . . . . . . . . . . . 1705

show ip ospf traffic . . . . . . . . . . . . . . . . 1706

show ip ospf virtual-links . . . . . . . . . . . . . 1708

show ip ospf virtual-links brief . . . . . . . . . . 1709

timers pacing flood . . . . . . . . . . . . . . . . 1710

timers pacing lsa-group . . . . . . . . . . . . . 1711

timers spf . . . . . . . . . . . . . . . . . . . . . 1712

OSPFv3 Commands . . . . . . . . . . . . . . . . . . . . . . . . . . .1713

area default-cost (Router OSPFv3) . . . . . . . . 1714

area nssa (Router OSPFv3) . . . . . . . . . . . . 1715

area nssa default-info-originate (Router OSPFv3 Config) 1716

area nssa no-redistribute. . . . . . . . . . . . . 1717

area nssa no-summary . . . . . . . . . . . . . . 1718

area nssa translator-role . . . . . . . . . . . . . 1719

area nssa translator-stab-intv . . . . . . . . . . 1720

area range (Router OSPFv3) . . . . . . . . . . . 1721

area stub . . . . . . . . . . . . . . . . . . . . . 1722

area stub no-summary . . . . . . . . . . . . . . 1723

area virtual-link . . . . . . . . . . . . . . . . . . 1723

area virtual-link dead-interval . . . . . . . . . . 1725

Contents 69

area virtual-link hello-interval . . . . . . . . . . 1726

area virtual-link retransmit-interval . . . . . . . 1727

area virtual-link transmit-delay. . . . . . . . . . 1728

default-information originate (Router OSPFv3 Configuration)

1728

default-metric. . . . . . . . . . . . . . . . . . . 1729

distance ospf . . . . . . . . . . . . . . . . . . . 1730

enable. . . . . . . . . . . . . . . . . . . . . . . 1731

exit-overflow-interval. . . . . . . . . . . . . . . 1732

external-lsdb-limit . . . . . . . . . . . . . . . . 1733

ipv6 ospf . . . . . . . . . . . . . . . . . . . . . 1733

ipv6 ospf area. . . . . . . . . . . . . . . . . . . 1734

ipv6 ospf cost . . . . . . . . . . . . . . . . . . . 1735

ipv6 ospf dead-interval . . . . . . . . . . . . . . 1736

ipv6 ospf hello-interval . . . . . . . . . . . . . . 1736

ipv6 ospf mtu-ignore . . . . . . . . . . . . . . . 1737

ipv6 ospf network . . . . . . . . . . . . . . . . . 1738

ipv6 ospf priority . . . . . . . . . . . . . . . . . 1739

ipv6 ospf retransmit-interval . . . . . . . . . . . 1740

ipv6 ospf transmit-delay . . . . . . . . . . . . . 1741

ipv6 router ospf . . . . . . . . . . . . . . . . . . 1741

maximum-paths. . . . . . . . . . . . . . . . . . 1742

Contents 70

nsf. . . . . . . . . . . . . . . . . . . . . . . . . 1743

nsf helper . . . . . . . . . . . . . . . . . . . . . 1744

nsf helper strict-lsa-checking . . . . . . . . . . 1745

nsf restart-interval . . . . . . . . . . . . . . . . 1745

passive-interface . . . . . . . . . . . . . . . . . 1746

passive-interface default . . . . . . . . . . . . . 1747

redistribute (OSPFv3) . . . . . . . . . . . . . . . 1748

router-id. . . . . . . . . . . . . . . . . . . . . . 1749

show ipv6 ospf . . . . . . . . . . . . . . . . . . 1749

show ipv6 ospf abr . . . . . . . . . . . . . . . . 1753

show ipv6 ospf area . . . . . . . . . . . . . . . 1754

show ipv6 ospf asbr . . . . . . . . . . . . . . . 1755

show ipv6 ospf border-routers . . . . . . . . . . 1755

show ipv6 ospf database . . . . . . . . . . . . . 1756

show ipv6 ospf database database-summary . . 1758

show ipv6 ospf interface . . . . . . . . . . . . . 1759

show ipv6 ospf interface brief . . . . . . . . . . 1760

show ipv6 ospf interface stats . . . . . . . . . . 1761

show ipv6 ospf interface vlan . . . . . . . . . . 1762

show ipv6 ospf neighbor . . . . . . . . . . . . . 1763

show ipv6 ospf range . . . . . . . . . . . . . . . 1764

Contents 71

show ipv6 ospf stub table. . . . . . . . . . . . . 1765

show ipv6 ospf virtual-links. . . . . . . . . . . . 1766

show ipv6 ospf virtual-link brief . . . . . . . . . 1767

Router Discovery Protocol Commands . . . . . . . . . .1768

Commands in this Section . . . . . . . . . . . . 1768

ip irdp . . . . . . . . . . . . . . . . . . . . . . . 1768

ip irdp holdtime . . . . . . . . . . . . . . . . . . 1770

ip irdp maxadvertinterval . . . . . . . . . . . . . 1771

ip irdp minadvertinterval . . . . . . . . . . . . . 1772

ip irdp multicast. . . . . . . . . . . . . . . . . . 1773

ip irdp preference. . . . . . . . . . . . . . . . . 1773

show ip irdp. . . . . . . . . . . . . . . . . . . . 1774

Routing Information Protocol Commands . . . . . . .1776

Commands in this Section . . . . . . . . . . . . 1776

auto-summary . . . . . . . . . . . . . . . . . . 1776

default-information originate (Router RIP Configuration) 1777

default-metric. . . . . . . . . . . . . . . . . . . 1778

distance rip . . . . . . . . . . . . . . . . . . . . 1779

distribute-list out . . . . . . . . . . . . . . . . . 1779

enable. . . . . . . . . . . . . . . . . . . . . . . 1780

hostroutesaccept . . . . . . . . . . . . . . . . . 1781

ip rip. . . . . . . . . . . . . . . . . . . . . . . . 1782

Contents 72

ip rip authentication . . . . . . . . . . . . . . . 1782

ip rip receive version . . . . . . . . . . . . . . . 1783

ip rip send version . . . . . . . . . . . . . . . . 1784

redistribute (RIP) . . . . . . . . . . . . . . . . . 1785

router rip . . . . . . . . . . . . . . . . . . . . . 1786

show ip rip . . . . . . . . . . . . . . . . . . . . 1787

show ip rip interface . . . . . . . . . . . . . . . 1788

show ip rip interface brief . . . . . . . . . . . . 1789

split-horizon. . . . . . . . . . . . . . . . . . . . 1790

Tunnel Interface Commands . . . . . . . . . . . . . . . . . .1791

Commands in this Section . . . . . . . . . . . . 1791

interface tunnel . . . . . . . . . . . . . . . . . . 1791

show interfaces tunnel . . . . . . . . . . . . . . 1792

tunnel destination. . . . . . . . . . . . . . . . . 1793

tunnel mode ipv6ip . . . . . . . . . . . . . . . . 1794

tunnel source . . . . . . . . . . . . . . . . . . . 1794

Virtual Router Commands . . . . . . . . . . . . . . . . . . . . .1796

Commands in this Section . . . . . . . . . . . . 1797

description . . . . . . . . . . . . . . . . . . . . 1798

ip vrf. . . . . . . . . . . . . . . . . . . . . . . . 1799

ip vrf forwarding . . . . . . . . . . . . . . . . . 1800

maximum routes . . . . . . . . . . . . . . . . . 1801

Contents 73

show ip vrf . . . . . . . . . . . . . . . . . . . . 1802

Virtual Router Redundancy Protocol Commands .1805

Pingable VRRP Interface . . . . . . . . . . . . . 1805

VRRP Route/Interface Tracking . . . . . . . . . 1806

Interface Tracking . . . . . . . . . . . . . . . . 1807

Route Tracking . . . . . . . . . . . . . . . . . . 1807

Commands in this Section . . . . . . . . . . . . 1807

ip vrrp . . . . . . . . . . . . . . . . . . . . . . . 1808

vrrp accept-mode. . . . . . . . . . . . . . . . . 1808

vrrp authentication . . . . . . . . . . . . . . . . 1809

vrrp description . . . . . . . . . . . . . . . . . . 1810

vrrp ip . . . . . . . . . . . . . . . . . . . . . . . 1811

vrrp mode . . . . . . . . . . . . . . . . . . . . . 1812

vrrp preempt . . . . . . . . . . . . . . . . . . . 1813

vrrp priority . . . . . . . . . . . . . . . . . . . . 1814

vrrp timers advertise . . . . . . . . . . . . . . . 1814

vrrp timers learn . . . . . . . . . . . . . . . . . 1815

vrrp track interface . . . . . . . . . . . . . . . . 1816

vrrp track ip route. . . . . . . . . . . . . . . . . 1817

show vrrp . . . . . . . . . . . . . . . . . . . . . 1818

show vrrp interface. . . . . . . . . . . . . . . . 1820

Contents 74

8 Switch Management Commands . . . . . 1823

Application Deployment . . . . . . . . . . . . . . . . . . . . . .1824

Commands in this Section . . . . . . . . . . . . 1824

application install . . . . . . . . . . . . . . . . . 1824

application start . . . . . . . . . . . . . . . . . 1825

application stop. . . . . . . . . . . . . . . . . . 1826

show application . . . . . . . . . . . . . . . . . 1827

Auto-Install Commands . . . . . . . . . . . . . . . . . . . . . . .1829

Commands in this Section . . . . . . . . . . . . 1830

boot auto-copy-sw . . . . . . . . . . . . . . . . 1830

boot auto-copy-sw allow-downgrade . . . . . . 1831

boot host auto-reboot . . . . . . . . . . . . . . 1832

boot host auto-save . . . . . . . . . . . . . . . 1832

boot host dhcp . . . . . . . . . . . . . . . . . . 1833

boot host retry-count . . . . . . . . . . . . . . . 1834

show auto-copy-sw . . . . . . . . . . . . . . . 1835

show boot. . . . . . . . . . . . . . . . . . . . . 1835

CLI Macro Commands . . . . . . . . . . . . . . . . . . . . . . . .1837

Commands in this Section . . . . . . . . . . . . 1838

macro name . . . . . . . . . . . . . . . . . . . 1838

macro global apply . . . . . . . . . . . . . . . . 1840

macro global trace . . . . . . . . . . . . . . . . 1840

Contents 75

macro global description . . . . . . . . . . . . . 1841

macro apply. . . . . . . . . . . . . . . . . . . . 1842

macro trace. . . . . . . . . . . . . . . . . . . . 1842

macro description . . . . . . . . . . . . . . . . 1843

show parser macro . . . . . . . . . . . . . . . . 1844

Clock Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . .1845

Real-time Clock . . . . . . . . . . . . . . . . . . 1845

Simple Network Time Protocol . . . . . . . . . . 1845

Commands in this Section . . . . . . . . . . . . 1846

show sntp configuration . . . . . . . . . . . . . 1846

show sntp server . . . . . . . . . . . . . . . . . 1847

show sntp status . . . . . . . . . . . . . . . . . 1848

sntp authenticate . . . . . . . . . . . . . . . . . 1849

sntp authentication-key . . . . . . . . . . . . . 1850

sntp broadcast client enable . . . . . . . . . . . 1851

sntp client poll timer . . . . . . . . . . . . . . . 1851

sntp server . . . . . . . . . . . . . . . . . . . . 1852

sntp source-interface . . . . . . . . . . . . . . 1853

sntp trusted-key . . . . . . . . . . . . . . . . . 1854

sntp unicast client enable . . . . . . . . . . . . 1855

clock set . . . . . . . . . . . . . . . . . . . . . 1856

Contents 76

clock timezone hours-offset . . . . . . . . . . . 1856

no clock timezone . . . . . . . . . . . . . . . . 1857

clock summer-time recurring . . . . . . . . . . 1858

clock summer-time date . . . . . . . . . . . . . 1859

no clock summer-time . . . . . . . . . . . . . . 1860

show clock . . . . . . . . . . . . . . . . . . . . 1860

Command Line Configuration Scripting Commands 1862

Commands in this Section . . . . . . . . . . . . 1862

script apply . . . . . . . . . . . . . . . . . . . . 1862

script delete . . . . . . . . . . . . . . . . . . . 1863

script list . . . . . . . . . . . . . . . . . . . . . 1864

script show . . . . . . . . . . . . . . . . . . . . 1864

script validate. . . . . . . . . . . . . . . . . . . 1865

Configuration and Image File Commands . . . . . . .1867

File System Commands . . . . . . . . . . . . . . 1867

Command Line Interface Scripting . . . . . . . . 1867

Commands in this Section . . . . . . . . . . . . 1867

boot system . . . . . . . . . . . . . . . . . . . . 1868

clear config . . . . . . . . . . . . . . . . . . . . 1869

copy. . . . . . . . . . . . . . . . . . . . . . . . 1869

delete . . . . . . . . . . . . . . . . . . . . . . . 1879

dir . . . . . . . . . . . . . . . . . . . . . . . . . 1879

Contents 77

erase . . . . . . . . . . . . . . . . . . . . . . . 1880

filedescr. . . . . . . . . . . . . . . . . . . . . . 1881

rename . . . . . . . . . . . . . . . . . . . . . . 1882

show backup-config . . . . . . . . . . . . . . . 1883

show bootvar . . . . . . . . . . . . . . . . . . . 1884

show running-config . . . . . . . . . . . . . . . 1885

show startup-config . . . . . . . . . . . . . . . 1886

write. . . . . . . . . . . . . . . . . . . . . . . . 1887

DHCP Client Commands . . . . . . . . . . . . . . . . . . . . . .1889

Commands in this Section . . . . . . . . . . . . 1889

release dhcp . . . . . . . . . . . . . . . . . . . 1890

renew dhcp . . . . . . . . . . . . . . . . . . . . 1890

show dhcp lease . . . . . . . . . . . . . . . . . 1892

DHCP Server Commands . . . . . . . . . . . . . . . . . . . . . .1894

Commands in this Section . . . . . . . . . . . . 1895

ip dhcp pool. . . . . . . . . . . . . . . . . . . . 1895

bootfile . . . . . . . . . . . . . . . . . . . . . . 1898

clear ip dhcp binding . . . . . . . . . . . . . . . 1898

clear ip dhcp conflict . . . . . . . . . . . . . . . 1899

client-identifier . . . . . . . . . . . . . . . . . . 1900

client-name . . . . . . . . . . . . . . . . . . . . 1900

default-router . . . . . . . . . . . . . . . . . . . 1901

Contents 78

dns-server (IP DHCP Pool Config) . . . . . . . . 1902

domain-name (IP DHCP Pool Config) . . . . . . . 1903

hardware-address . . . . . . . . . . . . . . . . 1903

host . . . . . . . . . . . . . . . . . . . . . . . . 1904

ip dhcp bootp automatic . . . . . . . . . . . . . 1905

ip dhcp conflict logging . . . . . . . . . . . . . . 1906

ip dhcp excluded-address . . . . . . . . . . . . 1906

ip dhcp ping packets . . . . . . . . . . . . . . . 1907

lease . . . . . . . . . . . . . . . . . . . . . . . 1908

netbios-name-server . . . . . . . . . . . . . . . 1909

netbios-node-type . . . . . . . . . . . . . . . . 1910

network . . . . . . . . . . . . . . . . . . . . . . 1911

next-server . . . . . . . . . . . . . . . . . . . . 1911

option . . . . . . . . . . . . . . . . . . . . . . . 1912

service dhcp . . . . . . . . . . . . . . . . . . . 1917

sntp . . . . . . . . . . . . . . . . . . . . . . . . 1917

show ip dhcp binding . . . . . . . . . . . . . . . 1918

show ip dhcp conflict . . . . . . . . . . . . . . . 1919

show ip dhcp global configuration . . . . . . . . 1919

show ip dhcp pool. . . . . . . . . . . . . . . . . 1920

show ip dhcp server statistics . . . . . . . . . . 1920

Contents 79

DHCPv6 Server Commands . . . . . . . . . . . . . . . . . . . .1922

clear ipv6 dhcp . . . . . . . . . . . . . . . . . . 1922

dns-server (IPv6 DHCP Pool Config) . . . . . . . 1923

domain-name (IPv6 DHCP Pool Config) . . . . . 1923

ipv6 dhcp pool . . . . . . . . . . . . . . . . . . 1924

ipv6 dhcp relay . . . . . . . . . . . . . . . . . . 1925

ipv6 dhcp server . . . . . . . . . . . . . . . . . 1926

prefix-delegation . . . . . . . . . . . . . . . . . 1928

service dhcpv6 . . . . . . . . . . . . . . . . . . 1929

show ipv6 dhcp . . . . . . . . . . . . . . . . . . 1930

show ipv6 dhcp binding. . . . . . . . . . . . . . 1930

show ipv6 dhcp interface (User Exec) . . . . . . 1931

show ipv6 dhcp interface (Privileged Exec) . . . 1932

show ipv6 dhcp pool . . . . . . . . . . . . . . . 1935

show ipv6 dhcp statistics. . . . . . . . . . . . . 1936

HiveAgent Commands . . . . . . . . . . . . . . . . . . . . . . . .1938

Commands in this Section . . . . . . . . . . . . 1938

eula-consent . . . . . . . . . . . . . . . . . . . 1938

hiveagent . . . . . . . . . . . . . . . . . . . . . 1939

server . . . . . . . . . . . . . . . . . . . . . . . 1940

enable. . . . . . . . . . . . . . . . . . . . . . . 1941

proxy-ip-address . . . . . . . . . . . . . . . . . 1942

Contents 80

url . . . . . . . . . . . . . . . . . . . . . . . . . 1943

show hiveagent status . . . . . . . . . . . . . . 1944

show eula-consent hiveagent . . . . . . . . . . 1945

IP Addressing Commands . . . . . . . . . . . . . . . . . . . . .1947

Commands in this Section . . . . . . . . . . . . 1947

clear host . . . . . . . . . . . . . . . . . . . . . 1948

clear ip address-conflict-detect . . . . . . . . . 1948

interface out-of-band. . . . . . . . . . . . . . . 1949

ip address. . . . . . . . . . . . . . . . . . . . . 1950

ip address (Out-of-Band) . . . . . . . . . . . . . 1951

ip address-conflict-detect run . . . . . . . . . . 1952

ip address dhcp (Interface Configuration) . . . . 1953

ip default-gateway . . . . . . . . . . . . . . . . 1954

ip domain-lookup . . . . . . . . . . . . . . . . . 1956

ip domain-name. . . . . . . . . . . . . . . . . . 1956

ip host. . . . . . . . . . . . . . . . . . . . . . . 1957

ip name-server . . . . . . . . . . . . . . . . . . 1958

ip name-server source-interface. . . . . . . . . 1959

ipv6 address (Interface Configuration) . . . . . . 1960

ipv6 address (OOB Port) . . . . . . . . . . . . . 1962

ipv6 address dhcp . . . . . . . . . . . . . . . . 1963

Contents 81

ipv6 enable (Interface Configuration) . . . . . . 1964

ipv6 enable (OOB Configuration) . . . . . . . . . 1965

ipv6 gateway (OOB Configuration) . . . . . . . . 1965

show hosts . . . . . . . . . . . . . . . . . . . . 1966

show ip address-conflict . . . . . . . . . . . . . 1967

show ip helper-address . . . . . . . . . . . . . 1968

show ipv6 dhcp interface out-of-band statistics. 1969

show ipv6 interface out-of-band . . . . . . . . . 1970

Line Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1972

accounting . . . . . . . . . . . . . . . . . . . . 1972

authorization . . . . . . . . . . . . . . . . . . . 1973

enable authentication . . . . . . . . . . . . . . 1974

exec-banner . . . . . . . . . . . . . . . . . . . 1975

exec-timeout . . . . . . . . . . . . . . . . . . . 1976

history. . . . . . . . . . . . . . . . . . . . . . . 1977

history size . . . . . . . . . . . . . . . . . . . . 1977

line . . . . . . . . . . . . . . . . . . . . . . . . 1978

motd-banner . . . . . . . . . . . . . . . . . . . 1981

password (Line Configuration) . . . . . . . . . . 1981

Contents 82

show line . . . . . . . . . . . . . . . . . . . . . 1982

speed . . . . . . . . . . . . . . . . . . . . . . . 1983

terminal length . . . . . . . . . . . . . . . . . . 1984

PHY Diagnostics Commands . . . . . . . . . . . . . . . . . .1986

show copper-ports tdr . . . . . . . . . . . . . . 1986

show fiber-ports optical-transceiver. . . . . . . 1987

test copper-port tdr. . . . . . . . . . . . . . . . 1988

Power Over Ethernet Commands . . . . . . . . . . . . . . .1990

Flexible Power Management . . . . . . . . . . . 1990

Commands in this Section . . . . . . . . . . . . 1991

power inline. . . . . . . . . . . . . . . . . . . . 1991

power inline detection . . . . . . . . . . . . . . 1992

power inline four-pair forced. . . . . . . . . . . 1993

power inline limit . . . . . . . . . . . . . . . . . 1994

power inline management . . . . . . . . . . . . 1997

power inline powered-device . . . . . . . . . . 1998

power inline priority . . . . . . . . . . . . . . . 1999

power inline reset . . . . . . . . . . . . . . . . 2000

power inline usage-threshold . . . . . . . . . . 2000

clear power inline statistics . . . . . . . . . . . 2001

show power inline . . . . . . . . . . . . . . . . 2002

show power inline firmware-version. . . . . . . 2004

Contents 83

RMON Commands . . . . . . . . . . . . . . . . . . . . . . . . . . .2005

Commands in this Section . . . . . . . . . . . . 2005

rmon alarm . . . . . . . . . . . . . . . . . . . . 2005

rmon collection history . . . . . . . . . . . . . . 2007

rmon event . . . . . . . . . . . . . . . . . . . . 2008

rmon hcalarm . . . . . . . . . . . . . . . . . . . 2009

show rmon alarm . . . . . . . . . . . . . . . . . 2011

show rmon alarms . . . . . . . . . . . . . . . . 2013

show rmon collection history. . . . . . . . . . . 2014

show rmon events . . . . . . . . . . . . . . . . 2015

show rmon hcalarm . . . . . . . . . . . . . . . 2016

show rmon history . . . . . . . . . . . . . . . . 2017

show rmon log . . . . . . . . . . . . . . . . . . 2020

show rmon statistics . . . . . . . . . . . . . . . 2021

Serviceability Commands . . . . . . . . . . . . . . . . . . . . .2025

Commands in this Section . . . . . . . . . . . . 2025

debug aaa accounting . . . . . . . . . . . . . . 2026

debug arp . . . . . . . . . . . . . . . . . . . . . 2027

debug authentication interface. . . . . . . . . . 2028

debug auto-voip . . . . . . . . . . . . . . . . . 2029

debug bfd . . . . . . . . . . . . . . . . . . . . . 2029

debug cfm. . . . . . . . . . . . . . . . . . . . . 2030

Contents 84

debug clear . . . . . . . . . . . . . . . . . . . . 2031

debug console . . . . . . . . . . . . . . . . . . 2032

debug crashlog . . . . . . . . . . . . . . . . . . 2032

debug dhcp packet . . . . . . . . . . . . . . . . 2035

debug dhcp server packet . . . . . . . . . . . . 2036

debug dot1ag . . . . . . . . . . . . . . . . . . . 2037

debug dot1x. . . . . . . . . . . . . . . . . . . . 2038

debug igmpsnooping . . . . . . . . . . . . . . . 2039

debug ip acl. . . . . . . . . . . . . . . . . . . . 2040

debug ip bgp . . . . . . . . . . . . . . . . . . . 2040

debug ip dvmrp . . . . . . . . . . . . . . . . . . 2042

debug ip igmp. . . . . . . . . . . . . . . . . . . 2043

debug ip mcache . . . . . . . . . . . . . . . . . 2044

debug ip pimdm packet. . . . . . . . . . . . . . 2044

debug ip pimsm packet . . . . . . . . . . . . . . 2045

debug ipv6 dhcp . . . . . . . . . . . . . . . . . 2046

debug ipv6 mcache . . . . . . . . . . . . . . . . 2047

debug ipv6 mld . . . . . . . . . . . . . . . . . . 2047

debug ipv6 pimdm . . . . . . . . . . . . . . . . 2048

debug ipv6 pimsm. . . . . . . . . . . . . . . . . 2049

debug isdp . . . . . . . . . . . . . . . . . . . . 2050

Contents 85

debug lacp . . . . . . . . . . . . . . . . . . . . 2051

debug mldsnooping. . . . . . . . . . . . . . . . 2051

debug ospf . . . . . . . . . . . . . . . . . . . . 2052

debug ospfv3 . . . . . . . . . . . . . . . . . . . 2053

debug ping . . . . . . . . . . . . . . . . . . . . 2054

debug rip . . . . . . . . . . . . . . . . . . . . . 2055

debug sflow. . . . . . . . . . . . . . . . . . . . 2055

debug spanning-tree . . . . . . . . . . . . . . . 2056

debug udld . . . . . . . . . . . . . . . . . . . . 2057

debug vpc . . . . . . . . . . . . . . . . . . . . 2058

debug vrrp . . . . . . . . . . . . . . . . . . . . 2059

exception core-file . . . . . . . . . . . . . . . . 2059

exception dump. . . . . . . . . . . . . . . . . . 2060

exception protocol . . . . . . . . . . . . . . . . 2062

exception switch-chip-register . . . . . . . . . 2065

ip http timeout-policy . . . . . . . . . . . . . . . 2065

show debugging . . . . . . . . . . . . . . . . . 2066

show supported mibs. . . . . . . . . . . . . . . 2069

snapshot bgp . . . . . . . . . . . . . . . . . . . 2074

write core . . . . . . . . . . . . . . . . . . . . . 2075

Sflow Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . .2077

Contents 86

Commands in this Section . . . . . . . . . . . . 2077

sflow destination . . . . . . . . . . . . . . . . . 2077

sflow polling . . . . . . . . . . . . . . . . . . . 2079

sflow polling (Interface Mode) . . . . . . . . . . 2080

sflow sampling . . . . . . . . . . . . . . . . . . 2081

sflow sampling (Interface Mode). . . . . . . . . 2082

sflow source-interface . . . . . . . . . . . . . . 2083

show sflow agent . . . . . . . . . . . . . . . . . 2084

show sflow destination . . . . . . . . . . . . . . 2085

show sflow polling . . . . . . . . . . . . . . . . 2086

show sflow sampling . . . . . . . . . . . . . . . 2087

show sflow source-interface. . . . . . . . . . . 2088

SNMP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . .2090

Commands in this Section . . . . . . . . . . . . 2090

show snmp . . . . . . . . . . . . . . . . . . . . 2090

show snmp engineid . . . . . . . . . . . . . . . 2092

show snmp filters . . . . . . . . . . . . . . . . . 2092

show snmp group. . . . . . . . . . . . . . . . . 2093

show snmp user . . . . . . . . . . . . . . . . . 2095

show snmp views. . . . . . . . . . . . . . . . . 2096

show trapflags . . . . . . . . . . . . . . . . . . 2097

Contents 87

snmp-server community . . . . . . . . . . . . . 2098

snmp-server community-group. . . . . . . . . . 2100

snmp-server contact . . . . . . . . . . . . . . . 2101

snmp-server enable traps . . . . . . . . . . . . 2102

snmp-server engineID local . . . . . . . . . . . 2105

snmp-server filter. . . . . . . . . . . . . . . . . 2106

snmp-server group . . . . . . . . . . . . . . . . 2108

snmp-server host . . . . . . . . . . . . . . . . . 2109

snmp-server location . . . . . . . . . . . . . . . 2111

snmp-server user . . . . . . . . . . . . . . . . . 2111

snmp-server view. . . . . . . . . . . . . . . . . 2114

snmp-server v3-host . . . . . . . . . . . . . . . 2115

snmp-server source-interface . . . . . . . . . . 2117

SupportAssist Commands . . . . . . . . . . . . . . . . . . . . .2119

Commands in this Section . . . . . . . . . . . . 2119

eula-consent . . . . . . . . . . . . . . . . . . . 2119

contact-company . . . . . . . . . . . . . . . . . 2121

contact-person . . . . . . . . . . . . . . . . . . 2122

enable. . . . . . . . . . . . . . . . . . . . . . . 2123

proxy-ip-address . . . . . . . . . . . . . . . . . 2124

server . . . . . . . . . . . . . . . . . . . . . . . 2125

Contents 88

show eula-consent support-assist . . . . . . . . 2126

show support-assist status. . . . . . . . . . . . 2128

support-assist. . . . . . . . . . . . . . . . . . . 2129

url . . . . . . . . . . . . . . . . . . . . . . . . . 2130

SYSLOG Commands . . . . . . . . . . . . . . . . . . . . . . . . . .2132

CLI Logged to Local File and SYSLOG Server . . 2132

Commands in this Section . . . . . . . . . . . . 2133

clear logging . . . . . . . . . . . . . . . . . . . 2133

clear logging file . . . . . . . . . . . . . . . . . 2134

description (Logging) . . . . . . . . . . . . . . . 2135

level . . . . . . . . . . . . . . . . . . . . . . . . 2135

logging cli-command . . . . . . . . . . . . . . . 2136

logging . . . . . . . . . . . . . . . . . . . . . . 2138

logging audit . . . . . . . . . . . . . . . . . . . 2140

logging buffered . . . . . . . . . . . . . . . . . 2140

logging console . . . . . . . . . . . . . . . . . . 2142

logging facility . . . . . . . . . . . . . . . . . . 2143

logging file . . . . . . . . . . . . . . . . . . . . 2143

logging monitor . . . . . . . . . . . . . . . . . . 2145

logging on. . . . . . . . . . . . . . . . . . . . . 2146

logging protocol . . . . . . . . . . . . . . . . . 2146

Contents 89

logging snmp . . . . . . . . . . . . . . . . . . . 2148

logging source-interface . . . . . . . . . . . . . 2149

logging traps . . . . . . . . . . . . . . . . . . . 2150

logging web-session . . . . . . . . . . . . . . . 2151

port . . . . . . . . . . . . . . . . . . . . . . . . 2152

show logging . . . . . . . . . . . . . . . . . . . 2153

show logging file . . . . . . . . . . . . . . . . . 2154

show syslog-servers . . . . . . . . . . . . . . . 2154

terminal monitor . . . . . . . . . . . . . . . . . 2155

System and Stack Management Commands . . . . .2157

asset-tag . . . . . . . . . . . . . . . . . . . . . 2158

banner exec . . . . . . . . . . . . . . . . . . . 2159

banner login . . . . . . . . . . . . . . . . . . . 2159

banner motd . . . . . . . . . . . . . . . . . . . 2160

banner motd acknowledge . . . . . . . . . . . . 2161

buffers . . . . . . . . . . . . . . . . . . . . . . 2163

clear checkpoint statistics . . . . . . . . . . . . 2165

clear counters stack-ports . . . . . . . . . . . . 2165

connect . . . . . . . . . . . . . . . . . . . . . . 2166

cut-through mode. . . . . . . . . . . . . . . . . 2167

disconnect . . . . . . . . . . . . . . . . . . . . 2168

Contents 90

exit . . . . . . . . . . . . . . . . . . . . . . . . 2169

hardware profile portmode . . . . . . . . . . . . 2170

hostname . . . . . . . . . . . . . . . . . . . . . 2171

initiate failover . . . . . . . . . . . . . . . . . . 2172

load-interval . . . . . . . . . . . . . . . . . . . 2173

locate . . . . . . . . . . . . . . . . . . . . . . . 2174

logout . . . . . . . . . . . . . . . . . . . . . . . 2175

member . . . . . . . . . . . . . . . . . . . . . . 2176

memory free low-watermark . . . . . . . . . . . 2177

nsf. . . . . . . . . . . . . . . . . . . . . . . . . 2178

ping . . . . . . . . . . . . . . . . . . . . . . . . 2178

process cpu threshold . . . . . . . . . . . . . . 2182

quit . . . . . . . . . . . . . . . . . . . . . . . . 2183

reload . . . . . . . . . . . . . . . . . . . . . . . 2184

service unsupported-transceiver . . . . . . . . 2186

set description . . . . . . . . . . . . . . . . . . 2186

slot . . . . . . . . . . . . . . . . . . . . . . . . 2187

show banner . . . . . . . . . . . . . . . . . . . 2189

show buffers . . . . . . . . . . . . . . . . . . . 2190

show checkpoint statistics . . . . . . . . . . . . 2191

show cut-through mode . . . . . . . . . . . . . 2192

Contents 91

show hardware profile . . . . . . . . . . . . . . 2192

show idprom interface . . . . . . . . . . . . . . 2193

show interfaces. . . . . . . . . . . . . . . . . . 2194

show interfaces advanced firmware. . . . . . . 2196

show interfaces utilization . . . . . . . . . . . . 2197

show memory cpu . . . . . . . . . . . . . . . . 2200

show nsf . . . . . . . . . . . . . . . . . . . . . 2201

show power-usage-history. . . . . . . . . . . . 2203

show process app-list . . . . . . . . . . . . . . 2204

show process app-resource-list . . . . . . . . . 2206

show process cpu . . . . . . . . . . . . . . . . 2207

show process proc-list . . . . . . . . . . . . . . 2208

show sessions . . . . . . . . . . . . . . . . . . 2210

show slot . . . . . . . . . . . . . . . . . . . . . 2211

show supported cardtype . . . . . . . . . . . . 2213

show supported switchtype . . . . . . . . . . . 2215

show switch . . . . . . . . . . . . . . . . . . . 2217

show system . . . . . . . . . . . . . . . . . . . 2222

show system fan . . . . . . . . . . . . . . . . . 2224

show system id . . . . . . . . . . . . . . . . . . 2225

show system power . . . . . . . . . . . . . . . 2225

Contents 92

show system temperature . . . . . . . . . . . . 2226

show tech-support . . . . . . . . . . . . . . . . 2228

show users . . . . . . . . . . . . . . . . . . . . 2231

show version . . . . . . . . . . . . . . . . . . . 2232

stack . . . . . . . . . . . . . . . . . . . . . . . 2233

stack-port . . . . . . . . . . . . . . . . . . . . . 2234

stack-port shutdown . . . . . . . . . . . . . . . 2236

standby . . . . . . . . . . . . . . . . . . . . . . 2237

switch renumber . . . . . . . . . . . . . . . . . 2238

telnet . . . . . . . . . . . . . . . . . . . . . . . 2239

traceroute. . . . . . . . . . . . . . . . . . . . . 2240

traceroute ipv6 . . . . . . . . . . . . . . . . . . 2242

update bootcode . . . . . . . . . . . . . . . . . 2244

Telnet Server Commands . . . . . . . . . . . . . . . . . . . . .2246

Telnet Client Behaviors. . . . . . . . . . . . . . 2246

Commands in this Section . . . . . . . . . . . . 2248

ip telnet server disable . . . . . . . . . . . . . . 2248

ip telnet port . . . . . . . . . . . . . . . . . . . 2249

show ip telnet. . . . . . . . . . . . . . . . . . . 2249

Time Ranges Commands . . . . . . . . . . . . . . . . . . . . . .2251

time-range [name] . . . . . . . . . . . . . . . . 2251

absolute. . . . . . . . . . . . . . . . . . . . . . 2252

Contents 93

periodic . . . . . . . . . . . . . . . . . . . . . . 2253

show time-range . . . . . . . . . . . . . . . . . 2255

USB Flash Drive Commands . . . . . . . . . . . . . . . . . . .2257

Validation of Files Downloaded/Uploaded from USB Device 2257

Validation for Files Uploaded from Switch to USB Flash Drive

2257

Downloading and Uploading of Files . . . . . . . 2258

Commands in this Section . . . . . . . . . . . . 2258

unmount usb . . . . . . . . . . . . . . . . . . . 2258

show usb . . . . . . . . . . . . . . . . . . . . . 2259

dir usb. . . . . . . . . . . . . . . . . . . . . . . 2260

User Interface Commands . . . . . . . . . . . . . . . . . . . .2263

configure terminal . . . . . . . . . . . . . . . . 2263

do . . . . . . . . . . . . . . . . . . . . . . . . . 2263

enable. . . . . . . . . . . . . . . . . . . . . . . 2265

end . . . . . . . . . . . . . . . . . . . . . . . . 2266

exit . . . . . . . . . . . . . . . . . . . . . . . . 2267

quit . . . . . . . . . . . . . . . . . . . . . . . . 2267

Web Server Commands . . . . . . . . . . . . . . . . . . . . . . .2269

Web Sessions. . . . . . . . . . . . . . . . . . . 2269

Commands in this Section . . . . . . . . . . . . 2270

common-name . . . . . . . . . . . . . . . . . . 2270

Contents 94

country . . . . . . . . . . . . . . . . . . . . . . 2271

crypto certificate generate . . . . . . . . . . . . 2272

crypto certificate import . . . . . . . . . . . . . 2274

crypto certificate request . . . . . . . . . . . . 2276

duration . . . . . . . . . . . . . . . . . . . . . . 2277

ip http port . . . . . . . . . . . . . . . . . . . . 2278

ip http server . . . . . . . . . . . . . . . . . . . 2279

ip http secure-certificate . . . . . . . . . . . . . 2280

ip http secure-port . . . . . . . . . . . . . . . . 2280

ip http secure-server . . . . . . . . . . . . . . . 2281

key-generate . . . . . . . . . . . . . . . . . . . 2282

location . . . . . . . . . . . . . . . . . . . . . . 2283

no crypto certificate . . . . . . . . . . . . . . . 2283

organization-unit . . . . . . . . . . . . . . . . . 2284

show crypto certificate mycertificate . . . . . . 2285

show ip http server status . . . . . . . . . . . . 2286

show ip http server secure status . . . . . . . . 2287

state. . . . . . . . . . . . . . . . . . . . . . . . 2288

A Appendix A: List of Commands . . . . . . 2289

Dell EMC Networking CLI 95

Dell EMC Networking CLI

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Introduction

The Command Line Interface (CLI) is a network management application

operated through an ASCII terminal without the use of a Graphic User

Interface (GUI) driven software application. By directly entering commands,

the user has greater configuration flexibility. The CLI is a basic command-line

interpreter with command-line completion, in-line syntax help, and prior

command recall.

A switch can be configured and maintained by entering commands from the

CLI, which is based solely on textual input and output with commands being

entered by a terminal keyboard and the output displayed as text via a terminal

monitor. The CLI can be accessed from a console terminal connected to an

RS-232 port or through a Telnet/SSH session. Serial communication via a

dedicated USB port is available on the N1100-ON Series switch.

This guide describes how the CLI is structured, describes the command

syntax, and describes the command functionality.

This guide also provides guidelines for configuring the Dell EMC Networking

switch, and provides limited configuration examples. Basic installation is

described in the User’s Guide and must be completed before using this

document.

This document applies to the following switch firmware versions:

• Version 6.3.0.x—N2000, N3000, and N4000 Series switches

• Version 6.3.5.x—N3100-ON Series switches

• Version 6.3.6.x—N2100-ON, and N3100-ON Series switches

• Version 6.4.x.x—N1100-ON Series switches

Dell EMC Networking CLI 96

Command Groups

The system commands can be broken down into three sets of functional

groups: Layer 2, Layer 3, and Utility.

Table 1-1. System Command Groups

Command Group Description

Layer 2 Commands

ACL

Configures and displays ACL information.

Address Table

Configures bridging address tables.

Auto-VoIP

Configures Auto VoIP for IP phones on a switch.

CDP Interoperability

Configures Cisco® Discovery Protocol (CDP).

DHCP L2 Relay

Enables the Layer 2 DHCP Relay agent for an interface.

DHCP Snooping

Configures DHCP snooping and displays DHCP

Snooping information.

Dynamic ARP Inspection

Configures for rejection of invalid and malicious ARP

packets.

Ethernet Configuration

Configures all port configuration options for example

ports, storm control, port speed and auto-negotiation.

Ethernet CFM

Configures and displays GVRP configuration and

information.

Green Ethernet

Configures Green Ethernet and displays Green Ethernet

information.

GVRP

Configures GVRP snooping and displays GVRP

information.

IGMP Snooping

Configures IGMP snooping and displays IGMP

configuration and IGMP information.

IGMP Snooping Querier

Configures IGMP Snooping Querier and displays IGMP

Snooping Querier information.

IP Addressing

Configures and manages IP addresses on the switch.

IPv6 ACL

Configures and displays ACL information for IPv6.

IPv6 MLD Snooping

Configures IPv6 MLD Snooping.

Dell EMC Networking CLI 97

IPv6 MLD Snooping

Querier

Configures IPv6 Snooping Querier and displays IPv6

Snooping Querier information.

IP Source Guard

Configures IP source guard and displays IP source guard

information.

iSCSI Optimization

Configures special QoS treatment for traffic between

iSCSI initiators and target systems.

Link Dependency

Configures and displays link dependency information.

LLDP

Configures and displays LLDP information.

Loop Protection

Configures keep alive.

MLAG

Configures MLAG and displays MLAG information.

Multicast VLAN

Registration

Configures MVLAN and displays MVLAN information.

Port Channel

Configures and displays Port channel information.

Port Monitor

Monitors activity on specific target ports.

QoS

Configures and displays QoS information.

Spanning Tree

Configures and reports on Spanning Tree protocol.

UDLD

Configures UDLD and displays UDLD information.

VLAN

Configures VLANs and displays VLAN information.

Voice VLAN

Configures voice VLANs and displays voice VLAN

information.

Security Commands

AAA

Configures connection security including authorization

and passwords.

Administrative Profiles

Commands

Group commands into a profile and assign a profile to a

user upon authentication.

E-mail Alerting

Configures e-mail capabilities.

RADIUS

Configures and displays RADIUS information.

TACACS+

Configures and displays TACACS+ information.

Table 1-1. System Command Groups (continued)

Command Group Description

Dell EMC Networking CLI 98

802.1x

Configures and displays commands related to 802.1x

security protocol.

Captive Portal

Blocks clients from accessing network until user

verification is established.

Denial of Service

Provides several Denial of Service options.

Management ACL

Configures and displays management access-list

information.

Password Management

Provides password management.

SSH

Configures SSH authentication.

Audio Visual Bridging Commands

MMRP

Configures and displays MMRP information.

MSRP

Configures and displays MSRP information.

MVRP

Configures and displays MVRP information.

802.1AS Timesync

Configures and displays commands related to 802.1AS

timesync.

Data Center Commands

Data Center Bridging

Configures data center bridging snooping and displays

data center bridging information.

OpenFlow

Configures the switch to be managed by a centralized

OpenFlow Controller using the OpenFlow protocol.

Priority Flow Control

Configures priority flow control and displays priority flow

control information.

Layer 3 Routing Commands

ARP (IPv4)

Manages Address Resolution Protocol functions.

BFD

Configures BFD and displays BFD information.

BGP

Configures BGP and displays BGP information.

BGP Routing Policy

Configures BGP routing policy and displays BGP routing

policy information.

DHCP Server and Relay

Agent (IPv4)

Manages DHCP/BOOTP operations on the system.

Table 1-1. System Command Groups (continued)

Command Group Description

Dell EMC Networking CLI 99

DHCPv6

Configures IPv6 DHCP functions.

DHCPv6 Snooping

Configures DHCP v6 snooping and whether an interface

is trusted or untrusted.

DVMRP

(Mcast) Configures DVMRP operations.

GMRP

Configures GMRP and displays GMRP information.

IGMP

(Mcast) Configures IGMP operations.

IGMP Proxy

(Mcast) Manages IGMP Proxy on the system.

IP Helper/DHCP Relay

Configures relay of UDP packets.

IP Routing

(IPv4) Configures IP routing and addressing.

IPv6 Multicast

Manages IPv6 Multicasting on the system.

IPv6 Routing

Configures IPv6 routing and addressing.

Loopback Interface

(IPv6)

Manages Loopback configurations.

Multicast

(Mcast) Manages Multicasting on the system.

OSPF

(IPv4) Manages shortest path operations.

OSPFv3

(IPv6) Manages IPv6 shortest path operations.

Router Discovery Protocol

(IPv4)

Manages router discovery operations.

Routing Information

Protocol

(IPv4)

Configures RIP activities.

Tunnel Interface

(IPv6) Managing tunneling operations.

Virtual Router

Manages a virtual router.

Virtual Router

Redundancy

(IPv4)

Controls virtual LAN routing.

Switch Management Commands

Application Deployment

Manages Dell-supplied applications.

Auto-Install

Automatically configures switch when a configuration file

is not found.

Table 1-1. System Command Groups (continued)

Command Group Description

Dell EMC Networking CLI 100

CLI Macro

Configures CLI Macro and displays CLI Macro

information.

Clock

Configures the system clock.

Command Line

Configuration Scripting

Manages the switch configuration files.

Configuration and Image

Files

Manages file system and Command Line Interface

scripting commands.

DHCP Client

Configures an interface to obtain an IP address via DHCP.

HiveAgent

Enables configuration of the Dell HiveAgent

Line

Configures the console, SSH, and remote Telnet

connection.

PHY Diagnostics

Diagnoses and displays the interface status.

Power Over Ethernet

(PoE)

Configures PoE and displays PoE information.

RMON

Can be configured through the CLI and displays RMON

information.

Serviceability Tracing

Controls display of debug output to serial port or telnet

console.

sFlow

Configures sFlow monitoring.

SNMP

Configures SNMP communities, traps and displays SNMP

information.

Syslog

Manages and displays syslog messages.

System Management

Configures the switch clock, name and authorized users.

Telnet Server

Configures Telnet service on the switch and displays

Telnet information.

Time Ranges

Configures time ranges and displays time range

information.

USB Flash Drive

Configures USB flash drive and displays USB flash drive

information.

User Interface

Describes user commands used for entering CLI

commands.

Table 1-1. System Command Groups (continued)

Command Group Description

Dell EMC Networking CLI 101

Mode Types

The tables on the following pages use these abbreviations for Command

Mode names.

• AAA — IAS User Configuration

• APC — Administrative Profile Configuration

• ARPA — ARP ACL Configuration

• BR—BGP Router Configuration

• CC — Crypto Configuration

• CP — Captive Portal Configuration

• CPI — Captive Portal Instance

• CMC — Class-Map Configuration

• DCB—Datacenter-Bridging Configuration

• DP — IP DHCP Pool Configuration

• DRC–Dynamic Radius Configuration mode

• GC — Global Configuration

• HAC—Hive Agent Sever Configuration

• IC — Interface Configuration

• IP — IP Access List Configuration

• IPAF4—IPv4 Address Family Configuration

• IPAF—IPv6 Address Family Configuration

• IR — Interface Range

• KC — Key Chain

• KE — Key

• L — Logging

• LC — Line Configuration

Web Server

Configures web-based access to the switch.

Table 1-1. System Command Groups (continued)

Command Group Description

Dell EMC Networking CLI 102

• LD — Link Dependency

• MA — Management Access-level

• MC — MST Configuration

• MD —MLAG Domain Configuration

• MDC — Maintenance Domain Configuration

• ML — MAC-List Configuration

• MSC — Mail Server Configuration

• MT — MAC-acl

• OFC—OpenFlow Configuration

• OG — OSPFv2 Global Configuration

• PE — Privileged Exec

• PM — Policy Map Configuration

• PCGC — Policy Map Global Configuration

• PCMC — Policy Class Map Configuration

• PTC—Peer Template Configuration

• R — Radius

• RIP — Router RIP Configuration

• RC — Router Configuration

• RM—Route Map Configuration

• ROSPF — Router Open Shortest Path First

• ROSV3 — Router Open Shortest Path First Version 3

• S—Support

• SAC—Support Assist Configuration

• SC — Stack Configuration

• SP — SSH Public Key

• SK — SSH Public Key-chain

• TC — TACACS Configuration

• TRC — Time Range Configuration

• UE — User Exec

Dell EMC Networking CLI 103

• VC — VLAN Configuration (reached via vlan command)

•

VRC—VRF Configuration

• VR—Virtual Router Configuration

• v6ACL — IPv6 Access List Configuration

• v6CMC — IPv6 Class-Map Configuration

• v6DP — IPv6 DHCP Pool Configuration

Layer 2 Commands

ACL

Command Description Modea

ip access-list

Creates an Access Control List (ACL) that is

identified by the parameter accesslistnumber.

deny | permit (IP ACL)

The deny command denies traffic if the

conditions defined in the deny statement are

matched. The permit command allows traffic if

the conditions defined in the permit statement

are matched.

deny | permit (Mac-Access-

List-Configuration)

The deny command denies traffic if the

conditions defined in the deny statement are

matched. The permit command allows traffic if

the conditions defined in the permit statement

are matched.

ip access-group

Attaches a specified access-control list to an

interface.

GC or

mac access-group

Attaches a specific MAC Access Control List

(ACL) to an interface in the in-bound

direction.

GC or

mac access-list extended

Creates the MAC Access Control List (ACL)

identified by the name parameter.

mac access-list extended

rename

Renames the existing MAC Access Control List

(ACL) name.

Dell EMC Networking CLI 104

Address Table

remark

Adds a comment to an ACL rule. IPAF4,

IPAF,

ML,

ARPA

service-acl input

Blocks Link Local Protocol Filtering (LLPF)

protocol(s) on a given port.

show access-lists interface

Displays interface ACLs. PE

show service-acl interface

Displays the status of LLPF rules configured on

a particular port or on all the ports.

show ip access-lists

Displays an Access Control List (ACL) and all

of the rules that are defined for the ACL.

show mac access-lists

Displays a MAC access list and all of the rules

that are defined for the ACL.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

clear mac address-table

Removes any learned entries from the

forwarding database.

mac address-table aging-

time

Sets the address table aging time. GC

mac address-table multicast

forbidden address

Forbids adding a specific multicast address to

specific ports.

mac address-table static vlan

Registers MAC-layer multicast addresses to the

bridge forwarding table, and adds static ports to

the group.

switchport port-security

(Interface Configuration)

Disables new address learning on an interface. IC

show mac address-table

Displays dynamically created entries in the

bridge-forwarding database.

show mac address-table

address

Displays all entries in the bridge-forwarding

database for the specified MAC address.

UE or

Command Description Modea

Dell EMC Networking CLI 105

Auto-VoIP

CDP Interoperability

show mac address-table

count

Displays the number of addresses present in the

Forwarding Database.

show mac address-table

dynamic

Displays all entries in the bridge-forwarding

database.

UE or

show mac address-table

interface

Displays the mac forwarding table entries for a

specific interface.

UE or

show mac address-table

multicast

Displays Multicast MAC address table

information.

show mac address-table

static

Displays statically created entries in the bridge-

forwarding database.

show mac address-table vlan

Displays all entries in the bridge-forwarding

database for the specified VLAN.

UE or

show port-security

Displays the port-lock status. PE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

switchport voice detect auto

Enables the VoIP Profile on all the interfaces of

the switch.

GC or

show switchport voice

Displays the status of auto-voip on an interface

or all interfaces.

Command Description Modea

clear isdp counters

Clears the ISDP counters. PE

clear isdp table

Clears entries in the ISDP table. PE

isdp advertise-v2

Enables the sending of ISDP version 2 packets

from the device.

isdp enable

Enables ISDP on the switch. GC or

Command Description Modea

Dell EMC Networking CLI 106

DHCP L2 Relay

isdp holdtime

Configures the hold time for ISDP packets that

the switch transmits.

isdp timer

Sets period of time between sending new ISDP

packets.

show isdp

Displays global ISDP settings. PE

show isdp entry

Displays ISDP entries. PE

show isdp interface

Displays ISDP settings for the specified

interface.

show isdp neighbors

Displays the list of neighboring devices. PE

show isdp traffic

Displays ISDP statistics. PE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

dhcp l2relay (Global

Configuration)

Enables the Layer 2 DHCP Relay agent for an

interface or globally.

GC or

dhcp l2relay (Interface

Configuration)

Enables DHCP L2 Relay for an interface. IC

dhcp l2relay circuit-id

Enables user to set the DHCP Option 82

Circuit ID for a VLAN.

dhcp l2relay remote-id

Enables user to set the DHCP Option 82

Remote ID for a VLAN.

dhcp l2relay trust

Configures an interface to trust a received

DHCP Option 82.

dhcp l2relay vlan

Enables the L2 DHCP Relay agent for a set of

VLANs.

show dhcp l2relay all

Displays the summary of DHCP L2 Relay

configuration.

PE or

show dhcp l2relay interface

Displays DHCP L2 Relay configuration specific

to interfaces.

Command Description Modea

Dell EMC Networking CLI 107

DHCP Snooping

show dhcp l2relay stats

interface

Displays DHCP L2 Relay statistics specific to

interfaces.

PE or

show dhcp l2relay agent-

option vlan

Displays DHCP L2 Relay Option-82

configuration specific to VLANs.

PE or

show dhcp l2relay vlan

Displays whether DHCP L2 Relay is globally

enabled on the specified VLAN or VLAN range.

PE or

show dhcp l2relay circuit-id

vlan

Displays whether DHCP L2 Relay is globally

enabled and whether the DHCP Circuit-ID

option is enabled on the specified VLAN or

VLAN range.

PE or

show dhcp l2relay remote-id

vlan

Displays whether DHCP L2 Relay is globally

enabled and shows the remote ID configured on

the specified VLAN or VLAN range.

PE or

clear dhcp l2relay statistics

interface

Resets the DHCP L2 Relay counters to zero. PE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

clear ip dhcp snooping

binding

Clears all DHCP Snooping entries. PE

clear ip dhcp snooping

statistics

Clears all DHCP Snooping statistics. PE

ip dhcp snooping

Enables DHCP snooping globally or on a

specific VLAN.

GC or

ip dhcp snooping binding

Configures a static DHCP Snooping binding. GC

ip dhcp snooping database

Configures the persistent location of the DHCP

snooping database.

ip dhcp snooping database

write-delay

Configures the interval in seconds at which the

DHCP Snooping database will be stored in

persistent storage.

ip dhcp snooping limit

Controls the maximum rate of DHCP

messages.

Command Description Modea

Dell EMC Networking CLI 108

Dynamic ARP Inspection

ip dhcp snooping log-invalid

Enables logging of DHCP messages filtered by

the DHCP Snooping application.

ip dhcp snooping trust

Configure a port as trusted for DHCP snooping. IC

ip dhcp snooping verify mac-

address

Enables the verification of the source MAC

address with the client MAC address in the

received DHCP message.

show ip dhcp snooping

Displays the DHCP snooping global and per

port configuration.

show ip dhcp snooping

binding

Displays the DHCP snooping binding entries. PE

show ip dhcp snooping

database

Displays the DHCP snooping configuration

related to the database persistence.

show ip dhcp snooping

interfaces

Displays the DHCP Snooping status of the

interfaces.

show ip dhcp snooping

statistics

Displays the DHCP snooping filtration

statistics.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

arp access-list

Creates an ARP ACL. GC

clear ip arp inspection

statistics

Resets the statistics for Dynamic ARP

Inspection on all VLANs.

ip arp inspection filter

Configures the ARP ACL to be used for a single

VLAN or a range of VLANs to filter invalid ARP

packets.

ip arp inspection limit

Configures the rate limit and burst interval

values for an interface.

ip arp inspection trust

Configures an interface as trusted for Dynamic

ARP Inspection.

Command Description Modea

Dell EMC Networking CLI 109

Ethernet Configuration

ip arp inspection validate

Enables additional validation checks like source

MAC address validation, destination MAC

address validation or IP address validation on

the received ARP packets.

ip arp inspection vlan

Enables Dynamic ARP Inspection on a single

VLAN or a range of VLANs.

permit ip host mac host

Configures a rule for a valid IP address and

MAC address combination used in ARP packet

validation.

ARPA

show arp access-list

Displays the configured ARP ACLs with the

rules.

show ip arp inspection

Displays the Dynamic ARP Inspection

configuration.

12 Enabled Disabled

Displays the Dynamic ARP Inspection

configuration on all the VLANs in the given

VLAN range.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

clear counters

Clears statistics on an interface or globally. PE

description

Adds a description to an interface. IC

flowcontrol

Configures the flow control on a given interface. GC or

interface

Enters the interface configuration mode to

configure parameters for an interface.

GC or

interface range

Enters the interface configuration mode to

execute a command on multiple ports at the

same time.

GC or

IC or

link debounce time

Configures the debounce timer for one or

multiple interfaces.

IC or

Command Description Modea

Dell EMC Networking CLI 110

rate-limit cpu

Reduces the amount of unknown

unicast/multicast packets forwarded to the

CPU.

show interfaces

Lists the traffic statistics for one or multiple

interfaces.

show interfaces advertise

Displays information about auto negotiation

advertisement.

show interfaces

configuration

Displays the configuration for all configured

interfaces.

show interfaces counters

Displays traffic seen by the Ethernet interface. UE

show interfaces debounce

Lists the debounce information for one or

multiple interfaces.

PE or

show interfaces description

Displays the description for all configured

interfaces.

show interfaces detail

Displays the detail for all configured interfaces. UE

show interfaces status

Displays the status for all configured interfaces. UE

show interfaces transceiver

Display the optic static parameters as well as

the Dell EMC qualification.

show statistics

Displays statistics for one port or for the entire

switch.

show statistics switchport

Displays detailed statistics for a specific port or

for the entire switch.

show storm-control

Displays the storm control configuration. PE

show storm-control action

Displays the storm control action configuration

for one or all interfaces.

shutdown

Disables interfaces. IC

speed

Configures the speed of a given Ethernet

interface when not using auto-negotiation.

switchport protected

Sets the port to Protected mode. IC

switchport protected name

Configures a name for a protected group. GC

show switchport protected

Displays protected group/port information. PE

Command Description Modea

Dell EMC Networking CLI 111

Ethernet CFM

show system mtu

Displays the configured MTU. PE

system jumbo mtu

Globally configures the Maximum Transmission

Unit (MTU) on all interfaces for forwarded and

system-generated frames.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

ethernet cfm domain

Enters into maintenance domain Configuration

mode for an existing domain. Use the optional

level parameter to create a domain and enter

into maintenance domain Configuration mode.

service

Associates a VLAN with a maintenance domain. MDC

ethernet cfm cc level

Initiates sending continuity checks (CCMs) at

the specified interval and level on a VLAN

monitored by an existing domain.

ethernet cfm mep level

Creates a Maintenance End Point (MEP) on an

interface at the specified level and direction.

ethernet cfm mep enable

Enables a MEP at the specified level and

direction.

ethernet cfm mep active

Activates a MEP at the specified level and

direction.

ethernet cfm mep archive-

hold-time

Maintains internal information on a missing

MEP.

ethernet cfm mip level

Creates a Maintenance Intermediate Point

(MIP) at the specified level.

ping ethernet cfm

Generates a loopback message (LBM) from

the configured MEP.

traceroute ethernet cfm

Generates a link trace message (LTM) from the

configured MEP.

show ethernet cfm errors

Displays the cfm errors. PE

show ethernet cfm domain

Displays the configured parameters in a

maintenance domain.

Command Description Modea

Dell EMC Networking CLI 112

Green Ethernet

show ethernet cfm

maintenance-points local

Displays the configured local maintenance

points.

show ethernet cfm

maintenance-points remote

Displays the configured remote maintenance

points.

show ethernet cfm statistics

Displays the CFM statistics. PE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

clear counters

Enables a Dell EMC proprietary mode of power

reduction on ports that are not connected to

another interface.

green-mode eee

Enables EEE low power idle mode on an

interface or all the interfaces.

description

Clears:

• The EEE LPI event count, and LPI duration

• The EEE LPI history table entries

• The Cumulative Power savings estimates

for a specified interface or for all the interfaces

based upon the argument.

green-mode eee-lpi-history

Configures the Global EEE LPI history

collection interval and buffer size. This value is

applied globally on all interfaces on the stack.

show green-mode interface-

Displays the green-mode configuration and

operational status of the port. This command is

also used to display the per port configuration

and operational status of the green-mode. The

status is shown only for the modes supported on

the corresponding hardware platform whether

enabled or disabled.

Command Description Modea

Dell EMC Networking CLI 113

GVRP

show green-mode

Displays the green-mode configuration for the

whole system. The status is shown only for the

modes supported on the corresponding

hardware platform whether enabled or disabled.

show green-mode eee-lpi-

history interface

Displays the interface green-mode EEE LPI

history.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

clear gvrp statistics

Clears all the GVRP statistics information. PE

garp timer

Adjusts the GARP application join, leave, and

leaveall GARP timer values.

gvrp enable (Global

Configuration)

Enables GVRP globally. GC

gvrp enable (Interface

Configuration)

Enables GVRP on an interface. IC

gvrp registration-forbid

Deregisters all VLANs, and prevents dynamic

VLAN registration on the port.

gvrp vlan-creation-forbid

Enables or disables dynamic VLAN creation. IC

show gvrp configuration

Displays GVRP configuration information,

including timer values, whether GVRP and

dynamic VLAN creation is enabled, and

which ports are running GVRP.

show gvrp error-statistics

Displays GVRP error statistics. UE

show gvrp statistics

Displays GVRP statistics. UE

Command Description Modea

Dell EMC Networking CLI 114

IGMP Snooping

IGMP Snooping Querier

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

ip igmp snooping

In Global Configuration mode, Enables

Internet Group Management Protocol (IGMP)

snooping.

show ip igmp snooping

groups

Displays Multicast groups learned by IGMP

snooping.

show ip igmp snooping

mrouter

Displays information on dynamically learned

Multicast router interfaces.

show ip igmp snooping

In VLAN Configuration mode, enables IGMP

snooping on a particular VLAN or on all

interfaces participating in a VLAN.

ip igmp snooping vlan

immediate-leave

Enables or disables IGMP Snooping fast-leave

mode on a selected VLAN.

ip igmp snooping vlan

groupmembership-interval

Sets the IGMP Group Membership Interval

time on a VLAN.

ip igmp snooping vlan last-

member-query-interval

Sets the IGMP Maximum Response time on a

particular VLAN.

ip igmp snooping vlan

mcrtrexpiretime

Sets the Multicast Router Present Expiration

time.

ip igmp snooping report-

suppression

Enables IGMP report suppression on a specific

VLAN.

ip igmp snooping

unregistered floodall

Enables flooding of unregistered multicast

traffic to all ports in the VLAN.

ip igmp snooping vlan

mrouter

Statically configures a port as connected to a

multicast router for a specified VLAN.

Command Description Modea

ip igmp snooping

Enables/disables IGMP Snooping Querier on

the system (Global Configuration mode) or on

a VLAN.

GC or

Dell EMC Networking CLI 115

IP Addressing

ip igmp snooping querier

election participate

Enables the Snooping Querier to participate in

the Querier Election process when it discovers

the presence of another Querier in the VLAN.

ip igmp snooping querier

query-interval

Sets the IGMP Querier Query Interval time. GC

ip igmp snooping querier

timer expiry

Sets the IGMP Querier timer expiration period. GC

ip igmp snooping querier

version

Sets the IGMP version of the query that the

snooping switch is going to send periodically.

show ip igmp snooping

querier

Displays IGMP Snooping Querier information. PE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

clear host

Deletes entries from the host name-to-address

cache.

clear ip address-conflict-

detect

Clears the address conflict detection status in

the switch.

interface out-of-band

Enters into OOB interface configuration mode. GC

ip address

Configures an IP address on an in-band

interface.

ip address (Out-of-Band)

Sets an IP address for the out-of-band interface. IC

ip address-conflict-detect

run

Triggers the switch to run active address conflict

detection by sending gratuitous ARP packets for

IPv4 addresses on the switch.

ip address dhcp (Interface

Configuration)

Acquires an IP address on an interface from the

DHCP server.

ip default-gateway

Defines a default gateway (router). GC

ip domain-lookup

Enables IP DNS-based host name-to-address

translation.

Command Description Modea

Dell EMC Networking CLI 116

ip domain-name

Defines a default domain name to complete

unqualified host names.

ip host

Configures static host name-to-address

mapping in the host cache.

ip name-server

Defines available IPv4 or IPv6 name servers. GC

ip name-server source-

interface

Configures available name servers. GC

ipv6 address (Interface

Configuration)

Sets the IPv6 address of the management

interface.

ipv6 address (OOB Port)

Sets the IPv6 prefix on the out-of-band port. IC

ipv6 address dhcp

Enables the DHCPv6 client on an IPv6

interface.

ipv6 enable (Interface

Configuration)

Enables IPv6 on the management interface. GC

ipv6 enable (OOB

Configuration)

Enables IPv6 operation on the out-of-band

interface.

ipv6 gateway (OOB

Configuration)

Configures the address of the IPv6 gateway. IC

show hosts

Displays the default domain name, a list of

name server hosts, static and cached list of host

names and addresses.

show ip address-conflict

Displays the status information corresponding

to the last detected address conflict.

UE or

show ip helper-address

Displays the ip helper addresses configuration. PE

show ipv6 dhcp interface

out-of-band statistics

Displays IPv6 DHCP statistics for the out-of-

band interface.

show ipv6 interface out-of-

band

Displays the IPv6 out-of-band port

configuration.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

Dell EMC Networking CLI 117

IPv6 ACL

IPv6 MLD Snooping

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

deny | permit (IPv6 ACL)

Creates a new rule for the current IPv6 access

list.

v6ACL

ipv6 access-list

Creates an IPv6 Access Control List (ACL)

consisting of classification fields defined for the

IP header of an IPv6 frame.

ipv6 access-list rename

Changes the name of an IPv6 ACL. GC

ipv6 traffic-filter

Attaches a specific IPv6 ACL to an interface or

associates it with a VLAN ID in a given

direction.

show ipv6 access-lists

Displays an IPv6 access list (and the rules

defined for it).

Command Description Modea

ipv6 mld snooping vlan

groupmembership-interval

Sets the MLD Group Membership Interval

time on a VLAN or interface.

ipv6 mld snooping vlan

immediate-leave

Enables or disables MLD Snooping immediate-

leave admin mode on a selected interface or

VLAN.

ipv6 mld snooping vlan last-

listener-query-interval

Sets the MLD Maximum Response time for an

interface or VLAN.

IC or

ipv6 mld snooping listener-

message-suppression

Enables MLD listener message suppression on a

specific VLAN.

ipv6 mld snooping vlan

mcrtrexpiretime

Sets the Multicast Router Present Expiration

time.

ipv6 mld snooping vlan

mrouter

Statically configures a port as connected to a

multicast router for a specified VLAN.

ipv6 mld snooping (Global)

Enables MLD Snooping on the system (Global

Configuration mode).

show ipv6 mld snooping

Displays MLD Snooping information. PE

Dell EMC Networking CLI 118

IPv6 MLD Snooping Querier

IP Source Guard

show ipv6 mld snooping

groups

Displays the MLD Snooping entries in the

MFDB table.

show ipv6 mld snooping

mrouter

Displays information on dynamically learned

Multicast router interfaces.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

ipv6 mld snooping querier

Enables MLD Snooping Querier on the system. GC

ipv6 mld snooping querier

(VLAN mode)

Enables MLD Snooping Querier on a VLAN. VC

ipv6 mld snooping querier

address

Sets the global MLD Snooping Querier address

on the system or on a VLAN.

GC or

ipv6 mld snooping querier

election participate

Enables the Snooping Querier to participate in

the Querier Election process when it discovers

the presence of another Querier in the VLAN.

ipv6 mld snooping querier

query-interval

Sets the MLD Querier Query Interval time. GC

ipv6 mld snooping querier

timer expiry

Sets the MLD Querier timer expiration period. GC

show ipv6 mld snooping

querier

Displays MLD Snooping Querier information. PE

Command Description Modea

ip verify source

Enables IP Source Guard on an interface. IC

ip verify binding

Configures IPSG static bindings. GC

show ip verify

Displays IPSG interface configuration. PE

show ip verify source

Displays the bindings configured on a particular

interface.

Command Description Modea

Dell EMC Networking CLI 119

iSCSI Optimization

Link Dependency

show ip source binding

Displays all bindings (static and dynamic). PE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

iscsi aging time

Sets aging time for iSCSI sessions. GC

iscsi cos

Sets the quality of service profile that will be

applied to iSCSI flows.

iscsi enable

Enables Global Configuration mode command

globally enables iSCSI awareness.

iscsi target port

Configures an iSCSI target port (optionally

configures target port address and name).

show iscsi

Displays the iSCSI settings. PE

show iscsi sessions

Displays the iSCSI sessions. PE

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

action

Indicates if the link-dependency group should

mirror or invert the status of the depended on

interfaces.

link-dependency group

Enters the link-dependency mode to configure

a link-dependency group.

add

Adds member gigabit Ethernet port(s) to the

dependency list.

depends-on

Adds the dependent Ethernet ports or port

channels list.

show link-dependency

Shows the link dependencies configured on a

particular group.

Command Description Modea

Dell EMC Networking CLI 120

LLDP

Command Description Modea

clear lldp remote-data

Deletes all data from the remote data table. PE

clear lldp statistics

Resets all LLDP statistics. PE

dcb enable

Enables the sending of DCBX information in

LLDP frames.

lldp med

Enables/disables LLDP-MED on an interface. IC

lldp med confignotification

Enables sending the topology change

notification.

lldp med

faststartrepeatcount

Sets the value of the fast start repeat count. GC

lldp med transmit-tlv

Specifies which optional TLVs in the LLDP

MED set are transmitted in the LLDPDUs.

lldp notification

Enables remote data change notifications. IC

lldp notification-interval

Limits how frequently remote data change

notifications are sent.

lldp receive

Enables the LLDP receive capability. IC

lldp timers

Sets the timing parameters for local data

transmission on ports enabled for LLDP.

lldp transmit

Enables the LLDP advertise capability. IC

lldp transmit-mgmt

Specifies that transmission of the local system

management address information in the

LLDPDUs is included.

lldp transmit-tlv

Specifies which optional TLVs in the 802.1AB

basic management set will be transmitted in the

LLDPDUs.

show lldp

Displays the current LLDP configuration

summary.

show lldp interface

Displays the current LLDP interface state. PE

show lldp local-device

Displays the LLDP local data. PE

show lldp med

Displays a summary of the current LLDP MED

configuration.

Dell EMC Networking CLI 121

Loop Protection

MLAG

show lldp med interface

Displays a summary of the current LLDP MED

configuration for a specific interface.

show lldp med local-device

detail

Displays the advertised LLDP local data in

detail.

show lldp med remote-

device

Displays the current LLDP MED remote data. PE

show lldp remote-device

Displays the current LLDP remote data. PE

show lldp statistics

Displays the current LLDP traffic statistics. PE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

keepalive (Interface Config)

Enables loop protection on an interface. IC

keepalive (Global Config)

Globally enable loop protection and

optionally configure the loop protection

timer and packet count.

keepalive action

Configure the action taken when a loop is

detected on an interface.

show keepalive

Displays the global loop protect

configuration.

show keepalive statistics

Displays the loop protect status for one or all

interfaces.

Command Description Modea

clear vpc statistics

Clears the counters for the keepalive

messages transmitted and received by the

MLAG switch.

feature vpc

Enables debug traces for the specified

protocols.

Command Description Modea

Dell EMC Networking CLI 122

feature vpc

Globally enables MLAG. GC

peer detection enable

Enables the Dual Control Plane

Detection Protocol.

peer detection interval

Configures the peer detection

transmission interval and the detection

interval.

peer-keepalive destination

Enables the Dual Control Plane Detection

Protocol with the configured IP address of

the peer MLAG, the local source address and

the peer timeout value.

peer-keepalive enable

Enables the peer keepalive protocol. MD

peer-keepalive timeout

Configures the peer keepalive timeout value,

in seconds.

role priority

Configures the priority value used on a

switch for primary/secondary role selection.

show vpc

Displays information about an MLAG. PE

show vpc brief

Displays the MLAG global status. PE

show vpc consistency-

parameters

Displays MLAG-related configuration

information in a format suitable for

comparison with the other MLAG peer.

show vpc consistency-

features

Displays MLAG-related configuration

information in a format suitable for

comparison with the other MLAG peer.

show vpc peer-keepalive

Displays the peer MLAG switch’s IP address

used by the dual control plane detection

protocol.

show vpc role

Displays information about the keepalive

status, keepalive parameters, role of the

MLAG switch, and the system MAC and

priority.

show vpc statistics

Displays counters for the keepalive messages

transmitted and received by the MLAG

switch

Command Description Modea

Dell EMC Networking CLI 123

Multicast VLAN Registration

system-mac

Manually configures the MAC address for the

VPC domain.

system-priority

Manually configures the priority for the VPC

domain.

vpc

Configures a port-channel (LAG) as part of

the MLAG domain.

vpc domain

Enters into MLAG Configuration mode. GC

vpc peer-link

Configures a port channel as the MLAG peer

link for a domain and enables the peer link

protocol.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

mvr

Enables MVR. GC or

mvr group

Adds an MVR membership group. GC

mvr mode

Changes the MVR mode type. GC

mvr querytime

Sets the MVR query response time. GC

mvr vlan

Sets the MVR multicast VLAN. GC

mvr immediate

Enables MVR Immediate Leave mode. IC

mvr type

Sets the MVR port type. IC

mvr vlan group

Use to participate in the specific MVR group. IC

show mvr

Displays global MVR settings. PE

show mvr members

Displays the MVR membership groups

allocated.

show mvr interface

Displays the MVR enabled interface

configuration.

show mvr traffic

Displays global MVR statistics. PE

Command Description Modea

Dell EMC Networking CLI 124

Port Channel

Port Monitor

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

channel-group

Associates a port with a port-channel. IC

feature vpc

Enables debug traces for the specified

protocols.

interface range port-channel

Enters the interface configuration mode to

configure multiple port-channels.

hashing-mode

Sets the hashing algorithm on trunk ports. IC (port-

channel)

lacp port-priority

Configures the priority value for Ethernet

ports.

lacp system-priority

Configures the system LACP priority. GC

lacp timeout

Assigns an administrative LACP timeout. IC

port-channel min-links

Sets the minimum number of links that must

be up in order for the port channel interface

to be declared up.

show interfaces port-

channel

Displays port-channel information. PE

show lacp

Displays LACP information for ports. PE

show statistics port-channel

Displays port-channel statistics. PE

Command Description Modea

monitor capture (Global

Configuration)

Captures packets transmitted or received from

the CPU.

monitor capture (Privileged

Exec)

Capture packets transmitted or received from

the CPU

monitor session

Configures a port monitoring session. GC

remote-span

Configures a VLAN as an RSPAN VLAN. VC

show monitor capture

Displays captured packets transmitted or

received from the CPU.

Dell EMC Networking CLI 125

QoS

show monitor session

Displays the port monitoring status. PE

show vlan remote-span

Displays the RSPAN VLAN IDs. UE or

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

assign-queue

Modifies the queue ID to which the associated

traffic stream is assigned.

PCMC

class

Creates an instance of a class definition within

the specified policy for the purpose of defining

treatment of the traffic class through

subsequent policy attribute statements.

PMC

class-map

Defines a new DiffServ class of type match-all. GC

class-map rename

Changes the name of a DiffServ class. GC

classofservice dot1p-

mapping

Maps an 802.1p priority to an internal traffic

class for a switch.

GC or

classofservice ip-dscp-

mapping

Maps an IP DSCP value to an internal traffic

class.

classofservice trust

Sets the class of service trust mode of an

interface.

GC or

conform-color

Specifies the precoloring of packets conforming

to or exceeding the specified rate(s). The

possible actions are drop, setdscp-transmit, set-

prec-transmit, or transmit.

PCMC

cos-queue min-bandwidth

Specifies the minimum transmission

bandwidth for each interface queue.

GC or

cos-queue random-detect

Configures WRED packet drop policy on an

interface CoS queue.

GC or

cos-queue strict

Activates the strict priority scheduler mode for

each specified queue.

GC or

diffserv

Sets the DiffServ operational mode to active. GC

Command Description Modea

Dell EMC Networking CLI 126

drop

Use the drop policy-class-map configuration

command to specify that all packets for the

associated traffic stream are to be dropped at

ingress.

PCMC

mark cos

Marks all packets for the associated traffic

stream with the specified class of service value

in the priority field of the 802.1p header.

PCMC

mark ip-dscp

Marks all packets for the associated traffic

stream with the specified IP DSCP value.

PCMC

mark ip-precedence

Marks all packets for the associated traffic

stream with the specified IP precedence value.

PCMC

match class-map

Adds add to the specified class definition the

set of match conditions defined for another

class.

CMC

match cos

Adds to the specified class definition a match

condition for the Class of Service value.

CMC

match destination-address

mac

Adds to the specified class definition a match

condition based on the destination MAC

address of a packet.

CMC

match dstip

Adds to the specified class definition a match

condition based on the destination IP address

of a packet.

CMC

match dstip6

Adds to the specified class definition a match

condition based on the destination IPv6

address of a packet.

v6CMC

match dstl4port

Adds to the specified class definition a match

condition based on the destination layer 4 port

of a packet using a single keyword, or a numeric

notation.

CMC

match ethertype

Adds to the specified class definition a match

condition based on the value of the ethertype.

CMC

match ip6flowlbl

Adds to the specified class definition a match

condition based on the IPv6 flow label of a

packet.

v6CMC

Command Description Modea

Dell EMC Networking CLI 127

match ip dscp

Adds to the specified class definition a match

condition based on the value of the IP DiffServ

Code Point (DSCP) field in a packet.

CMC

match ip precedence

Adds to the specified class definition a match

condition based on the value of the IP.

CMC

match ip tos

Adds to the specified class definition a match

condition based on the value of the IP TOS

field in a packet.

CMC

match protocol

Adds to the specified class definition a match

condition based on the value of the IP Protocol

field in a packet using a single keyword

notation or a numeric value notation.

CMC

match source-address mac

Adds to the specified class definition a match

condition based on the source MAC address of

the packet.

CMC

match srcip

Adds to the specified class definition a match

condition based on the source IP address of a

packet.

CMC

match srcip6

Adds to the specified class definition a match

condition based on the source IPv6 address of a

packet.

v6CMC

match srcl4port

Adds to the specified class definition a match

condition based on the source layer 4 port of a

packet using a single keyword, a numeric

notation, or a numeric range notation.

CMC

match vlan

Adds to the specified class definition a match

condition based on the value of the layer 2

VLAN Identifier field.

CMC

mirror

Mirrors all the data that matches the class

defined to the destination port specified.

PCMC

police-simple

Implements simple color aware marking for the

specified class.

PCMC

police-single-rate

Implements a single-rate Three Color Marker

(trTCM) per RFC 2698

PCMC

Command Description Modea

Dell EMC Networking CLI 128

police-two-rate

Implements a two-rate Three Color Marker

(trTCM) per RFC 2698.

PCMC

policy-map

Establishes a new DiffServ policy or enters

policy map configuration mode.

random-detect queue-

parms

Configures the green, yellow and red TCP and

non-TCP packet minimum and maximum

thresholds and corresponding drop

probabilities on an interface or all interfaces.

GC, IC,

or IR

random-detect exponential-

weighting-constant

Configures the decay in the calculation of the

average queue size user for WRED on an

interface or all interfaces.

GC, IC,

or IR

redirect

Specifies that all incoming packets for the

associated traffic stream are redirected to a

specific egress interface (Ethernet port or port-

channel).

PCMC

service-policy

Attaches a policy to an interface in a particular

direction.

GC or

show class-map

Displays all configuration information for the

specified class.

show classofservice dot1p-

mapping

Displays the current 802.1p priority mapping

to internal traffic classes for a specific interface.

show classofservice ip-dscp-

mapping

Displays the current IP DSCP mapping to

internal traffic classes for a specific interface.

show classofservice trust

Displays the current trust mode setting for a

specific interface.

show diffserv

Displays the DiffServ General Status

information.

show diffserv service

interface

Displays policy service information for the

specified interface and direction.

show diffserv service brief

Displays all interfaces in the system to which a

DiffServ policy has been attached.

show interfaces cos-queue

Displays the class-of-service queue

configuration for the specified interface.

Command Description Modea

Dell EMC Networking CLI 129

Spanning Tree

show interfaces random-

detect

Displays the WRED policy on an interface. PE

show policy-map

Displays all configuration information for the

specified policy.

show policy-map interface

Displays policy-oriented statistics information

for the specified interface and direction.

show service-policy

Displays a summary of policy-oriented

statistics information for all interfaces.

traffic-shape

Specifies the maximum transmission

bandwidth limit for the interface as a whole.

GC or

vlan priority

Assigns a default VLAN priority tag for

untagged frames ingressing an interface.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

clear spanning-tree

detected-protocols

Restarts the protocol migration process on all

interfaces or on the specified interface.

exit (mst)

Exits the MST configuration mode and applies

configuration changes.

instance (mst)

Maps VLANs to an MST instance. MC

name (mst)

Defines the MST configuration name. MC

revision (mst)

Defines the configuration revision number. MC

show spanning-tree

Displays spanning tree configuration. PE

show spanning-tree

summary

Displays spanning tree settings and parameters

for the switch.

show spanning-tree vlan

Displays spanning tree information per VLAN

and also lists the port roles and states as well as

the port cost.

spanning-tree

Enables spanning-tree functionality. GC

spanning-tree auto-portfast

Sets the port to auto portfast mode. IC

Command Description Modea

Dell EMC Networking CLI 130

spanning-tree backbonefast

Enables the detection of indirect link failures

and accelerate spanning tree convergence on

STP-PV/RSTP-PV configured switches using

Indirect Link Rapid Convergence (IRC).

spanning-tree bpdu flooding

Allows flooding of BPDUs received on

nonspanning-tree ports to all other non-

spanning-tree ports.

spanning-tree bpdu-

protection

Enables BPDU protection on a switch. GC

spanning-tree cost

Configures the spanning tree path cost for a

port.

spanning-tree disable

Disables spanning tree on a specific port. IC

spanning-tree forward-time

Configures the spanning tree bridge forward

time.

spanning-tree guard

Selects whether loop guard or root guard is

enabled on an interface.

spanning-tree loopguard

Enables loop guard on all ports. GC

spanning-tree max-age

Configures the spanning tree bridge maximum

age.

spanning-tree max-hops

Sets the MSTP Max Hops parameter to a new

value for the common and internal spanning

tree.

spanning-tree mode

Configures the spanning tree protocol. GC

spanning-tree mst

configuration

Enables configuring an MST region by entering

the multiple spanning-tree (MST) mode.

spanning-tree mst cost

Configures the path cost for multiple spanning

tree (MST) calculations.

spanning-tree mst port-

priority

Configures port priority. IC

spanning-tree mst priority

Configures the switch priority for the specified

spanning tree instance.

spanning-tree portfast

Enables portfast mode. IC

Command Description Modea

Dell EMC Networking CLI 131

UDLD

spanning-tree portfast

bpdufilter default

Discards BPDUs received on spanningtree ports

in portfast mode.

spanning-tree portfast

default

Enables portfast mode on all ports. GC

spanning-tree port-priority

(Interface Configuration)

Configures port priority. IC

spanning-tree priority

Configures the spanning tree priority. GC

spanning-tree tcnguard

Prevents a port from propagating topology

change notifications.

spanning-tree transmit hold-

count

Set the maximum number of BPDUs that a

bridge is allowed to send within a hello time

window (2 seconds).

spanning-tree uplinkfast

Configures the rate at which gratuitous frames

are sent after a switchover to an alternate port

and enables Direct Link Rapid Convergence.

spanning-tree vlan

Enables per VLAN spanning tree on a VLAN. GC

spanning-tree vlan forward-

time

Configures the spanning tree forward delay time

for a specified VLAN or a range of VLANs.

spanning-tree vlan hello-

time

Configures the spanning tree hello time for a

specified VLAN or a range of VLANs.

spanning-tree vlan max-age

Configures the spanning tree maximum age

time for a set of VLANs.

spanning-tree vlan root

Configures the switch to become the root

bridge or standby root bridge.

spanning-tree vlan priority

Configures the bridge priority of a VLAN. GC

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

udld enable (Global

Configuration)

Globally enable UDLD. UDLD must be

globally enabled and enabled on an interface to

operate.

Command Description Modea

Dell EMC Networking CLI 132

VLAN

udld reset

Resets (enable) all interfaces disabled by

UDLD.

udld message time

Configures the interval between the

transmission of UDLD probe messages on ports

that are in the advertisement phase.

udld timeout interval

Configures the interval for the receipt of ECHO

replies.

udld enable (Interface

Configuration)

Enables UDLD on a specific interface. IC

udld port

Selects the UDLD operating mode on a specific

interface.

show udld

Displays the global settings for UDLD. PE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

interface vlan

Enters the VLAN interface configuration mode. GC

interface range vlan

Enters the interface configuration mode to

configure multiple VLANs.

name (VLAN

Configuration)

Configures a name to a VLAN. IC

private-vlan

Defines a private VLAN association between

the primary and secondary VLANs.

protocol group

Attaches a vlan-id to the protocol-based VLAN

identified by groupid.

protocol vlan group

Adds the Ethernet interface to the protocol-

based VLAN identified by groupid.

protocol vlan group all

Adds all Ethernet interfaces to the protocol-

based VLAN identified by groupid.

show dot1q-tunnel

Displays the QinQ status for each interface. PE

show interfaces switchport

Displays switchport configuration. PE or

Command Description Modea

Dell EMC Networking CLI 133

show port protocol

Displays the Protocol-Based VLAN information

for either the entire system or for the indicated

group.

show switchport ethertype

Displays the configured Ethertype for each

interface.

show vlan

Displays detailed information, including

interface information and dynamic vlan type,

for a specific VLAN.

show vlan association mac

Displays the VLAN associated with a specific

configured MAC address.

show vlan association subnet

Displays the VLAN associated with a specific

configured IP subnet.

show vlan private-vlan

Displays information about the configured

private VLANs.

switchport access vlan

Configures the VLAN ID when the interface is

in access mode.

switchport dot1q ethertype

(Global Configuration)

Defines additional QinQ tunneling TPIDs for

matching in the outer VLAN tag of received

frames.

switchport general forbidden

vlan

Forbids adding specific VLANs to a port. IC

switchport general

acceptable-frame-type

tagged-only

Discards untagged frames at ingress. IC

switchport general allowed

vlan

Adds or removes VLANs from a port in General

mode.

switchport general ingress-

filtering disable

Disables port ingress filtering. IC

switchport general pvid

Configures the PVID when the interface is in

general mode.

switchport mode

Configures the VLAN membership mode of a

port.

Command Description Modea

Dell EMC Networking CLI 134

Voice VLAN

switchport mode private-

vlan

Defines a private VLAN association for an

isolated or community interface or a mapping

for a promiscuous interface.

switchport mode dot1q-

tunnel

Enables QinQ tunneling on customer edge

(CE) interfaces.

switchport private-vlan

Defines a private VLAN association for an

isolated or community port or a mapping for a

promiscuous port.

switchport trunk

Adds or removes VLANs from a trunk port. IC

switchport trunk

encapsulation dot1q

Use this command for compatibility. This

command performs no action.

IC or

vlan

Configures a VLAN. GC

vlan association mac

Associates a MAC address to a VLAN. VC

vlan association subnet

Associates an IP subnet to a VLAN. VC

vlan makestatic

Changes a GVRP dynamically created VLAN to

a static VLAN.

vlan protocol group

Adds protocol-based VLAN groups to the

system.

vlan protocol group add

protocol

Adds a protocol to the protocol-based VLAN

identified by groupid.

vlan protocol group name

Adds a group name to the protocol-based VLAN

identified by groupid.

vlan protocol group remove

Removes the protocol-base VLAN group

identified by groupid.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

voice vlan

Enables the voice VLAN capability on the

switch.

voice vlan (Interface)

Enables the voice VLAN capability on the

interface.

Command Description Modea

Dell EMC Networking CLI 135

Security Commands

AAA

voice vlan data priority

Trusts or not trusts the data traffic arriving on

the voice VLAN port.

show voice vlan

Displays various properties of the voice VLAN. PE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

aaa accounting

Creates an accounting method list GC

aaa authentication dot1x

default

Specifies an authentication method for 802.1x

clients.

aaa authentication enable

Defines authentication method lists for

accessing higher privilege levels.

aaa authentication login

Defines login authentication. GC

aaa authorization

Creates an authorization method list. GC

aaa authorization network

default radius

Enables the switch to accept VLAN assignment

by the RADIUS server.

aaa ias-user username

Configures IAS users and their attributes. Also

changes the mode to aa user Configuration

mode.

aaa new-model

This command is a no-op command. It is

present only for compatibility purposes.

aaa server radius dynamic-

author

Enters radius dynamic authorization mode. GC

authentication enable

Globally enables the Authentication Manager. GC

authentication order

Sets the order of authentication methods used

on a port.

authentication priority

Sets the priority for the authentication methods

used on a port.

Command Description Modea

Dell EMC Networking CLI 136

authentication restart

Sets the interval after which reauthentication

starts.

clear (IAS)

Deletes all IAS users. PE

clear authentication

statistics

Clears the authentication statistics. PE

clear authentication

authentication-history

Clears the authentication history logs. PE

enable password

Sets a local password to control access to the

normal level.

ip http authentication

Specifies authentication methods for http. GC

ip https authentication

Specifies authentication methods for https. GC

password (AAA IAS User

Configuration)

Configures a password for a user. AAA

password (User Exec)

Specifies a user password UE

show aaa ias-users

Displays configured IAS users and their

attributes.

show aaa statistics

Displays accounting statistics PE

show accounting methods

Displays the configured accounting method

lists.

show authentication

Shows information about authentication

methods.

show authentication

authentication-history

Displays the authentication history on one or

more interfaces.

show authentication

methods

Displays information about the authentication

methods.

show authentication

statistics

Displays the Authentication Manager statistics

on one or more interfaces.

show authorization methods

Displays the configured authorization method

lists.

show users accounts

Displays information about the local user

database.

Command Description Modea

Dell EMC Networking CLI 137

Administrative Profiles

E-mail Alerting

show users login-history

Displays information about login histories of

users.

username

Establishes a username-based authentication

system. Optionally allows the specification of an

Administrative Profile for a local user.

username unlock

Transfers local user passwords between devices

without having to know the passwords.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

admin-profile

Creates an administrative profile. GC

description (Administrative

Profile Configuration)

Adds a description to an administrative profile. APC

rule

Adds a rule to an administrative profile. APC

show admin-profiles

Displays the administrative profiles. PE

show admin-profiles brief

Lists the names of the administrative profiles

defined on the switch.

show cli modes

Lists the names of all the CLI modes. PE

show users

Shows which administrative profiles have been

assigned to local user accounts and to show

which profiles are active for logged-in users.

username

Optionally allows the specification of an

Administrative Profile for a local user.

Command Description Modea

logging email

Enables e-mail alerting and sets the lowest

severity level for which log messages are e-

mailed.

Command Description Modea

Dell EMC Networking CLI 138

logging email urgent

Sets the lowest severity level at which log

messages are e-mailed in an urgent manner.

logging email message-type

to-addr

Sets the lowest severity level at which SNMP

traps are logged.

logging email message-type

to-addr

Configures the To address field of the e-mail. GC

logging email from-addr

Configures the From address of the e-mail. GC

logging email message-type

subject

Configures the subject. GC

logging email logtime

Configures the value of how frequently the

queued messages are sent.

logging email test message-

type

Tests whether or not an e-mail is being sent to

an SMTP server.

show logging email statistics

Displays information on how many e-mails are

sent, how many e-mails failed, when the last e-

mail was sent, how long it has been since the

last e-mail was sent, how long it has been since

the e-mail changed to disabled mode.

clear logging email statistics

Clears the e-mail alerting statistics. GC

security

Sets the e-mail alerting security protocol. MSC

mail-server ip-address |

hostname

Configures the SMTP server IP address and

changes the mode to Mail Server Configuration

Mode.

port (Mail Server

Configuration Mode)

Configures the TCP port to use for

communication with the SMTP servers.

MSC

username (Mail Server

Configuration Mode)

Configures the username required by the

authentication.

MSC

password (Mail Server

Configuration Mode)

Configures the password required to

authenticate to the e-mail server.

MSC

show mail-server

Displays the configuration of all the mail servers

or a particular mail server.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

Dell EMC Networking CLI 139

RADIUS

Command Description Modea

acct-port

Sets the port that connects to the RADIUS

accounting server.

attribute 6

Configures the switch to send the RADIUS

Service-Type attribute in the Access-Request

message sent to a specific RADIUS

authentication server.

attribute 8

Configures the switch to send the RADIUS

Framed-IP-Address attribute in the Access-

Request message sent to a specific RADIUS

authentication server.

attribute 25

Enables the switch to send the RADIUS Class

attribute as supplied by the RADIUS server in

accounting messages sent to the specific

accounting server.

attribute 31

Alters the format of the MAC address sent in

the Calling-Station-Id attribute to the RADIUS

server when authenticating using 802.1X MAC

based authentication for an interface.

authentication event fail

retry

Sets the number of times authentication may

be reattempted by the user for the RADIUS

method for an IEEE 802.1X supplicant.

auth-port Sets the port number for authentication requests

of the designated radius server

deadtime

Improves Radius response times when a server is

unavailable by causing the unavailable server to

be skipped.

key Sets the authentication and encryption key for all

RADIUS communications between the switch

and the RADIUS daemon

msgauth

Enables the message authenticator attribute to

be used for the RADIUS Authenticating server

being configured.

name (RADIUS server)

Assigns a name to a RADIUS server. R

Dell EMC Networking CLI 140

primary

Specifies that a configured server should be the

primary server in the group of authentication

servers which have the same server name.

priority

Specifies the order in which the servers are to be

used, with 0 being the highest priority.

radius-server attribute 4

Sets the network access server (NAS) IP address

for the RADIUS server.

radius-server attribute 6

Enables the switch to send the RADIUS

Service-Type attribute in authentication

messages sent to the authentication server.

radius-server attribute 8

Enables the switch to send the RADIUS

Framed-IP-Address attribute in authentication

messages sent to the authentication server.

radius-server attribute 25

Globally enables the switch to send the

RADIUS Class attribute as supplied by the

RADIUS server in accounting messages sent to

the accounting server.

radius-server attribute 31

Globally enables the switch to send the

RADIUS Class attribute as supplied by the

RADIUS server in accounting messages sent to

the accounting server.

radius-server deadtime

Improves RADIUS response times when servers

are unavailable. Causes the unavailable servers

to be skipped.

radius-server host

Specifies a RADIUS server host. GC

radius-server key

Sets the authentication and encryption key for

all RADIUS communications between the

switch and the RADIUS daemon.

radius-server retransmit

Specifies the number of times the software

searches the list of RADIUS server hosts.

radius-server source-ip

Specifies the source IP address used for

communication with RADIUS servers.

radius-server source-

interface

Selects the interface from which to use the IP

address in the source IP address field of

transmitted RADIUS packets.

Command Description Modea

Dell EMC Networking CLI 141

TACACS+

radius-server timeout

Sets the interval for which a switch waits for a

RADIUS server to reply.

retransmit

Specifies the number of times the software

searches the list of RADIUS server hosts before

stopping the search.

show aaa servers

Displays the list of configured RADIUS servers

and the values configured for the global

parameters of the RADIUS client.

UE or

show radius statistics

Shows the statistics for an authentication or

accounting server.

UE or

source-ip

Specifies the source IP address to be used for

communication with RADIUS servers.

timeout

Sets the timeout value in seconds for the

designated RADIUS server.

usage

Specifies the usage type of the server. R

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

key

Specifies the authentication and encryption key

for all TACACS communications between the

device and the TACACS server.

port

Specifies a server port number. TC

priority

Specifies the order in which servers are used. TC

show tacacs

Displays TACACS+ server settings and

statistics.

tacacs-server host

Specifies a TACACS+ server host. GC

tacacs-server key

Sets the authentication and encryption key for

all TACACS+ communications between the

switch and the TACACS+ daemon.

Command Description Modea

Dell EMC Networking CLI 142

802.1x

tacacs-server source-

interface

Selects the interface from which to use the IP

address in the source IP address field of

transmitted TACACS packets.

tacacs-server timeout

Sets the interval for which the switch waits for a

server host to reply.

timeout

Specifies the timeout value in seconds. TC

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

dot1x dynamic-vlan enable

Enables the capability of creating VLANs

dynamically when a RADIUS-assigned VLAN

does not exist in the switch.

dot1x eapolflood

Enables the flooding of received IEEE 802.1x

frames in the VLAN.

dot1x initialize

Begins the initialization sequence on the

specified port.

dot1x mac-auth-bypass

Enables MAB on an interface. IC

dot1x max-req

Sets the maximum number of times the switch

sends an EAP-request frame to the client before

restarting the authentication process.

dot1x max-users

Sets the maximum number of clients supported

on the port when MAC-based 802.1X

authentication is enabled on the port.

dot1x port-control

Enables manual control of the authorization

state of the port.

dot1x re-authenticate

Manually initiates a reauthentication of all

802.1x-enabled ports or a specified 802.1X

enabled port.

dot1x reauthentication

Enables periodic reauthentication of the client. IC

dot1x system-auth-control

monitor

Enables 802.1X globally. GC

Command Description Modea

Dell EMC Networking CLI 143

dot1x timeout guest-vlan-

period

Sets the number of seconds that the switch

waits before authorizing the client if the client

is a dot1x unaware client.

dot1x timeout quiet-period

Sets the number of seconds the switch remains

in the quiet state following a failed

authentication attempt.

dot1x timeout re-authperiod

Sets the number of seconds between

reauthentication attempts.

dot1x timeout server-

timeout

Sets the number of seconds the switch waits for

a response from the authentication server

before resending the request.

dot1x timeout supp-timeout

Sets the time that the switch waits for a

response before retransmitting an Extensible

Authentication Protocol (EAP)-request frame

to the client

dot1x timeout tx-period

Sets the number of seconds the switch waits for

a response to an EAP-request/identify frame

from the client before resending the request.

auth-type

Set the accepted authorization types for

dynamic RADIUS clients.

DRC

client

Sets the CoA client parameters. DRC

ignore

Sets the switch to ignore certain authentication

parameters from dynamic RADIUS clients.

DRC

port

Sets the port on which to listen for CoA and

disconnect requests from authorized dynamic

RADIUS clients.

DRC

server-key

Configures a global shared secret that is used for

all dynamic RADIUS clients that do not have an

individual shared secret configured.

DRC

show dot1x

Displays 802.1X status for the switch or the

specified interface.

show dot1x authentication-

history

Displays the dot1x authentication events and

information during successful and unsuccessful

dot1x authentication processes.

Command Description Modea

Dell EMC Networking CLI 144

Captive Portal

show dot1x clients

Displays detailed information about the users

who have successfully authenticated on the

system or on a specified port.

show dot1x interface

Shows the status of MAC Authentication

Bypass.

show dot1x interface

statistics

Displays 802.1X statistics for the specified

interface.

show dot1x users

Displays active 802.1X authenticated users for

the switch.

clear dot1x authentication–

history

Clears the authentication history table captured

during successful and unsuccessful

authentication.

dot1x guest-vlan

Sets the guest VLAN on a port. IC

dot1x unauth-vlan

Specifies the unauthenticated VLAN on a port. IC

show dot1x advanced

Displays 802.1X advanced features for the

switch or specified interface.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

authentication timeout

Configures the authentication timeout. CP

captive-portal

Enables the captive portal configuration mode. GC

enable

Globally enables captive portal. CPI

http port

Configures an additional HTTP port for captive

portal to monitor.

https port

Configures an additional HTTPS port for

captive portal to monitor.

show captive-portal

Displays the status of captive portal. PE

show captive-portal status

Reports the status of all captive portal instances

in the system.

Command Description Modea

Dell EMC Networking CLI 145

block

Blocks all traffic for a captive portal

configuration.

CPI

configuration

Enables the captive portal instance mode. CP

enable

Enables a captive portal configuration. CPI

group

Configures the group number for a captive

portal configuration.

CPI

interface

Associates an interface with a captive portal

configuration.

CPI

locale

Associates an interface with a captive portal

configuration.

CPI

name (Captive Portal)

Configures the name for a captive portal

configuration.

CPI

protocol

Configures the protocol mode for a captive

portal configuration.

CPI

redirect

Enables the redirect mode for a captive portal

configuration.

CPI

redirect-url

Configures the redirect URL for a captive portal

configuration.

CPI

session-timeout

Configures the session timeout for a captive

portal configuration.

CPI

verification

Configures the verification mode for a captive

portal configuration.

CPI

captive-portal client

deauthenticate

De-authenticates a specific captive portal

client.

show captive-portal client

status

Displays client connection details or a

connection summary for connected captive

portal users.

show captive-portal

configuration client status

Displays the clients authenticated to all captive

portal configurations or a to specific

configuration.

show captive-portal

interface client status

Displays information about clients

authenticated on all interfaces or a specific

interface.

Command Description Modea

Dell EMC Networking CLI 146

show captive-portal

interface configuration

status

Displays the clients authenticated to all captive

portal configurations or a to specific

configuration.

clear captive-portal users

Deletes all captive portal user entries. PE

no user

Deletes a user from the local user database. CP

show captive-portal user

Displays all configured users or a specific user in

the captive portal local user database.

user group

Associates a group with a captive portal user. CP

user-logout

Enables captive portal users to log out of the

portal.

CPI

user name

Modifies the user name for a local captive portal

user.

user password

Creates a local user or changes the password for

an existing user.

user session-timeout

Sets the session timeout value for a captive

portal user.

show captive-portal

configuration

Displays the operational status of each captive

portal configuration.

show captive-portal

configuration interface

Displays information about all interfaces

assigned to a captive portal configuration or

about a specific interface assigned to a captive

portal configuration.

show captive-portal

configuration locales

Displays locales associated with a specific

captive portal configuration.

show captive-portal

configuration status

Displays information about all configured

captive portal configurations or a specific

captive portal configuration.

user group

Creates a user group. CP

user group moveusers

Moves a group's users to a different group. CP

user group name

Configures a group name. CP

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

Dell EMC Networking CLI 147

Denial of Service

Management ACL

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

dos-control firstfrag

Enables Minimum TCP Header Size Denial of

Service protection.

dos-control icmp

Enables Maximum ICMP Packet Size Denial of

Service protections.

dos-control l4port

Enables L4 Port Denial of Service protection. GC

dos-control sipdip

Enables Source IP Address = Destination IP

Address (SIP=DIP) Denial of Service protection.

dos-control tcpflag

Enables TCP Flag Denial of Service protections. GC

dos-control tcpfrag

Enables TCP Fragment Denial of Service

protection.

rate-limit cpu

Configures the rate in packets-per-second for the

number of IPv6 data packets trapped to CPU

when the packet fails to be forwarded in the

hardware due to unresolved hardware address of

the destined IPv6 node.

show dos-control

Displays Denial of Service configuration

information.

show system internal

pktmgr

Displays the configured CPU rate limit for

unknown packets in packets per second.

storm-control broadcast

Enables Broadcast storm control. IC

storm-control multicast

Enables the switch to count Multicast packets

together with Broadcast packets.

storm-control unicast

Enables Unicast storm control. IC

Command Description Modea

deny (management)

Defines a deny rule. MA

management access-class

Defines which management access-list is used. GC

Dell EMC Networking CLI 148

Password Management

management access-list

Defines a management access-list, and enters

the access-list for configuration.

permit (management)

Defines a permit rule. MA

show management access-

class

Displays the active management access-list. PE

show management access-

list

Displays management access-lists. PE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

passwords aging

Implements aging on the passwords such that

users are required to change passwords when

they expire.

passwords history

Enables the administrator to set the number of

previous passwords that are stored to ensure

that users do not reuse their passwords too

frequently.

passwords lock-out

Enables the administrator to strengthen the

security of the switch by enabling the user

lockout feature. When a lockout count is

configured, a user who is logging in must enter

the correct password within that count.

passwords min-length

Enables the administrator to enforce a

minimum length required for a password.

passwords strength-check

Enables the Password Strength feature. GC

passwords strength

minimum uppercase-letters

Enforces a minimum number of uppercase

letters that a password should contain.

passwords strength

minimum lowercase-letters

Enforces a minimum number of lowercase

letters that a password must contain.

passwords strength

minimum numeric-

characters

Enforces a minimum number of numeric

numbers that a password should contain.

Command Description Modea

Dell EMC Networking CLI 149

SSH

passwords strength

minimum special-characters

Enforces a minimum number of special

characters that a password may contain.

passwords strength max-

limit consecutive-characters

Enforces a maximum number of consecutive

characters that a password can contain.

passwords strength max-

limit repeated-characters

Enforces a maximum repeated characters that a

password should contain.

passwords strength

minimum character-classes

Enforces the minimum number of character

classes (uppercase letters, lowercase letters,

numeric characters and special characters) that

a password must contain.

passwords strength exclude-

keyword

Enforces a maximum number of consecutive

characters that a password can contain.

enable password encrypted

Used by an Administrator to transfer the enable

password between devices without having to

know the password.

show passwords

configuration

Displays the configuration parameters for

password configuration.

show passwords result

Displays the last password set result

information.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

crypto key generate dsa

Generates DSA key pairs for the switch. GC

crypto key generate rsa

Generates RSA key pairs for the switch. GC

crypto key pubkey-chain ssh

Enters SSH Public Key-chain configuration

mode.

crypto key zeroize pubkey-

chain

Erases all public key chains or the public key

chain for a user.

crypto key zeroize {rsa|dsa}

Deletes the RSA or DSA keys from the switch. GC

ip ssh port

Specifies the port to be used by the SSH server. GC

Command Description Modea

Dell EMC Networking CLI 150

Audio Visual Bridging Commands

MMRP

ip ssh pubkey-auth

Enables public key authentication for incoming

SSH sessions.

ip ssh server

Enables the switch to be configured from a SSH

server connection.

key-string

Manually specifies a SSH public key. SK

show crypto key mypubkey

Displays its own SSH public keys stored on the

switch.

show crypto key pubkey-

chain ssh

Displays SSH public keys stored on the switch. PE

show ip ssh

Displays the SSH server configuration. PE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

clear mmrp statistics

Clears the MMRP statistics for an interface or

all interfaces.

mmrp

Enables MMRP on a specific interface. IC or

mmrp global

Globally enables MMRP. GC

mmrp periodic state

machine

Globally enables the MMRP periodic state

machine.

show mmrp

Displays the MMRP configuration for an

interface or globally.

PE or

show mmrp statistics

Displays the MMRP statistics for an interface

or globally.

PE or

Command Description Modea

Dell EMC Networking CLI 151

MVRP

MSRP

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

clear mmrp statistics

Clears the MVRP statistics for an interface or

all interfaces.

mmrp

Enables MVRP on a specific interface. IC

mmrp global

Globally enables MVRP. GC

mmrp periodic state

machine

Globally enables the MVRP periodic state

machine.

show mmrp

Displays the MVRP configuration for an

interface or globally.

show mmrp statistics

Displays the MVRP statistics for an interface

or globally.

Command Description Modea

clear msrp statistics

Clears the MSRP statistics for an interface or

all interfaces.

msrp (Interface)

Enables MSRP on a specific interface. IC

msrp boundary-propagate

Configures the IEEE 802.1Qav boundary

propagation.

msrp delta-bw

Configures the MSRP VLAN ID for the SR

traffic class on the interface.

msrp global

Globally enables MSRP. GC

msrp max-fan-in-ports

Configures the fan-in value used in calculating

available bandwidth.

msrp srclass-pvid

Configures the MSRP VLAN ID for the SR

traffic class on the interface.

msrp srclassqav

Configures the IEEE 802.1Qav class priority

map.

Dell EMC Networking CLI 152

802.1AS Timesync

msrp talker-pruning

Enables source pruning. GC

show msrp

Displays the MSRP configuration for an

interface or globally.

PE or

show msrp reservations

Displays the MSRP reservation information for

an interface.

PE or

show msrp statistics

Displays the MSRP statistics for an interface

or globally.

PE or

show msrp stream

Displays MSRP stream information. PE or

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

clear dot1as statistics

Clears the IEEE 802.1AS statistics for an

interface or all interfaces.

dot1x dynamic-vlan enable

Globally enables IEEE 802.1AS. GC

dot1as (Interface

Configuration)

Enables IEEE 802.1AS on an interface. IC

dot1as priority

Globally configures the priority 1 or priority 2

value.

dot1as interval announce

Configures the initial log announcement

interval for an interface.

dot1as interval sync

Configures the sync interval for an interface. IC

dot1as interval pdelay

Configures the pdelay interval for an interface. IC

dot1as timeout announce

Configures the number of announce intervals

expiries with no received announce message in

which case the master is considered to be no

longer transmitting.

dot1as timeout sync

Configures the number of sync intervals

expiries with no received announce message in

which case the master is considered to be no

longer transmitting.

Command Description Modea

Dell EMC Networking CLI 153

Data Center Commands

Data Center Bridging

dot1as pdelay-threshold

Configures the propagation delay threshold in

nanoseconds, above which an interface is not

considered capable of participating in the

802.1AS protocol.

dot1as interval pdelay-loss

Configures the number of Pdelay_Req messages

for which a valid response has not been

received, above which a port is considered to

not be exchanging peer delay messages with its

neighbor.

show dot1as

Displays the IEEE 802.1AS configuration for

an interface or globally.

show dot1as statistics

Displays the IEEE 802.1AS statistics for an

interface.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

datacenter-bridging

Enables an Ethernet interface to enter

DataCenterBridging mode.

lldp dcbx version

Configures the administrative version for the

Data Center Bridging Capability Exchange

(DCBX) protocol.

lldp tlv-select dcbxp (dcb

enable)

Enables the LLDP to send DCBX TLVs, if

LLDP is enabled to transmit on the given

interface.

GC or

lldp dcbx port-role

Configures the port role to manual, auto-

upstream, auto-downstream and configuration

source.

show lldp tlv-select

Displays the Traffic Class to Traffic Class Group

mapping.

Command Description Modea

Dell EMC Networking CLI 154

OpenFlow

show lldp dcbx

Displays the Traffic Class to Traffic Class Group

mapping.

classofservice traffic-class-

group

Maps the internal Traffic Class to an internal

Traffic Class Group (TCG).

GC or

traffic-class-group max-

bandwidth

Specifies the maximum transmission

bandwidth limit for each TCG as a percentage

of the interface rate.

GC or

traffic-class-group min-

bandwidth

Specifies the minimum transmission bandwidth

guaranteed for each TCG before processing

frames from other TCGs on an interface.

GC or

traffic-class-group strict

Activates the strict priority scheduler mode for

each specified TCG.

GC or

traffic-class-group weight

Specifies the scheduling weight for each TCG. GC or

show classofservice traffic-

class-group

Displays the Traffic Class to Traffic Class Group

mapping.

show interfaces traffic

Displays traffic information. PE

show interfaces traffic-class-

group

Displays the Traffic Class to Traffic Class Group

mapping.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

controller

Configures a connection to an OpenFlow

controller

OFC

hardware profile openflow

Selects the forwarding mode for the OpenFlow

hybrid capability.

ipv4 address

Assigns the IPv4 source address utilized for

controller connections.

OFC

mode

Configures the selection of interfaces used to

assign the IP address utilized for controller

connections.

OFC

Command Description Modea

Dell EMC Networking CLI 155

Priority Flow Control

Layer 3 Routing Commands

ARP (IPv4)

openflow

Enables OpenFlow on the switch (if disabled)

and enters into OpenFlow configuration mode.

passive

Sets the switch to wait for the controller to

initiate the connection.

OFC

protocol-version

Selects the version of the protocol in which to

operate.

OFC

show openflow

Displays OpenFlow configuration and status. PE,

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

Data Center Bridging

Capability Exchange

Commands

Enables Priority-Flow-Control (PFC) on an

interface.

DCB

priority-flow-control priority

Enables the priority group for lossless (no-drop)

or lossy (drop) behavior on the selected

interface.

DCB

clear priority-flow-control

statistics

Clears all or interface Priority-Flow-Control

statistics.

show interfaces priority-

flow-control

Displays the global or interface priority flow

control status and statistics.

Command Description Modea

arp

Creates an Address Resolution Protocol (ARP)

entry.

Command Description Modea

Dell EMC Networking CLI 156

BFD

arp cachesize

Configures the maximum number of entries in

the ARP cache.

arp dynamicrenew

Enables the ARP component to automatically

renew dynamic ARP entries when they age out.

arp purge

Causes the specified IP address to be removed

from the ARP cache.

arp resptime Configures the ARP request response timeout.

arp retries

Configures the ARP count of maximum request

for retries.

arp timeout

Configures the ARP entry age-out time. GC

clear arp-cache

Removes all ARP entries of type dynamic from

the ARP cache.

clear arp-cache management

Removes all entries from the ARP cache learned

from the management port.

ip local-proxy-arp

Enables proxying of ARP requests. IC

ip proxy-arp

Enables proxy ARP on a router interface. IC

show arp

Displays the Address Resolution Protocol (ARP)

cache.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

feature bfd

Enables BFD on the router. GC

bfd echo

Enables BFD echo mode on an interface. IC

bfd interval

Configures BFD session parameters for a VLAN

routing interface.

bfd slow-timer

Configures the BFD periodic slow transmission

interval for BFD Control packets.

ip ospf bfd

Enable sending of BFD events to OSPF on a

VLAN routing interface.

Command Description Modea

Dell EMC Networking CLI 157

BGP

ipv6 ospf bfd

Enables sending of BFD events to OSPF on a

VLAN routing interface.

neighbor fall-over bfd

Enables BFD support for a BGP neighbor. RBC

show bfd neighbor

Displays the neighbors for which BFD has

established adjacencies.

PE or

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

router bgp

Enables BGP and identify the autonomous

system (AS) number for the router.

address-family

Configures policy parameters within a peer

template to be applied to a specific address

family

PTC

address-family ipv4 vrf

address-family ipv6

Specifies IPv6 configuration parameters. BR

aggregate-address

Configures a summary address for BGP. BR or

IPAF

bgp aggregate-different-

meds (BGP Router

Configuration)

Controls the aggregation of routes with

different multi-exit discriminator (MED)

attributes.

bgp aggregate-different-

meds (IPv6 Address Family

Configuration)

Allows IPv6 routes with different MEDs to be

aggregated.

IPAF

bgp always-compare-med

Compares MED values during the decision

process in paths received from different

autonomous systems.

IPAF

bgp client-to-client

reflection (BGP Router

Configuration)

Enables client-to-client reflection. BR

bgp client-to-client

reflection (IPv6 Address

Family Configuration)

Enables client-to-client reflection. IPAF

Command Description Modea

Dell EMC Networking CLI 158

bgp cluster-id

Specifies the cluster ID of a route reflector. BR

bgp default local-preference

Enables the network operator to specify the

default local preference.

bgp fast-external-fallover

Configures BGP to immediately reset the

adjacency with an external peer if the routing

interface to the peer goes down.

bgp fast-internal-fallover

Configures BGP to immediately reset the

adjacency with an internal peer when there is a

loss of reachability to an internal peer.

bgp listen

Creates an IPv4 listen range and associates it

with the specified peer template.

BR,

IPAF

bgp log-neighbor-changes

Enables logging of adjacency state changes. BR

bgp maxas-limit

Specifies a limit on the length of AS Paths that

BGP accepts from its neighbors.

bgp router-id

Sets the BGP router ID. BR

clear ip bgp

Resets peering sessions with all of a subnet of

BGP peers.

clear ip bgp counters

Resets all BGP counters to 0. PE

default-information

originate (BGP Router

Configuration)

Enables BGP to originate a default route. BR

default-information

originate (IPv6 Address

Family Configuration)

Allows BGP to originate an IPv6 default route. IPAF

default metric (BGP Router

Configuration)

Sets the value of the MED attribute on routes

redistributed into BGP when no metric has

been specified.

default metric (IPv6 Address

Family Configuration)

Sets the metric of redistributed IPv6 routes

when a metric is not configured in the

redistribute command.

IPAF

distance

Sets the preference of BGP routes to specific

destinations.

IPAF

Command Description Modea

Dell EMC Networking CLI 159

distance bgp (BGP Router

Configuration)

Sets the preference of BGP routes. BR

distance bgp (IPv6 Address

Family Configuration)

Sets the preference of BGP routes. IPAF

distribute-list prefix in

Configures a filter that restricts the routes that

BGP accepts from all neighbors based on

destination prefix.

IPAF

distribute-list prefix out

(BGP Router

Configuration)

Configures a filter that restricts the

advertisement of routes based on destination

prefix.

distribute-list prefix out

(IPv6 Address Family

Configuration)

Applies an IPv6 prefix list to IPv6 routes

advertised via BGP.

IPAF

enable

Globally enables BGP. BR

ip as-path access-list

Creates an AS path access list. GC

ip bgp-community new-

format

Displays BGP standard communities in AA:NN

format.

ip bgp fast-external-fallover

Configures fast external failover behavior for a

specific routing interface.

ip community-list

Creates or configures a BGP community list. GC

ip extcommunity-list

Creates an extended community list to

configure VRF route filtering.

match extcommunity

Matches BGP extended community list

attributes.

maximum-paths (BGP

Router Configuration)

Specifies the maximum number of next hops

BGP may include in an Equal Cost Multipath

(ECMP) route derived from paths received

from neighbors outside the local autonomous

system.

maximum-paths (IPv6

Address Family

Configuration)

Limits the number of ECMP next hops in IPv6

routes from external peers.

IPAF

Command Description Modea

Dell EMC Networking CLI 160

maximum-paths ibgp (BGP

Router Configuration)

Specifies the maximum number of next hops

BGP may include in an Equal Cost Multipath

(ECMP) route derived from paths received

from neighbors within the local autonomous

system.

maximum-paths ibgp (IPv6

Address Family

Configuration)

Limits the number of ECMP next hops in IPv6

routes from internal peers.

IPAF

neighbor activate

Enables the exchange of IPv6 routes with a

neighbor.

IPAF,

IPAF4

neighbor advertisement-

interval (BGP Router

Configuration)

Configures the minimum time that must elapse

between advertisements of the same route to a

given neighbor.

neighbor advertisement-

interval (IPv6 Address

Family Configuration)

Controls the time between sending Update

messages containing IPv6 routes.

IPAF

neighbor allowas-in

Configures BGP to accept prefixes even if the

local ASN is part of the AS_PATH.

neighbor connect-retry-

interval

Configure the initial connection retry time for a

specific neighbor.

neighbor default-originate

(BGP Router

Configuration)

Configures BGP to originate a default route to a

specific neighbor.

neighbor default-originate

(IPv6 Address Family

Configuration)

Configures BGP to originate a default IPv6

route to a specific neighbor.

IPAF

neighbor description

Records a text description of a neighbor. BR

neighbor ebgp-multihop

Configures BGP to form neighborship with

external peers that are not directly connected.

BR,

IPAF

neighbor filter-list (BGP

Router Configuration)

Filters advertisements to or from a specific

neighbor according to the advertisement’s AS

Path.

neighbor filter-list (IPv6

Address Family

Configuration)

Filters BGP to apply an AS path access list to

UPDATE messages received from or sent to a

specific neighbor.

IPAF

Command Description Modea

Dell EMC Networking CLI 161

neighbor inherit peer

Configures a BGP peer to inherit peer

configuration parameters from a peer template.

neighbor local-as

Configures BGP to advertise the local-as instead

of the router’s own AS in the routes advertised

to the neighbor.

BR,

IPAF

neighbor maximum-prefix

(BGP Router

Configuration)

Configures the maximum number of IPv4

prefixes that BGP will accept from a specified

neighbor.

neighbor maximum-prefix

(IPv6 Address Family

Configuration)

Specifies the maximum number of IPv6 prefixes

that BGP will accept from a given neighbor.

IPAF

neighbor next-hop-self

(BGP Router

Configuration)

Configures BGP to set the next hop attribute to

a local IP address when advertising a route to an

internal peer.

neighbor next-hop-self (IPv6

Address Family

Configuration)

Configures BGP to use a local address as the

IPv6 next hop when advertising IPv6 routes to a

specific peer.

IPAF

neighbor password

Enables MD5 authentication of TCP segments

sent to and received from a neighbor, and to

configure an authentication key.

neighbor prefix-list (BGP

Router Configuration)

Filters advertisements sent to a specific

neighbor based on the destination prefix of each

route.

neighbor prefix-list (IPv6

Address Family

Configuration)

Specifies an IPv6 prefix list to filter routes

received from or advertised to a given peer.

IPAF

neighbor remote-as

Configures a neighbor and identify the

neighbor’s autonomous system.

neighbor remove-private-as

Removes private AS numbers when advertising

IPv4 routes to an external peer.

neighbor rfc5549-support

Enables advertisement of IPv4 routes over IPv6

next hops selectively to an external BGP IPv6

peer.

neighbor route-map (BGP

Router Configuration)

Applies a route map to incoming or outgoing

routes for a specific neighbor.

Command Description Modea

Dell EMC Networking CLI 162

neighbor route-map (IPv6

Address Family

Configuration)

Specifies a route map to be applied to inbound

or outbound IPv6 routes.

IPAF

neighbor route-reflector-

client (BGP Router

Configuration)

Configures an internal peer as an IPv4 route

reflector client.

neighbor route-reflector-

client (IPv6 Address Family

Configuration)

Configures an internal peer as an IPv4 route

reflector client.

IPAF

neighbor send-community

(BGP Router

Configuration)

Configures the local router to send the BGP

communities attribute in UPDATE messages to

a specific neighbor.

neighbor send-community

(IPv6 Address Family

Configuration)

Tells BGP to send the COMMUNITIES

attribute with routes advertised to the peer.

IPAF

neighbor shutdown

Administratively disables communications with

a specific BGP neighbor.

BR,

IPAF

neighbor timers

Overrides the global keepalive and hold timer

values as well as set the keepalive and hold

timers for a specific neighbor.

neighbor update-source

Configures BGP to use a specific IP address as

the source address for the TCP connection with

a neighbor.

network (BGP Router

Configuration)

Configures BGP to advertise an address prefix. BR

network (IPv6 Address

Family Configuration)

Identifies network IPv6 prefixes that BGP

originates in route advertisements to its

neighbors.

IPAF

redistribute (BGP)

Configures BGP to advertise routes learned by

means outside of BGP. BGP can redistribute

local (connected), static, OSPF, and RIP routes.

redistribute (BGP IPv6)

Configures BGP to redistribute non-BGP routes

from the IPv6 routing table.

IPAF

Command Description Modea

Dell EMC Networking CLI 163

route-target

Creates a list of export, import, or both route

target (RT) extended communities for the

specified VRF instance.

set extcommunity rt

Sets BGP extended community attributes for

the route target.

RMC

set extcommunity soo

Sets BGP extended community attributes for

the site of origin.

RMC

show bgp ipv6

Displays IPv6 routes in the BGP routing table. UE,

PE,

show bgp ipv6 aggregate-

address

Displays the configured IPv6 aggregate

addresses and indicates if each address is

currently active.

show bgp ipv6 community

Displays the IPv6 routes that belong to the

specified set of communities.

show bgp ipv6 community-

list

Displays the IPv6 routes that match a specified

community list.

show bgp ipv6 listen range

Displays information about IPv6 BGP listen

ranges.

show bgp ipv6 neighbors

Displays neighbors with IPv4 or IPv6 peer

addresses that are enabled for the exchange of

IPv6 prefixes.

show bgp ipv6 neighbors

advertised-routes

Displays IPv6 routes advertised to a specific

neighbor.

show bgp ipv6 neighbors

policy

Displays the inbound and outbound IPv6

policies configured for a specific peer.

show bgp ipv6 neighbors

received-routes

Displays a list of IPv6 routes received from a

specific neighbor.

show bgp ipv6 statistics

Displays statistics for the IPv6 decision process. UE,

PE,

show bgp ipv6 summary

Displays a summary of BGP configuration and

status.

UE,

PE,

Command Description Modea

Dell EMC Networking CLI 164

show bgp ipv6 update-group

Reports the status of IPv6 outbound groups and

their members.

show bgp ipv6 route-

reflection

Displays a summary of BGP route reflection. PE

show ip bgp

Displays BGP routes. UE

show ip bgp aggregate-

address

Lists the aggregate addresses that have been

configured and indicates whether each is

currently active.

show ip bgp community

Displays a BGP community. PE

show ip bgp community-list

Lists the routes that are allowed by the specified

community list.

show ip bgp extcommunity-

list

Displays all the permit and deny attributes of

the given extended community list.

PE,

show ip bgp listen range

Displays information about IPv4 BGP listen

ranges.

show ip bgp neighbors

Shows details about BGP neighbor

configuration and status.

show ip bgp neighbors

advertised-routes

Displays the list of routes advertised to a

specific neighbor.

show ip bgp neighbors

received-routes

Displays the list of routes received from a

specific neighbor.

show ip bgp neighbors policy

Displays the inbound and outbound IPv4

policies configured for a specific peer.

show ip bgp route-reflection

Displays all global configuration related to IPv4

route reflection, including the cluster ID and

whether client-to-client route reflection is

enabled, and lists all the neighbors that are

configured as route reflector clients.

show ip bgp statistics

Displays recent decision process history. UE

show ip bgp summary

Displays a summary of BGP configuration and

status.

show ip bgp template

Lists the routes that are allowed by the specified

community list.

Command Description Modea

Dell EMC Networking CLI 165

BGP Routing Policy

show ip bgp traffic

Lists the routes that are allowed by the specified

community list.

show ip bgp update-group

Reports the status of IPv4 outbound update

groups and their members.

show ip bgp vpn4

Displays the VPNv4 address information from

the BGP table.

PE,

template peer

Creates a BGP peer template and enters peer

template configuration mode.

timers bgp

Configures the default keepalive and hold

timers that BGP uses for all neighbors unless

specifically overridden by the neighbor timers

command.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

ip as-path access-list

Create an AS path access list. GC

ip bgp-community new-

format

Displays BGP standard communities in AA:NN

format.

ip community-list

Creates or configures a BGP community list. GC

ip prefix-list

Creates a prefix list or adds a prefix list entry. GC

ip prefix-list description

Applies a text description to a prefix list. GC

ipv6 prefix-list

Creates an IPv6 prefix list or add an IPv6 prefix

list entry.

match as-path

Adds criteria that matches BGP autonomous

system paths against an AS path access list to a

route map.

match community

Configures a route map to match based on a

BGP community list.

match ip address prefix-list

Configures a route map to match based on a

destination prefix.

Command Description Modea

Dell EMC Networking CLI 166

DHCP Server and Relay Agent (IPv4)

match ipv6 address prefix-

list

Configures a route map to match based on an

IPv6 destination prefix.

show ip as-path-access-list

Displays the contents of AS path access lists. PE or

show ip community-list

Displays the contents of AS path access lists. PE or

show ip prefix-list

Displays the contents of IPv4 prefix lists. PE or

show ipv6 prefix-list

Displays the contents of IPv6 prefix lists. PE or

clear ip prefix-list

Resets the IPv4 prefix-list counters. PE

clear ipv6 prefix-list

Resets the IPv6 prefix-list counters. PE

clear ip community-list

Resets the IPv6 prefix-list counters. PE

set as-path

Prepends one or more AS numbers to the AS

path in a BGP route.

set comm-list delete

Removes BGP communities from an inbound

or outbound UPDATE message.

set community

Modifies the communities attribute of

matching routes.

set ipv6 next-hop (BGP)

Sets the IPv6 next hop of a route. RM

set local-preference

Sets the local preference of specific BGP routes. RM

set metric

Sets the metric of a route. RM

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

ip dhcp pool

Defines a DHCP address pool that can be used

to supply addressing information to DHCP

client. This command puts the user into DHCP

Pool Configuration mode.

Command Description Modea

Dell EMC Networking CLI 167

bootfile

Sets the name of the image for the DHCP

client to load.

clear ip dhcp binding

Removes automatic DHCP server bindings. PE

clear ip dhcp conflict

Removes DHCP server address conflicts. PE

client-identifier

Identifies a a Microsoft® DHCP client to be

manually assigned an address.

client-name

Specifies the host name of a DHCP client. DP

default-router

Sets the IPv4 address of one or more routers for

the DHCP client to use.

dns-server (IP DHCP Pool

Config)

Sets the IPv4 DNS server address which is

provided to a DHCP client by the DHCP server.

domain-name (IP DHCP

Pool Config)

Sets the DNS domain name which is provided

to a DHCP client by the DHCP server.

hardware-address

Specifies the MAC address of a client to be

manually assigned an address.

host

Specifies a manual binding for a DHCP client

host.

ip dhcp bootp automatic

Enables automatic BOOTP address

assignments.

ip dhcp conflict logging

Enables DHCP address conflict detection. GC

ip dhcp excluded-address

Excludes one or more DHCP addresses from

automatic assignment.

ip dhcp ping packets

Configures the number of pings sent to detect if

an address is in use prior to assigning an address

from the DHCP pool.

lease

Sets the period for which a dynamically

assigned DHCP address is valid.

netbios-name-server

Configures the IPv4 address of the Windows®

Internet Naming Service (WINS) for a

Microsoft DHCP client.

netbios-node-type

Sets the NetBIOS node type for a Microsoft

DHCP client.

Command Description Modea

Dell EMC Networking CLI 168

DHCPv6

network

Defines a pool of IPv4 addresses for distributing

to clients.

next-server

Sets the IPv4 address of the TFTP server to be

used during auto-install.

option

Supplies arbitrary configuration information to

a DHCP client.

service dhcp

Enables local IPv4 DHCP server on the switch. GC

sntp

Sets the IPv4 address of the NTP server to be

used for time synchronization of the client.

show ip dhcp binding

Displays the configured DHCP bindings. PE

show ip dhcp conflict

Displays DHCP address conflicts for all relevant

interfaces or a specified interface.

show ip dhcp global

configuration

Displays the DHCP global configuration. PE

show ip dhcp pool

Displays the configured DHCP pool or pools. UE or

show ip dhcp server statistics

Displays the DHCP server binding and message

counters.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

clear ipv6 dhcp

Clears DHCPv6 statistics for all interfaces or for

a specific interface.

dns-server (IPv6 DHCP Pool

Config)

Sets the IPv6 DNS server address which is

provided to a DHCPv6 client by the DHCPv6

server.

v6DP

domain-name (IPv6 DHCP

Pool Config)

Sets the DNS domain name which is provided

to a DHCPv6 client by the DHCPv6 server.

v6DP

ipv6 dhcp pool

Enters IPv6 DHCP Pool Configuration mode. GC

ipv6 dhcp relay

Configures an interface for DHCPv6 Relay

functionality.

Command Description Modea

Dell EMC Networking CLI 169

DHCPv6 Snooping

ipv6 dhcp server

Configures DHCPv6 server functionality on an

interface.

prefix-delegation

Defines Multiple IPv6 prefixes within a pool for

distributing to specific DHCPv6 Prefix

delegation clients.

v6DP

service dhcpv6

Enables DHCPv6 configuration on the router. GC

show ipv6 dhcp

Displays the DHCPv6 server name and status. PE

show ipv6 dhcp binding

Displays the configured DHCP pool. PE

show ipv6 dhcp interface

(User Exec)

Displays DHCPv6 information for all relevant

interfaces or a specified interface.

show ipv6 dhcp interface

(Privileged Exec)

Displays DHCPv6 information for all relevant

interfaces or a specified interface.

show ipv6 dhcp pool

Displays the configured DHCP pool. PE

show ipv6 dhcp statistics

Displays the DHCPv6 server name and status. UE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

clear ipv6 dhcp snooping

binding

Clears all IPv6 DHCP snooping entries. UE or

clear ipv6 dhcp snooping

statistics

Clears all IPv6 DHCP snooping statistics. UE or

ipv6 dhcp snooping

Globally enables IPv6 DHCP snooping. GC

ipv6 dhcp snooping vlan

Enables IPv6 DHCP snooping on a set of

VLANs.

ipv6 dhcp snooping binding

Configures a static IPv6 DHCP snooping

binding.

ipv6 dhcp snooping database

Configures the persistent location of the DHCP

snooping database.

ipv6 dhcp snooping database

write-delay

Configures the time period between successive

writes of the binding database.

Command Description Modea

Dell EMC Networking CLI 170

ipv6 dhcp snooping limit

Configures an interface to disable itself if the

rate of received DHCP messages exceeds the

configured limit.

ipv6 dhcp snooping log-

invalid

Configures the port to log invalid received

DHCP messages.

ipv6 dhcp snooping trust

Configures the port as trusted. IC

ipv6 dhcp snooping verify

mac-address

Enables the additional verification of the source

MAC address with the client hardware address

in the received DHCP message.

ipv6 verify binding

Configures a static IP source guard binding. GC

ipv6 verify source

Configures an interface to filter incoming

traffic from sources that are not present in the

DHCP binding database.

show ipv6 dhcp snooping

Displays the IPv6 DHCP snooping

configuration.

UE or

show ipv6 dhcp snooping

binding

Displays the IPv6 DHCP snooping

configuration.

UE or

show ipv6 dhcp snooping

database

Displays IPv6 DHCP snooping configurations

related to database persistency.

UE or

show ipv6 dhcp snooping

statistics

Displays IPv6 DHCP snooping filtration

statistics.

UE or

show ipv6 source binding

Displays the IPv6 source guard configurations

on all ports, an individual port, or on a VLAN.

UE or

show ipv6 verify

Displays the IPv6 Source Guard configuration

on all interfaces or the specified interface.

UE or

show ipv6 verify source

Displays the Ipv6 source guard configurations

on all ports.

UE or

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

Dell EMC Networking CLI 171

DVMRP

GMRP

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

router bgp

ets the administrative mode of DVMRP in the

router to active.

GC or

ip dvmrp metric

Configures the metric for an interface. IC

show ip dvmrp

Displays the system-wide information for

DVMRP.

show ip dvmrp interface

Displays the interface information for DVMRP

on the specified interface.

show ip dvmrp neighbor

Displays the neighbor information for DVMRP. PE

show ip dvmrp nexthop

isplays the next hop information on

outgoing interfaces for routing multicast

datagrams.

show ip dvmrp prune

Displays the table that lists the router’s

upstream prune information.

show ip dvmrp route

Displays the multicast routing information for

DVMRP.

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

gmrp enable

Enables GMRP globally or on a port. GC or

clear gvrp statistics

Clears all the GMRO statistics information. PE

show gmrp configuration

Displays GMRP configuration. GC or

Dell EMC Networking CLI 172

IGMP

Command Description Modea

ip igmp last-member-query-

count

Sets the number of Group-Specific Queries

sent before the router assumes that there are

no local members on the interface.

ip igmp last-member-query-

interval

Configures the Maximum Response Time

inserted in Group-Specific Queries which are

sent in response to Leave Group messages.

ip igmp mroute-proxy

Configures downstream IGMP proxy on the

selected VLAN interface associated with

multicast hosts.

ip igmp query-interval

Configures the query interval for the specified

interface. The query interval determines how

fast IGMP Host-Query packets are transmitted

on this interface.

ip igmp query-max-response-

time

Configures the maximum response time

interval for the specified interface.

ip igmp robustness

Configures the robustness that allows tuning

of the interface.

ip igmp startup-query-count

Sets the number of queries sent out on

startup — at intervals equal to the startup

query interval for the interface.

ip igmp startup-query-

interval

Sets the interval between general queries sent

at startup on the interface.

ip igmp version

Configures the version of IGMP for an

interface.

show ip igmp

Displays system-wide IGMP information. PE

show ip igmp groups

Displays the registered multicast groups on the

interface.

show ip igmp interface

Displays the IGMP information for the

specified interface.

show ip igmp membership

Displays the list of interfaces that have

registered in the multicast group.

Dell EMC Networking CLI 173

IGMP Proxy

IP Helper/DHCP Relay

show ip igmp interface stats

Displays the IGMP statistical information for

the interface.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

arp

Enables the IGMP Proxy on the router. IC

ip igmp proxy-service reset-

status

Resets the host interface status parameters of

the IGMP Proxy router.

ip igmp proxy-service

unsolicit-rprt-interval

Sets the unsolicited report interval for the

IGMP Proxy router.

show ip igmp proxy-service

Displays a summary of the host interface status

parameters.

show ip igmp proxy-service

interface

Displays a detailed list of the host interface

status parameters.

show ip igmp-proxy groups

Displays a table of information about multicast

groups that IGMP Proxy reported.

show ip igmp proxy-service

groups detail

Displays complete information about multicast

groups that IGMP Proxy has reported.

Command Description Modea

bootpdhcprelay

maxhopcount

Configures the maximum allowable relay agent

hops for BootP/DHCP Relay on the system.

bootpdhcprelay

minwaittime

Configures the minimum wait time in seconds

for BootP/DHCP Relay on the system.

clear ip helper statistics

Resets (to 0) the statistics displayed in show ip

helper statistics.

Command Description Modea

Dell EMC Networking CLI 174

IP Routing

ip dhcp relay information

check

Enables DHCP Relay to check that the relay

agent information option in forwarded

BOOTREPLY messages is valid.

ip dhcp relay information

check-reply

Enables DHCP Relay to check that the relay

agent information option in forwarded

BOOTREPLY messages is valid.

ip dhcp relay information

option

Enables the circuit ID option and remote agent

ID mode for BootP/DHCP Relay on the system

(also called option 82).

ip dhcp relay information

option-insert

Enables the circuit ID option and remote agent

ID mode for BootP/DHCP Relay on the circuit

ID option and remote agent ID mode for

BootP/DHCP Relay on the interface (also called

option 82).

ip helper-address (global

configuration)

Configures the relay of certain UDP broadcast

packets received on any interface.

ip helper-address (interface

configuration)

Configures the relay of certain UDP broadcast

packets received on a specific interface.

ip helper enable

Enables relay of UDP packets. GC

show ip helper-address

Displays the IP helper address configuration. PE

show ip dhcp relay

Displays the BootP/DHCP Relay information. UE or

show ip helper statistics

Displays the number of DHCP and other UDP

packets processed and relayed by the UDP relay

agent.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

encapsulation

Configures the link layer encapsulation type for

the packet.

ip icmp echo-reply

Configures an IP address on an interface. IC

Command Description Modea

Dell EMC Networking CLI 175

ip netdirbcast

nables the forwarding of network-directed

broadcasts.

ip policy route-map

Applies a route map on an interface. IC

ip redirects

Enables the generation of ICMP Redirect

messages.

ip route

Configures a static route. Use the no form of

the command to delete the static route.

ip route default

Configures the default route. Use the no form

of the command to delete the default route.

ip route distance

Sets the default distance (preference) for static

routes.

ip routing

Globally enables IPv4 routing on the router. GC

ip unnumbered

Identifies an interface as an unnumbered

interface and specifies the numbered interface

providing the borrowed address.

ip unnumbered gratuitous-

arp accept

Enables installation of a static interface route to

the unnumbered peer upon receiving a

gratuitous ARP.

ip unreachables

Enables the generation of ICMP Destination

Unreachable messages.

match ip address

Specify IP address match criteria for a route

map.

match length

Configures packet length matching criteria for a

route map.

match mac-list

Configures MAC ACL match criteria for a route

map.

route-map

Creates a policy based route map. GC

set interface null0

Routes packets to interface null 0. RM

set ip default next-hop

Sets a list of default next-hop IP addresses

to be used if no explicit route for the packet’s

destination address appears in the routing table.

Command Description Modea

Dell EMC Networking CLI 176

IPv6 Routing

set ip next-hop

Specifies the adjacent next-hop router in the

path toward the destination to which the

packets should be forwarded.

set ip precedence

Sets the IP precedence bits in the IP packet

header.

show ip brief

Displays all the summary information of the IP. PE

Maximum Next

Hops.............................. 16

Displays all pertinent information about the IP

interface.

show ip policy

Displays the route maps used for policy based

routing on the router interfaces.

show ip protocols

Displays the parameters and current state of the

active routing protocols.

show ip route

Displays the routing table. PE

show ip route static

Displays the configured routes, whether or not

they are reachable.

show ip route preferences

Displays detailed information about the route

preferences.

show ip route summary

Shows the number of all routes, including best

and non-best routes.

show ip traffic

Displays IP statistical information. UE or

show ip vlan

Displays the VLAN routing information for all

VLANs with routing enabled.

show route-map

Displays the route maps. PE

show routing heap summary

Displays a summary of the memory allocation

from the routing heap.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

arp

Clears all entries in the IPv6 neighbor table

or an entry on a specific interface.

Command Description Modea

Dell EMC Networking CLI 177

clear ipv6 statistics

Clears IPv6 statistics for all interfaces or for a

specific interface, including loopback and

tunnel interfaces.

ipv6 address

Configures an IPv6 address on an interface

(including tunnel and loopback interfaces).

ipv6 enable

Enables IPv6 routing on an interface

(including tunnel and loopback interfaces)

that has not been configured with an explicit

IPv6 address.

ipv6 hop-limit

Configures the hop limit used in IPv6 PDUs

originated by the router.

ipv6 host

Defines static host name-to-IPv6 address

mapping in the host cache.

ipv6 mld last-member-

query-count

Sets the number of listener-specific queries

sent before the router assumes that there are

no local members on the interface.

IC (VC)

ipv6 mld last-member-

query-interval

Sets the last member query interval for the

MLD interface, which is the value of the

maximum response time parameter in the

group specific queries sent out of this

interface.

IC (VC)

ipv6 mld host-proxy

Enables MLD Proxy on the router. IC

ipv6 mld host-proxy reset-

status

Resets the host interface status parameters of

the MLD Proxy router.

ipv6 mld host-proxy

unsolicit-rprt-interval

Sets the unsolicited report interval for the

MLD Proxy router.

ipv6 mld query-interval

Sets the MLD router's query interval for the

interface.

ipv6 mld query-max-

response-time

Sets MLD querier's maximum response time

for the interface.

ipv6 nd dad attempts

Sets the number of duplicate address

detection probes transmitted while doing

neighbor discovery.

Command Description Modea

Dell EMC Networking CLI 178

ipv6 nd managed-config-

flag

Sets the managed address configuration flag

in router advertisements.

ipv6 nd ns-interval

Sets the interval between router

advertisements for advertised neighbor

solicitations.

ipv6 nd nud max-

multicast-solicits

Configures the maximum number of

multicast neighbor solicitations sent during

neighbor resolution or during NUD

(neighbor unreachability detection).

ipv6 nd nud max-unicast-

solicits

Configures the maximum number of unicast

neighbor solicitations sent during neighbor

resolution or during NUD (neighbor

unreachability detection).

ipv6 nd nud retry

Configures the exponential backoff multiple

to be used in the calculation of the next

timeout value for Neighbor Solicitation

transmission during NUD (neighbor

unreachabililty detection) following the

exponential backoff algorithm.

ipv6 nd other-config-flag

Sets the other stateful configuration flag in

router advertisements sent from the

interface.

ipv6 nd prefix

Sets the IPv6 prefixes to include in the router

advertisement.

ipv6 nd raguard attach-

policy

Enables RA Guard policy on an interface. IC

ipv6 nd ra-interval

Sets the transmission interval between router

advertisements.

ipv6 nd ra-lifetime

Sets the value that is placed in the Router

Lifetime field of the router advertisements

sent from the interface.

ipv6 nd reachable-time

Sets the router advertisement time to

consider a neighbor reachable after neighbor

discovery confirmation.

Command Description Modea

Dell EMC Networking CLI 179

ipv6 nd suppress-ra

Suppresses router advertisement

transmission on an interface.

ipv6 route

Configures an IPv6 static route GC

ip route distance

Sets the default distance (preference) for

static routes.

ipv6 unicast-routing

Enables forwarding of IPv6 unicast

datagrams.

ipv6 unreachables

Enables the generation of ICMPv6

Destination Unreachable messages.

show ipv6 brief

Displays the IPv6 status of forwarding mode

and IPv6 unicast routing mode.

show ipv6 interface

Shows the usability status of IPv6 interfaces. PE

show ipv6 mld groups

Displays information about multicast groups

that MLD reported.

show ipv6 mld interface

Displays MLD related information for an

interface.

show ipv6 mld host-proxy

Displays a summary of the host interface

status parameters.

show ipv6 mld host-proxy

groups

Displays information about multicast groups

that the MLD Proxy reported.

show ipv6 mld host-proxy

groups detail

Displays information about multicast groups

that MLD Proxy reported.

show ipv6 mld host-proxy

interface

Displays a detailed list of the host interface

status parameters.

show ipv6 mld traffic

Displays MLD statistical information for the

router.

show ipv6 nd raguard

policy

Displays the RA Guard policy on all interfaces

for which it is enabled.

PE or GC

show ipv6 neighbors

Displays information about IPv6 neighbors. PE

show ipv6 protocols

Displays information about the configured

IPv6 routing protocols.

PE or GC

show ipv6 route

Displays the IPv6 routing table. PE

Command Description Modea

Dell EMC Networking CLI 180

Loopback Interface

Multicast

show ipv6 route

preferences

Shows the preference value associated with

the type of route.

show ipv6 route summary

Displays a summary of the routing table. PE

show ipv6 snooping

counters

Displays the RA guard dropped packet

counters.

show ipv6 traffic

Shows traffic and statistics for IPv6 and

ICMPv6.

show ipv6 vlan

Displays IPv6 VLAN routing interface

addresses.

traceroute ipv6

Discovers the routes that packets actually

take when traveling to their destination

through the network on a hop-by-hop basis.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

arp

Enters the Interface Loopback configuration

mode.

show interfaces loopback

Displays information about configured

loopback interfaces.

Command Description Modea

arp

Adds an administrative scope multicast

boundary.

ip mroute

Creates a static multicast route for a source

range.

ip multicast-routing

Sets the administrative mode of the IP

multicast forwarder in the router to active.

ip multicast ttl-threshold

Applies a ttlvalue to a routing interface. IC

Command Description Modea

Dell EMC Networking CLI 181

ip pim

Administratively configures PIM mode for IP

multicast routing on a VLAN interface.

ip pim bsr-border

Administratively disables bootstrap router

(BSR) messages from being sent or received

through an interface.

ip pim bsr-candidate

Configures the router to advertise itself as a

bootstrap router (BSR).

ip pim dense-mode

Administratively configures PIM dense mode

for IP multicast routing.

ip pim dr-priority

Administratively configures the advertised

designated router (DR) priority value.

ip pim hello-interval

Administratively configures the PIM Hello

messages on the specified interface.

ip pim join-prune-interval

Administratively configures the frequency of

join/prune messages on the specified interface.

ip pim rp-address

Defines the address of a PIM RP for a specific

multicast group range.

ip pim rp-candidate

Configures the router to advertise itself to the

bootstrap router (BSR) as a PIM candidate

rendezvous point (RP) for a specific multicast

group range.

ip pim sparse-mode

Administratively configures PIM sparse mode

for IP multicast routing.

ip pim ssm

Administratively configures PIM Source

Specific Multicast (SSM) range of addresses for

IP multicast routing.

show ip multicast

Displays the system-wide multicast

information.

show ip pim boundary

Displays the system-wide multicast

information.

show ip multicast interface

Displays the multicast information for the

specified interface.

show ip mroute

Displays a summary or all the details of the

multicast table.

Command Description Modea

Dell EMC Networking CLI 182

IPv6 Multicast

show ip mroute group

Displays the multicast configuration settings of

entries in the multicast mroute table.

show ip mroute source

Displays the multicast configuration settings of

entries in the multicast mroute table.

show ip mroute static

Displays all the static routes configured in the

static mcast table.

show ip pim

Displays information about the interfaces

enabled for PIM.

UE or

show ip pim bsr-router

Displays the bootstrap router (BSR)

information.

show ip pim interface

Displays PIM interface status parameters. If no

interface is specified, the command displays the

status parameters of all PIM-enabled interfaces.

UE or

show ip pim neighbor

Displays PIM neighbors discovered by PIMv2

Hello messages. If no interface is specified, the

command displays the neighbors discovered on

all PIM-enabled interfaces.

UE or

show ip pim rp-hash

Displays the rendezvous point (RP) selected for

the specified group address.

UE or

show ip pim rp mapping

Displays the mappings for the PIM group to the

active rendezvous points (RPs).

UE or

show ip pim statistics

Displays the count of PIM sparse mode received

control packets per VLAN.

PE or

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

clear ipv6 mroute

Selectively clears dynamic IPv6 multicast

entries from the cache.

ipv6 pim (VLAN Interface

config)

Administratively enables PIM-SM multicast

routing mode on a particular IPv6 router

interface.

Command Description Modea

Dell EMC Networking CLI 183

ipv6 pim bsr-border

Prevents bootstrap router (BSR) messages from

being sent or received through an interface.

ipv6 pim bsr-candidate

Configures the router to announce its

candidacy as a bootstrap router (BSR).

ipv6 pim dense-mode

Administratively configures PIM dense mode

for IPv6 multicast routing.

ipv6 pim dr-priority

Sets the priority value for which a router is

elected as the designated router (DR).

ipv6 pim hello-interval

Administratively configures the PIM-SM Hello

Interval for the specified interface.

ipv6 pim join-prune-interval

Administratively configures the interface

join/prune interval for the PIM-SM router.

ipv6 pim register-threshold

Configures the Register Threshold rate for the

RP router to switch to the shortest path.

ipv6 pim rp-address

Statically configures the Rendezvous Point (RP)

address for one or more multicast groups.

ipv6 pim rp-candidate

Configures the router to advertise itself as a

PIM candidate rendezvous point (RP) to the

bootstrap router (BSR).

ipv6 pim sparse-mode

Administratively configures PIM sparse mode

for multicast routing.

ipv6 pim ssm

Defines the Source Specific Multicast (SSM)

range of multicast addresses.

show ipv6 pim

Displays global status of IPv6 PIMSM and its

IPv6 routing interfaces.

PE or

show ipv6 pim bsr-router

Display the bootstrap router (BSR)

information.

UE,

PE, or

show ip mroute group

Displays the multicast configuration settings PE

show ip mroute source

Displays the multicast configuration settings PE

show ipv6 pim interface

Displays interface config parameters. PE or

Command Description Modea

Dell EMC Networking CLI 184

OSPF

show ipv6 pim neighbor

Displays IPv6 PIMSM neighbors learned on the

routing interfaces.

PE or

show ipv6 pim rp-hash

Displays which rendezvous point (RP) is being

selected for a specified group.

PE or

show ipv6 pim rp mapping

Displays all group-to-RP mappings of which the

router is aware (either configured or learned

from the bootstrap router (BSR).

PE or

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

area default-cost (Router

OSPF)

Configures the advertised default cost for the

stub area.

ROSPF

area nssa (Router OSPF)

Configures the specified area ID to function as an

NSSA.

ROSPF

area nssa default-info-

originate (Router OSPF

Config)

Configures the metric value and type for the

default route advertised into the NSSA.

ROSPF

area nssa no-redistribute

Configures the NSSA Area Border router (ABR)

so that learned external routes are not

redistributed to the NSSA.

ROSPF

area nssa no-summary

Configures the NSSA so that summary LSAs are

not advertised into the NSSA.

ROSPF

area nssa translator-role

Configures the translator role of the NSSA. ROSPF

area nssa translator-stab-

intv

Configures the translator stability interval of the

NSSA.

ROSPF

area range (Router OSPF)

Creates a specified area range for a specified

NSSA.

ROSPF

area stub

Creates a stub area for the specified area ID. ROSPF

area stub no-summary

Prevents Summary LSAs from being advertised

into the NSSA.

ROSPF

Command Description Modea

Dell EMC Networking CLI 185

area virtual-link

Creates the OSPF virtual interface for the

specified area-id and neighbor router.

ROSPF

area virtual-link

authentication

Configures the authentication type and key for

the OSPF virtual interface identified by the area

ID and neighbor ID.

ROSPF

area virtual-link dead-

interval

Configures the dead interval for the OSPF virtual

interface on the virtual interface identified by

area-id and neighbor router.

ROSPF

area virtual-link hello-

interval

Configures the hello interval for the OSPF virtual

interface on the virtual interface identified by the

area ID and neighbor ID.

ROSPF

area virtual-link

retransmit-interval

Configures the retransmit interval for the OSPF

virtual interface on the virtual interface identified

by the area ID and neighbor ID.

ROSPF

area virtual-link transmit-

delay

Configures the transmit delay for the OSPF

virtual interface on the virtual interface identified

by the area ID and neighbor ID.

ROSPF

auto-cost

Allows user to change the reference bandwidth

used in computing link cost.

ROSPF

bandwidth

Allows user to change the bandwidth used in

computing link cost.

bfd

Enables processing of BFD events by OSPF on all

interfaces enabled for BFD.

ROSPF,

ROSV3

capability opaque

Enables Opaque Capability on the router. RC

clear ip ospf

Resets specific OSPF states. PE

compatible rfc1583

Enables OSPF 1583 compatibility. ROSPF

default-information

originate (Router OSPF

Configuration)

Controls the advertisement of default routes. ROSPF

default-metric

Sets a default for the metric of distributed routes. ROSPF

distance ospf

Sets the route preference value of OSPF in the

router.

ROSPF

Command Description Modea

Dell EMC Networking CLI 186

distribute-list out

Specifies the access list to filter routes received

from the source protocol.

ROSPF

enable

Resets the default administrative mode of OSPF

in the router (active).

ROSPF

exit-overflow-interval

Configures the exit overflow interval for OSPF. ROSPF

external-lsdb-limit

Configures the external LSDB limit for OSPF. ROSPF

ip ospf area

Enables OSPFv2 and sets the area ID of an

interface.

ip ospf authentication

Sets the OSPF Authentication Type and Key for

the specified interface.

ip ospf cost

Configures the cost on an OSPF interface. IC

ip ospf database-filter all

out

Prevents the flooding of OSPF LSAs on an

interface.

ip ospf dead-interval

l Sets the OSPF dead interval for the specified

interface.

ip ospf hello-interval

Sets the OSPF hello interval for the specified

interface.

ip ospf mtu-ignore

Disables OSPF maximum transmission unit

(MTU) mismatch detection.

ip ospf network

Configure OSPF to treat an interface as a point-

to-point, rather than broadcast interface.

ip ospf priority

Sets the OSPF priority for the specified router

interface.

ip ospf retransmit-interval

Sets the OSPF retransmit Interval for the

specified interface.

ip ospf transmit-delay

Sets the OSPF Transit Delay for the specified

interface.

log adjacency-changes

Enables logging of OSPFv2 neighbor state

changes.

ROSPF

max-metric router-lsa

Configures OSPF to enable stub router mode. ROSPF

maximum-paths

Sets the number of paths that OSPF can report

for a given destination.

ROSPF

Command Description Modea

Dell EMC Networking CLI 187

network area

Enables OSPFv2 on an interface and sets its area

ID if the IP address of an interface is covered by

this network command.

ROSPF

nsf

Enables OSPF graceful restart. ROSPF

nsf helper

Allow OSPF to act as a helpful neighbor for a

restarting router.

ROSPF

nsf helper strict-lsa-

checking

Set an OSPF helpful neighbor exit helper mode

whenever a topology change occurs.

ROSPF

nsf restart-interval

Configures the length of the grace period on the

restarting router.

ROSPF

passive-interface

Sets the interface or tunnel as passive. IC

passive-interface default

Enables the global passive mode by default for all

interfaces.

ROSPF

passive-interface

Sets the interface or tunnel as passive. ROSPF

redistribute (BGP)

Configures OSPF protocol to allow redistribution

of routes from the specified source

protocol/routers.

ROSPF

router-id

Sets a 4-digit dotted-decimal number uniquely

identifying the router OSPF ID.

ROSPF

router ospf

Enters Router OSPF mode. GC

show ip ospf

Displays information relevant to the OSPF

router.

show ip ospf abr

Displays the internal OSPF routing table entries

to Area Border Routers (ABR).

show ip ospf area

Displays information about the identified OSPF

area.

show ip ospf asbr

Displays the internal OSPF routing table entries

to Autonomous System Boundary Routes

(ASBR).

show ip ospf database

Displays information about the link state

database when OSPF is enabled.

show ip ospf database

database-summary

Displays the number of each type of LSA in the

database for each area and for the router.

Command Description Modea

Dell EMC Networking CLI 188

OSPFv3

show ip ospf interface

Displays the information for the IFO object or

virtual interface tables.

show ip ospf interface

brief

Displays brief information for the IFO object or

virtual interface tables.

show ip ospf interface

stats

Displays the statistics for a specific interface. PE

show ip ospf lsa-group

Displays the number of self-originated LSAs

within each LSA group.

PE, GC

show ip ospf neighbor

Displays information about OSPF neighbors. PE

show ip ospf range

Displays information about the area ranges for

the specified area-id.

show ip ospf statistics

Displays information about recent Shortest Path

First (SPF) calculations.

show ip ospf stub table

Displays the OSPF stub table. PE

show ip ospf virtual-links

Displays the OSPF Virtual Interface information

for a specific area and neighbor.

show ip ospf virtual-links

brief

Displays the OSPF Virtual Interface information

for all areas in the system.

timers pacing flood

Adjusts the rate at which OSPFv2 sends LS

Update packets

timers pacing lsa-group

Tunes how OSPF groups LSAs for periodic

refresh.

timers spf

Configures the SPF delay and hold time. ROSPF

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

area default-cost (Router

OSPFv3)

Configures the monetary default cost for the stub

area.

ROSV3

area nssa (Router

OSPFv3)

Configures the specified areaid to function as an

NSSA.

ROSV3

Command Description Modea

Dell EMC Networking CLI 189

area nssa default-info-

originate (Router

OSPFv3 Config)

Configures the metric value and type for the

default route advertised into the NSSA.

ROSV3

area nssa no-redistribute

Configures the NSSA ABR so that learned

external routes will not be redistributed to the

NSSA.

ROSV3

area nssa no-summary

Configures the NSSA so that summary LSAs are

not advertised into the NSSA.

ROSV3

area nssa translator-role

Configures the translator role of the NSSA. ROSV3

area nssa translator-stab-

intv

Configures the translator stability interval of the

NSSA.

ROSV3

area range (Router

OSPFv3)

Creates an area range for a specified NSSA. ROSV3

area stub

Creates a stub area for the specified area ID. ROSV3

area stub no-summary

Disables the import of Summary LSAs for the

stub area identified by areaid.

ROSV3

area virtual-link

Creates the OSPF virtual interface for the

specified areaid and neighbor.

ROSV3

area virtual-link dead-

interval

Configures the dead interval for the OSPF virtual

interface on the virtual interface identified by

areaid and neighbor.

ROSV3

area virtual-link hello-

interval

Configures the hello interval for the OSPF virtual

interface on the virtual interface identified by

areaid and neighbor.

ROSV3

area virtual-link

retransmit-interval

Configures the retransmit interval for the OSPF

virtual interface on the virtual interface identified

by areaid and neighbor.

ROSV3

area virtual-link transmit-

delay

Configures the transmit delay for the OSPF

virtual interface on the virtual interface identified

by areaid and neighbor.

ROSV3

default-information

originate (Router

OSPFv3 Configuration)

Controls the advertisement of default routes. ROSV3

default-metric

Sets a default for the metric of distributed routes. ROSV3

Command Description Modea

Dell EMC Networking CLI 190

distance ospf

Sets the route preference value of OSPF in the

router.

ROSV3

enable

Resets the default administrative mode of OSPF

in the router (active).

ROSV3

exit-overflow-interval

Configures the exit overflow interval for OSPF. ROSV3

external-lsdb-limit

Configures the external LSDB limit for OSPF. ROSV3

arp

Enables OSPF on a router interface or loopback

interface.

ipv6 ospf area

Sets the OSPF area to which the specified router

interface belongs.

ipv6 ospf cost

Configures the cost on an OSPF interface. IC

ipv6 ospf dead-interval

Sets the OSPF dead interval for the specified

interface.

ipv6 ospf hello-interval

Sets the OSPF hello interval for the specified

interface.

ipv6 ospf mtu-ignore

Disables OSPF maximum transmission unit

(MTU) mismatch detection.

ipv6 ospf network

Changes the default OSPF network type for the

interface.

ipv6 ospf priority

Sets the OSPF priority for the specified router

interface.

ipv6 ospf retransmit-

interval

Sets the OSPF retransmit interval for the

specified interface.

ipv6 ospf transmit-delay

Sets the OSPF Transmit Delay for the specified

interface.

ipv6 router ospf

Enters Router OSPFv3 Configuration mode. GC

maximum-paths

Sets the number of paths that OSPF can report

for a given destination.

ROSV3

nsf

Enables OSPF graceful restart. ROSV3

nsf helper

Allows OSPF to act as a helpful neighbor for a

restarting router.

ROSV3

Command Description Modea

Dell EMC Networking CLI 191

nsf helper strict-lsa-

checking

Requires that an OSPF helpful neighbor exit

helper mode whenever a topology change occurs.

ROSV3

nsf restart-interval

Configures the length of the grace period on the

restarting router.

ROSV3

passive-interface

Sets the interface or tunnel as passive. IC

passive-interface default

Enables the global passive mode by default for all

interfaces.

ROSV3

redistribute (OSPFv3)

Configures the OSPFv3 protocol to allow

redistribution of routes from the specified source

protocol/routers.

ROSV3

router-id

Sets a 4-digit dotted-decimal number uniquely

identifying the Router OSPF ID.

ROSV3

show ipv6 ospf

Displays information relevant to the OSPF

router.

show ipv6 ospf abr

Displays the internal OSPFv3 routes to reach

Area Border Routers (ABR).

show ipv6 ospf area

Displays information about the area. PE

show ipv6 ospf asbr

Displays the internal OSPFv3 routes to reach

Autonomous System Boundary Routes (ASBR).

show ipv6 ospf border-

routers

Displays internal OSPFv3 routers to reach Area

Border Routers (ABR) and Autonomous System

Boundary Routers (ASBR).

UE or

show ipv6 ospf database

Displays information about the link state

database when OSPFv3 is enabled.

show ipv6 ospf database

database-summary

Displays the number of each type of LSA in the

database and the total number of LSAs in the

database.

show ipv6 ospf interface

Displays the information for the IFO object or

virtual interface tables.

show ipv6 ospf interface

brief

Displays brief information for the IFO object or

virtual interface tables.

show ipv6 ospf interface

stats

Displays the statistics for a specific interface. UE

Command Description Modea

Dell EMC Networking CLI 192

Router Discovery Protocol

show ipv6 ospf interface

vlan

Displays OSPFv3 configuration and status

information for a specific VLAN.

show ipv6 ospf neighbor

Displays information about OSPF neighbors. PE

show ipv6 ospf range

Displays information about the area ranges for

the specified area identifier.

show ipv6 ospf stub table

Displays the OSPF stub table. PE

show ipv6 ospf virtual-

links

Displays the OSPF Virtual Interface information

for a specific area and neighbor.

show ipv6 ospf virtual-

link brief

Displays the OSPFV3 Virtual Interface

information for all areas in the system.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

encapsulation

Enables Router Discovery on an interface. IC

ip irdp holdtime

Configures the value, in seconds, of the hold-

time field of the router advertisement sent from

this interface.

ip irdp maxadvertinterval

Configures the maximum time, in seconds,

allowed between sending router advertisements

from the interface.

ip irdp minadvertinterval

Configures the minimum time, in seconds,

allowed between sending router advertisements

from the interface.

ip irdp multicast

Sends router advertisements as IP multicast

packets.

ip irdp preference

Configures the preference of the address as a

default router address relative to other router

addresses on the same subnet.

show ip irdp

Displays the router discovery information for all

interfaces, or for a specified interface.

Command Description Modea

Dell EMC Networking CLI 193

Routing Information Protocol

Command Description Modea

auto-summary

Enables the RIP auto-summarization mode. RIP

default-information

originate (Router RIP

Configuration)

Controls the advertisement of default routes. RIP

default-metric

Sets a default for the metric of distributed

routes.

RIP

distance rip

Sets the route preference value of RIP in the

router.

RIP

distribute-list out

Specifies the access list to filter routes received

from the source protocol.

RIP

enable

Resets the default administrative mode of RIP

in the router (active).

RIP

hostroutesaccept

Enables the RIP hostroutesaccept mode. RIP

ip rip

Enables RIP on a router interface. IC

ip rip authentication

Sets the RIP Version 2 Authentication Type and

Key for the specified interface.

ip rip receive version

Configures the interface to allow RIP control

packets of the specified version(s) to be

received.

ip rip send version

Configures the interface to allow RIP control

packets of the specified version to be sent.

redistribute (RIP)

Configures OSPF protocol to allow

redistribution of routes from the specified

source protocol/routers.

PIP

router rip

Enters Router RIP mode. GC

show ip rip

Displays information relevant to the RIP router. PE

show ip rip interface

Displays information related to a particular RIP

interface.

show ip rip interface brief

Displays general information for each RIP

interface.

split-horizon

Sets the RIP split horizon mode. RIP

Dell EMC Networking CLI 194

Tunnel Interface

Virtual Router

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

interface tunnel

Enables the interface configuration mode for a

tunnel.

show interfaces tunnel

Displays the parameters related to tunnel such

as tunnel mode, tunnel source address and

tunnel destination address.

tunnel destination

Specifies the destination transport address of

the tunnel.

tunnel mode ipv6ip

Specifies the mode of the tunnel. IC

tunnel source

Specifies the source transport address of the

tunnel, either explicitly or by reference to an

interface.

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

description

Assigns descriptive text to the VRF instance. VR

ip vrf

Creates a virtual router with a specified name

and enters Virtual Router Configuration mode.

ip vrf forwarding

Associates an interface with a VRF instance. IC or

maximum routes

Reserves the number of routes allowed and sets

the maximum limit on the number of routes for

a virtual router instance in the total routing

table space for the router.

show ip vrf

Shows the interfaces associated with a VRF

instance.

Dell EMC Networking CLI 195

Virtual Router Redundancy

Command Description Modea

ip vrrp

Enables the administrative mode of Virtual

Router Redundancy Protocol (VRRP) for the

router.

vrrp accept-mode

Enables the VRRP Master to accept ping

packets sent to one of the virtual router’s IP

addresses.

vrrp authentication

Sets the authentication details value for the

virtual router configured on a specified

interface.

vrrp description

Assigns a description to the VRRP group. IC

vrrp ip

Sets the virtual router IP address value for an

interface.

vrrp mode

Enables the virtual router configured on an

interface. Enabling the status field starts a

virtual router.

vrrp preempt

Sets the preemption mode value for the virtual

router configured on a specified interface.

vrrp priority

Sets the priority value for the virtual router

configured on a specified interface.

vrrp timers advertise

Sets the frequency, in seconds, that an interface

on the specified virtual router sends a virtual

router advertisement.

vrrp timers learn

Configures the router, when it is acting as

backup virtual router for a VRRR group, to learn

the advertisement interval used by the master

virtual router.

vrrp track interface

Alters the priority of the VRRP router based on

the availability of its interfaces.

vrrp track ip route

Tracks route reachability. IC

show vrrp

Displays the global VRRP configuration and

status as well as the brief or detailed status of

one or all VRRP groups.

UE or

Dell EMC Networking CLI 196

Switch Management Commands

Application Deployment

Auto-Install

show vrrp interface

Displays all configuration information and

VRRP router statistics of a virtual router

configured on a specific interface.

UE or

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

application install

Installs or removes a Dell-supplied application. GC

application start

Schedules a Dell-supplied application for

immediate execution on the stack master.

application stop

Stops a Dell-supplied application if the

application is executing on the stack master.

show application

Displays installed applications and optionally

displays application files.

Command Description Modea

boot auto-copy-sw

Enables or disables Stack Firmware

Synchronization.

boot auto-copy-sw allow-

downgrade

Enables downgrading the firmware version on

the stack member if the firmware version on the

manager is older than the firmware version on

the member.

boot host auto-reboot

Enables rebooting the device (no administrative

intervention) when the auto-image is

successfully downloaded.

boot host auto-save

Enables/disables automatically saving the

downloaded configuration on the switch.

Command Description Modea

Dell EMC Networking CLI 197

CLI Macro

Clock

boot host dhcp

Enables/disables Auto Config on the switch. GC

boot host retry-count

Set the number of attempts to download a

configuration.

show auto-copy-sw

Displays Stack Firmware Synchronization

configuration status.

show boot

Displays the current status of the Auto Config

process.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

macro name

Creates a user-defined macro. GC

macro global apply

Use to apply a macro. GC

macro global trace

Applies and traces a macro. GC

macro global description

Appends a line to the global macro description. GC

macro apply

Use to apply a macro. IC

macro trace

Applies and traces a macro. IC

macro description

Appends a line to the macro description. IC

show parser macro

Displays information about defined macros. PE

Command Description Modea

show sntp configuration

Displays the SNTP configuration. PE

show sntp server

Displays the preconfigured SNTP servers. PE

show sntp status

Displays the SNTP status. PE

sntp authenticate

Set to require authentication for received NTP

traffic from servers.

sntp authentication-key

Defines an authentication key for SNTP. GC

Command Description Modea

Dell EMC Networking CLI 198

Command Line Configuration Scripting

sntp broadcast client enable

Enables SNTP Broadcast clients. GC

sntp client poll timer

Defines polling time for the SNTP client. GC

sntp server

Configures the SNTP server to use SNTP to

request and accept NTP traffic from it.

sntp source-interface

Selects the interface from which to use the IP

address in the source IP address field of

transmitted SNTP packets.

sntp trusted-key

Authenticates the identity of a system to which

Simple Network Time Protocol (SNTP) will

synchronize.

sntp unicast client enable

Enables clients to use Simple Network Time

Protocol (SNTP) predefined Unicast clients.

clock timezone hours-offset

Sets the offset to Coordinated Universal Time. GC

no clock timezone

Resets the time zone settings. GC

clock summer-time

recurring

Sets the summertime offset to UTC recursively

every year.

clock summer-time date

Sets the summertime offset to UTC. GC

no clock summer-time

Resets the summertime configuration. GC

show clock

Displays the time and date from the system

clock.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

There are no user guidelines

for this command.

Applies commands in the script to the switch. PE

script delete

Deletes a specific script. PE

script list

Lists all scripts present in the switch. PE

script show

Displays the contents of a script file. PE

script validate

Validates a script file. PE

Command Description Modea

Dell EMC Networking CLI 199

DHCP Client

a. For the meaning of each Mode abbreviation, see

Mode Types

Configuration and Image Files

Command Description Modea

boot system

Specifies the system image that the switch loads

at startup.

clear config

Restores switch to default configuration. PE

copy

Copies files from a source to a destination. PE

delete

Deletes a file from a flash memory. PE

dir

Prints the contents of the flash file system. PE

erase

Erases the startup configuration, the backup

configuration, or the backup image.

filedescr

Adds a description to a file. PE

rename

Renames the file present in flash. PE

show backup-config

Displays contents of a backup configuration

file.

show bootvar

Displays the active system image file that the

switch loads at startup.

show running-config

Displays the contents of the currently running

configuration file.

show startup-config

Displays the startup configuration file contents. PE

write

Copies the running configuration image to the

startup configuration.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

release dhcp

Forces the DHCPv4 client to release a leased

address.

renew dhcp

Forces the DHCP client to immediately renew

an IPv4 address lane.

Dell EMC Networking CLI 200

HiveAgent

Line

show dhcp lease

Displays IPv4 addresses leased from a DHCP

server.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

eula-consent

Accepts or declines the end-user license

agreement (EULA) for the hive agent

hiveagent

Accesses the HiveAgent configuration mode. GC

server

Configures a HiveAgent server (HiveManager

NG) and enter HiveAgent server configuration

mode.

HAC

enable

Enables a HiveAgent server. HAC

proxy-ip-address

Configures a proxy server to be used to contact

the HiveManager NG.

HAC

url

Configures the URL to reach on HiveManager

NG.

HAC

show hiveagent status

Displays information on the HiveAgent

configuration.

PE,

show eula-consent hiveagent

Reviews the EULA details. PE,

Command Description Modea

accounting

Applies an accounting method to a line config. LC

authorization

Applies a command authorization method to a

line config.

enable authentication

Specifies the authentication method list when

accessing a higher privilege level from a remote

telnet or console.

Command Description Modea

Dell EMC Networking CLI 201

PHY Diagnostics

exec-banner

Enables exec banner on the console, telnet or

SSH connection.

exec-timeout

Configures the interval that the system waits for

user input before Privileged Exec mode

timeout.

history

Enables the command history function. LC

history size

Changes the command history buffer size for a

particular line.

line

Identifies a specific line for configuration and

enters the line configuration command mode.

Specifies the login authentication method list

for a remote telnet or console.

Enables login banner on the console, telnet, or

SSH connection.

nsf

Enables display of the message of the day

banner on the console, telnet, or SSH

connection.

password (Line

Configuration)

Specifies a password on a line. LC

show line

Displays line parameters. UE

speed

Sets the serial port BAUD rate. LC

terminal length

Sets the terminal length. PE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

show copper-ports tdr

Displays the last TDR (Time Domain

Reflectometry) tests on specified ports.

show fiber-ports optical-

transceiver

Displays the optical transceiver diagnostics. PE

Command Description Modea

Dell EMC Networking CLI 202

Power Over Ethernet (PoE)

test copper-port tdr

Diagnoses with TDR (Time Domain

Reflectometry) technology the quality and

characteristics of a copper cable attached to a

port.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

power inline

Enables/disables the ability of the port to

deliver power.

(Ethernet)

power inline detection

Configures the detection type that tells

which types of PD’s will be detected and

power inline four-pair

forced

Forces 4-pair power feed on an interface. IC

power inline limit

Configure the type of power limit. IC

power inline management

Sets the power management type. GC

power inline powered-

device

Adds a comment or description of the

powered device type.

(Ethernet)

power inline priority

Configures the port priority level for the

delivery of power to an attached device.

(Ethernet)

power inline reset

Use to reset the port. IC

power inline usage-

threshold

Configures the system power usage

threshold level at which lower priority

ports are disconnected.

clear power inline statistics

Clears the PoE statistics. PE

show power inline

Reports current PoE configuration and

status.

show power inline

firmware-version

Displays the version of the PoE controller

firmware present on the switch file system.

Command Description Modea

Dell EMC Networking CLI 203

RMON

Serviceability Tracing

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

rmon alarm

Configures alarm conditions. GC

rmon collection history

Enables a Remote Monitoring (RMON) MIB

history statistics group on an interface.

rmon event

Configures an RMON event. GC

rmon hcalarm

Configures high capacity alarms. GC

show rmon alarm

Displays alarm configurations. UE

show rmon alarms

Displays the alarms summary table. UE

and

show rmon collection history

Displays

the requested group of statistics.

show rmon events

Displays the RMON event table. UE

show rmon hcalarm

Displays the high capacity alarms. PE

show rmon history

Displays RMON Ethernet Statistics history. UE

show rmon log

Displays the RMON logging table. UE

show rmon statistics

Displays RMON Ethernet Statistics. UE

Command Description Modea

debug aaa accounting

Enables debugging for accounting. PE

debug arp

Enables tracing of ARP packets. PE

debug authentication

interface

Enables Authentication Manager debug traces

for the interface.

debug auto-voip

Enables Auto VOIP debug messages. PE

debug bfd

Enables the display of BFD events or packets. PE

debug cfm

Enables CFM debugging. PE

debug clear

Disables all debug traces. PE

Dell EMC Networking CLI 204

debug console

Enables the display of debug trace output on

the login session in which it is executed.

debug crashlog

Displays the crash log contents on the console. PE or

debug dhcp packet

Displays debug information about DHCPv4

client activities and traces DHCP v4 packets to

and from the local DHCPv4 client.

debug dot1ag

Enable the tracing of CFM components for

events and CFM PDUs based on the type of

packet for reception and transmission.

debug dot1x

Enables dot1x packet tracing. PE

debug igmpsnooping

Enables tracing of IGMP Snooping packets

transmitted and/or received by the switch.

debug ip acl

Enables debug of IP Protocol packets matching

the ACL criteria.

debug ip bgp

Enables debug tracing of BGP events. PE

debug ip dvmrp

Traces DVMRP packet reception and

transmission.

debug ip igmp

Traces IGMP packet reception and

transmission.

debug ip mcache

Traces MDATA packet reception and

transmission.

debug ip pimdm packet

Traces PIMDM packet reception and

transmission.

debug ip pimsm packet

Traces PIMSM packet reception and

transmission.

debug ipv6 dhcp

Displays debug information about DHCPv6

client activities and to trace DHCPv6 packets to

and from the local DHCPv6 client.

debug ipv6 mcache

Traces MDATAv6 packet reception and

transmission.

debug ipv6 mld

Traces MLD packet reception and transmission. PE

Command Description Modea

Dell EMC Networking CLI 205

debug ipv6 pimdm

Traces PIMDMv6 packet reception and

transmission.

debug ipv6 pimsm

Traces PIMSMv6 packet reception and

transmission.

debug isdp

Traces ISDP packet reception and transmission. PE

debug lacp

Traces of LACP packets received and

transmitted by the switch.

debug mldsnooping

Traces MLD snooping packet reception and

transmission.

debug ospf

Enables tracing of OSPF packets received and

transmitted by the switch.

debug ospfv3

Enables tracing of OSPFv3 packets received and

transmitted by the switch.

debug ping

Enables tracing of ICMP echo requests and

responses.

debug rip

Enables tracing of RIP requests and responses. PE

debug sflow

Enables sFlow debug packet trace. PE

debug spanning-tree

Traces spanning tree BPDU packet reception

and transmission.

debug spanning-tree

Traces spanning tree BPDU packet reception

and transmission.

debug udld

Enables the display of UDLD packets or event

processing.

debug vpc

Enables debug traces for the specified protocols GC

debug vrrp

Enables VRRP debug protocol messages. PE

exception core-file

Configures the core dump file name. GC

exception dump

Configures the core dump location. GC

exception protocol

Enables full core dumps. GC

exception switch-chip-

Enables the dumping of the switch chip

registers in case of an exception.

Command Description Modea

Dell EMC Networking CLI 206

sFlow

ip http timeout-policy

Configures the timeout policy for closing HTTP

and HTTPS sessions to the local HTTP server.

show debugging

Displays packet tracing configurations. PE

show supported mibs

Displays the HTTP server status and

configuration.

PE,

show supported mibs

Displays the implemented SNMP MIBs. PE,

snapshot bgp

Dumps a set of BGP debug information to

capture the current state of BGP.

write core

Generates a core file on demand and either,

reboots the switch or tests the core file

configuration.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

sflow destination

Configures sFlow collector parameters (owner

string, receiver timeout, ip address, and port).

sflow polling

Enables a new sflow poller instance for the data

source if rcvr_idx is valid.

sflow polling (Interface

Mode)

Enable a new sflow poller instance for this data

source if rcvr_idx is valid.

sflow sampling

Enables a new sflow sampler instance for this

data source if rcvr_idx is valid.

sflow sampling (Interface

Mode)

Enables a new sflow sampler instance for this

data source if rcvr_idx is valid.

sflow source-interface

Selects the interface from which to use the IP

address inserted in the source IP address field of

transmitted sFlow packets.

show sflow agent

Displays the sflow agent information. PE

show sflow destination

Displays all the configuration information

related to the sFlow receivers.

Command Description Modea

Dell EMC Networking CLI 207

SNMP

show sflow polling

Displays the sFlow polling instances created on

the switch.

show sflow sampling

Displays the sFlow sampling instances created

on the switch.

show sflow source-interface

Displays the assigned sFlow source interface. PE or

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

show snmp

Displays the SNMP status. PE

show snmp engineid

Displays the SNMP engine ID. PE

show snmp filters

Displays the configuration of filters. PE

show snmp group

Displays the configuration of groups. PE

show snmp user

Displays the configuration of users. PE

show snmp views

Displays the configuration of views. PE

show trapflags

Displays SNMP traps globally or displays

specific SNMP traps.

snmp-server community

Sets up the community access string to permit

access to SNMP protocol.

snmp-server community-

group

Maps SNMP v1 and v2 security models to the

group name.

snmp-server contact

Set

s up a system contact (sysContact) string.

snmp-server enable traps

Enables SNMP traps globally or enables specific

SNMP traps.

snmp-server engineID local

Specifies the Simple Network Management

Protocol (SNMP) engine ID on the local switch.

snmp-server filter

Creates or updates an SNMP server filter entry. GC

snmp-server group

Configures a new SNMP group or a table that

maps SNMP users to SNMP views.

snmp-server host

Specifies the recipient of SNMP notifications. GC

Command Description Modea

Dell EMC Networking CLI 208

Support Assist

snmp-server location

Sets

the system location string.

snmp-server user

onfigures a new SNMP Version 3 user.

snmp-server view

Creates or updates a Simple Network

Management Protocol (SNMP) server view

entry.

snmp-server v3-host

Specifies the recipient of Simple Network

Management Protocol Version 3 (SNMPv3)

notifications.

snmp-server source-interface

Selects the interface from which to use the IP

address in the source IP address field of

transmitted SNMP traps and informs.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

eula-consent

Accepts or rejects the end-user license

agreement (EULA) for the SupportAssist server.

contact-company

Configures the contact information to be sent

to the SupportAssist server.

SAC

contact-person

Configures the contact information to be sent

to the SupportAssist server.

SAC

enable

Enables a SupportAssist server. SAC

proxy-ip-address

Configures a proxy server to be used to contact

the SupportAssist servers.

SAC

server

Configures a SupportAssist server and enter

SupportAssist server configuration mode.

SAC

show eula-consent support-

assist

Reviews the EULA details whenever desired. PE

show support-assist status

Displays information on the SupportAssist

feature status

PE,

Command Description Modea

Dell EMC Networking CLI 209

Syslog

support-assist

Enables support-assist configuration mode if

the EULA has been accepted.

url

Configures the URL to reach on the

SupportAssist remote server.

SAC

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

clear logging

Clears messages from the in memory logging

buffer.

clear logging file

Clears messages from the logging file. PE

description (Logging)

Describes the SYSLOG server. L

level

Specifies the level of SYSLOG messages sent to

the server.

logging cli-command

Enables CLI command logging. GC

logging

Configures a SYSLOG server GC

logging audit

Enables switch auditing. GC

logging buffered

Enables logging to the in-memory log. GC

logging console

Enables logging to the console. GC

logging facility

Configures the facility to be used in SYSLOG

messages.

logging file

Enables logging to the persistent (on flash) log. GC

logging monitor

Enables logging messages to telnet and SSH

sessions with the default severity level.

logging on

Enables error messages logging. GC

logging protocol

Logs messages in RFC5424 of RFC 3164

format.

logging snmp

Enables SNMP Set command logging. GC

logging source-interface

Selects the interface from which to use the IP

address in the source IP address field of

transmitted SYSLOG packets.

Command Description Modea

Dell EMC Networking CLI 210

System Management

logging traps

Sets the lowest severity level at which SNMP

traps are logged.

logging web-session

Enables web session logging. GC

port

Specifies the port number on which the

SYSLOG server listens for messages.

show logging

Displays the state of logging and the messages

stored in the internal buffer.

show logging file

Displays the state of logging and the messages

stored in the logging file.

show syslog-servers

Displays the SYSLOG server settings. PE

terminal monitor

Enables the display of logging messages over a

telnet of SSH session.

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

asset-tag

Specifies the switch asset-tag. GC

banner exec

Sets the message that is displayed after a

successful login.

banner login

Sets the message that is displayed just before

the login prompt.

banner motd

Specifies message-of-the-day banner. GC

banner motd

acknowledge

Acknowledges message-of-the-day banner. GC

buffers

Configures the rising and falling thresholds for

the issuance of the message buffer SNMP trap

and notification via a SYSLOG message.

clear checkpoint

statistics

Clears the statistics for the checkpointing

process.

clear counters stack-

ports

Clears the statistics for all stack-ports. PE

Command Description Modea

Dell EMC Networking CLI 211

connect

Connects to the serial console of a different

stack member.

cut-through mode

Enables cut-through mode on the switch (if

supported).

exit

Disconnects the serial connection to the remote

unit.

hardware profile

portmode

Configures a 40G port in 4x10G mode or

1x40G mode.

hostname

Specifies or modifies the switch host name. GC

initiate failover

Forces failover of management unit. GC

load-interval

Loads the interface utilization measurement

interval.

locate

Locates a switch by LED blinking. PE

logout

Disconnects the serial connection to a remote

unit on a stack member.

member

Preconfigures a stack member. SG

memory free low-

watermark

Configures the notification of a low memory

condition on the switch for the issuance of the

CPU overload SNMP trap and notification via a

SYSLOG message.

nsf

Specifies non-stop forwarding. GC

ping

Sends ICMP echo request packets to another

node on the network.

process cpu threshold

Configures the rising and falling thresholds for

the issuance of the CPU overload SNMP trap

and notification via a SYSLOG message.

quit

Disconnects the serial connection to the remote

unit on a stack member.

reload

Reloads the operating system. PE

set description

Associates a text description with a switch in

the stack.

slot

Configures a slot in the system. GC

Command Description Modea

Dell EMC Networking CLI 212

show banner

Displays banner information. PE

show buffers

Displays the system allocated buffers. UE or PE

show checkpoint

statistics

Displays the statistics for the checkpointing

process.

show cut-through mode

Show the cut-through mode on the switch. PE

show hardware profile

Displays the hardware profile information for

the 40G ports.

show idprom interface

Displays the optics EEPRM contents in a user-

readable format.

UE or PE

show interfaces

Displays the traffic statistics for one or multiple

interfaces.

show interfaces

advanced firmware

Displays the firmware revision of the PHY for a

port.

show interfaces

Displays the static and dynamic parameters for

the optics.

UE or PE

show interfaces

utilization

Displays the interface utilization. PE

show memory cpu

Checks the total and available RAM space on

the switch.

show nsf

Shows non-stop forwarding status. PE

show power-usage-

history

Shows the history of unit power consumption

for the unit specified in the command and total

stack power consumption.

show process app-list

Displays the system applications. PE or GC

show process app-

resource-list

Lists the configured and in-use resources for

each application known to the Process Manager.

PE or GC

show process cpu

Checks the CPU utilization for each process

currently running on the switch.

show process proc-list

Lists the configured and in-use resources for

each application known to the Process Manager.

PE or GC

show sessions

Displays a list of the open console sessions. PE

Command Description Modea

Dell EMC Networking CLI 213

show slot

Displays information about all the slots in the

system or for a specific slot.

show supported cardtype

Displays information about all card types

supported in the system.

show supported

switchtype

Displays information about all supported switch

types.

show switch

Displays information about the switch status. UE

show system

Displays system information. UE

show system fan

Explicitly displays the fan status. UE or PE

show system id

Displays the service ID information. UE

show system power

Displays information about the system level

power consumption.

UE or PE

show system

temperature

Displays information about the system

temperature and fan status.

UE or PE

show tech-support

Displays system and configuration information

(for debugging/calls to technical support).

show users

Displays information about the active users,

including which profiles have been assigned to

local user accounts and which profiles are active

for logged-in users.

show version

Displays the system version information. UE

stack

Sets the mode to Stack Configuration mode. GC

stack-port

Sets the mode to Stack Configuration mode to

configure Stack ports as either Stacking ports or

as Ethernet ports.

stack-port shutdown

Enables or disable the stack port

administratively.

standby

Configures the standby in the stack. SG

switch renumber

Changes the identifier for a switch in the stack. GC

telnet

Logs into a host that supports Telnet. PE

traceroute

Discovers the IP routes that packets actually

take when traveling to their destinations.

Command Description Modea

Dell EMC Networking CLI 214

Telnet Server

Time Ranges

traceroute ipv6

Discovers the IP routes that packets actually

take when traveling to their destinations.

update bootcode

Updates the boot code on one or more switches. PE

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

ip telnet server disable

Enables/disables the Telnet service on the

switch.

ip telnet port

Configures the Telnet TCP port number on the

switch.

show ip telnet

Displays the status of the Telnet server and the

Telnet TCP port number.

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

time-range [name]

Creates a time range identified by name,

consisting of one absolute time entry and/or one

or more periodic time entries.

absolute

Adds an absolute time entry to a time range. TRC

periodic

Adds a periodic time entry to a time range. TRC

show time-range

Displays a time range and all the

absolute/periodic time entries that are defined

for the time range.

Command Description Modea

Dell EMC Networking CLI 215

USB Flash Drive

User Interface

Web Server

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

unmount usb

Makes the USB flash device inactive. PE

show usb

Displays the USB flash device details. PE

dir usb

Displays the USB device contents and memory

statistics.

Command Description Modea

a. For the meaning of each Mode abbreviation, see

Mode Types

configure terminal

Enters Global Configuration mode. PE

Executes commands available in Privileged

Exec mode with command line completion.

All

except

and

enable

Enters the privileged Exec mode. UE

end

Gets the CLI user control back to the privileged

execution mode or user execution mode.

Any

exit

Exits any configuration mode to the previously

highest mode in the CLI mode hierarchy.

(All)

quit

exit

logout

Closes an active terminal session by logging off

the switch.

Command Description Modea

common-name

Specifies the common-name for the device. CC

country

Specifies the country. CC

crypto certificate generate

Generates a HTTPS certificate. GC

Dell EMC Networking CLI 216

crypto certificate import

Imports a certificate signed by the Certification

Authority for HTTPS.

crypto certificate request

Generates and displays a certificate request for

HTTPS.

duration

Specifies the duration in days. CC

ip http port

Specifies the TCP port for use by a web browser

to configure the switch.

ip http server

Enables the switch to be configured from a

browser.

ip http secure-certificate

Configures the active certificate for HTTPS. GC

ip http secure-port

Configures a TCP port for use by a secure web

browser to configure the switch.

ip http secure-server

Enables the switch to be configured, monitored,

or modified securely from a browser.

key-generate

Specifies the key-generate. CC

location

Specifies the location or city name. CC

no crypto certificate

Deletes a certificate from the switch. GC

organization-unit

Specifies the organization-unit or department

name.

show crypto certificate

mycertificate

Displays the SSL certificates of your switch. PE

show ip http server status

Displays the HTTP server status information. PE

show ip http server secure

status

Displays the HTTP secure server status

information.

UE or

state

Specifies the state or province name. CC

a. For the meaning of each Mode abbreviation, see

Mode Types

Command Description Modea

Using the CLI 217

Using the CLI

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Introduction

This section describes the basics of entering and editing the Dell EMC

Networking N1100-ON, N1500, N2000, N2100-ON, N3000, N3100-ON, and

N4000 Series Command Line Interface (CLI) commands and defines the

command hierarchy. It also explains how to activate the CLI and implement

its major functions.

This section covers the following topics:

•Entering and Editing CLI Commands

•CLI Command Modes

•Starting the CLI

•Using CLI Functions and Tools

Entering and Editing CLI Commands

A CLI command is a series of keywords and arguments. The total number of

characters that may be entered in a single command is limited to 1536

characters. Keywords identify a command and arguments specify

configuration parameters. For example, in the command show interfaces

status gigabitethernet 1/0/5, show, interfaces and status are keywords;

gigabitethernet is an argument that specifies the interface type, and 1/0/5 is

an argument that specifies the unit/slot/port.

When working with the CLI, the command options are not displayed. The

command is not selected by a menu but is entered manually. To see what

commands are available in each mode or within an Interface Configuration,

the CLI provides a method of displaying the available commands, the

command syntax requirements and in some instances parameters required to

complete the command. The standard command to request context-sensitive

help is the <?> key.

Using the CLI 218

Two instances where the help information can be displayed are:

•Keyword lookup — The <?> key is entered in place of a command. A list

of all valid commands and corresponding help messages is displayed.

•Partial keyword lookup — A command is incomplete and the <?> key is

entered in place of a parameter. The matched parameters for this

command are displayed.

The following features and conventions are applicable to CLI command entry

and editing:

•History Buffer

•Negating Commands

•Show Command

•Command Completion

•Short Form Commands

•Keyboard Shortcuts

•Command line parameters are entered by the user to choose an individual

value or range of values for the specific command. Command line

parameters are not syntax or range checked until the carriage return is

entered. In some cases, the user may need to enter special characters, most

often in a string parameter such as a password or a label. Special characters

are one of the following characters (`! $ % ^ & * ( ) _ - + = { [ } ] : ; @ '

" ~ # | \ < , > . / ) or a blank. In these cases, it may be necessary to

enclose the entire string in double or single quotes for the command line

parser to properly interpret the parameter.Parameters

•Command Scripting

•CLI Command Notation Conventions

•Interface Naming Conventions

History Buffer

Every time a command is entered in the CLI, it is recorded in an internally

managed Command History buffer. Commands are stored in the buffer,

which operates on a First In First Out (FIFO) basis. These commands can be

recalled, reviewed, modified, and reissued. This buffer is not preserved after

switch resets.

Using the CLI 219

Table 2-1. History Buffer

By default, the history buffer system is enabled, but it can be disabled at any

time. The standard number of 10 stored commands can be increased to 216.

By configuring 0, the effect is the same as disabling the history buffer system.

For information about the command syntax for configuring the command

history buffer, see the

history size

command in the Line command mode

section of this guide.

Negating Commands

For many commands, the prefix keyword no is entered to cancel the effect of

a command or reset the configuration to the default value. Nearly all

configuration commands have this capability. This guide describes the

negation effect for all commands to which it applies.

Show Command

The show command executes in the User Executive (Exec), Privileged

Executive (Exec), Global Configuration mode, Interface Configuration mode

and all configuration submodes with command completion. Output from

show commands is paginated. Use the terminal length command to set the

number of lines displayed in a page. When the paging prompt appears, press

the space bar to display the next page of output or the enter key to display the

next line of output.

Example:

console>en

console#configure

console(config)#interface Gi1/0/1

Keyword Source or Destination

Up-arrow key

Recalls commands in the history buffer, beginning with the

most recent command. Repeats the key sequence to recall

successively older commands.

Down-arrow key

Returns to more recent commands in the history buffer after

recalling commands with the up-arrow key. Repeating the key

sequence recalls more recent commands in succession.

Using the CLI 220

console(config-if-Gi1/0/1)#show interface status

Port Name Duplex Speed Neg Link Flow

State Status Control

--------- ------------------------- --------- ------------- --------- --------- ------------

Gi1/0/1 N/A Unknown Auto Down Inactive

Gi1/0/2 N/A Unknown Auto Down Inactive

Gi1/0/3 N/A Unknown Auto Down Inactive

Gi1/0/4 N/A Unknown Auto Down Inactive

Gi1/0/5 N/A Unknown Auto Down Inactive

Gi1/0/6 N/A Unknown Auto Down Inactive

Command Completion

CLI can complete partially entered commands when the user presses the

<tab> or <space> key. If a command entered is not complete, is not valid,

or if some parameters of the command are not valid or missing, an error

message is displayed to assist in entering the correct command. By pressing

the <tab> key, an incomplete command is changed into a complete

command. If the characters already entered are not enough for the system to

identify a single matching command, the <?>key displays the available

commands matching the characters already entered.

Short Form Commands

The CLI supports the short forms of all commands. As long as it is possible to

recognize the entered command unambiguously, the CLI accepts the short

form of the command as if the user typed the full command.

Keyboard Shortcuts

The CLI has a range of keyboard shortcuts to assist in editing the CLI

commands. The help command, when used in the User Exec and Privileged

Exec modes, displays the keyboard short cuts.

Table 2-2 contains the CLI shortcuts displayed by the help command.

Using the CLI 221

Table 2-2. CLI Shortcuts

Parameters

Command line parameters are entered by the user to choose an individual

value or range of values for the specific command. Command line parameters

are not syntax or range checked until the carriage return is entered. In some

cases, the user may need to enter special characters, most often in a string

parameter such as a password or a label. Special characters are one of the

following characters (`! $ % ^ & * ( ) _ - + = { [ } ] : ; @ ' " ~ # | \ < , > . /

Keyboard Key Description

<Delete, Backspace> Delete previous character

<Ctrl>+<A> Go to beginning of line

<Ctrl>+<E> Go to end of line

<Ctrl>+<F> Go forward one character

<Ctrl>+<B> Go backward one character

<Ctrl>+<D> Delete current character

<Ctrl>+<U,X> Delete to beginning of line

<Ctrl>+<K> Delete to the end of the line.

<Ctrl>+<W> Delete previous word

<Ctrl>+<T> Transpose previous character

<Ctrl>+<P> Go to previous line history buffer

<Ctrl>+<R> Rewrites or pastes the line

<Ctrl>+<N> Go to next line in history buffer

<Ctrl>+<Y> Print last deleted character

<Ctrl>+<Q> Pauses screen output.

<Ctrl>+<S> Resumes screen output.

<Ctrl>+<Z> Return to root command prompt

<Tab, SPACE> Command-line completion

end Return to the root command prompt

exit Go to next lower command prompt

<?> List choices

Using the CLI 222

) or a blank. In these cases, it may be necessary to enclose the entire string in

double or single quotes for the command line parser to properly interpret the

parameter.

Command Scripting

The CLI can be used as a programmable management interface. To facilitate

this function, any characters entered after the <!> character are treated as a

comment and ignored by the CLI. Also, the CLI allows the user to disable

session timeouts.

CLI Command Notation Conventions

When entering commands there are certain command-entry notations which

apply to all commands. Table 2-3 describes these conventions as they are used

in syntax definitions.

Using the CLI 223

Table 2-3. CLI Command Notation Conventions

Interface Naming Conventions

The conventions for naming interfaces in CLI commands are as follows:

Ethernet Interfaces

Individual physical interfaces (Gigabit Ethernet, Ten Gigabit Ethernet, and

Forty Gigabit Ethernet) are identified in the CLI by the variable

unit/slot/port, where:

• <Interface Type> Unit#/Slot#/Port# — Identifies a specific interface by

the interface type tag followed by the Unit# followed by a / symbol, then

the Slot# followed by a / symbol, and then the Port#.

For example,

gi2/0/10 identifies the Gigabit interface 10 in slot 0 within the second

unit on a non-blade switch. Table 2-4 below lists the supported interface

type tags.

• Unit # — The unit number is greater than 1 only in a stacking solution

where a number of switches are stacked to form a virtual switch. In this

case, the Unit# indicates the logical position of the switch in a stack. The

range is 1–12. The unit value is 1 for standalone switches.

Convention Description

[ ]In a command line, square brackets indicate an optional entry.

{ }In a command line inclusive brackets indicate a selection of

compulsory parameters separated by the | character. One option

must be selected. For example: flowcontrol {auto | on | off}

means that for the flowcontrol command either auto, on or off

must be selected.

Italic Indicates a variable.

<Enter> Any individual key on the keyboard.

<Ctrl>+<F4> Any combination of keys pressed simultaneously on the keyboard.

Screen Display Indicates system messages and prompts appearing on the

console.

all Indicates a literal parameter, entered into the command as it is.

Using the CLI 224

• Slot# — The slot number is an integer number assigned to a particular

slot. Front panel ports have a slot number of 0. Rear panel ports are

numbered from 1 and can be identified by the lexan on the rear panel. Use

the show slot command to retrieve information for a particular slot.

•Port # — The port number is an integer number assigned to the physical

port on the switch and corresponds to the lexan printed next to the port on

the front or back panel. Ports are numbered from 1 to the maximum

number of ports available on the switch unit, typically 24 or 48.

Logical interfaces are identified by one of the keywords: loopback, port-

channel, tunnel or vlan followed an integer index identifying the specific

logical interface.

Within this document, the tag interface–id refers to a logical or Ethernet

interface identifier that follows the naming convention above. If the

command is restricted to a subset of the interfaces, then the subset is

described in the command description. Ethernet interfaces are

Gigabitethernet, Tengigabitethernet, and Fortygigabitethernet. NBASE-T

interfaces running at 2.5 and 5 Gigabit speeds are identified as

Gigabitethernet.

Using the CLI 225

Table 2-4. Interface Identifiers

When listed in command line output, Gigabit Ethernet interfaces are

preceded by the characters Gi, ten-Gigabit Ethernet interfaces are preceded

by Te, and forty-Gigabit Ethernet interfaces are preceded by Fo, as shown in

the examples below.

Stacking Interfaces

Stacking interfaces are represented in the CLI with the same unit/slot/port

form as Ethernet interfaces. The fixed stacking interfaces on the

N2000/N2100-ON/N3000 switches always use the TwentyGigabitStacking or

Tw notation and on the N1100-ON/N1500/N4000 switches, are referred to

using Ethernet notation.

Loopback Interfaces

Loopback interfaces are represented in the CLI by the keyword loopback

followed by the variable loopback-id, which can assume values from 0–7.

Port Channel Interfaces

Port-channel (or LAG) interfaces are represented in the CLI by the keyword

port-channel followed by the variable port-channel-number.

Interface Type Long Form Short Form Interface Identifier

Gigabit Ethernet Gigabitethernet Gi unit/slot/port

10-Gigabit

Ethernet

Tengigabitethernet Te unit/slot/port

21-Gigabit

Stacking

Twentygigabitstacking Tw unit/slot/port

40-Gigabit

Ethernet

Fortygigabitethernet Fo unit/slot/port

Loopback Loopback Lo loopback-id (0-7)

Port Channel Port-channel Po port-channel-number

(1-128) N1500 (1–64)

Tunnel Tunnel Tu tunnel-id (0-7)

Vlan VLAN Vl vlan-id (1-4093)

Using the CLI 226

When listed in command line output, port channel interfaces are preceded by

the characters Po.

Tunnel Interfaces

Tunnel interfaces are represented in the CLI by the keyword tunnel followed

by the variable tunnel-id, which can assume values from 0–7.

VLAN Routing Interfaces

VLAN interfaces are represented in the CLI by the keywords interface vlan

followed by the variable vlan-id, which can can assume values from 1-4093. A

VLAN routing interface will typically have an IP address assigned, either via

DHCP or a static assignment or, in the case of IPv6, auto assignment of a link

local address.

Operating on Multiple Interfaces (Ranges)

The CLI allows the user to operate on multiple interfaces in one operation.

The guidelines are as follows for range operation:

• The range key word is used to identify that an interface range specifier

follows.

– An interface range specifier consists of an interface identifier followed

by an optional range parameter. The interface type may be a physical

interface or a logical interface (port channel or VLAN) as described in

the Interface Naming Conventions section.

• The range parameter may be written in the following manner:

(#-#) — a range from a particular interface to another higher-numbered

interface (inclusive). For example, 1/0/1-10 indicates that the operation

applies to the physical interfaces 1 to 10 in slot 0 on unit 1. The number to

the left of the hyphen must always be less than or equal to the number to

the right of the hyphen, e.g. interface range Gi1/0/10-1 is not valid.

(#, #, #) — a list of interfaces. For example, (1/0/1, 1/0/1,1/0/3, 1/0/5)

indicates that the operation applies to the physical interfaces 1, 3, and 5 on

unit 1. The interfaces may or may not be consecutive, nor must the

interfaces be of the same type.

Using the CLI 227

(#, #-#, #) — ranges and non-consecutive interfaces listed together. For

example, (1/0/1, 1/0/3-5, 1/0/7) indicates that the operation applies to the

physical interfaces 1, 3, 4, 5, and 7 on unit 1.

NOTE: Each physical interface must be a fully qualified interface identifier in

the format unit/slot/port. See

Interface Naming Conventions

• Port channels and VLANs are supported in ranges.

• No spaces are allowed anywhere in a range parameter, e.g. Gi1/0/1 -2 is not

accepted, nor is Gi1/0/2, Gi1/0/4. Use Gi1/0/1-2 and Gi/1/0/2,Gi1/0/4

respectively.

• When operating on a range of interfaces, the CLI implementation hides

the parameters that may not be configured in a range (for example,

parameters that must be uniquely configured for each instance).

• The CLI uses best effort when operating on a list of objects. If the user

requests an operation on a list of objects, the CLI attempts to execute the

operation on as many objects in the list as possible even if failure occurs for

some of the items in the list. The CLI provides the user with a detailed list

of all failures, listing the objects and the reasons for the failures.

Some parameters must be configured individually for each port or interface.

Examples

Example 1 shows the various forms of interface notation that can be entered

in the CLI. Examples 2 and 3 show various forms of CLI output using

shorthand interface notation.

Example #1

gigabitethernet 1/0/1

gigabitethernet1/0/1 (there is no space)

gi 1/0/1

gi1/0/1 (there is no space)

port-channel 1

vlan 5

tunnel 7

loopback 3

Example #2

console(config-if-Gi1/0/23)#show vlan

VLAN Name Ports Type

----- --------------- ------------- --------------

Using the CLI 228

1 default Po1-128, Default

Gi1/0/1-24,

Te1/0/1-2

RSPAN Vlan

---------------------------------------------------------------------

None

console(config-if-Gi1/0/23)#show slot 2/0

Slot.............................. 2/0

Slot Status....................... Empty

Admin State....................... Enable

Power State....................... Enable

Configured Card:

Model Identifier............... Dell Networking N3024F

Card Description............... Dell 24 Port 10G Fiber

Pluggable......................... No

Example #3

console(config-if-Gi1/0/23)#show slot

Admin Power Configured Card

Slot Status State State Model ID Pluggable

----- ------ ------- ------- -------------------------------- ---------

1/0 Full Enable Enable Dell Networking N3024F No

1/1 Empty Disable Disable Yes

2/0 Empty Enable Enable Dell Networking N3024F No

2/1 Empty Enable Enable Yes

3/0 Empty Enable Enable Dell Networking N3048 No

3/1 Empty Enable Enable Yes

console(config-if-Gi1/0/23)#show slot 1/0

Slot.............................. 1/0

Slot Status....................... Full

Admin State....................... Enable

Power State....................... Enable

Inserted Card:

Model Identifier............... Dell Networking N3024F

Card Description............... Dell 24 Port 10G Fiber

Configured Card:

Model Identifier............... Dell Networking N3024F

Card Description............... Dell 24 Port 10G Fiber

Pluggable......................... No

Using the CLI 229

Addresses

MAC Addresses

MAC addresses are specified in 3 groups of four upper or lower case

hexadecimal characters separated by periods with no spaces, e.g.

0011.2233.FFee or by eight pairs of upper or lower case hexadecimal

characters separated by colons, e.g. 00:11:22:33:FF:ee. Leadings zeros must be

specified in all cases.

IPv4 Addresses

IPv4 addresses are specified by four groups of decimal integers in the range 0-

255, i.e. dotted quad notation. Leading zeros are not required. Example IPv4

addresses are 1.2.3.4 or 255.255.255.255.

The net mask, if specified, consists of four decimal digits in dotted quad

notation, e.g. 255.255.252.0 or a decimal prefix length preceded by a forward

slash and indicating the number of left justified 1 bits in the net mask. The

net mask is always separated from an IPv4 address by one or more spaces.

Examples:

1.2.3.0 /24 is equivalent to 1.2.3.0 255.255.255.0

IPv6 Addresses

IPv6 addresses may be expressed in up to eight blocks of four upper or lower

case hexadecimal characters. For simplification, the leading zeros of each 16

bit block may be omitted. One sequence of 16 bit blocks - containing only

zeros - may be replaced by a double colon”::”, but not more than one at a

time. Example IPv6 addresses are:

Dropped zeros: 3ffe:ffff:100:f101:0:0:0:1 becomes 3ffe:ffff:100:f101::1

Local Host: 0000:0000:0000:0000:0000:0000:0000:0001 becomes ::1

Any host: 0000:0000:0000:0000:0000:0000:0000:0000 becomes ::

The prefix length, if specified, ranges from 1 to 128 and is specified by a

forward slash and a decimal number indicating the significant bits of the

address, e.g. 3ffe:ffff:100:f101:0:0:0:/64. No spaces are allowed between the

last address digit and the forward slash.

Using the CLI 230

CLI Command Modes

Since the set of CLI commands is very large, the CLI is structured as a

command-tree hierarchy, where related command sets are assigned to

command modes for easier access. At each level, only the commands related

to that level are available to the user and only those commands are shown in

the context sensitive help for that level.

In this guide, commands are organized into multiple categories:

• Layer 2 Switching commands

• Security commands

• Audio Visual Bridging commands

• Data Center Technology commands

• Layer 3 Routing commands

• Switch Management commands

Layer 2 Switching describes the commands used for filtering and forwarding

of packets within a VLAN based upon learned MAC addresses.

Security describes the commands used to configure switch administrator and

end user network access.

Audio Visual Bridging describes the commands utilized to configure IEEE

802.1BA systems.

Data Center Technology describes the commands used to configure ANSI

T11 FC-BB-5 and OpenFlow capabilities.

Layer 3 Routing describes the commands used to forward packets within and

across VLANs based upon the IP addresses as well as management of the

routing protocols necessary to enable the distribution of routes.

Switch Management describes commands used to manage the switch.

Commands that cause specific actions to be taken immediately by the system

and do not directly affect the system configurations are defined at the top of

the command tree. For example, commands for rebooting the system or for

downloading or backing up the system configuration files are placed at the

top of the hierarchy tree.

Commands that result in configuration changes to the switch are grouped in

a Global Configuration sub tree.

Using the CLI 231

There are levels beneath the Global Configuration mode for further grouping

of commands. The system prompt reflects these sub-Configuration modes.

All the parameters are provided with reasonable defaults where possible.

When starting a session, the initial mode is the User Exec mode (privilege

level 0). Only a limited subset of commands is available in this mode. This

level is reserved for tasks that do not change the configuration. To enter the

next level, Privileged Exec mode (privilege level 1) may be required if

configured by the administrator.

Privileged Exec mode provides access to commands that can not be executed

in the User Exec mode and permits access to Global Configuration mode.

Global Configuration mode manages switch configuration on a global level.

For specific configurations, command modes exist at a sublevel.

Entering a <?> at the system prompt displays a list of commands available

for that particular command mode. A specific command is used to navigate

from one command mode to another. The standard order to access the modes

is as follows: User Exec mode, Privileged Exec mode, Global Configuration

mode, and Interface Configuration and other specific configuration modes.

User Exec Mode

After logging into the switch, the user is automatically in the User Exec

command mode unless the user is defined as a privileged user. In general, the

User Exec commands allow the user to perform basic tests, and list system

information.

The user-level prompt consists of the switch host name followed by the angle

bracket (>).

console>

The default host name is Console unless it has been changed using the

hostname command in Global Configuration mode.

Privileged Exec Mode

Because many of the privileged commands set operating parameters,

privileged access may be password-protected to prevent unauthorized use.

The password is not displayed on the screen and is case sensitive.

Privileged users enter into the Privileged Exec mode from User Exec mode,

where the following prompt is displayed.

Using the CLI 232

console#

Global Configuration Mode

Global Configuration commands allow the operator to change the

configuration of the switch. The Privileged Exec mode command configure

(or configure terminal) is used to enter Global Configuration mode.

console(config)#

The following are the Global Configuration submodes:

•SNMP v3 Host Configuration — Configures the parameters for the

SNMP v3 server host.

•SNMP Community Configuration — Configures the parameters for the

SNMP server community.

•MST — The Global Configuration mode command spanning-tree mst

configuration is used to enter into the Multiple Spanning Tree

configuration mode.

•Line Interface — Contains commands to configure the management

connections. These include commands such as line speed and time-out

settings. The Global Configuration mode command line is used to enter

the Line Interface mode.

•Router OSPF Configuration — Global configuration mode command

router ospf is used to enter into the Router OSPF Configuration mode.

•Router RIP Configuration — Global configuration mode command

router rip is used to enter into the Router RIP Configuration mode.

•Router OSPFv3 Configuration — Global configuration mode command

ipv6 router ospf is used to enter into the Router OSPFv3 Configuration

mode.

•Router BGP Configuration — Global configuration mode command

router bgp is used to enter into the Router BGP Configuration mode.

•IPv6 DHCP Pool Mode — Global configuration mode command ipv6

dhcp pool is used to enter into the IPv6 DHCP Pool mode.

•Management Access List — Contains commands to define management

access administration lists. The Global Configuration mode command

management access-list is used to enter the Management Access List

configuration mode.

Using the CLI 233

•Policy-map — Use the policy-map command to access the QoS policy

map configuration mode to configure the QoS policy map.

•Policy Class — Use the class command to access the QoS Policy-class

mode to attach or remove a diffserv class from a policy and to configure

the QoS policy class.

•Class-Map — This mode consists of class creation/deletion and matching

commands. The class matching commands specify layer 2, layer 3 and

general match criteria. Use the class-map class-map-name commands to

access the QoS Class Map Configuration mode to configure QoS class

maps.

•Stack — Use the stack command to access the Stack Configuration Mode.

•SSH Public Key-chain — Contains commands to manually specify other

switch SSH public keys. The Global Configuration mode command crypto

key pub-key chain ssh is used to enter the SSH Public Key-chain

configuration mode.

•SSH Public Key-string — Contains commands to manually specify the

SSH Public-key of a remote SSH Client.

•MAC Access-List — Configures conditions required to allow traffic based

on MAC addresses. The Global Configuration mode command mac

access-list is used to enter the MAC Access-List configuration mode.

•TACACS — Configures the parameters for the TACACS server.

•Radius — Configures the parameters for the RADIUS server.

•SNMP Host Configuration — Configures the parameters for the SNMP

server host. Only IPv4 hosts are supported.

•Crypto Certificate Request — Configures the parameters for crypto

certificate request.

•Crypto Certificate Generation — Configures the parameters for crypto

certificate generate.

•Logging — Configures the parameters for SYSLOG servers.

•VLAN— Creates a VLAN and configures non-L3 parameters on a VLAN.

•Virtual Router Configuration— Configures parameters for a virtual

routing instance.

Using the CLI 234

Pre-configuration

Nearly all switch features support a pre-configuration capability, even when a

feature is not enabled or the required hardware is not present.

Pre-configured capabilities become active only when enabled (typically via an

admin mode control) or when the required hardware is present (or both). For

example, a port can be pre-configured with both trunk and access mode

information. The trunk mode information is applied only when the port is

placed into trunk mode and the access mode information is only applied

when the port is placed into access mode. Likewise, OSPF routing can be

configured in the switch without being enabled on any port.

Interface Configuration Modes

Interface configuration modes are used to modify specific interface

operations. The following are the Interface Configuration and other specific

configuration modes:

•Ethernet — Contains commands to manage Ethernet port configuration.

The Global Configuration mode command interface interface-id enters

the Interface Configuration mode to configure an Ethernet interface.

•Port Channel — Contains commands to configure port-channels, i.e.,

assigning ports to a port-channel. Most of these commands are the same as

the commands in the Ethernet interface mode and are used to manage the

member ports as a single entity. The Global Configuration mode

command interface port-channel port-channel-number is used to enter

the Port Channel mode.

•Tunnel — Contains commands to manage tunnel interfaces. The Global

Configuration mode command interface tunnel enters the Tunnel

Configuration mode to configure an tunnel type interface.

•Loopback — Contains commands to manage loopback interfaces. The

Global Configuration mode command interface loopback enters the

Loopback Configuration mode to configure an loopback type interface.

•Out-of-band—Contains commands to manage the out-of-band interface,

if present. The Global Configuration mode command interface out-of-

band enters the Out-of-band Interface mode to configure the out-of-band

interface.

Using the CLI 235

•Interface VLAN— Enables routing on a VLAN and configures routing/L3

parameters on a VLAN.

Identifying the Switch and Command Mode from the System Prompt

The system prompt provides the user with the name of the switch

(hostname) and identifies the command mode. The following is a formal

description of the system command prompt:

[device name][([command mode-[object]])][# | >]

[device name] — is the name of the managed switch, which is typically the

user-configured hostname established by the hostname command.

[command mode] — is the current configuration mode and is omitted for the

top configuration levels.

[object] — indicates specific object or range of objects within the

configuration mode.

For example, if the current configuration mode is config-if and the object

being operated on is Gigabit Ethernet 1 on unit 1, the prompt displays the

object type and unit (for example, Gi1/0/1).

[# | >] — The # sign is used to indicate that the system is in the Privileged

Exec mode. The > symbol indicates that the system is in the User Exec

mode, which is a read-only mode in which the system does not allow

configuration.

Navigating CLI Command Modes

Table 2-5 describes how to navigate through the CLI Command Mode

hierarchy.

Table 2-5. Navigating CLI Command Modes

Command Mode Access Method Command Prompt Exit or Access

Previous Mode

User Exec The user is

automatically in

User Exec mode

unless the user is

defined as a

privileged user.

console> logout

Using the CLI 236

Privileged Exec Use the enable

command to enter

into this mode. This

mode is password

protected.

console# Use the exit

command, or

press

to return to the

User Exec mode.

Global

Configuration

From Privileged

Exec mode, use the

configure

command.

console(config)# Use the exit

command, or

press

to return to the

Privileged Exec

mode.

Line Interface From Global

Configuration

mode, use the line

command.

console(config-line)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

BGP Router

Configuration

From Global

Configuration

mode, use the

router bgp

command.

console(config-router)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Table 2-5. Navigating CLI Command Modes (continued)

Command Mode Access Method Command Prompt Exit or Access

Previous Mode

Using the CLI 237

IPv6 Address

Family

Configuration

From BGP Router

Configuration

mode, use the

address-family ipv6

command.

console (config-router-af)# To exit to BGP

Router

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Management

Access-List

From Global

Configuration

mode, use the

management

access-list

command.

console(config-macal)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Policy-Class-Map From Global

Configuration

mode, use the

policy-map class

command.

console(config-policy-map)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Class-Map From Global

Configuration

mode, use the class-

map command.

console(config-classmap)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Table 2-5. Navigating CLI Command Modes (continued)

Command Mode Access Method Command Prompt Exit or Access

Previous Mode

Using the CLI 238

MAC Access List From Global

Configuration

mode, use the mac

access-list

command.

console(config-mac-access-

list)#

To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

SSH Public Key-

Chain

From Global

Configuration

mode, use the

crypto key pubkey-

chain ssh

command.

console(config-pubkey-

chain)#

To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

SSH Public Key

String

From the SSH

Public Key- Chain

mode, use the user-

key <user name >

{rsa | dsa}

command.

console(config-pubkey-key)# To return to the

SSH Public key-

chain mode, use

the exit

command, or

press

to Privileged

Exec mode.

TACACS From Global

Configuration

mode, use the

tacacs-server host

command.

console(tacacs)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Table 2-5. Navigating CLI Command Modes (continued)

Command Mode Access Method Command Prompt Exit or Access

Previous Mode

Using the CLI 239

Radius From Global

Configuration

mode, use the

radius-server host

command.

console(Config-auth-

radius)#

To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Radius Dynamic

Authorization

From Global

Configuration, use

the aaa server radius

dynamic-author

command.

console(config-radius-da)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

SNMP Host

Configuration

From Global

Configuration

mode, use the

snmp-server

command.

console(config-snmp)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

SNMP v3 Host

Configuration

From Global

Configuration

mode, use the

snmp-server v3-host

command.

console(config-snmp)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Table 2-5. Navigating CLI Command Modes (continued)

Command Mode Access Method Command Prompt Exit or Access

Previous Mode

Using the CLI 240

SNMP

Community

Configuration

From Global

Configuration

mode, use the

snmp-server

community

command.

console(config-snmp)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode

Crypto

Certificate

Generation

From Global

Configuration

mode, use the

crypto certificate

number generate

command.

console(config-crypto-cert)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Crypto

Certificate

Request

From Privileged

Exec mode, use the

crypto certificate

number request

command.

console(config-crypto-cert)# To exit to

Privileged Exec

mode, use the

exit command,

or press

<Ctrl>+<Z>.

Stack From Global

Configuration

mode, use the stack

command.

console(config-stack)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Table 2-5. Navigating CLI Command Modes (continued)

Command Mode Access Method Command Prompt Exit or Access

Previous Mode

Using the CLI 241

Logging From Global

Configuration

mode, use the

logging command.

console(config-logging)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

MST From Global

Configuration

mode, use the

spanning-tree mst

configuration

command.

console(config-mst)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

VLAN Config From Global

Configuration

mode, use the vlan

command.

console(config-vlan)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Router OSPF

Config

From Global

Configuration

mode, use the

router ospf

command.

console(config-router)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode

Table 2-5. Navigating CLI Command Modes (continued)

Command Mode Access Method Command Prompt Exit or Access

Previous Mode

Using the CLI 242

Virtual Router

Config

From Global

Configuration

mode, use the ip vrf

command.

console(config-vrf-

XXX)#where XXX is the VRF

name.

To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode

Router RIP

Config

From Global

Configuration

mode, use the

router rip

command.

console(config-router)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode

Router OSPFv3

Config

From Global

Configuration

mode, use the ipv6

router ospf

command.

console(config-rtr)# To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode

IPv6 DHCP Pool

Mode

From Global

Configuration

mode, use the ipv6

dhcp pool

command.

console(config-dhcp6s-

pool)#

To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode

Interface Configuration Modes

Table 2-5. Navigating CLI Command Modes (continued)

Command Mode Access Method Command Prompt Exit or Access

Previous Mode

Using the CLI 243

Gigabit Ethernet From Global

Configuration

mode, use the

interface

gigabitethernet

command. Or, use

the abbreviation

interface gi.

console (config-if-

Giunit/slot/port#

To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

10 Gigabit

Ethernet

From Global

Configuration

mode, use the

interface

tengigabitethernet

command. Or, use

the abbreviation

interface te.

console (config-if-

Teunit/slot/port#

To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

40 Gigabit

Ethernet

From Global

Configuration

mode, use the

interface

fortygigabitetherne

t command. Or, use

the abbreviation

interface fo.

console (config-if-

Founit/slot/port#

To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Port Channel From Global

Configuration

mode, use the

interface port-

channel command.

Or, use the

abbreviation

interface po.

console (config-if-poport-

channel-number)#

To exit to Global

Configuration

mode, use the

exit command,

to Privileged

Exec mode.

Table 2-5. Navigating CLI Command Modes (continued)

Command Mode Access Method Command Prompt Exit or Access

Previous Mode

Using the CLI 244

Starting the CLI

To begin running the CLI, perform the following steps:

NOTE: This procedure is for use on the console line only.

NOTE: The Easy Setup Wizard may appear if the switch has no user configuration

saved. Follow the procedure in the Getting Started Guide to configure the switch

using the Easy Setup Wizard.

Start the switch and wait until the startup procedure is complete and the

User Exec mode is entered. The prompt console> is displayed.

Configure the switch and complete any required tasks.

VLAN From Global

Configuration

mode, use the

interface vlan

command.

console(config-if-vlanvlan-

id)#

To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Tunnel From Global

Configuration

mode, use the

interface tunnel

command. Or, use

the abbreviation

interface tu.

console(config-tunneltunnel-

id)#

To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Loopback From Global

configuration mode,

use the interface

loopback

command. Or, use

the abbreviation

interface lo.

console(config-

loopbackloopback-id)#

To exit to Global

Configuration

mode, use the

exit command,

or press

to Privileged

Exec mode.

Table 2-5. Navigating CLI Command Modes (continued)

Command Mode Access Method Command Prompt Exit or Access

Previous Mode

Using the CLI 245

When finished, exit the session with the quit or exit command.

The switch can be managed over a direct connection to the switch console

port or through a Telnet connection. If access is through a Telnet connection,

the switch must have a defined IP address, corresponding management access

granted, and a connection to the network.

Using CLI Functions and Tools

The CLI has been designed to manage the switch’s configuration file system

and to manage switch security. A number of resident tools exist to support

these and other functions.

Configuration Management

All managed systems have software images and databases that must be

configured, backed up and restored. Two software images may be stored on

the system, but only one of them is active. The other one is a backup image.

The same is true for configuration files, which store the configuration

parameters for the switch. The system has three configuration files. One file is

a memory-only file and is the current configuration file for the switch. The

second file is the one that is loaded by the system when it reboots. There is

one backup configuration file. The system also provides methods to back up

these files to a remote system.

File System Commands

All files are stored in a file system. The commands shown in Table 2-6 are

used to perform operations on these files.

Table 2-6. File System Commands

Command Description

delete file Deletes file.

filedescr file description Adds a description to a file (up to 128

characters can be used).

copy source destination Copies a file from source file to destination

file.

Using the CLI 246

Copying Files

The copy command not only provides a method for copying files within the

file system, but also to and from remote servers. With the copy command and

URLs to identify files, the user can back up images to local or remote systems

or restore images from local or remote systems.

To use the copy command, the user specifies the source file and the

destination file. For example, copy tftp://remotehost/pub/backupfile backup-

config copies a file from the remote TFTP server to a local backup

configuration file. In this case, if the local configuration file does not exist,

then it is created by the command. If it does exist, it is overwritten. If there is

not enough space on the local file system to accommodate the file, an error is

flagged.

Refer to the

copy

command description in the Layer 2 commands section of

the guide for command details.

Referencing External/Internal File systems

Configuration or software images are copied to or retrieved from remote

systems using the TFTP or FTP protocols.

• tftp://server-name/path/filename — identifies a file on a remote TFTP

server identified by the server-name. Trivial file transfer protocol is a

simplified FTP and uses a UDP port instead of TCP and does not have

password protection.

• <ftp://{user@ipaddress | hostname}/filepath/filename> — Identifies a

file on a remote FTP server identified by the server-name. The File

Transfer Protocol (FTP) is a standardized protocol used to transfer files

over the network using TCP. FTP is optionally secured with a clear-text

user name and password.

Special System Files

The following special filenames are used to refer to special virtual system files,

which are under control of the system and may not be removed or added.

These file names are reserved and may not be used as user-defined files.

When the user copies a local source file into one of these special files and the

source file has an attached file description, it also is copied as the file

description for the special file.

•backup-config — This file refers to the backup configuration file.

Using the CLI 247

•running-config — This file refers to the configuration file currently active

in the system. It is possible to copy the running-config image to a backup-

config file or to the startup-config file.

•startup-config — This file refers to the special configuration image stored

in flash memory which is loaded when the system next reboots. The user

may copy a particular configuration file (remote or local) to this special file

name and reboot the system to force it to use a particular configuration.

•active & backup — These files refer to software images. The active image

will be loaded when the system next reboots. Either the active or backup

can be chosen for the next reboot using the command boot system.

The CLI prevents the user from accidentally copying a configuration image

onto a software image and vice versa.

Management Interface Security

This section describes the minimum set of management interface security

measures implemented by the CLI. Management interface security consists

of user account management, user access control and remote network/host

access controls.

CLI through Telnet, SSH, Serial Interfaces

The CLI is accessible through a local serial interface/console port, the out-of-

band interface, or in-band interfaces. Since the console port requires a

physical connection for access, it is used if all else fails. The console port

interface is the only interface from which the user may access the Easy Setup

Wizard. It is the only interface that the user can access if the remote

authentication servers are down and the user has not configured the system to

revert to local managed accounts.

The following rules and specifications apply to these interfaces:

• The CLI is accessible from remote telnet through the IP address for the

switch. IP addresses are assigned separately for the out-of-band interface

and the in-band ports.

• The CLI is accessible from a secure shell interface.

• The administrator generates keys for SSH locally via the CLI.

Using the CLI 248

• The serial session defaults to 9600 BAUD, eight data bits, one stop bit, no

parity and no flow control

(115200 for the N1100-ON, N2100-ON, and

N3100-ON)

User Accounts Management

The CLI provides authentication for users either through remote

authentication servers supporting TACACS+ or Radius or through a set of

locally managed user accounts. The setup wizard asks the user to create the

initial administrator account and password at the time the system is booted.

The following rules and specifications apply:

• The administrator may create additional

administrator

accounts.

• User accounts have an associated privilege level, a user name, and a user

password.

• The administrator is able to delete the administrator accounts.

• The password is saved internally in encrypted format and never appears in

clear text anywhere on the CLI.

• The CLI supports TACACS+ and Radius authentication servers.

• The CLI allows the administrator to configure primary and secondary

authentication servers. If the primary authentication server fails to respond

within a configurable period, the CLI automatically tries the secondary

authentication server.

• The administrator can specify whether the CLI should revert to using local

accounts when the remote authentication servers do not respond or if the

CLI simply fails the login attempt because the authentication servers are

down. This capability applies only when the administrator is logged in

through a telnet or an SSH session.

• The CLI always allows the administrator to log in to a local serial port even

if the remote authentication server(s) are down. In this case, CLI reverts to

using the locally configured accounts to allow the administrator to log in.

User Access Control

In addition to authenticating an

administrator

, the CLI also assigns the

administrator

access to one of two security levels. Privilege level 1 has read-

only access. This level allows the

administrator

to read information but not

Using the CLI 249

configure the switch. The access to this level cannot be modified. Level 15 is

the special access level assigned to the superuser of the switch. This level has

full access to all functions within the switch.

If the account is created and maintained locally, each account is given an

access level at the time of account creation. If the administrator is

authenticated through remote authentication servers, the authentication

server is configured to pass the access level to the CLI when the account is

authenticated. When RADIUS is used, the Vendor-Specific Option field

returns the access level. Two vendor specific options are supported. These are

CISCO-AV-Pairs(Shell:priv-lvl=x) and Dell Radius VSA (user-group=x).

TACACS+ provides the appropriate level of access.

The following rules and specifications apply:

• The

administrator

determines whether remote authentication servers or

locally defined authentication accounts are used.

• If authentication servers are used, the

administrator

can identify at least

two remote servers (the user may choose to configure only one server) and

what protocol to use with the server, TACACS+ or Radius. One of the

servers is primary and the other is the secondary server (the user is not

required to specify a secondary server). If the primary server fails to

respond in a configurable time period, the CLI automatically attempts to

authenticate the user with the secondary server.

• The

administrator

is able to specify what happens when both primary and

secondary servers fail to respond. In this case, the user is able to indicate

that the CLI should either use the local user accounts or reject all requests.

• Even if the

administrator

configures the CLI to fail login when the remote

authentication servers are down, the CLI allows access via the serial

interface authenticated by locally managed account data. The default for

serial port access is no login or password required.

SYSLOG

The switch supports sending logging messages to a remote SYSLOG server.

The administrator configures a remote log server to which SYSLOG messages

are sent.

The following rules apply:

• The administrator configures a remote SYSLOG server to which system

logging messages are sent.

Using the CLI 250

• Log messages are implementation-dependent but may contain debug

messages, security or fault events.

• The switch maintains at most the last 1000 system events in the in-

memory log.

Security Logs

The system log records security events including the following:

• User login.

• User logout.

• Denied login attempts.

• User attempt to exceed security access level.

• Denied attempts by external management system to access the system.

The security log record contains the following information:

• The login name, if available, or the protocol being accessed if the event is

related to a remote management system.

• The IP address from which the user is connecting or the IP address of the

remote management system.

• A description of the security event.

• A timestamp of the event

If a SYSLOG server is configured and available, the switch sends security

records to the configured servers.

Management ACL

In addition to user access control, the system also supports filtering of

management protocol packets addressed to the switch over the in-band ports.

This capability allows individual hosts or subnets to access the switch using

specific management protocols.

The administrator defines a management profile, which identifies

management protocols such as the following:

• Telnet.

• SSH and the keying information to use for SSH.

• HTTP.

Using the CLI 251

• HTTPS and the security certificate to be used.

• SNMPv1/v2c and the read and read/write community strings to be used.

• SNMPv3 and the security information for used this protocol.

For each of these management profiles, the administrator defines the list of

hosts or subnets from which the management profiles may be used. The

management ACL capability only applies to in-band ports and may not be

configured on the out-of-band management port.

Other CLI Tools and Capabilities

The CLI has several other capabilities associated with its primary functions.

Terminal Paging

The terminal width and length for CLI displays is 79 characters and 25 lines,

respectively. The length setting is used to control the number of lines the CLI

will display before it pauses. For example, the CLI pauses at 24 lines and

prompts the user with the --More-- or (q)uit prompt on the 25th line. The

CLI waits for the user to press either <q> or <Enter> or any other key. If

the user presses any key other than <Enter> or <q>, the CLI shows the next

page. A <q> key stops the display and returns to the CLI prompt. The

<Enter> key advances the display by one line. Use the terminal length

command to change the number of lines displayed in a page. A terminal

length of 0 disables pagination. This option is not recommended for serial

console speeds of less than 115200.

Boot Message

The boot message is a system message that is not user-configurable and is

displayed when the system is booting.

To start the normal booting process, select item 1 in the Boot Menu. The

following is a sample log for booting information.

Select startup option within 5 seconds, else Operational Code will start

automatically...

Operational Code Startup -- Main Menu

1 - Start Operational Code

2 - Display Boot Menu

Select (1, 2)#

active = /dev/mtd7

Using the CLI 252

Extracting Operational Code from .stk file...done.

Loading Operational Code...done.

Decompressing Operational Code...done.

Scanning devshell symbols file...

47544 symbols, loading...

Done.

PCI unit 0: Dev 0xb842, Rev 0x02, Chip BCM56842_A0, Driver BCM56840_B0

SOC unit 0 attached to PCI device BCM56842_A0

Adding BCM transport pointers

Configuring CPUTRANS TX

Configuring CPUTRANS RX

<186> Aug 26 08:18:23 0.0.0.0-1 General[72162340]: bootos.c(166) 4 %%

Event(0xaaaaaaaa) started!

(Unit 1 - Waiting to select management unit)>

Applying Global configuration, please wait ...

Applying Interface configuration, please wait ...

Boot Utility Menu

If a user is connected through the serial interface during the boot sequence,

the operator is presented with the option to enter the Boot Utility Menu

during the boot sequence. Selecting item 2 displays the menu and may be

typed only during the initial boot up sequence.

Select startup option within 5 seconds, else Operational Code will start

automatically...

Operational Code Startup -- Main Menu

1 - Start Operational Code

2 - Display Boot Menu

Select (1, 2)# 2

Enter the Boot Menu password:calvin

Boot Menu Rev: 6.0

Operational Code -- Boot Main Menu

1 - Start Operational Code

2 - Select Baud Rate

3 - Retrieve Logs

4 - Load New Operational Code

5 - Display Operational Code Details

9 - Reboot

10 - Restore Configuration to Factory Defaults

Using the CLI 253

11 - Activate Backup Image

12 - Start Password Recovery

Enter Choice# 4

Creating tmpfs filesystem on /mnt/download for download...done.

Current Active Image# /dev/mtd7

Which Image to Update Active (/dev/mtd7) OR Back-Up (/dev/mtd6)? Select

(A/B): B

You selected to update Back-Up Image /dev/mtd6...

Select Mode of Transfer (Press T/X/Y/Z for TFTP/XMODEM/YMODEM/ZMODEM) []:T

Please ensure TFTP server is running to begin Transfer...

Enter Server IP []:10.27.9.99

Enter Host IP []:10.27.22.99

Enter Host Subnet Mask [255.255.255.0]:255.255.252.0

Enter Gateway IP []:10.27.20.1

Enter Filename []:jmclendo/N4000v6.0.0.8.stk

Do you want to continue? Press(Y/N): y

Bringing up eth0 interface...done.

Adding default gateway 10.27.20.1 to the Routing Table...done.

Bringing down eth0 interface...done.

Erasing /dev/mtd6!!!

Erasing 128 Kibyte @ 17e0000 -- 99 % complete.

Updating code file...

Code Update Instructions Found!

Critical components modified on Back-Up Partition -- Please activate Back-Up

Image to load the same on Reboot

Do you wish to activate Back-Up Image? (Y/N):

Cleaning tmpfs filesystem on /mnt/download...done.

Enter Choice# 5

active = /dev/mtd7

Extracting Operational Code from .stk file...done.

Loading Operational Code...done.

Decompressing Operational Code...done.

Product Details:-

Operational Code Image File Name - N4000v6.0.0.8

Rel 6, Ver 0, Maint Lev 0, Bld No 8

Timestamp - Thu Aug 22 13:09:33 EDT 2013

Number of components - 1

Device 776

ImageFlags 1

L7_MODULE_LIST=linux-kernel-bde.ko linux-user-bde.ko

Enter Choice# 10

Are sure you want to Erase Current Configuration? (Y/N): y

Erasing Current Configuration...done.

Using the CLI 254

Boot Menu Rev: 6.0

Operational Code -- Boot Main Menu

1 - Start Operational Code

2 - Select Baud Rate

3 - Retrieve Logs

4 - Load New Operational Code

5 - Display Operational Code Details

9 - Reboot

10 - Restore Configuration to Factory Defaults

11 - Activate Backup Image

12 - Start Password Recovery

Enter Choice# 11

Current Active Image# /dev/mtd7

Checking for valid back-up image at /dev/mtd6...done.

Activating Back-Up Image /dev/mtd6...done.

Code Update Instructions Found!

Back-Up Image on /dev/mtd6 Activated -- System Reboot Recommended!

Reboot? (Y/N):

Enter Choice# 12

Starting Operational Code for Password Recovery...

active = /dev/mtd6

Extracting Operational Code from .stk file...done.

Loading Operational Code...done.

Decompressing Operational Code...done.

4 START_OPR_CODE_PASSWD_RECOVERY MODE

Uncompressing apps.lzma

SyncDB Running...

DMA pool size: 16777216

PCI unit 0: Dev 0xb842, Rev 0x02, Chip BCM56842_A1, Driver BCM56840_B0

SOC unit 0 attached to PCI device BCM56842_A1

hpc - No stack ports. Starting in stand-alone mode.

<186> Jul 12 02:40:46 0.0.0.0-1 General[63446620]: bootos.c(179) 11 %%

Event(0xaaaaaaaa) started!

(Unit 1 - Waiting to select management unit)>

Applying Global configuration, please wait ...

Welcome to Dell Easy Setup Wizard

The setup wizard guides you through the initial switch configuration, and

gets you up and running as quickly as possible. You can skip the setup

Using the CLI 255

wizard, and enter CLI mode to manually configure the switch. You must

respond to the next question to run the setup wizard within 60 seconds,

otherwise the system will continue with normal operation using the default

system configuration. Note: You can exit the setup wizard at any point

by entering [ctrl+z].

Would you like to run the setup wizard (you must answer this question within

60 seconds)? [Y/N] n

Thank you for using the Dell Easy Setup Wizard. You will now enter CLI mode.

Applying Interface configuration, please wait ...

Booting without a Startup Configuration

When the system boots without a startup configuration (which is not the

same as an empty startup-config) and no EULA Accept file exists on the stack

master, the following prompt occurs:

(Unit 1 - Waiting to select management unit)>

Applying Global configuration, please wait...

SupportAssist EULA

I accept the terms of the license agreement. You can reject the license

agreement by configuring this command 'eula-consent support-assist reject’.

By installing SupportAssist, you allow Dell to save your contact

information(e.g. name, phone number and/or email address) which would be used

to provide technical support for your Dell products and services. Dell may

use the information for providing recommendations to improve your IT

infrastructure. SupportAssist also collects and stores machine diagnostic

information, which may include but is not limited to configuration

information, user supplied contact information, names of data volumes, IP

addresses, access control lists, diagnostics & performance information,

network configuration information, host/server configuration& performance

information and related data (Collected Data) and transmits this information

to Dell. By downloading SupportAssist and agreeing to be bound by the set

terms and the Dell end user license agreement, available at:

www.dell.com/aeula, you agree to allow Dell to provide remote monitoring

services of your IT environment and you give Dell the right to collect the

Collected Data in accordance with Dells Privacy Policy, available at:

www.dell.com/privacypolicycountryspecific, in order to enable the

performance of all of the various functions of SupportAssist during your

entitlement to receive related repair services from Dell,. You further agree

to allow Dell to transmit and store the Collected Data from SupportAssist in

accordance with these terms. You agree that the provision of SupportAssist

may involve international transfers of data from you to Dell and/or to Dells

affiliates, subcontractors or business partners. When making such transfers,

Dell shall ensure appropriate protection is in place to safeguard the

Collected Data being transferred in connection with SupportAssist. If you are

downloading SupportAssist on behalf of a company or other legal entity, you

are further certifying to Dell that you have appropriate authority to provide

this consent on behalf of that entity. If you do not consent to the

collection, transmission and/or use of the Collected Data, you may not

download, install or otherwise use SupportAssist.

Using the CLI 256

AeroHive HiveManager NG EULA

This switch includes a feature that enables it to work with HiveManager (an

optional management suite), by sending the switch’s service tag number to

HiveManager to authenticate your entitlement to use HiveManager. If you wish

to disable this feature, you should run command “eula-consent hiveagent

reject” immediately upon powering up the switch for the first time, or at any

time thereafter.

Welcome to Dell Easy Setup Wizard

The setup wizard guides you through the initial switch configuration, and

gets you up and running as quickly as possible. You can skip the setup

wizard, and enter CLI mode to manually configure the switch. You must

respond to the next question to run the setup wizard within 60 seconds,

otherwise the system will continue with normal operation using the default

system configuration. Note: You can exit the setup wizard at any point

by entering [ctrl+z].

Would you like to run the setup wizard (you must answer this question within

60 seconds)? (y/n)

Regardless of if the administrator runs or does not run the Easy Setup wizard

and if the SupportAssist application is installed:

eula-consent support-assist accept

is entered into the running-config if the SupportAssist EULA Accept file

exists on the stack master and contains the ‘EULA: Accepted’ text.

Regardless of whether the administrator runs or does not run the Easy Setup

wizard and if the HiveAgent is installed:

eula-consent hiveagent accept

is entered into the running-config if the HiveAgent EULA Accept file exists

on the stack master and contains the ‘EULA: Accepted’ text.

The Easy Setup Wizard also prompts the user to configure a proxy server as

follows:

Step 5:

Would you like to configure the address of an HTTPS proxy server used by the

SupportAssist agent? [Y/N] y

Enter the IPv4 or IPv6 address of the proxy server:192.168.0.3

Enter the port number used by HTTPS [443]:

Enter the user name required to access the proxy server:

Enter the password required to access the proxy server:

This is the configuration information that has been collected:

User Account setup = admin

Using the CLI 257

Password = ********

Out-of-band IP address = DHCP

VLAN1 Router Interface IP = 0.0.0.0 0.0.0.0

Proxy Server Address: 192.168.0.3

Proxy Server Port: 443

Proxy Server User Name:

Proxy Server Password:

Monitoring Traps from CLI

It is possible to connect to the CLI session and monitor the events or faults

that are being sent as traps from the system. This feature is equivalent to the

alarm-monitoring window in a typical network management system. The user

enables display of events or monitor traps from the CLI by entering the

command logging console. Traps generated by the system are dumped to all

CLI sessions that have requested monitoring mode to be enabled. The no

logging console command disables trap monitoring for the session. By

default, console logging is enabled. Use the terminal monitor command to

observe logging messages when connected via telnet or SSH.

Viewing System Messages

System messages autonomously display information regarding occurrences

that may affect switch operations. By default, system messages are not

displayed on CLI sessions connected via telnet or SSH. Use the terminal

monitor command to enable the autonomous display of system messages

when connecting to the switch via telnet or SSH. System messages are always

displayed on the serial console.

Using the CLI 258

Layer 2 Switching Commands 259

Layer 2 Switching Commands

The sections that follow describe commands that conform to the OSI model

data link layer (Layer 2). Layer 2 commands provide a logical organization for

transmitting data bits on a particular medium. This layer defines the framing,

addressing, and checksum functions for Ethernet packets.

This section of the document contains the following Layer 2 topics:

ACL Commands Ethernet

Configuration

Commands

IPv6 Access List

Commands

MLAG Commands

MAC Address Table

Commands

Ethernet CFM

Commands

IPv6 Access List

Commands

Port Channel

Commands

Auto-VoIP

Commands

Green Ethernet

Commands

IPv6 MLD

Snooping

Commands

Port Monitor

Commands

CDP

Interoperability

Commands

GMRP Commands IPv6 MLD

Snooping Querier

Commands

QoS Commands

–

GVRP Commands IP Source Guard

Commands

Spanning Tree

Commands

DHCP Layer 2

Relay Commands

IGMP Snooping

Commands

iSCSI

Optimization

Commands

UDLD Commands

DHCP Snooping

Commands

IGMP Snooping

Querier Commands

Link Dependency

Commands

VLAN Commands

DHCPv6 Snooping

Commands

Interface Error

Disable and Auto

Recovery

LLDP Commands Voice VLAN

Commands

Dynamic ARP

Inspection

Commands

–

Loop Protection

–

Layer 2 Switching Commands 260

ACL Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Access to a switch or router can be made more secure through the use of

Access Control Lists (ACLs) to control the type of traffic allowed into or out

of specific ports. An ACL consists of a series of rules, each of which describes

the type of traffic to be processed and the actions to take for packets that

meet the classification criteria. Rules within an ACL are evaluated

sequentially until a match is found, if any. An implicit deny-all rule is added

after the end of the last configured access group. ACLs can help ensure that

only authorized users have access to specific resources while blocking out any

unwarranted attempts to reach network resources.

ACLs may be used to restrict contents of routing updates, decide which types

of traffic are forwarded or blocked and, above all, provide security for the

network. ACLs are normally used in firewall routers that are positioned

between the internal network and an external network, such as the Internet.

They can also be used on a router positioned between two parts of the

network to control the traffic entering or exiting a specific part of the internal

network.

The Dell EMC Networking ACL feature allows classification of packets based

upon Layer 2 through Layer 4 header information. An Ethernet IPv6 packet is

distinguished from an IPv4 packet by its unique EtherType value; thus, all

IPv4 and IPv6 classifiers implicitly include the EtherType field.

Multiple ACLs per interface are supported. The ACLs can be a combination

of Layer 2 and/or Layer 3/4 ACLs. ACL assignment is appropriate for both

Ethernet ports and LAGs. ACLs can also be time based. The maximum

number of ACLs and rules supported depends on the resources consumed by

other processes and configured features running on the switch.

ACL Logging

Access list rules are monitored in hardware to either permit or deny traffic

matching a particular classification pattern, but the network administrator

currently has no insight as to which rules are being hit. Dell EMC Networking

platforms have the ability to count the number of hits for a particular

Layer 2 Switching Commands 261

classifier rule. The ACL logging feature allows these hardware hit counts to be

collected on a per-rule basis and reported periodically to the network

administrator using the system logging facility and an SNMP trap.

The Dell EMC Networking ACL syntax supports a log parameter that enables

hardware hit count collection and reporting. A five minute logging interval is

used, at which time trap log entries are written for each ACL logging rule that

accumulated a nonzero hit count during that interval. The logging interval is

not user configurable.

How to Build ACLs

This section describes how to build ACLs that are less likely to exhibit false

matches.

Administrators are cautioned to specify ACL access-list, permit and deny rule

criteria as fully as is possible in order to avoid false matches. As an example,

rules that specify a TCP or UDP port value should also specify the TCP or

UDP protocol and the IPv4 or IPv6 Ether type. Rules that specify an IP

protocol should also specify the Ether type value for the frame. In general, any

rule that specifies matching on an upper layer protocol field should also

include matching constraints for each of the lower layer protocols. For

example, a rule to match packets directed to the well-known UDP port

number 22 (SSH) should also include matching constraints on the IP

protocol field (protocol = 0x11 or UDP) and the Ether type field (Ether type

= 0x0800 or IPv4). In Table 3-1 is a list of commonly used Ether types and, in

Table 3-2 commonly used IP protocol numbers.

Layer 2 Switching Commands 262

Table 3-1. Common Ethertypes

EtherType Protocol

0x0800 Internet Protocol version 4 (IPv4)

0x0806 Address Resolution Protocol (ARP)

0x0842 Wake-on LAN Packet

0x8035 Reverse Address Resolution Protocol (RARP)

0x8100 VLAN tagged frame (IEEE 802.1Q)

0x86DD Internet Protocol version 6 (IPv6)

0x8808 MAC Control

0x8809 Slow Protocols (IEEE 802.3)

0x8870 Jumbo frames

0x888E EAP over LAN (EAPOL – 802.1x)

0x88CC Link Layer Discovery Protocol

0x8906 Fibre Channel over Ethernet

0x8914 FCoE Initialization Protocol

0x9100 Q in Q

Table 3-2. Common IP Protocol Numbers

IP Protocol Numbers Protocol

0x00 IPv6 Hop-by-hop option

0x01 ICMP

0x02 IGMP

0x06 TCP

0x08 EGP

0x09 IGP

0x11 UDP

Layer 2 Switching Commands 263

Commands in this Section

This section explains the following commands:

ip access-list

Use the ip access-list command in Global Configuration mode to create an

Access Control List (ACL) that is identified by the parameter list-name and

to enter IPv4-Access-List configuration mode. If parameterized with the

name of an existing access list, additional match clauses are added to the end

of the access list.

ip access-list list-name [extended]

no ip access-list list-name

•

list-name

—Access-list name up to 31 characters in length.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

Access lists use the extended access list format. Multiple permit and deny

clauses and actions may be specified without requiring the access list name to

be entered each time. Permit and deny clauses are entered in order from the

first match clause when in Access List Configuration mode.

ip access-list mac access-list extended rename

deny | permit (IP ACL) remark

deny | permit (Mac-Access-List-

Configuration)

service-acl input

ip access-group show service-acl interface

mac access-group show ip access-lists

mac access-list extended show mac access-lists

Layer 2 Switching Commands 264

ACL names are global. An IPv6 access list cannot have the same name as an

IPv4 access list. Access list names can consist of any printable character

except a question mark. Names can be up to 31 characters in length. ACLs

referenced in a route map may not be edited. Instead, create a new ACL with

the desired changes and refer to the new ACL in the route map.

deny | permit (IP ACL)

Use this command in Ipv4-Access-List Configuration mode to create a new

rule for the current IP access list. Each rule is appended to the list of

configured rules for the list if no sequence number is specified. Use the no

form of the command to delete an existing permit/deny clause.

Syntax

[sequence-number]deny | permit (IP ACL)

[sequence-number]{deny | permit} {ipv4-protocol | 0-255 | every} {srcip

srcmask | any | host srcip} [{range {portkey | startport} {portkey |

endport}} | {eq | neq | lt | gt} {portkey | 0-65535} ] {dstip dstmask | any |

host dstip} [{range {portkey | startport} {portkey | endport}} | {eq | neq |

lt | gt} {portkey | 0-65535}] [flag [+fin | -fin] [+syn | -syn] [+rst | -rst]

[+psh | -psh] [+ack | -ack] [+urg | -urg] [established]] [icmp-type icmp-

type [icmp-code icmp-code] | icmp-message icmp-message] [igmp-type

igmp-type] [fragments] [precedence precedence | tos tos [tosmask] | dscp

dscp]}} [time-range time-range-name] [log] [assign-queue queue-id]

[{mirror | redirect} interface-id] [rate-limit rate burst-size]

no <sequence-number>

•

[sequence-number]

—Identifies the order of application of the

permit/deny statement. If no sequence number is assigned, permit/deny

statements are assigned a sequence number beginning at 1000 and

incrementing by 10. Statements are applied in hardware beginning with

the lowest sequence number. Sequence numbers only have applicability

within an access group, i.e. the ordering applies within the access-group

scope. The range for sequence numbers is 1– 2147483647.

•{deny | permit}–Specifies whether the IP ACL rule permits or denies the

matching traffic.

•

{ipv4-protocol | number| every}—

Specifies the protocol to match for

the IP ACL rule.

Layer 2 Switching Commands 265

– IPv4 protocols: eigrp, gre, icmp, igmp, ip, ipinip, ospf, tcp, udp, pim,

arp, sctp

–number: a protocol number in decimal, for example, 8 for EGP

–every: Match any protocol (don’t care)

•

srcip srcmask | any | host srcip

—Specifies a source IP address and

netmask to match for the IP ACL rule.

– Specifying “any” implies specifying srcip as “0.0.0.0” and srcmask as

“255.255.255.255” for IPv4.

– Specifying “host A.B.C.D” implies srcip as “A.B.C.D” and srcmask as

“0.0.0.0”.

•

[{{eq | neq | lt | gt} {portkey | number} | range startport endport}]

—

Specifies the layer 4 source or destination port match condition for the

TCP/UDP ACL rule. When the protocol is SCTP, TCP or UDP, a source or

destination port number, which ranges from 0-65535, or a portkey, which

can be one of the following keywords: domain, echo, ftp, ftp-data, http,

smtp, snmp, telnet, tftp, www, bgp, pop2, pop3, ntp, rip, time, who may be

entered. Each of these keywords translates into its equivalent destination

port number.

– When “range” is specified, IP ACL rule matches only if the layer 4

port number falls within the specified port range. The startport and

endport parameters identify the first and last ports that are part of the

port range. They have values from 0 to 65535. The ending port must

have a value equal or greater than the starting port. The starting port,

ending port, and all ports in between will be part of the layer 4 port

range.

– When “eq” is specified, IP ACL rule matches only if the layer 4 port

number is equal to the specified port number or portkey.

– When “lt” is specified, IP ACL rule matches if the layer 4 destination

port number is less than the specified port number or portkey. It is

equivalent to specifying the range as 0 to <specified port number –

1>.

– When “gt” is specified, IP ACL rule matches if the layer 4 destination

port number is greater than the specified port number or portkey. It is

equivalent to specifying the range as <specified port number + 1> to

65535.

Layer 2 Switching Commands 266

– When “neq” is specified, IP ACL rule matches only if the layer 4

destination port number is not equal to the specified port number or

portkey.

– IPv4 TCP/UDP port names: domain, echo, ftp, ftp-data, http, smtp,

snmp, telnet, tftp, www, bgp, pop2, pop3, ntp, rip, time, who

• dstip dstmask | any | host dstip—Specifies a destination IP address and

netmask for match condition of the IP ACL rule.

– Specifying “any” implies specifying dstip as “0.0.0.0” and dstmask as

“255.255.255.255”.

– Specifying “host A.B.C.D” implies dstip as “A.B.C.D” and dstmask as

“0.0.0.0”.

•

[precedence precedence | tos tos [tosmask] | dscp dscp]—

Specifies the

TOS for an IP/TCP/UDP ACL rule depending on a match of precedence

or DSCP values using the parameters dscp, precedence, or tos tosmask.

[+urg | -urg] [established]—Specifies that the IP/TCP/UDP ACL rule

matches on the TCP flags.

–Ack – Acknowledgment bit

–Fin – Finished bit

–Psh – push bit

–Rst – reset bit

–Syn – Synchronize bit

–Urg – Urgent bit

– When “+<tcpflagname>” is specified, a match occurs if specified

<tcpflagname> flag is set in the TCP header.

– When “-<tcpflagname>” is specified, a match occurs if specified

<tcpflagname> flag is *NOT* set in the TCP header.

– When “established” is specified, a match occurs if either the RST or

ACK bits are set in the TCP header.

– This option is visible only if protocol is “tcp”.

•

[icmp-type icmp-type [icmp-code icmp-code] | icmp-message icmp-

message] —

Specifies a match condition for ICMP packets.

Layer 2 Switching Commands 267

– When icmp-type is specified, IP ACL rule matches on the specified

ICMP message type, a number from 0 to 255.

– When icmp-code is specified, IP ACL rule matches on the specified

ICMP message code, a number from 0 to 255.

– Specifying icmp-message implies both icmp-type and icmp-code are

specified.

– ICMP message is decoded into corresponding ICMP type and ICMP

code within that ICMP type. This option is visible only if the protocol

is “icmp”.

– IPv4 ICMP message types: echo echo-reply host-redirect mobile-

redirect net-redirect net-unreachable redirect packet-too-big port-

unreachable source-quench router-solicitation router-advertisement

time-exceeded ttl-exceeded unreachable

•igmp-type igmp-type—When igmp-type is specified, IP ACL rule matches

on the specified IGMP message type (i.e., a number from 0 to 255).

•

fragments—

Specifies the rule matches packets that are non-initial

fragments (fragment bit asserted). Not valid for rules that match L4

information such as TCP port number since that information is carried in

the initial packet.

•

log—

Specifies that this rule is to be logged if the permit/deny rule has

been matched one or more times since the expiry of the last logging

interval. The logging interval is 5 minutes.

•time-range time-range-name—Allows imposing time limitation on the

ACL rule as defined by the parameter time-range-name. (See Time

Ranges Commands for more information.) If a time range with the

specified name does not exist and the ACL containing this ACL rule is

applied to an interface or bound to a VLAN, then the ACL rule is applied

immediately. If a time range with specified name exists and the ACL

containing this ACL rule is applied to an interface or bound to a VLAN,

then the ACL rule is applied when the time-range with specified name

becomes active. The ACL rule is removed when the time-range with

specified name becomes inactive.

Layer 2 Switching Commands 268

•assign-queue queue-id—Specifies the assign-queue, which is the queue

identifier to which packets matching this rule are assigned. The queue ID

is the internal queue number (traffic class), not the CoS value. Use the

show classofservice command to display the assignment of CoS and DSCP

values to internal queue numbers.

•

{mirror | redirect} interface-id

—Specifies the mirror or redirect Ethernet

interface to which packets matching this rule are copied or forwarded,

respectively.

•

rate-limit rate burst-size

—Specifies the allowed rate of traffic as per the

configured rate in Kbps, and burst-size in kbytes. Rate limits only apply to

permit rules.

– Rate – the committed rate in kilobits per second

– Burst-size – the committed burst size in Kilobytes.

Default Configuration

No ACLs are configured by default. An implicit deny all condition is added by

the system after the last MAC or IP/IPv6 access group if no route-map is

configured on the interface.

Command Mode

Ipv4-Access-List Configuration mode

User Guidelines

Administrators are cautioned to specify permit and deny rule matches as fully

as is possible in order to avoid false matches. Rules that specify an IP port

value should also specify the protocol (TCP or UDP) and relevant IP

addresses or subnets. In general, any rule that specifies matching on an upper

layer protocol field should also include matching constraints for lower layer

protocol fields. For example, a rule to match packets directed to the well-

known UDP port number 22 (SSH) should also include constraints on the IP

protocol field (UDP). IPv4 and IPv6 ACLs implicitly include the EtherType

in the match criteria. Below is a list of commonly used EtherTypes:

Ethertype Protocol

0x0800 Internet Protocol version 4 (IPv4)

Layer 2 Switching Commands 269

In order to provide the greatest amount of flexibility in configuring ACLs, the

permit/deny syntax allows combinations of matching criteria that may not

make sense when applied in practice.

Port ranges are not supported for ACLs configured in egress (out) access-

groups. This means that only the eq operator is supported in an egress (out)

ACL.

The protocol type must be sctp, tcp or udp to specify a port range.

The fragment keyword is not supported for ACLs configured in egress (out)

IPv4 access-groups.

The rate-limit command is not supported for ACLs configured in egress (out)

IPv4 access-groups on the N4000 switches. Rate limits are only valid for

permit rules.

Any – is equivalent to 0.0.0.0 255.255.255.255 for IPv4 access lists

Host – indicates specified address with mask equal to 255.255.255.255 and

address 0.0.0.0 for IPv4.

0x0806 Address Resolution Protocol (ARP)

0x0842 Wake-on LAN Packet

0x8035 Reverse Address Resolution Protocol (RARP)

0x8100 VLAN tagged frame (IEEE 802.1Q)

0x86DD Internet Protocol version 6 (IPv6)

0x8808 MAC Control

0x8809 Slow Protocols (IEEE 802.3)

0x8870 Jumbo frames

0x888E EAP over LAN (EAPOL – IEEE 802.1x)

0x88CC Link Layer Discovery Protocol

0x8906 Fibre Channel over Ethernet

0x8914 FCoE Initialization Protocol

0x9100 Q in Q

Ethertype Protocol

Layer 2 Switching Commands 270

The command accepts the optional time-range parameter. The time-range

parameter allows imposing a time limitation on the IP ACL rule as defined by

the parameter time-range-name. If a time range with the specified name does

not exist, and the IP ACL containing this ACL rule is applied to an interface

or bound to a VLAN, then the ACL rule is applied immediately. If a time

range with the specified name exists, and the IP ACL containing this ACL

rule is applied to an interface or bound to a VLAN, then the ACL rule is

applied when the time-range with a specified name becomes active. The ACL

rule is removed when the time-range with a specified name becomes inactive.

An implicit deny all condition is added by the system after the last MAC or

IP/IPv6 access group if no route-map is configured on the interface.

Every permit/deny rule that does not have a rate-limit parameter is assigned a

counter. If counter resources become exhausted, a warning is issued and the

rule is applied to the hardware without the counter.

If a permit|deny clause is entered with the same sequence number as an

existing rule, an error is displayed and the existing rule is not updated with

the new information.

Command History

Updated in 6.3.0.1 firmware. Description updated in the 6.4 release.

Example

console(config)#ip access-list ipv4

console(config-ip-acl)#100 deny ip any any precedence 3

deny | permit (Mac-Access-List-Configuration)

Use the deny command in Mac-Access-List Configuration mode to deny

traffic if the conditions defined in the deny statement are matched. Use the

permit command in Mac-Access-List Configuration mode to allow traffic if

the conditions defined in the permit statement are matched.

Use this command in Mac-Access-List Configuration mode to create a new

rule for the current MAC access list. Each rule is appended to the list of

configured rules for the list, if no sequence number is specified.

The command is enhanced to accept the optional time-range parameter. The

time-range parameter allows imposing a time limitation on the MAC ACL

rule as defined by the parameter time-range-name. If a time range with the

Layer 2 Switching Commands 271

specified name does not exist, and the MAC ACL containing this ACL rule is

applied to an interface or bound to a VLAN, then the ACL rule is applied

immediately. If a time range with the specified name exists, and the MAC

ACL containing this ACL rule is applied to an interface or bound to a VLAN,

then the ACL rule is applied when the time-range with a specified name

becomes active. The ACL rule is removed when the time-range with a

specified name becomes inactive.

Use the no form of the command to delete an existing permit/deny clause.

Syntax

[sequence-number] deny | permit (MAC access-list configuration)

[sequence-number] {deny | permit} {{any | srcmac srcmacmask} {any |

bpdu |dstmac dstmacmask}} [ethertypekey | [0x0600-0xFFFF] [vlan {eq 0-

4095}] [secondary-vlan {eq 0-4095}] [cos 0-7] [log] [time-range time-range-

name] [assign-queue queue-id] [{mirror | redirect} interface-id] [rate-limit

rate burst-size]

no sequence-number

• sequence-number—Identifies the order of application of the permit/deny

statement. If no sequence number is assigned, permit/deny statements are

assigned a sequence number beginning at 1000 and incrementing by 10.

Statements are applied in hardware beginning with the lowest sequence

number. Sequence numbers only have applicability within an access group,

i.e. the ordering applies within the access-group scope. The range for

sequence numbers is 1– 2147483647.

•

srcmac

—Valid source MAC address in format xxxx.xxxx.xxxx.

•

srcmacmask

—Valid MAC address bit mask for the source MAC address in

format xxxx.xxxx.xxxx.

•

any

—Packets sent to or received from any MAC address.

•

dstmac

—Valid destination MAC address in format xxxx.xxxx.xxxx.

•

destmacmask

—Valid MAC address bit mask for the destination MAC

address in format xxxx.xxxx.xxxx.

•

bpdu

—Bridge protocol data unit

•

ethertypekey

—Either a keyword or valid four-digit hexadecimal number.

(Range: Supported values are appletalk, arp, ibmsna, ipv4, ipv6, ipx,

mplsmcast, mplsucast, Netbios, novell, pppoe, rarp.)

Layer 2 Switching Commands 272

•

0x0600-0xFFFF

—Specify custom EtherType value (hexadecimal range

0x0600-0xFFFF).

•

vlan eq

—VLAN identifier. (Range 0-4095). This matches the outer VLAN

of a single or double-tagged packet. It does not match untagged packets.

•

secondary-vlan eq

—VLAN identifier. (Range 0-4095). This matches the

inner VLAN of a double-tagged packet. It does not match single or

untagged packets.

•

cos

—

Class of service. (Range 0-7)

•

log

—

Specifies that this rule is to

be logged if the permit/deny rule has

been matched one or more times since the expiry of the last logging

interval. The logging interval is 5 minutes

• time-range-name—Use the time-range parameter to impose a time

limitation on the MAC ACL rule as defined by the parameter.

•assign-queue—

Specifies particular hardware queue for handling traffic

that matches the rule.

•

queue-id

—

0-6, where n is number of user configurable queues available

for that hardware platform. The queue ID is the internal queue number

(traffic class), not the CoS value. Use the show classofservice command

to display the assignment of CoS and DSCP values to internal queue

numbers.

•

mirror

—

Copies the traffic matching this rule to the specified interface.

•

redirect

—

Forwards traffic matching this rule to the specified Ethernet

interface.

•

interface-id

—

An Ethernet interface identifier, for example gi1/0/12.

•rate-limit rate burst-size—Specifies the allowed rate of traffic per the

configured rate in Kbps and burst-size in kbytes. Rate limits only apply to

permit rules.

– Rate— The committed rate in kilobits per second

– Burst-size—The committed burst size in Kilobytes.

Default Configuration

An implicit deny all condition is added by the system after the last MAC or

IP/IPv6 access group if no route-map is configured on the interface.

Layer 2 Switching Commands 273

Command Mode

Mac-Access-List Configuration mode

User Guidelines

The assign-queue and redirect parameters are only valid for permit

commands.

An implicit deny all condition is added by the system after the last MAC or

IP/IPv6 access group if no route-map is configured on the interface.

Every permit/deny rule that does not have a rate-limit parameter is assigned a

counter. If counter resources become exhausted, a warning is issued and the

rule is applied to the hardware without the counter.

If a permit|deny clause is entered with the same sequence number as an

existing rule, an error is displayed and the existing rule is not updated with

the new information.

Command History

Updated in 6.3.0.1 firmware. Secondary VLAN option added in 6.3.5 release.

Example

The following example configures a MAC ACL to deny traffic from MAC

address 0806.c200.0000.

console(config)#mac access-list extended DELL123

console(config-mac-access-list)#500 deny 0806.c200.0000 0000.0000.0000 any

ip access-group

Use the ip access-group command in Global and Interface Configuration

modes to apply an IP-based ACL on an interface or a group of interfaces.

Use the no ip access-group command to disable an IP-based ACL on an

interface or a group of interfaces.

Syntax

ip access-group name [in | out | control-plane] [seqnum]

no ip access-group name [in | out | control-plane]

Layer 2 Switching Commands 274

• name — Access list name. (Range: Valid IP access-list name up to 31

characters in length)

•in — The access list is applied to ingress packets.

•out—The access list is applied to egress packets.

•control-plane—The access list is applied to egress control plane packets

only. This is only available in Global Configuration mode.

• seqnum — Precedence for this interface and direction. A lower sequence

number has higher precedence. Range: 1 – 4294967295. Default is 1.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration and Interface Configuration (Ethernet, VLAN, or Port

Channel) modes

User Guidelines

The Global Configuration mode command configures the ACL on all

physical and LAG interfaces, whereas the interface mode command does so

for the interface.

Dell EMC Networking switches support configuration of multiple access

groups. Packets are matched against group entries, from lowest sequence

number to highest. Configuring an access-group, using the same sequence

number as an existing entry, replaces the original group entry.

If the access-list specified in the command does not exist, an error is given.

The ACLs in the access-group are configured in hardware when the interface

becomes active. Resource contention issues will only become apparent at that

time. It is recommended that ACLs be configured on an active interface as a

check prior to deployment in the network.

The optional control-plane keyword allows application of an ACL on the CPU

port. Control-plane match actions occur in the egress direction. System level

rules are applied on ingress, after application of any user defined ingress rules,

therefore, it is not possible to rate limit packets matching the system defined

rules with an ACL having a control-plane target. Use the rate-limit cpu

command to reduce the effects of low priority traffic on the switch CPU.

Layer 2 Switching Commands 275

An implicit deny-all rule is added after the end of the last access group in each

direction (in or out).

Examples

console(config)#ip access-list aclname

console(config-ip-acl)#exit

console(config)#ip access-group aclname in

console(config)#no ip access-group aclname in

console(config)#ip access-list aclname1

console(config-ip-acl)#exit

console(config)#ip access-group aclname1 out

console(config)#interface te1/0/1

console(config-if-Te1/0/1)#ip access-group aclname out 2

console(config-if-Te1/0/1)#no ip access-group aclname out

Command History

Example and description updated in the 6.4 release.

mac access-group

Use the mac access-group command in Global Configuration or Interface

Configuration mode to attach a specific MAC Access Control List (ACL) to

an interface.

Syntax

mac access-group name [in | out | control-plane] [sequence]

no mac access-group name [in | out | control-plane]

• name — Name of the existing MAC access list. (Range: 1-31 characters)

•[in | out | control-plane]— The packet direction. in applies the access-

list to ingress packets. out applies the access-list to egress packets. control-

plane applies the access-list to ingress control plane packets. control-plane

is only valid in Global Configuration mode.

• sequence — Order of access list relative to other access lists already

assigned to this interface and direction. (Range: 1-4294967295)

Default Configuration

No ACLs are configured by default.

Layer 2 Switching Commands 276

Command Mode

Global Configuration mode or Interface Configuration (Ethernet, VLAN or

Port Channel) mode

User Guidelines

If the access-list specified in the command does not exist, an error is given.

The ACLs in the access-group are configured in hardware when the interface

becomes active. Resource contention issues will only become apparent at that

time. It is recommended that ACLs be configured on an active interface as a

check prior to deployment in the network.

An optional sequence number may be specified to indicate the order of this

access-list relative to the other access-lists already assigned to this interface

and direction. A lower number indicates higher precedence order. If a

sequence number already is in use for this interface and direction, the

specified access-list replaces the currently attached access list using that

sequence number. If the sequence number is not specified for this command,

a sequence number is selected that is one greater than the highest sequence

number currently in use for this interface and direction.

The optional control-plane keyword allows the application of an egress MAC

ACL on the CPU port.

This command specified in Interface Configuration mode only affects a

single interface.

Example

This example rate limits IPv4 multicast traffic ingressing the front panel ports

to 8 Kbps and a maximum burst of 4 kilobytes.

console(config)# mac access-list extended ipv4-multicast

console(config-mac-access-list)#permit 01:00:5e:00:00:00 00:00:00:ff:ff:ff

any rate-limit 8 4

console(config-mac-access-list)#permit any any

console(config-mac-access-list)#exit

console(config)#mac access-group ipv4-multicast in

Layer 2 Switching Commands 277

mac access-list extended

Use the mac access-list extended command in Global Configuration mode to

create the MAC Access Control List (ACL) identified by the name parameter

and enter MAC Access-list Configuration mode.

Syntax

mac access-list extended name

no mac access-list extended name

• name — Name of the access list. (Range: 1-31 characters)

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

Use this command to create a mac access control list. The CLI mode is

changed to Mac-Access-List Configuration when this command is

successfully executed.

Example

The following example creates MAC ACL and enters MAC-Access-List-

Configuration mode.

console(config)#mac access-list extended dell-networking

mac access-list extended rename

Use the mac access-list extended rename command in Global Configuration

mode to rename the existing MAC Access Control List (ACL).

Syntax

mac access-list extended rename name newname

• name — Existing name of the access list. (Range: 1-31 characters)

Layer 2 Switching Commands 278

• newname — New name of the access list. (Range: 1-31 characters)

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

Command fails if the new name is the same as the old one.

Example

The following example shows the mac access-list extended rename

command.

console(config)#mac access-list extended DELL1

console(config-mac-access-list)#exit

console(config)#mac access-list extended rename DELL1 DELL2

remark

Use the remark command to add a comment to an ACL rule. Use the no form

of the command to remove a comment from an ACL rule.

Syntax

remark comment

no remark comment

• comment—Each remark line is limited to 100 characters. The remark may

consist of characters in the range A-Z, a-z, 0-9, and special characters like

space, hyphen, underscore. The total length of the remark must not exceed

100 characters.

Default Configuration

No remarks are present by default.

Layer 2 Switching Commands 279

Command Mode

IPv4 Access-list Configuration mode, IPv6 Access-list Configuration mode,

MAC Access-list Configuration mode, ARP Access-list Configuration mode

The no form of the command is executed in Global Configuration mode.

User Guidelines

The administrator can use the remark keyword to add comments to ACL rule

entries belonging to an IPv4, IPv6, MAC or ARP ACL. Remarks are associated

with the ACL rule that is created immediately after the remarks are created.

When the ACL rule is removed, the associated remarks are also deleted.

Remarks are shown only in show running-config and are not displayed in

show ip access-lists.

The no remark command removes the first matching remark from an ACL

access-list. Repeated execution of this command with the same remark

comment removes the remark from the next ACL rule which associated with

the comment (if there is any rule configured with the same comment) or an

error message is displayed if there are no matching comments.

Command History

Updated in 6.3.0.1 firmware

Example

console(config)#arp access-list new

console(config-arp-access-list)#remark “test1”

console(config-arp-access-list)#permit ip host 1.1.1.1 mac host

00:01:02:03:04:05

console(config-arp-access-list)#remark “test1”

console(config-arp-access-list)#remark “test2”

console(config-arp-access-list)#remark “test3”

console(config-arp-access-list)#permit ip host 1.1.1.2 mac host

00:03:04:05:06:07

console(config-arp-access-list)#permit ip host 2.1.1.2 mac host

00:03:04:05:06:08

console(config-arp-access-list)#remark “test4”

console(config-arp-access-list)#remark “test5”

console(config-arp-access-list)#permit ip host 2.1.1.3 mac host

00:03:04:05:06:01

Layer 2 Switching Commands 280

service-acl input

Use the service-acl input command in Interface Configuration mode to block

Link Local Protocol Filtering (LLPF) protocol(s) on a given port. Use the no

form of this command to unblock link-local protocol(s) on a given port.

Syntax

service-acl input {blockcdp | blockvtp | blockdtp | blockudld | blockpagp |

blocksstp | blockall}

no service-acl input [blockcdp | blockvtp | blockdtp | blockudld |

blockpagp | blocksstp | blockall]

•

blockcdp

—

To block CDP PDU’s from being forwarded.

•

blockvtp

—

To block VTP PDU’s from being forwarded.

•

blockdtp

—

To block DTP PDU’s from being forwarded.

•

blockudld

—

To block UDLD PDU’s from being forwarded.

•

blockpagp

—

To block PAgP PDU’s from being forwarded.

•

blocksstp

—

To block SSTP PDU’s from being forwarded.

•

blockall

—

To block all the PDU’s with MAC of 01:00:00:0c:cc:cx (x-don’t care)

from being forwarded.

Default Configuration

The default is that none of the listed protocol PDUs are blocked.

Command Mode

Interface Configuration (Ethernet, Port-channel)

User Guidelines

To specify multiple protocols, enter the protocol parameters together on the

command line, separated by spaces. This command may be entered multiple

times and will block all protocols identified in the arguments.

Example

console(config-if-Te1/0/1)#service-acl input blockall

Layer 2 Switching Commands 281

show service-acl interface

This command displays the status of LLPF rules configured on a particular

port or on all the ports.

Syntax

show service-acl interface {interface-id | all}

•

interface-id—

An Ethernet interface identifier or a port channel interface

identifier.

See

Interface Naming Conventions

for interface

representation.

Default Configuration

UDLD is blocked by default. No other protocol is blocked by default.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

console#show service-acl interface te1/0/1

console(config-if-Te1/0/1)#show service-acl interface te1/0/1

Service-acl Interface Te1/0/1

Protocol Mode

--------------- ----------

CDP Disabled

VTP Disabled

DTP Disabled

UDLD Enabled

PAGP Disabled

SSTP Disabled

ALL Disabled

Layer 2 Switching Commands 282

show access-lists interface

Use the show access-lists interface command to display interface ACLs.

Syntax

show access-lists interface {interface-id {in | out}} | control-plane

•

interface-id

—

The interface identifier (Ethernet, port-channel, or

VLAN).

•in—

Show the ingress ACLs.

•out—

Show the egress ACLs.

•control-plane—

Show the control plane ACLs.

Default Configuration

No ACLs are configured by default.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Examples

console#show access-lists interface control-plane

ACL Type ACL Name Sequence Number

-------- ------------------------------- ---------------

IPv6 ip61 1000

show ip access-lists

Use the show ip access-lists command to display an IP ACL and time-range

parameters.

Syntax

show ip access-lists [accesslistname]

Layer 2 Switching Commands 283

• accesslistname—

The name used to identify the IP ACL.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command displays information about the attributes “icmp-type”, “icmp-

code”, “igmp-type,” “fragments,” “routing,” and “source and destination L4

port ranges.” It displays the committed rate, committed burst size and the

ACL rule hit count of packets matching the ACL rule. This matching packet

counter value rolls over upon reaching the maximum value

(18446744073709551615 or 264 -1).

For an ACL with multiple match rules, processing occurs in order until a rule

is matched. Only the counter associated with the matching rule is

incremented. (e.g., consider an ACL with three rules, rule 1 does not match,

and rule 2 is matched. Rule 3 is not processed. The counters for rule 1 and

rule 3 are not incremented.)

If an ACL rule is configured with a rate limit, the counter value is the

matched packet count (i.e., both the forwarded and dropped packets are

counted). If an ACL rule is configured without a rate limit, the counter value

is the count of either the permitted or denied packets.

ACL counters do not interact with DiffServ policies. ACL counters do not

interact with PBR counters.

ACL hit counters are associated with the ACL, not the interface on which the

ACL is applied. An ACL applied to multiple interfaces will display identical

(or nearly identical) counts for each interface. The count displayed is the sum

of matching packets received or transmitted on all associated interfaces.

Command History

Updated in 6.3.0.1 firmware.

Layer 2 Switching Commands 284

Examples

The following example displays the configured IP ACLs.

console(config)#show ip access-lists

Current number of ACLs: 4 Maximum number of ACLs: 100

ACL Name Rules Count Interface(s) Direction

---------------- ----- ---------- ------------------------- ---------

TO_FRM 2 437 Gi1/0/26 Inbound

UPLINKS 5 0 Gi1/0/26 Outbound

Allow-192-168-0-x 3 7617636 Gi1/0/29 Inbound

The following example displays the IP ACLs configured on a device.

console#show ip access-lists asdasd

IP ACL Name: asdasd

Inbound Interface(s):

Gi1/0/7

Rule Number: 1

Action......................................... permit

Match All...................................... FALSE

Protocol....................................... 6(tcp)

Source IP Address.............................. 1.2.3.4

Source IP Mask................................. 0.0.0.0

Source Layer 4 Operator........................ Equal To

Source L4 Port Keyword......................... 43

Destination IP Address......................... any

TCP Flags...................................... FIN (Ignore)

SYN (Set)

RST (Ignore)

PSH (Ignore)

ACK (Ignore)

URG (Ignore)

ACL Hit Count...................................... 43981900

Rule Number: 2

Action......................................... permit

Match All...................................... FALSE

Protocol....................................... 6(tcp)

Source IP Address.............................. any

Destination IP Address......................... 1.2.3.4

Destination IP Mask............................ 0.0.0.0

Layer 2 Switching Commands 285

TCP Flags...................................... FIN (Ignore)

SYN (Set)

RST (Ignore)

PSH (Ignore)

ACK (Ignore)

URG (Ignore)

ACL Hit Count.................................. 1

show mac access-lists

Use the show mac access-lists command to display a MAC access list and all

the rules that are defined for the MAC ACL. Use the [name] parameter to

identify a specific MAC ACL to display.

Syntax

show mac access-lists name

• name—Use this parameter to identify the specific MAC ACL to display.

Default Configuration

This command has no default configuration

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The hit counter applies to the ACL, not to the interface. It shows the sum of

all matching packets across all interfaces to which the ACL is applied. For an

ACL applied to multiple interfaces, the hit counter will be identical for all

interfaces.

Command History

Updated in 6.3.0.1 firmware. Updated User Guidelines in 6.3.0.5 firmware.

Example

console#show mac access-lists

Current number of all ACLs: 9 Maximum number of all ACLs: 100

Layer 2 Switching Commands 286

MAC ACL Name Rules Count Interface(s) Direction

--------------- ----- ---------- ------------------------- ---------

DELL123 1 0 Gi1/0/1 Inbound

ipv4-multicast 2 14666 Po1-64,Gi1/0/1-24, Inbound

console#show mac access-lists mac-acl

MAC ACL Name: mac-acl

Outbound Interface(s):

Gi1/0/8

Rule Number: 1

Action......................................... permit

Source MAC Address............................. 0000.1122.3344

Source MAC Mask................................ FFFF.0000.0000

EtherType...................................... ipx

VLAN........................................... 100

ACL Hit Count.................................. 213

Rule Number: 2

Action......................................... permit

Source MAC Address............................. 0000.1133.2244

Source MAC Mask................................ FFFF.0000.0000

EtherType...................................... ip

VLAN........................................... 100

ACL Hit Count.................................. 213

Layer 2 Switching Commands 287

MAC Address Table Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Dell EMC Networking switches implement a MAC Learning Bridge is

compliance with IEEE 802.1Q. The switches implement independent VLAN

learning (IVL). Dynamically learned MAC addresses are used to filter the set

of ports on which a frame is forwarded within a VLAN, that is, the destination

MAC address and ingress VLAN for a frame entering the switch is looked up

in the MAC address table and, if a match is found, the frame is forwarded out

the matching port(s). If no match is found, the frame is flooded out all ports

in the VLAN except for the ingress port.

When a frame is received on a port, the source MAC address (and VLAN) is

looked up in the MAC address table. If no matching entry is found, a new

entry is added to the MAC address table associated with the source port. If a

matching entry is found, the matching entry timestamp is refreshed such that

it will continue to remain in the MAC address table. Dynamic MAC address

entries for which no frames have been received within the aging period are

removed out of the MAC address table. The administrator can globally

configure the MAC address aging timer.

Administrators can configure static MAC address entries. Static MAC entries

are treated in the same manner as dynamic MAC address entries for the

purposes of frame forwarding. Static MAC addresses never age out of the

MAC address database and can only be removed by administrator action.

Port security allows the administrator to disable learning of MAC addresses

on selected interfaces. Dynamically learned MAC addresses are flushed on an

interface at the time port security is enabled. The interface then dynamically

learns MAC addresses up to the configured limit and no more. The

administrator may configure a limit of 0 in order to disable MAC learning on

the interface entirely. In this configuration, it is advisable to configure static

MAC entries on the interface in order to facilitate forwarding.

Layer 2 Switching Commands 288

Commands in this Section

This section explains the following commands:

clear mac address-table

Use the clear mac address-table command to remove learned entries from the

forwarding database.

Syntax

clear mac address-table dynamic [address mac-addr | interface interface-id |

vlan vlan-id]

•

mac-addr

—

Delete the specified MAC address.

•

interface-id

—

Delete all dynamic MAC addresses on the specified Ethernet port

or port channel.

•

vlan-id

—

Delete all dynamic MAC addresses for the specified VLAN. The range

is 1 to 4093.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

clear mac address-table show mac address-table

multicast

show mac address-table

dynamic

mac address-table aging-

time

show mac address-table show mac address-table

interface

mac address-table multicast

forbidden address

show mac address-table

address

show mac address-table

static

mac address-table static

vlan

show mac address-table

count

show mac address-table vlan

switchport port-security

(Interface Configuration)

show mac address-table

count

show port-security

Layer 2 Switching Commands 289

User Guidelines

This command has no user guidelines.

Example

In this example, the mac address-table tables are cleared.

console#clear mac address-table dynamic

mac address-table aging-time

Use the mac address-table aging-time command in Global Configuration

mode to set the aging time of the address. To restore the default, use the no

form of the mac address table aging-time command.

Syntax

mac address-table aging-time {0 | 10-1000000}

no mac address-table aging-time

•0—

Disable aging time for the MAC Address Table.

•

10-1000000

—

Set the

number of seconds

aging time for the MAC Address

Table.

Default Configuration

300 seconds

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

In this example the MAC Address Table aging time is set to 400.

console(config)#mac address-table aging-time 400

Layer 2 Switching Commands 290

mac address-table multicast forbidden address

Use the mac address-table multicast forbidden address command in Global

Configuration mode to forbid adding a specific Multicast address to specific

ports. To return to the system default, use the no form of this command. If

routers exist on the VLAN, do not change the unregistered multicast

addresses state to drop on the routers ports.

Syntax

mac address-table multicast forbidden address vlan vlan-id {mac-multicast-

address | ip-multicast-address} {add | remove} interface interface-list

no mac address-table multicast forbidden address vlan vlan-id {mac-

multicast-address | ip-multicast-address}

•

add

—

Adds ports to the group.

•

remove

—

Removes ports from the group.

•

vlan vlan-id

—

A valid vlan-id. (Range 1-4093)

•

mac-multicast-address

—MAC Multicast address

in the format

xxxx.xxxx.xxxx.

•

ip-multicast-address

—

IP Multicast address.

•

interface-list

—

Specify a comma separated list of interface identifiers, a range of

interfaces, or a combination of both. Interface identifiers can be

port channel

interface identifiers or Ethernet interface identifiers. Embedded blanks are

not allowed in the list.

Default Configuration

No forbidden addresses are defined.

Command Mode

Global Configuration mode

User Guidelines

Before defining forbidden ports, ensure that the multicast group is registered.

Layer 2 Switching Commands 291

Examples

In this example the MAC address 0100.5e02.0203 is forbidden on port 2/0/9

within VLAN 8.

console(config)#mac address-table multicast forbidden address vlan 8

0100.5e02.0203 add interface gigabitethernet 2/0/9

mac address-table static vlan

Use the mac address table static vlan command in Global Configuration

mode to add a static MAC-layer station source address to the bridge table. To

delete the MAC address, use the no form of the mac address table static

command.

Syntax

mac address-table static mac-addr vlan vlan-id interface interface-id

no mac address-table static mac-addr vlan vlan-id interface-id]

•

mac-address

—

A valid MAC address in the format xxxx.xxxx.xxxx or

xx:xx:xx:xx:xx:xx

•

vlan-id

—

Valid VLAN ID (1-4093)

•

interface-id

—

The interface to which the received packet is forwarded.

Ethernet

interface identifiers and port channel identifiers are valid for this

command.

Default Configuration

No static addresses are defined. The default mode for an added address is

permanent.

Command Mode

Global Configuration mode

User Guidelines

The MAC address may be a unicast or multicast MAC address. Static MAC

addresses are never overridden by dynamically learned addresses. This has

implications for protocols like IGMP snooping, where statically configuring

the MAC address of a multicast router keeps IGMP snooping from

dynamically adding the multicast router to a different port.

Layer 2 Switching Commands 292

The maximum number of static MAC addresses that may be configured on a

port is limited by the switchport port-security maximum command.

This command may be invoked multiple times with different interfaces (and

the same VLAN) when used with a multicast MAC address.

Example

The following example adds a permanent static MAC address c2f3.220a.12f4

to the MAC address table.

console(config)# mac address-table static c2f3.220a.12f4 vlan 4 interface

gigabitethernet6/0/1

switchport port-security (Global Configuration)

Use the switchport port-security command in Global Configuration mode to

enable port security globally. Use the no form of the command to disable port

security globally.

Syntax

switchport port-security

no switchport port-security

Default Configuration

Port security is disabled by default.

No MAC addresses are learned or configured by default.

Command Mode

Global Configuration mode

User Guidelines

Port security must be enabled globally and on the interface in order to be

active on the the interface. Disabling port security globally does not remove

sticky MAC address configuration from the running-config.

Layer 2 Switching Commands 293

Port security allows the network administrator to secure interfaces by

specifying (or learning) the allowable MAC addresses on a given port. Packets

with a matching source MAC address are forwarded normally. All other host

packets are discarded. Port security operates on access, trunk and general

mode ports.

Two methods are used to implement Port MAC locking: dynamic locking and

static locking. Static locking further has an optional sticky mode.

Dynamic locking implements a ‘first arrival’ mechanism for MAC locking.

The administrator specifies how many dynamic addresses may be learned on

the locked port. If the limit has not been reached, then a packet with an

unknown source MAC address is learned and forwarded normally. If the MAC

address limit has been reached, the packet is discarded. The administrator can

disable dynamic locking (learning) by setting the number of allowable

dynamic entries to zero.

When a MAC locking enabled link goes down, all of the dynamically locked

addresses are ‘freed.’ When the link is restored, that port can once again learn

MAC addresses up to the administrator specified limit.

A dynamically locked MAC address is eligible to be aged out if another packet

with that MAC address is not seen within the age-out time. Dynamically

locked MAC addresses are also eligible to be relearned on another port if

station movement occurs. Statically locked MAC addresses are not eligible for

aging. If a packet arrives on a port with a source MAC address that is statically

locked on another port, then the packet is discarded.

Static locking allows the administrator to specify a list of host MAC addresses

that are allowed on a port. The behavior of packets is the same as for dynamic

locking: only packets with a known source MAC address can be forwarded.

Any packets with source MAC addresses that are not configured are

discarded. The switch treats this as violation and supports send a SNMP port-

security trap.

If the administrator knows the specific MAC address (or addresses) that will

be connected to a particular port, she can specify those addresses as static

entries. By setting the number of allowable dynamic entries to zero, only

packets with a source MAC address matching a MAC address in the static list

are forwarded.

To configure static locking only, set the dynamic MAC limit to 0. To configure

dynamic locking only, set the static MAC limit to 0.

Layer 2 Switching Commands 294

Sticky mode configuration converts all the existing dynamically learned MAC

addresses on an interface to sticky. This means that they will not age out and

will appear in the running-config. In addition, new addresses learned on the

interface will also become sticky. Note that sticky is not the same as static –

the difference is that all sticky addresses for an interface are removed from the

running-config when the interface is taken out of sticky mode. Static

addresses must be removed from the running-config individually.

Sticky MAC addresses appear in the running-config in the following form:

switchport port-security mac-address sticky 0011.2233.4455 vlan 33

Statically locked MAC addresses appear in the running-config in the

following form:

switchport port-security mac-address 0011.2233.4455 vlan 33

Command History

Updated in 6.3.0.1 firmware.

Example

Enable port security/MAC locking globally and on an interface.

console(config)#switchport port-security

console(config)#interface gi1/0/3

console(config-if-gi1/0/3)#switchport port-security

Enable port security/MAC locking globally and on an interface, enable sticky

mode on the interface and convert all dynamic addresses on the interface to

sticky.

console(config)#switchport port-security

console(config)#interface gi1/0/3

console(config-if-gi1/0/3)#switchport port-security

console(config-if-gi1/0/3)#switchport port-security mac-address sticky

Add a statically locked MAC address to trunk port Gi1/0/3 and VLAN 33.

console(config)#vlan 33

console(config-vlan33)#interface gi1/0/3

console(config-if-Gi1/0/3)#switchport mode trunk

console(config-if-Gi1/0/3)#switchport port-security mac-address

0011.2233.4455 vlan 33

Add a sticky mode statically locked MAC address to trunk port Gi1/0/3 and

VLAN 33.

Layer 2 Switching Commands 295

console(config)#vlan 33

console(config-vlan33)#interface gi1/0/3

console(config-if-Gi1/0/3)#switchport mode trunk

console(config-if-Gi1/0/3)#switchport port-security mac-address sticky

0011.2233.4455 vlan 33

Remove a sticky mode MAC address from trunk port Gi1/0/3 and VLAN 33.

console(config)#vlan 33

console(config-vlan33)#interface gi1/0/3

console(config-if-Gi1/0/3)#switchport mode trunk

console(config-if-Gi1/0/3)#no switchport port-security mac-address

0011.2233.4455 vlan 33

Convert all dynamically learned MAC addresses on trunk port gi1/0/3 to

sticky MAC addresses and save the running-config so the configuration will

persist across reboots.

console(config)#vlan 33

console(config-vlan33)#interface gi1/0/3

console(config-if-Gi1/0/3)#switchport mode trunk

console(config-if-Gi1/0/3)#switchport port-security mac-address sticky

console(config)#do write

Convert all sticky MAC addresses on trunk port gi1/0/3 to sticky MAC

addresses and save the running-config so the configuration will persist across

reboots.

console(config)#vlan 33

console(config-vlan33)#interface gi1/0/3

console(config-if-Gi1/0/3)#switchport mode trunk

console(config-if-Gi1/0/3)#switchport port-security mac-address sticky

console(config)#do write

switchport port-security (Interface Configuration)

Use the switchport port-security command to enable or configure port

security (MAC locking) globally. Use the no form of the command to disable

port security globally.

Syntax

switchport port-security [mac-address { sticky | [sticky] mac-address vlan

{vlan-id}} | dynamic value | maximum value | violation {protect |

shutdown}]

no switchport port-security [mac-address {sticky | mac-address vlan {vlan-

id}} | dynamic | maximum | violation]

Layer 2 Switching Commands 296

•mac-address — The static MAC address to be configured on the interface

and VLAN.

• vlan-id — The VLAN identifier on which to configure the MAC address.

•dynamic — Configure the maximum number of dynamic MAC addresses

that be be learned on the interface. Setting the dynamic limit to 0 causes

all received packets with non-static MAC addresses to be considered as

violations.

•sticky – Configure a sticky MAC address on the interface. If the sticky

parameter not given, a statically locked MAC address is configured on the

interface.

•maximum — Configure the maximum number of static MAC addresses

that may be configured on the interface.

•violation—Configure the interface to:

–protect—Protect the interface by discarding MAC frames that are not

learned (default) and issuing a log message and a trap.

–shutdown—Protect the interface by error disabling the interface and

issuing a log message and a trap.

Default Configuration

Port security is disabled by default.

No static or sticky MAC addresses are learned or configured by default.

The default number of dynamic MAC addresses per interface is 600 (300 for

the N1500 Series switches). The default number of static MAC addresses per

interface is 100.

Both limits are subject to the total MAC address limit supported by the

system.

Command Mode

Interface (physical and port-channel) Configuration mode.

Interface Range mode - Only when using switchport port-security syntax.

Layer 2 Switching Commands 297

User Guidelines

Port security allows the network administrator to secure interfaces by

specifying (or learning) the allowable MAC addresses on a given port. Packets

with a matching source MAC address are forwarded normally. All other host

packets are discarded. Port security operates on access, trunk and general

mode ports.

Two methods are used to implement port security: dynamic locking and static

locking. Static locking further has an optional sticky mode.

Dynamic locking implements a ‘first arrival’ mechanism for MAC locking.

The administrator specifies how many dynamic addresses may be learned on

the secure port. If the limit has not been reached, then a packet with an

unknown source MAC address is learned and forwarded normally. If the MAC

address limit has been reached, the packet is discarded, the MAC address is

not learned, and a violation is raised. The administrator can disable dynamic

learning by setting the number of allowable dynamic entries to zero. This

causes all packets with unknown MAC addresses to be considered as

violations.

When a port security enabled link goes down, all of the dynamically learned

addresses are removed from the MAC forwarding database. When the link is

restored, that port can once again learn MAC addresses up to the

administrator specified limit.

A dynamically learned MAC address is eligible to be aged out if another

packet with that MAC address is not seen within the age-out time.

Dynamically learned MAC addresses are also eligible to be re-learned on

another port if station movement occurs.

Static locking allows the administrator to specify a list of MAC addresses that

are allowed on a port. The behavior of packets is the same as for dynamic

learning once the dynamic limit has been reached: only packets with a known

source MAC address can be forwarded. Any packets with source MAC

addresses that are not configured are discarded. The switch treats this as

violation.

If the administrator knows the specific MAC address (or addresses) that will

be connected to a particular port, she can specify those addresses as static

entries. By setting the number of allowable dynamic entries to zero, only

packets with a source MAC address matching a MAC address in the static list

are forwarded.

Layer 2 Switching Commands 298

Statically locked MAC addresses are not eligible for aging. If a packet arrives

on a port with a source MAC address that is statically locked on another port,

then the packet is discarded.

To configure static locking only, set the dynamic MAC limit to 0 and

configure the static MAC addresses on the interface. To configure dynamic

locking only, set the static MAC limit to 0, and set the appropriate dynamic

MAC address limit.

MAC addresses seen on an interface other than the learned or configured

MAC addresses and in excess of the limit are considered violations of port

security. Trap issuance violation actions can be configured using the snmp-

server enable traps port-security command. The default action is to log a

message and send an SNMP trap. Port security can optionally error disable an

interface on which a violation occurs using the switchport port-security

violation shutdown command.

Enabling mode configuration converts all the existing dynamically learned

MAC addresses on an interface to sticky. It also converts the last violation

MAC address to sticky, even if the dynamic limit is set to 0. These MAC

addresses will not age out and will appear in the running-config. In addition,

new addresses learned on the interface will also become sticky. Note that

sticky is not the same as static – the difference is that all sticky addresses for

an interface are removed from the running-config when the interface is taken

out of sticky mode. Static addresses must be removed from the running-

config individually.

Sticky MAC addresses appear in the running-config in the following form:

switchport port-security mac-address sticky 0011.2233.4455 vlan 33

Statically locked MAC addresses appear in the running-config in the

following form:

switchport port-security mac-address 0011.2233.4455 vlan 33

In order for sticky or static MAC addresses to survive a reboot, the

configuration must be saved.

Port security must be enabled globally and on the interface in order to be

active.

Port security should only be enabled on access mode ports and not on trunk

mode ports. This recommendation is not enforced by the switch.

Layer 2 Switching Commands 299

Command History

Updated in 6.3.0.1 firmware.

Example

Enable port security/MAC locking globally and on an interface.

console(config)#switchport port-security

console(config)#interface gi1/0/3

console(config-if-gi1/0/3)#switchport port-security

Enable port security/MAC locking globally and on an interface, enable sticky

mode on the interface and convert all dynamic addresses on the interface to

sticky.

console(config)#switchport port-security

console(config)#interface gi1/0/3

console(config-if-gi1/0/3)#switchport port-security

console(config-if-gi1/0/3)#switchport port-security mac-address sticky

Add a statically locked MAC address to trunk port Gi1/0/3 and VLAN 33.

console(config)#vlan 33

console(config-vlan33)#interface gi1/0/3

console(config-if-Gi1/0/3)#switchport mode trunk

console(config-if-Gi1/0/3)#switchport port-security mac-address

0011.2233.4455 vlan 33

Add a sticky mode statically locked locked MAC address to trunk port Gi1/0/3

and VLAN 33.

console(config)#vlan 33

console(config-vlan33)#interface gi1/0/3

console(config-if-Gi1/0/3)#switchport mode trunk

console(config-if-Gi1/0/3)#switchport port-security mac-address sticky

0011.2233.4455 vlan 33

Remove a sticky mode MAC address from trunk port Gi1/0/3 and VLAN 33.

console(config)#vlan 33

console(config-vlan33)#interface gi1/0/3

console(config-if-Gi1/0/3)#switchport mode trunk

console(config-if-Gi1/0/3)#no switchport port-security mac-address

0011.2233.4455 vlan 33

Convert all dynamically learned MAC addresses on trunk port 33 to sticky

MAC addresses and save the running-config so the configuration will persist

across reboots.

console(config)#vlan 33

console(config-vlan33)#interface gi1/0/3

console(config-if-Gi1/0/3)#switchport mode trunk

Layer 2 Switching Commands 300

console(config-if-Gi1/0/3)#switchport port-security mac-address sticky

console(config)#do write

Convert all sticky MAC addresses on trunk port 33 to sticky MAC addresses

and save the running-config so the configuration will persist across reboots.

console(config)#vlan 33

console(config-vlan33)#interface gi1/0/3

console(config-if-Gi1/0/3)#switchport mode trunk

console(config-if-Gi1/0/3)#switchport port-security mac-address sticky

console(config)#do write

show mac address-table multicast

Use the show mac address-table multicast command to display Multicast

MAC address table information.

Syntax

show mac address-table multicast [count]|[[vlan vlan-id] [address {mac-

multicast-address | ip-multicast-address}] [format {ip | mac}]]

• vlan-id — A valid VLAN ID value.

• mac-multicast-address — A valid MAC Multicast address.

• ip- multicast-address — A valid IP Multicast address.

•format — Multicast address display format. Can be ip or mac.

Default Configuration

If format is unspecified, the default is mac.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The count parameter requests the display of the address table usage. No other

parameters may be supplied with the count parameter. The address

parameter indicates that the entry matching the specified address is

displayed. The vlan parameter requests display of entries associated with the

specified VLAN. The format parameter requests that addresses be displayed

Layer 2 Switching Commands 301

in the specified format. The vlan, address, and format parameters may all be

specified together.

A MAC address can be displayed in IP format only if it is in the range

01:00:5e:00:00:00 through 01:00:5e:7f:ff:ff.

Static multicast MAC addresses can be added via the mac address-table static

command.

Example

In this example, Multicast MAC address table information is displayed.

console#show mac address-table multicast

Vlan MAC Address Type Ports

----- ------------------- ------- ------------------

1 0100.5E05.0505 Static

Forbidden ports for multicast addresses:

Vlan MAC Address Ports

---- ----------------------- ---------------------------

1 0100.5E05.0505

NOTE: A multicast MAC address maps to multiple IP addresses, as shown above.

Command History

The description was updated in the 6.4 release.

show mac address-table

Use the show mac address-table command in User Exec or Privileged Exec

mode to display all entries in the bridge-forwarding database.

Syntax

show mac address-table

Default Configuration

This command has no default configuration.

Layer 2 Switching Commands 302

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

Use the show mac address-table multicast to display multicast MAC address

entries along with forbidden multicast MAC entries.

Example

In this example, all classes of entries in the mac address-table are displayed.

console#show mac address-table

Aging time is 300 Sec

Vlan Mac Address Type Port

---- ---------------- ---------- -----------

0 001E.C9AA.AE19 Management CPU Interface

1 001E.C9AA.AC19 Dynamic Gi1/0/21

1 001E.C9AA.AE1B Management Vl1

10 001E.C9AA.AE1B Management Vl10

90 001E.C9AA.AE1B Management Vl90

Total MAC Addresses in use: 5

show mac address-table address

Use the show mac address-table address command in User Exec or Privileged

Exec mode to display all entries in the bridge-forwarding database for the

specified MAC address.

Syntax

show mac address-table address mac-address [interface interface-id] [vlan

vlan-id]

•

mac-address

—

A MAC address with the format xxxx.xxxx.xxxx.

•

interface-id

—

Display information for a specific interface. Valid interfaces

include Ethernet ports and port channels.

•

vlan-id

—

Display entries for the specific VLAN only. The range is 1 to 4093.

Layer 2 Switching Commands 303

Default Configuration

This command has no default configuration.

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

This command has no user guidelines.

Example

In this example, the mac address table entry for 0000.E26D.2C2A is

displayed.

console#show mac address-table address 0000.E26D.2C2A

Vlan Mac Address Type Port

---- -------------- -------- -------------

1 0000.E26D.2C2A Dynamic Gi1/0/1

show mac address-table count

Use the show mac address-table count command in User Exec or Privileged

Exec mode to display the number of addresses present in the Forwarding

Database.

Syntax

show mac address-table count [vlan vlan-id | interface interface-id]

•

interface-id

—

Specify an interface type; valid interfaces include Ethernet ports

and port channels.

•

vlan-id

—

Specify a valid VLAN, the range is 1 to 4093.

Default Configuration

This command has no default configuration.

Layer 2 Switching Commands 304

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays the addresses in the Forwarding Database:

console#show mac address-table count

Capacity: 8192

Used: 109

Static addresses: 2

Secure addresses: 1

Dynamic addresses: 97

Internal addresses: 9

show mac address-table dynamic

Use the show mac address-table command in User Exec or Privileged Exec

mode to display all dynamic entries in the bridge-forwarding database.

Syntax

show mac address-table dynamic [address mac-address] [interface interface-

id] [vlan vlan-id]

•

mac-address

—

A MAC address in the format xxxx.xxxx.xxxx.

•

interface-id

—

Display information for a specific interface. Valid interfaces

include Ethernet ports and port channels.

•

vlan-id

—

Display entries for the specific VLAN only. The range is 1 to 4093.

Default Configuration

This command has no default configuration.

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

Layer 2 Switching Commands 305

User Guidelines

This command has no user guidelines.

Example

In this example, all dynamic entries in the mac address-table are displayed.

console#show mac address-table dynamic

Aging time is 300 Sec

Vlan Mac Address Type Port

---- -------------- ------- -------------

1 0000.0001.0000 Dynamic Gi1/0/1

1 0000.8420.5010 Dynamic Gi1/0/1

1 0000.E26D.2C2A Dynamic Gi1/0/1

1 0000.E89A.596E Dynamic Gi1/0/1

1 0001.02F1.0B33 Dynamic Gi1/0/1

show mac address-table interface

Use the show mac address-table command in User Exec or Privileged Exec

mode to display all entries in the mac address-table.

Syntax

show mac address-table interface interface-id [vlan vlan-id]

•

interface-id

—

Specify an interface type.Valid interfaces include Ethernet ports

and port channels.

•

vlan-id

—

Specify a valid VLAN. The range is 1 to 4093.

Default Configuration

This command has no default configuration.

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

This command has no user guidelines.

Layer 2 Switching Commands 306

Example

In this example, all classes of entries in the bridge-forwarding database for

Gigabit Ethernet interface 1/0/1 are displayed.

console#show mac address-table interface gigabitethernet 1/0/1

Aging time is 300 Sec

Vlan Mac Address Type Port

---- -------------- ---- -------------

1 0000.0001.0000 Dynamic Gi1/0/1

1 0000.8420.5010 Dynamic Gi1/0/1

1 0000.E26D.2C2A Dynamic Gi1/0/1

1 0000.E89A.596E Dynamic Gi1/0/1

1 0001.02F1.0B33 Dynamic Gi1/0/1

show mac address-table static

Use the show mac address-table static command in User Exec or Privileged

Exec mode to display static entries in the bridge-forwarding database.

Syntax

show mac address-table static [address mac-address] [interface interface-id]

[vlan vlan-id]

•

mac-address

—

A MAC address with the format xxxx.xxxx.xxxx.

•

interface-id

—

Specify an interface type; valid interfaces include Ethernet ports

and port channels.

•

vlan-id

—

Specify a valid VLAN; the range is 1 to 4093.

Default Configuration

This command has no default configuration.

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

This command has no user guidelines.

Layer 2 Switching Commands 307

Example

In this example, all static entries in the bridge-forwarding database are

displayed.

console#show mac address-table static

Vlan Mac Address Type Port

---- -------------- ----- -----

1 0001.0001.0001 Static Gi1/0/1

show mac address-table vlan

Use the show mac address-table vlan command in User Exec or Privileged

Exec mode to display all entries in the bridge-forwarding database for the

specified VLAN.

Syntax

show mac address-table [vlan vlan-id]

•

vlan-id

—

Specify a valid VLAN; the range is 1 to 4093.

Default Configuration

This command has no default configuration.

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

This command has no user guidelines.

Example

In this example, multiple classes of entries in the bridge forwarding database

are displayed.

console(config-if-Gi1/0/4)#show mac address-table vlan 1

Aging time is 400 Sec

Vlan Mac Address Type Port

-------- --------------------- ----------- ---------------------

1 1418.7715.1BAA Dynamic Gi2/0/29

Layer 2 Switching Commands 308

1 1418.7715.47E8 Management CPU

1 2047.47BA.F696 Dynamic Gi2/0/29

1 B8CA.3AD5.DF1A Static Gi2/0/29

show port-security

Use the show ports security command to display port security (MAC locking)

configuration.

Syntax

show port-security [ interface-id | all | dynamic interface-id | static interface-id

| violation interface-id]

• interface-id —A physical or port channel interface identifier.

• all—Display information for all interfaces.

Default Configuration

Port security is disabled by default.

No port security MAC addresses are learned or configured by default.

The maximum static MAC address limit is 100 MAC addresses.

The maximum dynamic MAC address limit is 600 MAC addresses.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

Setting the dynamic limit to 0 causes all received packets with non-static or

sticky MAC addresses to be considered as violations.

This information is shown if no parameters are given:

Field Description

Admin Mode The configured global administrative status of port

MAC locking.

Layer 2 Switching Commands 309

This information is shown if only an interface parameter is given:

This information is shown if the dynamic parameter is given:

This information is shown if the static parameter is given:

This information is shown if the violation parameter is given:

Field Description

Interface Identifier The interface identifier.

Status The port security administrative status

(enabled/disabled).

Max-dynamic The dynamic MAC address limit.

Max-static The static address limit.

Protect Trap issued on violation (enabled/disabled).

Frequency The frequency of trap issuance (in seconds).

Shutdown Shut down (err-disable) interface on violation

(enabled/disabled).

Sticky Mode Sticky mode configuration (enabled/disabled).

Field Description

Dynamically Learned

MAC Address

Dynamically learned MAC addresses.

VLAN ID The VLAN on which the MAC address is learned.

Field Description

Statically Configured

MAC Address

Statically configured MAC addresses.

VLAN ID The VLAN identifier of the MAC address.

Sticky Indicates if the secure MAC address is sticky.

Layer 2 Switching Commands 310

Command History

Updated in 6.3.0.1 firmware.

Example

console(config)#show port-security static gi1/0/1

Number of static MAC addresses configured: 2

Static MAC address VLAN ID Sticky

------------------ ------- ------

00:01:ad:32:01 2 Yes

00:10:fe:48:19 2 No

Field Description

MAC address The source MAC address of the last packet

discarded on the interface. These are packets with

unknown MAC addresses, e.g., as in the case of the

dynamic limit set to 0.

VLAN ID The VLAN identifier of the discarded packet, if

applicable.

Layer 2 Switching Commands 311

Auto-VoIP Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Voice over Internet Protocol (VoIP) allows network users to make telephone

calls using a computer network over a data network like the Internet. With

the increased prominence of delay-sensitive applications (voice, video, and

other multimedia applications) deployed in networks today, proper QoS

configuration ensures high-quality application performance. The Auto-VoIP

feature is intended to provide an easy classification mechanism for voice

packets so that they can be prioritized above data packets in order to provide

better QoS. The Auto-VoIP service is independent of the Voice VLAN service.

Only one of the two services should be deployed in any network.

The Auto-VoIP feature explicitly matches VoIP streams in Ethernet switches

and provides them with a better class of service than ordinary traffic. The

Auto VoIP module provides the capability to assign the highest priority for

the following VoIP packets:

• Session Initiation Protocol (SIP)

• H.323

• Skinny Client Control Protocol (SCCP)

Auto-VoIP borrows ACL lists from the global system pool. ACL lists allocated

by Auto-VoIP reduce the total number of ACLs available for use by the

network operator. Enabling Auto-VoIP uses one ACL list to monitor for VoIP

sessions. Each monitored VoIP session utilizes two rules from an additional

ACL list. This means that the maximum number of ACL lists allocated by

Auto-VoIP is two. The Auto-VoIP feature limits the maximum number of

simultaneous users to 16. Administrators should utilize the Voice VLAN

feature for deployment of IP voice service in an enterprise network because

Voice VLAN scales to significantly higher numbers of users.

NOTE: This feature is not available on the N3000 when loaded with the

AGGREGATION ROUTER enabled firmware (e.g., N3000_BGPvA.B.C.D.stk).

Commands in this Section

This section explains the following commands:

Layer 2 Switching Commands 312

show switchport voice

Use the show switchport voice command to show the status of Auto-VoIP on

an interface or all interfaces.

Syntax

show switchport voice [ interface-id ]

• interface-id —An Ethernet or port channel interface identifier.

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

See the

debug auto-voip

command for assistance in troubleshooting Auto-

VoIP issues.

This command accepts an Ethernet interface identifier or a port channel

identifier.

Examples

The following example shows command output when a port is not specified:

console#show switchport voice

Interface Auto VoIP Mode Traffic Class

--------- -------------- -------------

Gi1/0/1 Disabled 6

Gi1/0/2 Disabled 6

Gi1/0/3 Disabled 6

Gi1/0/4 Disabled 6

Gi1/0/5 Disabled 6

show switchport voice switchport voice detect auto

Layer 2 Switching Commands 313

Gi1/0/6 Disabled 6

Gi1/0/7 Disabled 6

Gi1/0/8 Disabled 6

Gi1/0/9 Disabled 6

Gi1/0/10 Disabled 6

Gi1/0/11 Disabled 6

Gi1/0/12 Disabled 6

Gi1/0/13 Disabled 6

Gi1/0/14 Disabled 6

Gi1/0/15 Disabled 6

Gi1/0/16 Disabled 6

Gi1/0/17 Disabled 6

Gi1/0/18 Disabled 6

Gi1/0/19 Disabled 6

Gi1/0/20 Disabled 6

Gi1/0/21 Disabled 6

Gi1/0/22 Disabled 6

Gi1/0/23 Disabled 6

Gi1/0/24 Disabled 6

Po1 Disabled 6

Po2 Disabled 6

Po3 Disabled 6

Po4 Disabled 6

Po5 Disabled 6

Po6 Disabled 6

Po7 Disabled 6

Po8 Disabled 6

Po9 Disabled 6

Po10 Disabled 6

Po11 Disabled 6

Po12 Disabled 6

Po13 Disabled 6

Po14 Disabled 6

Po15 Disabled 6

The following example shows command output when a port is specified:

console#show switchport voice gigabitethernet 1/0/1

Interface Auto VoIP Mode Traffic Class

--------- -------------- -------------

Gi1/0/1 Disabled 6

The command output provides the following information:

•AutoVoIP Mode—The Auto VoIP mode on the interface.

Layer 2 Switching Commands 314

•Traffic Class—The Cos Queue or Traffic Class to which all VoIP traffic is

mapped. This is not configurable and defaults to the highest COS queue

available in the system for data traffic.

switchport voice detect auto

The switchport voice detect auto command is used to enable the VoIP Profile

on all the interfaces of the switch (global configuration mode) or for a specific

interface (interface configuration mode).Use the no form of the command to

disable the VoIP Profile.

Syntax

switchport voice detect auto

no switchport voice detect auto

Default Configuration

This feature is disabled by default.

Command Mode

Global Configuration mode and all Configuration submodes, Interface

(gigabitethernet, port-channel, tengigabitethernet, fortygigabitethernet)

Configuration mode

User Guidelines

The switch Auto-VoIP capability is independent of the Voice VLAN capability.

Voice VLAN configuration has no effect on the Auto-VoIP capabilities. Voice

VLAN is recommended for enterprise deployments as Auto-VoIP is limited in

the number of active VoIP users that can be serviced.

This command is valid for Ethernet and port channel interfaces.

Example

console(config)#interface tengigabitethernet 1/0/1

console(config-if-Te1/0/1)#switchport voice detect auto

Layer 2 Switching Commands 315

CDP Interoperability Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Industry Standard Discovery Protocol (ISDP) is a proprietary Layer 2 network

protocol which inter-operates with Cisco network equipment and is used to

share information between neighboring devices. Dell EMC Networking

switches participate in the ISDP protocol and are able to both discover and be

discovered by devices that support the Cisco Discovery Protocol (CDP).

ISDP is based on CDP, which is a precursor to LLDP.

Commands in this Section

This section explains the following commands:

clear isdp counters

The clear isdp counters command clears the ISDP counters.

Syntax

clear isdp counters

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode

clear isdp counters show isdp

clear isdp table show isdp entry

isdp advertise-v2 show isdp interface

isdp enable show isdp neighbors

isdp holdtime show isdp traffic

isdp timer

–

Layer 2 Switching Commands 316

User Guidelines

There are no user guidelines for this command.

Example

console#clear isdp counters

clear isdp table

The clear isdp table command clears entries in the ISDP table.

Syntax

clear isdp table

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode

User Guidelines

There are no user guidelines for this command.

Example

console#clear isdp table

isdp advertise-v2

The isdp advertise-v2 command enables the sending of ISDP version 2

packets from the device. Use the no form of this command to send version 1

packets.

Syntax

isdp advertise-v2

no isdp advertise-v2

Layer 2 Switching Commands 317

Default Configuration

ISDP sends version 2 packets by default.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console(config)#isdp advertise-v2

isdp enable

The isdp enable command enables ISDP on the switch. User the “no” form

of this command to disable ISDP. Use this command in global configuration

mode to enable the ISDP function on the switch. Use this command in

interface mode to enable sending ISDP packets on a specific interface.

Syntax

isdp enable

no isdp enable

Default Configuration

ISDP is enabled.

Command Mode

Global Configuration mode.

Interface Configuration (Ethernet) mode.

User Guidelines

There are no user guidelines for this command.

Example

The following example enables isdp on interface Gi1/0/1.

Layer 2 Switching Commands 318

console(config)#isdp enable

console(config)#interface gigabitethernet 1/0/1

console(config-if-Gi1/0/1)#isdp enable

isdp holdtime

The isdp holdtime command configures the hold time for ISDP packets that

the switch transmits. The hold time specifies how long a receiving device

should store information sent in the ISDP packet before discarding it. The

range is given in seconds. Use the no form of this command to reset the

holdtime to the default.

Syntax

isdp holdtime time

no isdp holdtime

• time—The time in seconds (range 10–255 seconds).

Default Configuration

The default holdtime is 180 seconds.

Command Mode

Global Configuration mode

User Guidelines

This command specifies the amount of time the partner device should

maintain the ISDP information. The local device uses the hold time in

packets received from the partner device. Configuring the hold time locally

does not change the amount of time displayed by the show isdp command.

Configure the hold time on the partner device to change the amount of time

the switch maintains the partner information.

Example

The following example sets isdp holdtime to 40 seconds.

console(config)#isdp holdtime 40

Layer 2 Switching Commands 319

isdp timer

The isdp timer command sets period of time between sending new ISDP

packets. The range is given in seconds. Use the “no” form of this command to

reset the timer to the default.

Syntax

isdp timer time

no isdp timer

•

time

—The time in seconds (range: 5–254 seconds).

Default Configuration

The default timer is 30 seconds.

Command Mode

Global Configuration mode

User Guidelines

Configuring the timer to a low value on a large number interfaces may affect

system processing due to CPU overload. Use the show process cpu command

to examine the system load.

Example

The following example sets the isdp timer value to 40 seconds.

console(config)#isdp timer 40

show isdp

The show isdp command displays global ISDP settings.

Syntax

show isdp

Default Configuration

There is no default configuration for this command.

Layer 2 Switching Commands 320

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show isdp

Timer................................ 30

Hold Time............................ 180

Version 2 Advertisements............. Enabled

Neighbors table last time changed.... 0 days 00:06:01

Device ID............................ QTFMPW82400020

Device ID format capability.......... Serial Number

Device ID format..................... Serial Number

show isdp entry

The show isdp entry command displays ISDP entries. If a device id specified,

then only the entry about that device is displayed.

Syntax

show isdp entry {all | deviceid}

•

all

—

Show ISDP settings for all devices.

•

deviceid

—

The device ID associated with a neighbor.

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Layer 2 Switching Commands 321

Example

console#show isdp entry Switch

Device ID N2000/N3000 Series Switch

Address(es):

IP Address: 172.20.1.18

Capability Router IGMP

Platform cisco WS-C4948

Interface Gi1/0/1

Port ID Gi1/0/1

Holdtime 64

Advertisement Version 2

Entry last changed time 0 days 00:13:50

Version:

Cisco IOS Software, Catalyst 4000 L3 Switch Software (cat4000 I9K91S-M),

Version 12.2(25)EWA9, RELEASE SOFTWARE (fc3)

Technical Support: http://www.cisco.com/techsupport

Compiled Wed 21-Mar-07 12:20 by tinhuang

show isdp interface

The show isdp interface command displays ISDP settings for the specified

interface.

Syntax

show isdp interface {all | interface-id}

• interface-id—An Ethernet interface identifier.

• all—Display all interfaces.

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command accepts an Ethernet interface identifier.

Layer 2 Switching Commands 322

Example

console#show isdp interface all

Interface Mode

--------------- ----------

Gi1/0/1 Enabled

Gi1/0/2 Enabled

Gi1/0/3 Enabled

Gi1/0/4 Enabled

Gi1/0/5 Enabled

Gi1/0/6 Enabled

Gi1/0/7 Enabled

Gi1/0/8 Enabled

Gi1/0/9 Enabled

console#show isdp interface gigabitethernet 1/0/1

Interface Mode

--------------- ----------

Gi1/0/1 Enabled

show isdp neighbors

The show isdp neighbors command displays the list of neighboring devices.

Syntax

show isdp neighbors [interface-id][detail]

• interface-id—A physical interface identifier.

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The information displayed varies based upon the information received from

the ISDP neighbor.

Layer 2 Switching Commands 323

Example

console#show isdp neighbors

Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge,

S - Switch, H - Host, I - IGMP, r - Repeater

Device ID Intf Holdtime Capability Platform Port ID

------------------------ --------- --------- ---------- ---------------- ---------

CN0H784T2829841E0534A00 Gi1/0/13 163 R N3048 Gi1/0/13

R3 Gi1/0/16 157 R N3048 Gi1/0/16

console#show isdp neighbors detail

Device ID Switch

Address(es):

IP Address: 172.20.1.18

Capability Router IGMP

Platform cisco WS-C4948

Interface Gi1/0/1

Port ID GigabitEthernet1/1

Holdtime 162

Advertisement Version 2

Entry last changed time 0 days 00:55:20

Version:

Cisco IOS Software, Catalyst 4000 L3 Switch Software (cat4000-I9K91S-M), Version

12.2(25)EWA9, RELEASE SOFTWARE (fc3)

Technical Support: http://www.cisco.com/techsupport

Compiled Wed 21-Mar-07 12:20 by tinhuang

show isdp traffic

The show isdp traffic command displays ISDP statistics.

Syntax

show isdp traffic

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Layer 2 Switching Commands 324

Example

console#show isdp traffic

ISDP Packets Received.......................... 4253

ISDP Packets Transmitted....................... 127

ISDPv1 Packets Received........................ 0

ISDPv1 Packets Transmitted..................... 0

ISDPv2 Packets Received........................ 4253

ISDPv2 Packets Transmitted..................... 4351

ISDP Bad Header................................ 0

ISDP Checksum Error............................ 0

ISDP Transmission Failure...................... 0

ISDP Invalid Format............................ 0

ISDP Table Full................................ 392

ISDP Ip Address Table Full..................... 737

Layer 2 Switching Commands 325

DHCP Layer 2 Relay Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

In the majority of network configurations, DHCP clients and their associated

servers do not reside on the same IP network or subnet. Therefore, some kind

of third-party agent is required to transfer DHCP messages between clients

and servers. Such an agent is known as a DHCP Relay agent.

The DHCP Relay agent accepts DHCP requests from any routed interface,

including VLANs. The agent relays requests from a subnet without a DHCP

server to a server or next-hop agent on another subnet. Unlike a router which

switches IP packets transparently, a DHCP Relay agent processes DHCP

messages and generates new DHCP messages as a result.

The Dell EMC Networking DHCP Relay supports DHCP Option 82 circuit-

id and remote-id for a VLAN.

Commands in this Section

This section explains the following commands:

dhcp l2relay (Global Configuration) show dhcp l2relay stats interface

dhcp l2relay (Interface Configuration)

–

dhcp l2relay circuit-id show dhcp l2relay agent-option vlan

dhcp l2relay remote-id show dhcp l2relay vlan

dhcp l2relay trust show dhcp l2relay circuit-id vlan

dhcp l2relay vlan show dhcp l2relay remote-id vlan

show dhcp l2relay all clear dhcp l2relay statistics interface

show dhcp l2relay interface

–

Layer 2 Switching Commands 326

dhcp l2relay (Global Configuration)

Use the dhcp l2relay command to enable Layer 2 DHCP Relay functionality.

The subsequent commands mentioned in this section can only be used when

the L2-DHCP Relay is enabled. Use the no form of this command to disable

L2-DHCP Relay.

Syntax

dhcp l2relay

no dhcp l2relay

Default Configuration

DHCP L2 Relay is disabled by default.

Command Mode

Global Configuration.

User Guidelines

There are no user guidelines for this command.

Example

console(config)#dhcp l2relay

dhcp l2relay (Interface Configuration)

Use the dhcp l2relay command to enable DHCP L2 Relay for an interface.

Use the no form of this command to disable DHCP L2 Relay for an interface.

Syntax

dhcp l2relay

no dhcp l2relay

Default Configuration

DHCP L2Relay is disabled on all interfaces by default.

Layer 2 Switching Commands 327

Command Mode

Interface Configuration (Ethernet, Port-channel).

User Guidelines

There are no user guidelines for this command.

Example

console(config-if-Gi1/0/1)#dhcp l2relay

dhcp l2relay circuit-id

Use the dhcp l2relay circuit-id command to enable setting the DHCP

Option 82 Circuit ID for a VLAN. When enabled, the interface number is

added as the Circuit ID in DHCP option 82. Use the no form of this

command to disable setting the DHCP Option 82 Circuit ID.

Syntax

dhcp l2relay circuit-id vlan vlan-list

no dhcp l2relay circuit-id vlan vlan-list

•vlan-list —A list of VLAN IDs. List separate, non-consecutive VLAN IDs

separated by commas (without spaces). Use a hyphen to designate a range

of IDs. (Range: 1–4093)

Default Configuration

Setting the DHCP Option 82 Circuit ID is disabled by default.

Command Mode

Global Configuration

User Guidelines

There are no user guidelines for this command.

Example

console(config)#dhcp l2relay circuit-id vlan 340-350

Layer 2 Switching Commands 328

dhcp l2relay remote-id

Use the dhcp l2relay remote-id command to enable setting the DHCP

Option 82 Remote ID for a VLAN. When enabled, the supplied string is used

for the Remote ID in DHCP Option 82. Use the no form of this command to

disable setting the DHCP Option 82 Remote ID.

Syntax

dhcp l2relay remote-id remoteId vlan vlan-list

no dhcp l2relay remote-id vlan vlan-list

•

remoteId

—

The string to be used as the remote ID in the Option 82 (Range: 1 -

128 characters).

•vlan-list —A list of VLAN IDs. List separate, non-consecutive VLAN IDs

separated by commas (without spaces). Use a hyphen to designate a range

of IDs. (Range: 1–4093)

Default Configuration

Setting the DHCP Option 82 Remote ID is disabled by default.

Command Mode

Global Configuration.

User Guidelines

There are no user guidelines for this command.

Example

console(config)#dhcp l2relay remote-id dslforum vlan 10,20-30

dhcp l2relay trust

Use the dhcp l2relay trust command to configure an interface to mandate

Option-82 on receiving DHCP packets.

Syntax

dhcp l2relay trust

no dhcp l2relay trust

Layer 2 Switching Commands 329

Default Configuration

DHCP Option 82 is discarded by default.

Configuration Mode

Interface Configuration (Ethernet, Port-channel).

User Guidelines

There are no user guidelines for this command.

Example

console(config-if-Gi1/0/1)#dhcp l2relay trust

dhcp l2relay vlan

Use the dhcp l2relay vlan command to enable the L2 DHCP Relay agent for

a set of VLANs. All DHCP packets which arrive on interfaces in the

configured VLAN are subject to L2 Relay processing. Use the no form of this

command to disable L2 DHCP Relay for a set of VLANs.

Syntax

dhcp l2relay vlan vlan-list

no dhcp l2relay vlan vlan-list

• vlan-list — A list of VLAN IDs. List separate, non-consecutive VLAN IDs

separated by commas (without spaces). Use a hyphen to designate a range

of IDs. (Range: 1–4093)

Default Configuration

DHCP L2 Relay is disabled on all VLANs by default.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Layer 2 Switching Commands 330

Example

console(config)#dhcp l2relay vlan 10,340-345

show dhcp l2relay all

Use the show dhcp l2relay all command to display the summary of DHCP L2

Relay configuration.

Syntax

show dhcp l2relay all

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console #show dhcp l2relay all

DHCP L2 Relay is Enabled.

Interface L2RelayMode TrustMode

---------- ----------- --------------

Gi1/0/2 Enabled untrusted

Gi1/0/4 Disabled trusted

VLAN Id L2 Relay CircuitId RemoteId

--------- ---------- ----------- ------------

3 Disabled Enabled --NULL--

5 Enabled Enabled --NULL--

6 Enabled Enabled --dell--

7 Enabled Disabled --NULL--

8 Enabled Disabled --NULL--

9 Enabled Disabled --NULL--

10 Enabled Disabled --NULL--

Layer 2 Switching Commands 331

show dhcp l2relay interface

Use the show dhcp l2relay interface command to display DHCP L2 Relay

configuration specific to interfaces.

Syntax

show dhcp l2relay interface {all | interface-id}

•

all

—

Show all interfaces.

•

interface-id

—

An Ethernet interface.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show dhcp l2relay interface all

DHCP L2 Relay is Enabled.

Interface L2RelayMode TrustMode

---------- ----------- --------------

0/2 Enabled untrusted

0/4 Disabled trusted

show dhcp l2relay stats interface

Use the show dhcp l2relay stats interface command to display DHCP L2

Relay statistics specific to interfaces.

Syntax

show dhcp l2relay stats interface {all | interface-id}

•all—

Show all interfaces.

Layer 2 Switching Commands 332

• interface-id—

An Ethernet interface.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show dhcp l2relay stats interface all

DHCP L2 Relay is Enabled.

Interface UntrustedServer UntrustedClient TrustedServer TrustedClient

MsgsWithOpt82MsgsWithOpt82 MsgsWithoutOpt82 MsgsWithoutOpt82

--------- ------------- ---------------- ---------------- -------------

Gi1/0/1 0 0 0 0

Gi1/0/2 0 0 3 7

Gi1/0/3 0 0 0 0

show dhcp l2relay agent-option vlan

Use the show dhcp l2relay agent-option vlan command to display DHCP L2

Relay Option-82 configuration specific to VLANs.

Syntax

show dhcp l2relay agent-option vlan vlan-list

•

vlan-list

—

Show information for the specified VLAN range

. List separate, non-

consecutive VLAN IDs separated by commas (without spaces). Use a

hyphen to designate a range of IDs. (Range: 1–4093)

Default Configuration

This command has no default configuration.

Layer 2 Switching Commands 333

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console# show dhcp l2relay agent-option vlan 5-10

DHCP L2 Relay is Enabled.

VLAN Id L2 Relay CircuitId RemoteId

--------- ---------- ----------- ------------

5 Enabled Enabled --NULL--

6 Enabled Enabled broadcom

7 Enabled Disabled --NULL--

8 Enabled Disabled --NULL--

9 Enabled Disabled --NULL--

10 Enabled Disabled --NULL—

show dhcp l2relay vlan

Use the show dhcp l2relay vlan command to display whether DHCP L2 Relay

is globally enabled on the specified VLAN or VLAN range.

Syntax

show dhcp l2relay vlan vlan-list

• vlan-list—Show information for the specified VLAN range. List separate, non-

consecutive VLAN IDs separated by commas (without spaces). Use a

hyphen to designate a range of IDs. (Range: 1–4093)

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

Layer 2 Switching Commands 334

User Guidelines

There are no user guidelines for this command.

Example

console#show dhcp l2relay vlan 100

DHCP L2 Relay is Enabled.

DHCP L2 Relay is enabled on the following VLANs:

100

show dhcp l2relay circuit-id vlan

Use the show dhcp l2relay circuit-id vlan command to display whether

DHCP L2 Relay is globally enabled and whether the DHCP Circuit-ID

option is enabled on the specified VLAN or VLAN range.

Syntax

show dhcp l2relay circuit-id vlan vlan-list

•

vlan-list

—

Show information for the specified VLAN range.

List separate, non-

consecutive VLAN IDs separated by commas (without spaces). Use a

hyphen to designate a range of IDs. (Range: 1–4093)

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show dhcp l2relay circuit-id vlan 300

DHCP L2 Relay is Enabled.

DHCP Circuit-Id option is enabled on the following VLANs:

300

Layer 2 Switching Commands 335

show dhcp l2relay remote-id vlan

Use the show dhcp l2relay remote-id vlan command to display whether

DHCP L2 Relay is globally enabled and shows the remote ID configured on

the specified VLAN or VLAN range.

Syntax

show dhcp l2relay remote-id vlan vlan-list

•

vlan-list

—

Show information for the specified VLAN range

. List separate, non-

consecutive VLAN IDs separated by commas (without spaces). Use a

hyphen to designate a range of IDs. (Range: 1–4093)

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show dhcp l2relay remote-id vlan 200

DHCP L2 Relay is Enabled.

VLAN ID Remote Id

-------- -------------

200 remote_22

clear dhcp l2relay statistics interface

Use the show dhcp l2relay statistics interface command to reset the DHCP

L2 Relay counters to zero. Specify the port with the counters to clear, or use

the all keyword to clear the counters on all ports.

Syntax

clear dhcp l2relay statistics interface {all | interface-id}

Layer 2 Switching Commands 336

•

all

—

Show all interfaces.

•

interface-id

—

An Ethernet interface.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

There are no user guidelines for this command.

Example

console#clear dhcp l2relay statistics interface gi1/0/1

Layer 2 Switching Commands 337

DHCP Snooping Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

DHCP Snooping is a security feature that monitors DHCP messages between

DHCP clients and DHCP server to filter harmful DHCP messages and build

a bindings database of {MAC address, IP address, VLAN ID, interface} tuples

that are considered authorized.

The DHCP snooping application processes incoming DHCP messages. For

DHCPRELEASE and DHCPDECLINE messages, the application compares

the receive interface and VLAN with the client's interface and VLAN in the

bindings database. If the interfaces do not match, the application logs the

event and drops the message. For valid client messages, DHCP snooping

compares the source MAC address to the DHCP client hardware address.

When there is a mismatch, DHCP snooping logs and drops the packet.

DHCP Snooping forwards valid client messages on trusted members within

the VLAN. If DHCP Relay and/or DHCP Server coexist with DHCP

Snooping, the DHCP client message is sent to the DHCP Relay or/and

DHCP Server for further processing.

The DHCP Snooping application uses DHCP messages to build and

maintain the binding's database. The binding's database only includes data

for clients on untrusted ports. DHCP Snooping creates a tentative binding

from DHCP DISCOVER and REQUEST messages. Tentative bindings tie a

client to a port (the port where the DHCP client message was received).

Tentative bindings are completed when DHCP Snooping learns the client's IP

address from a DHCP ACK message on a trusted port. DHCP Snooping

removes bindings in response to DECLINE, RELEASE, and NACK messages.

The DHCP Snooping application ignores the ACK messages as a reply to the

DHCP Inform messages received on trusted ports. The network administrator

can enter static bindings into the binding database.

IP Source Guard and Dynamic ARP Inspection use the DHCP Snooping

bindings database for the validation of IP and ARP packets.

Layer 2 Switching Commands 338

Commands in this Section

This section explains the following commands:

clear ip dhcp snooping binding

Use the clear ip dhcp snooping binding command to clear all DHCP

Snooping bindings on a specific interface or on all interfaces.

Syntax

clear ip dhcp snooping binding {* | interface interface-id}

•*—

Clear all DHCP Snooping entries.

• interface-id—

Clear all DHCP Snooping entries on the specified interface.

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec

User Guidelines

There are no user guidelines for this command.

clear ip dhcp snooping binding ip dhcp snooping trust

clear ip dhcp snooping statistics ip dhcp snooping verify mac-address

ip dhcp snooping show ip dhcp snooping

ip dhcp snooping binding show ip dhcp snooping binding

ip dhcp snooping database show ip dhcp snooping database

ip dhcp snooping database write-delay show ip dhcp snooping interfaces

ip dhcp snooping limit show ip dhcp snooping statistics

ip dhcp snooping log-invalid

–

Layer 2 Switching Commands 339

clear ip dhcp snooping statistics

Use the clear ip dhcp snooping statistics command to clear all DHCP

Snooping statistics.

Syntax

clear ip dhcp snooping statistics

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec

User Guidelines

There are no user guidelines for this command.

Example

console#clear ip dhcp snooping statistics

ip dhcp snooping

Use the ip dhcp snooping command to enable DHCP snooping globally, or

on a range of VLANs. Use the “no” form of this command to disable DHCP

snooping.

Syntax

ip dhcp snooping [vlan vlan-list]

no ip dhcp snooping

Default Configuration

DHCP Snooping is globally disabled by default. DHCP Snooping is not

enabled on any VLAN by default.

Command Mode

Global Configuration mode

Layer 2 Switching Commands 340

User Guidelines

To enable DHCP snooping, do the following:

Enable DHCP Snooping globally.

Enable DHCP Snooping per VLAN.

Configure at least one DHCP Snooping trusted port via which the DHCP

server may be reached.

The bindings database populated by DHCP snooping is used by several other

services, including IP source guard and dynamic ARP inspection. DHCP

snooping must be enabled for these services to operate.

Example

The following configuration enables DHCP snooping on VLAN 1 for a switch

connected to a DHCP server over interface gi1/0/4:

console(config)#ip dhcp snooping

console(config)#ip dhcp snooping vlan 1

console(config-if-vlan1)#exit

console(config)#interface gi1/0/4

console(config-if-Gi1/0/4)#ip dhcp snooping trust

ip dhcp snooping binding

Use the ip dhcp snooping binding command to configure a static DHCP

Snooping binding. Use the “no” form of this command to remove a static

binding.

Syntax

ip dhcp snooping binding mac-address vlan vlan-id ip-address interface

interface-id

no ip dhcp snooping binding mac-address

•

mac-address

—

The client's MAC address.

•

vlan-id

—

The identifier of the VLAN the client is authorized to use.

•

ip-address

—

The IP address of the client.

•

interface-id

—

The interface on which the client is authorized. The interface may

be an Ethernet interface identifier or a port channel interface identifier.

Layer 2 Switching Commands 341

Default Configuration

There are no static or dynamic DHCP snooping bindings by default.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console(config)#ip dhcp snooping binding 00:00:00:00:00:01 vlan 10

10.131.12.134 interface Gi1/0/1

ip dhcp snooping database

Use the ip dhcp snooping database command to configure the persistent

storage location of the DHCP snooping database. This can be local to the

switch or on a remote machine.

Syntax

ip dhcp snooping database {local | tftp://hostIP/filename}

•

hostIP

—

The IP address of the remote host.

•

filename

—

The name of the file for the database on the remote host. The

filename may contain any printable charact

er except a question mark

and is

checked only when attempting to open the file. The file must reside in the

working directory of the TFTP server. Specification of a sub-directory in the file

name parameter is not supported.

Default Configuration

The database is stored locally by default.

Configuration Mode

Global Configuration mode.

User Guidelines

There are no user guidelines for this command.

Layer 2 Switching Commands 342

Example

The following example configures the storage location of the snooping

database as local.

console(config)#ip dhcp snooping database local

The following example configures the storage location of the snooping

database as remote.

console(config)#ip dhcp snooping database tftp://10.131.11.1/db.txt

ip dhcp snooping database write-delay

Use the ip dhcp snooping database write-delay command to configure the

interval in seconds at which the DHCP Snooping database will be stored in

persistent storage. Use the “no” form of this command to reset the write delay

to the default.

Syntax

ip dhcp snooping database write-delay seconds

no ip dhcp snooping database write-delay

• seconds—

The write delay (Range: 15–86400 seconds).

Default Configuration

The write delay is 300 seconds by default.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console(config)#ip dhcp snooping database write-delay 500

Layer 2 Switching Commands 343

ip dhcp snooping limit

Use the ip dhcp snooping limit command to diagnostically disable itself if

the rate of received DHCP messages exceeds the configured limit. Use the no

shutdown command to re-enable the interface. Use the no form of this

command to disable automatic shutdown of the interface.

Syntax

ip dhcp snooping limit {rate rate [burst interval seconds]}

no ip dhcp snooping limit

• rate— The maximum number of packets per second allowed (Range: 0–

300 pps).

• seconds — Interval over which to measure a burst of packets. (Range: 1–15

seconds).

Default Configuration

By default, DCHP messages do not cause an interface to be disabled.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

This command is available in Ethernet interface configuration mode or port

channel interface configuration mode. The switch hardware rate limits

DHCP packets sent to the CPU from snooping enabled interfaces to 512

Kbps.

To prevent DHCP packets from being used in a DoS attack when DHCP

snooping is enabled; the snooping application allows configuration of rate

limiting for received DHCP packets. DHCP snooping monitors the receive

rate on each interface separately. If the receive rate exceeds the configured

limit within the configured interval, DHCP snooping shuts down the

interface. The administrator must perform the “no shutdown” command on

the affected interface to re-enable the interface.

Layer 2 Switching Commands 344

The administrator can configure the rate and burst interval. Rate limiting is

configured independently on each physical interface and may be enabled on

both trusted and untrusted interfaces. The rate limit is configurable in the

range of 0-300 packets per second and the burst interval in the range of 1-15

seconds. In general, a rate limit of under 100 pps is valid for untrusted

interfaces.

Examples

console(config-if-Gi1/0/1)#ip dhcp snooping limit rate 100 burst interval 1

ip dhcp snooping log-invalid

Use the ip dhcp snooping log-invalid command to enable logging of DHCP

messages filtered by the DHCP Snooping application. Use the no form of this

command to disable logging.

Syntax

ip dhcp snooping log-invalid

no ip dhcp snooping log-invalid

Default Configuration

Logging of filtered messages is disabled by default.

Invalid DHCP messages are not logged by default.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

This command is available in physical interface configuration mode or port

channel configuration mode.

Example

console(config-if-Gi1/0/1)#ip dhcp snooping log-invalid

console(config-if-Gi1/0/1)#no ip dhcp snooping log-invalid

Layer 2 Switching Commands 345

ip dhcp snooping trust

Use the ip dhcp snooping trust command to configure a port as trusted. Use

the no form of this command to configure a port as untrusted.

Syntax

ip dhcp snooping trust

no ip dhcp snooping trust

Default Configuration

Ports are untrusted by default.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

Configuring an interface as trusted disables DHCP snooping validation of

DHCP packets and exposes the port to IPv4 DHCP DoS attacks. Configuring

an interface as untrusted indicates that the switch should firewall DHCP

messages and act as if the port is connected to a device outside the DMZ.

DHCP snooping must be enabled globally and on the VLAN for which the

port is a member for this command to have an effect.

Interfaces connected to the DHCP server must be configured as trusted in

order for DHCP snooping to operate.

Use the ip verify source command to disallow traffic from untrusted sources

on an interface.

Example

console(config-if-Gi1/0/1)#ip dhcp snooping trust

console(config-if-Gi1/0/1)#no ip dhcp snooping trust

Layer 2 Switching Commands 346

ip dhcp snooping verify mac-address

Use the ip dhcp snooping verify mac-address command to enable the

verification of the source MAC address with the client MAC address in the

received DHCP message. Use the “no” form of this command to disable

verification of the source MAC address.

Syntax

ip dhcp snooping verify mac-address

no ip dhcp snooping verify mac-address

Default Configuration

Source MAC address verification is disabled by default.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console(config)#ip dhcp snooping verify mac-address

show ip dhcp snooping

Use the show ip dhcp snooping command to display the DHCP snooping

global configuration.

Syntax

show ip dhcp snooping

Default Configuration

There is no default configuration for this command.

Layer 2 Switching Commands 347

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show ip dhcp snooping

DHCP snooping is Disabled

DHCP snooping source MAC verification is enabled

DHCP snooping is enabled on the following VLANs:

11 - 30, 40

Interface Trusted Log Invalid Pkts

--------- -------- ----------------

Gi1/0/1 Yes No

Gi1/0/2 No Yes

Gi1/0/3 No Yes

Gi1/0/4 No No

Gi1/0/6 No No

show ip dhcp snooping binding

Use the show ip dhcp snooping binding command to display the DHCP

snooping binding entries.

Syntax

show ip dhcp snooping binding [{static | dynamic}] [interface interface-id |

port-channel port-channel-number] [vlan vlan-id]

•static

dynamic — Use these keywords to filter by static or dynamic

bindings.

• interface-id — The physical interface for which to show bindings.

• port-channel-number—The port channel for which to show bindings.

• vlan-id — The VLAN identifier for which to show bindings.

Layer 2 Switching Commands 348

Default Configuration

There is no default configuration for this command.

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show ip dhcp snooping binding

Total number of bindings: 2

MAC Address IP Address VLAN Interface Type Lease (Secs)

----------------- --------------- ---- ----------- ------- ------------

00:02:B3:06:60:80 210.1.1.3 10 Gi1/0/1 Dyn 86400

00:02:FE:06:13:04 210.1.1.4 10 Gi1/0/1 Dyn 86400

show ip dhcp snooping database

Use the show ip dhcp snooping database command to display the DHCP

snooping configuration related to the database persistence.

Syntax

show ip dhcp snooping database

Default Configuration

There is no default configuration for this command.

Command Mode

User Exec, Privileged Exec, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Layer 2 Switching Commands 349

Example

console#show ip dhcp snooping database

agent url: /10.131.13.79:/sai1.txt

write-delay: 5000

show ip dhcp snooping interfaces

Use the show ip dhcp snooping interfaces command to show the DHCP

Snooping status of the interfaces.

Syntax

show ip dhcp snooping interfaces [interface-id]

• interface-id — A valid physical interface.

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show ip dhcp snooping interfaces

Interface Trust State Rate Limit Burst Interval

(pps) (seconds)

---------- ------------- ------------- ---------------

Gi1/0/1 No 15 1

Gi1/0/2 No 15 1

Gi1/0/3 No 15 1

console#show ip dhcp snooping interfaces gigabitethernet 1/0/15

Interface Trust State Rate Limit Burst Interval

(pps) (seconds)

---------- ------------- ------------- ---------------

Layer 2 Switching Commands 350

Gi1/0/15 Yes 15 1

show ip dhcp snooping statistics

Use the show ip dhcp snooping statistics command to display the DHCP

snooping filtration statistics.

Syntax

show ip dhcp snooping statistics

Default Configuration

There is no default configuration for this command.

Command Mode

User Exec, Privileged Exec, Global Configuration mode and all Configuration

submodes

User Guidelines

The following fields are displayed by this command:

Example

console#show ip dhcp snooping statistics

Interface MAC Verify Client Ifc DHCP Server

Failures Mismatch Msgs Rec'd

----------- ---------- ---------- -----------

Gi1/0/2 0 0 0

Gi1/0/3 0 0 0

Fields Description

MAC Verify

Failures

The number of DHCP messages that were filtered on an

untrusted interface because of source MAC address and client

MAC address mismatch.

Client Ifc

Mismatch

The number of DHCP release and Deny messages received on

the different ports than previously learned.

DHCP Server Msgs The number of DHCP server messages received on untrusted

ports.

Layer 2 Switching Commands 351

Gi1/0/4 0 0 0

Gi1/0/5 0 0 0

Gi1/0/6 0 0 0

Gi1/0/7 0 0 0

Gi1/0/8 0 0 0

Gi1/0/9 0 0 0

Gi1/0/10 0 0 0

Gi1/0/11 0 0 0

Gi1/0/12 0 0 0

Gi1/0/13 0 0 0

Gi1/0/14 0 0 0

Gi1/0/15 0 0 0

Gi1/0/16 0 0 0

Gi1/0/17 0 0 0

Gi1/0/18 0 0 0

Gi1/0/19 0 0 0

Gi1/0/20 0 0 0

Layer 2 Switching Commands 352

DHCPv6 Snooping Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

This section explains the following commands:

clear ipv6 dhcp snooping binding

Use the clear ipv6 dhcp snooping binding command to clear all IPv6 DHCP

Snooping entries.

Syntax

clear ipv6 dhcp snooping binding {* | interface interface-id}

• *—Clears all snooping bindings.

• interface-id—Clears all snooping bindings on a specified physical

interface.

Default Configuration

This command has no default configuration.

clear ipv6 dhcp snooping binding ipv6 dhcp snooping verify mac-address

clear ipv6 dhcp snooping binding ipv6 verify binding

ipv6 dhcp snooping ipv6 verify source

ipv6 dhcp snooping vlan show ipv6 dhcp snooping

ipv6 dhcp snooping binding show ipv6 dhcp snooping binding

ipv6 dhcp snooping database show ipv6 dhcp snooping database

ipv6 dhcp snooping database write-delay show ipv6 dhcp snooping interfaces

ipv6 dhcp snooping limit show ipv6 dhcp snooping statistics

ipv6 dhcp snooping log-invalid show ipv6 source binding

ipv6 dhcp snooping trust show ipv6 verify

–

show ipv6 verify source

Layer 2 Switching Commands 353

Command Modes

User Exec, Privileged Exec

User Guidelines

This command has no user guidelines.

Example

(console)#clear ipv6 dhcp snooping binding

clear ipv6 dhcp snooping statistics

Use the clear ipv6 dhcp snooping statistics command to clear all IPv6 DHCP

Snooping statistics.

Syntax

clear ipv6 dhcp snooping statistics

Default Configuration

This command has no default configuration.

Command Modes

User Exec, Privileged Exec

User Guidelines

The IPv6 snooping statistics are also cleared by the clear counters command.

Example

(console)#clear ipv6 dhcp snooping statistics

ipv6 dhcp snooping

Use the ipv6 dhcp snooping command to globally enable IPv6 DHCP

snooping. Use the no form of the command to globally disable IPv6 DHCP

snooping.

Layer 2 Switching Commands 354

Syntax

ipv6 dhcp snooping

no ipv6 dhcp snooping

Default Configuration

By default, DHCP snooping is not enabled.

Command Modes

Global Configuration mode

User Guidelines

The DHCP snooping application processes incoming DHCP messages. For

RELEASE and DECLINE messages from a DHCPv6 client and

RECONFIGURE messages from a DHCPv6 server received on an untrusted

interface, the application compares the receive interface and VLAN with the

client’s interface and VLAN in the bindings database. If the interfaces do not

match, the application logs the event and drops the packet. If configured, for

valid client messages, DHCP snooping additionally compares the source

MAC address to the DHCP client hardware address. If there is a mismatch,

DHCP snooping logs a message and drops the packet. The network

administrator can disable this option using the no ip v6 dhcp snooping verify

mac-address for DHCPv6. DHCP snooping always forwards client messages

on trusted interfaces within the VLAN. If DHCP relay or/and DHCP server

are enabled simultaneously with DHCP snooping, the DHCP client message

will be sent to the DHCP relay or/and DHCP server to process further.

Example

console(config)#ipv6 dhcp snooping

ipv6 dhcp snooping vlan

Use the ipv6 dhcp snooping vlan command to globally enable IPv6 DHCP on

a set of VLANs. Use the no form of the command to globally disable IPv6

DHCP snooping on a set of VLANs.

Layer 2 Switching Commands 355

Syntax

ipv6 dhcp snooping vlan vlan-list

no ipv6 dhcp snooping vlan-list

• vlan-list —A single VLAN, one or more VLANs separated by commas, or

two VLANs separated by a single dash indicating all VLANs between the

first and second inclusive. Multiple VLAN identifiers can be entered

provided that no embedded spaces are contained within the vlan-list.

Default Configuration

By default, DHCP snooping is not enabled on any VLANs.

Command Modes

Global Configuration mode

User Guidelines

DHCP snooping must be enabled on at least one VLAN and globally enabled

to become operational.

Example

console(config)#ipv6 dhcp snooping

console(config)#ipv6 dhcp snooping vlan 5-10,15,30

console(config)#interface Te1/0/1

console(config-if-Te1/0/1)#switchport mode access

console(config-if-Te1/0/1)#switchport access vlan 10

console(config-if-Te1/0/1)#no ipv6 dhcp snooping trust

ipv6 dhcp snooping binding

Use the ipv6 dhcp snooping binding command to configure a static IPv6

DHCP snooping binding. Use the no form of the command to remove the

entry from the binding database.

Syntax

ipv6 dhcp snooping binding mac-address vlan vlan-id ip-address interface

{gigabitethernet unit/slot/port | tengigabitethernet unit/slot/port |

fortygigabitethernet unit/slot/port | port-channel port-channel-number}

no ipv6 dhcp snooping binding mac-address

Layer 2 Switching Commands 356

•

mac-address

—

A valid mac address in standard format.

•

vlan-id

—

A configured VLAN id. (Range 1-4093)

•

ip-address

—

A valid IPv6 address.

•

interface-id

—

A valid physical interface ID in short or long format.

• port-channel-number—A valid port channel identifier.

Default Configuration

By default, no static DHCP bindings are configured.

Command Modes

Global Configuration mode

User Guidelines

Static bindings do not age out of the DHCP binding database.

ipv6 dhcp snooping database

Use the ipv6 dhcp snooping database command to configure the persistent

location of the DHCP snooping database. This can be a local or remote file

on a TFTP server.

Syntax

ipv6 dhcp snooping database {local | tftp://hostIP/filename}

no ipv6 dhcp snooping database

Default Configuration

By default, the local database is used.

Command Modes

Global Configuration mode

Layer 2 Switching Commands 357

User Guidelines

The DHCP binding database is persistently stored on a configured external

server or locally in flash, depending on the user configuration. A row-wise

checksum is placed in the text file that is stored on the configured TFTP

server. On switch startup, the switch reads the text file and uses the contents

to build the DHCP snooping database. If the calculated checksum value

equals the stored checksum, the switch uses the entries from the binding file

and populates the binding database. Checksum failure or a connection

problem to the external configured server causes the switch to lose the

bindings and may cause connectivity loss for hosts if IPSG or DAI is enabled.

ipv6 dhcp snooping database write-delay

Use the ipv6 dhcp snooping database write-delay command to configure the

time period between successive writes of the binding database. The binding

database is used to persistently store the DHCP bindings. Use the no form of

the command to return the write delay to the default value.

Syntax

ipv6 dhcp snooping database write-delay seconds

no ipv6 dhcp snooping write-delay

• seconds—The period of time between successive writes of the binding

database to persistent storage. (Range 15-86400 seconds.)

Default Configuration

By default, the write delay is 300 seconds.

Command Modes

Global Configuration mode

User Guidelines

The binding database is cached in memory and written to storage every write-

delay seconds.

Layer 2 Switching Commands 358

ipv6 dhcp snooping limit

Use the ipv6 dhcp snooping limit command configures an interface to be

diagnostically disabled if the rate of received DHCP messages exceeds the

configured limit. Use the no shutdown command to reenable the interface.

Use the no form of the command to disable diagnostic disabling of the

interface.

Syntax

ipv6 dhcp snooping limit {rate pps [burst interval seconds]}

no ipv6 dhcp snooping limit

• pps—The rate in packets per interval. (Range 0-300.)

• seconds—The time interval over which to measure a burst of packets.

(Range 1-15, default 1 second.)

Default Configuration

By default, DHCP messages do not shut down the interface.

Command Modes

Interface Configuration mode

User Guidelines

The switch hardware rate limits DHCP packets sent to the CPU from

snooping enabled interfaces to 512 Kbps.

To prevent DHCP packets from being used in a DoS attack when DHCP

snooping is enabled, the snooping application allows configuration of rate

limiting for received DHCP packets. DHCP snooping monitors the receive

rate on each interface separately. If the receive rate exceeds the configured

limit within the configured interval, DHCP snooping diagnostically disables

the interface. The administrator must perform the no shutdown command

on the affected interface to reenable the interface.

Layer 2 Switching Commands 359

The administrator can configure the rate and burst interval. Rate limiting is

configured independently on each physical interface and may be enabled on

both trusted and untrusted interfaces. The rate limit is configurable in the

range of 0-300 packets per second and the burst interval in the range of 1-15

seconds.

ipv6 dhcp snooping log-invalid

Use the ipv6 dhcp snooping log-invalid command to configure the port to

log invalid received DHCP messages.

Syntax

ipv6 dhcp snooping log-invalid

no ipv6 dhcp snooping log-invalid

Default Configuration

By default, invalid DHCP messages are not logged.

Command Modes

Interface Configuration mode

User Guidelines

An invalid DHCP message is one that is received on an untrusted interface

that is not a member of the VLAN over which the IP address (and optionally

the MAC address) has been learned. Receiving large number of invalid

messages may be an indication of an attack.

Logging invalid messages can use valuable CPU resources if the switch

receives such messages at a high rate. To avoid allowing the switch to be

vulnerable to a DoS attack, DHCP snooping only logs invalid messages if the

user has enabled logging. Logging is enabled on individual interfaces so that

only messages on interfaces of interest are logged. To further protect the

system, invalid message logging is rate limited to 1 per second.

Layer 2 Switching Commands 360

ipv6 dhcp snooping trust

Use the ipv6 dhcp snooping trust command to configure an interface as

trusted. Use the no form of the command to return the interface to the

default configuration.

Syntax

ipv6 dhcp snooping trust

no ipv6 dhcp snooping trust

Default Configuration

By default, interfaces are untrusted.

Command Modes

Interface Configuration mode (physical and port-channel)

User Guidelines

Configuring an interface as trusted disables DHCP snooping address

validation checking and exposes the port to IPv6 DHCP DoS attacks.

DHCP snooping must be enabled globally and on the VLAN for which the

port is a member for this command to have an effect. Configuring a port as

trusted indicates that the port is connected to an IPv6 DHCP server or to a

trusted device. Configuring a port as untrusted indicates that the switch

should firewall IPv6 DHCP messages and act as if the port is connected to an

untrusted device.

Use the ipv6 verify source command to disable traffic from untrusted sources

on an interface.

ipv6 dhcp snooping verify mac-address

Use the ipv6 dhcp snooping verify mac-address command to enable the

additional verification of the source MAC address with the client hardware

address in the received DHCP message.

Syntax

ipv6 dhcp snooping verify mac-address

Layer 2 Switching Commands 361

no ipv6 dhcp snooping verify mac-address

Default Configuration

By default, MAC address verification is not enabled.

Command Modes

Global Configuration mode

User Guidelines

DHCP MAC address verification operates on DHCP messages received over

untrusted interfaces. The source MAC address of DHCP packet is different

from the client hardware if:

• A DHCP discovery/request broadcast packet that was forwarded by the

relay agent.

• A DHCP unicast request packet was routed in renew process.

For DHCP servers and relay agents connected to untrusted interfaces, source

MAC verification should be disabled.

DHCP snooping must be enabled on at least one VLAN and globally enabled

to become operational.

Example

console(config)#ipv6 dhcp snooping

console(config)#ipv6 dhcp snooping vlan 5-10,15,30

console(config)#interface te1/0/1

console(config-if-Te1/0/1)#switchport mode access

console(config-if-Te1/0/1)#switchport access vlan 10

console(config-if-Te1/0/1)#no ipv6 dhcp snooping trust

console(config-if-Te1/0/1)#exit

console(config)#ipv6 dhcp snooping verify mac-address

ipv6 verify binding

Use the ipv6 verify binding command to configure a static IP source guard

binding.

Layer 2 Switching Commands 362

Syntax

ipv6 verify binding mac-address vlan vlan-id ip-address interface interface id

no ipv6 verify binding mac-address vlan vlan-id ip-address interface interface

• mac-address —A valid mac address in standard format.

• vlan-id —A configured VLAN id. (Range 1-4093.

• ip-address —A valid IPv6 address.

• interface-id—A valid interface ID in short or long format.

Default Configuration

By default, no static IP Source Guard entries are configured.

Command Modes

Global Configuration mode

User Guidelines

Traffic is filtered based upon the source IPv6 address and VLAN. Use the

switchport port-security command in interface mode to optionally add MAC

address filtering in addition to source IPv6 address filtering. If port security is

enabled, the filtering is based upon IPv6 address, MAC address and VLAN.

ipv6 verify source

Use the ipv6 verify source command to configure an interface to filter (drop)

incoming traffic from sources that are not present in the DHCP binding

database. Use the no form of the command to enable unverified traffic to

flow over the interfaces.

Syntax

ipv6 verify source [port-security]

no ipv6 verify source

•port-security — Enables filtering based upon source IP address, VLAN and

MAC address.

Layer 2 Switching Commands 363

Default Configuration

By default, no sources are blocked.

Command Modes

Interface Configuration mode (physical and port-channel)

User Guidelines

DHCP snooping should be enabled on any interfaces for which ipv6 verify

source is configured. If ipv6 verify source is configured on an interface for

which DHCP snooping is disabled, or for which DHCP snooping is enabled

and the interface is trusted, incoming traffic on the interface is dropped.

Traffic is filtered based on the source IP address and VLAN. When the port-

security keyword is configured, filtering occur based upon source IP address,

VLAN and source MAC address.

IP source guard also interacts with the port security component. Use the port

security command in interface mode to optionally add checking of learned

MAC addresses. When port security is enabled, MAC learning coordinates

with the IP Source Guard component to verify that the MAC address is in the

DHCP binding database. If it is not, port security is notified that the frame is

in violation of the security policy.

show ipv6 dhcp snooping

Use the show ipv6 dhcp snooping command to display the IPv6 DHCP

snooping configuration

Syntax

show ipv6 dhcp snooping

Default Configuration

This command has no default configuration.

Command Modes

User Exec, Privileged Exec (all show modes)

Layer 2 Switching Commands 364

User Guidelines

This command has no user guidelines.

Example

(console)#show ipv6 dhcp snooping

DHCP snooping is Disabled

DHCP snooping source MAC verification is enabled

DHCP snooping is enabled on the following VLANs:

11 - 30, 40

Interface Trusted Log Invalid Pkts

--------- -------- ----------------

Gi1/0/1 Yes No

Gi1/0/2 No Yes

Gi1/0/3 No Yes

Gi1/0/4 No No

Gi1/0/6 No No

show ipv6 dhcp snooping binding

Use the show ipv6 dhcp snooping binding command to display the IPv6

DHCP snooping configuration

Syntax

show ipv6 dhcp snooping binding [{static|dynamic}] [interface interface-id

| port-channel port-channel-number] [vlan vlan-id]

•static—Only show static entries.

•dynamic—Only show dynamic entries.

• interface-id—Limit the display to entries associated with physical

interface-id.

• vlan-id—Limit the display to entries associated with VLAN vlan-id.

• port-channel-number—Limit the display to entries associated with the

identified port channel.

Default Configuration

This command has no default configuration.

Layer 2 Switching Commands 365

Command Modes

User Exec, Privileged Exec (all show modes)

User Guidelines

There are no user guidelines for this command.

Example

(console)#show ipv6 dhcp snooping binding

Total number of bindings: 2

MAC Address IPv6 Address VLAN Interface Lease time(Secs)

------------------ ------------ ---- --------- -------------

00:02:B3:06:60:80 2000::1/64 10 0/1 86400

00:0F:FE:00:13:04 3000::1/64 10 0/1 86400

show ipv6 dhcp snooping database

Use the show ipv6 dhcp snooping database command to display IPv6 DHCP

snooping configuration related to database persistency.

Syntax

show ipv6 dhcp snooping database

Default Configuration

This command has no default configuration.

Command Modes

User Exec, Privileged Exec (all show modes)

User Guidelines

This command has no user guidelines.

Example

(console)#show ipv6 dhcp snooping database

agent url: /10.131.13.79:/sai1.txt

Layer 2 Switching Commands 366

write-delay: 5000

show ipv6 dhcp snooping interfaces

Use the show ipv6 dhcp snooping interfaces command to show the DHCP

Snooping status of IPv6 interfaces.

Syntax

show ipv6 dhcp snooping interfaces [interface id]

• interface id—A valid physical interface.

Default Configuration

There is no default configuration for this command.

Command Modes

User Exec, Privileged Exec (all show modes)

User Guidelines

If no parameter is given, all interfaces are shown.

Example

(console)#show ipv6 dhcp interfaces

Interface Trust State Rate Limit Burst Interval

(pps) (seconds)

---------- ------------- ------------- ---------------

Gi1/0/1 No 15 1

Gi1/0/2 No 15 1

Gi1/0/3 No 15 1

show ipv6 dhcp snooping statistics

Use the show ipv6 dhcp snooping statistics command to display IPv6 dhcp

snooping filtration statistics.

Layer 2 Switching Commands 367

Syntax

show ipv6 dhcp snooping statistics

Default Configuration

This command has no default configuration.

Command Modes

User Exec, Privileged Exec (all show modes)

User Guidelines

The following statistics are displayed.

Example

(console)#show ipv6 dhcp snooping statistics

Interface MAC Verify Client Ifc DHCP Server

Failures Mismatch Msgs Rec'd

----------- ---------- ---------- -----------

Gi1/0/2 0 0 0

Gi1/0/3 0 0 0

Gi1/0/4 0 0 0

Gi1/0/5 0 0 0

Gi1/0/6 0 0 0

Parameter Description

MAC Verify Failures The number of DHCP messages that got filtered

on an untrusted interface because of the source

MAC address and client hardware address

mismatch.

Client Ifc mismatch The number of DHCP release and reply messages

received on different ports than the ones they were

learned on previously.

DHCP Server Msgs It represents the number of DHCP server messages

received on Untrusted ports.

Layer 2 Switching Commands 368

show ipv6 source binding

Use the show ipv6 source binding command to display the IPv6 Source

Guard configurations on all ports, on an individual port, or on a VLAN.

Syntax

show ipv6 source binding [{dhcp-snooping | static}] [interface interface-id]

[vlan vlan-id]

• dhcp-snooping — Displays the DHCP snooping bindings.

• static —Displays the statically configured bindings.

Default Configuration

This command has no default configuration.

Command Modes

User Exec, Privileged Exec (all show modes)

User Guidelines

This command has no user guidelines.

Example

(console)#show ipv6 source binding

MAC Address IP Address Type Vlan Interface

----------------- --------------- ------------- ----- ---------

00:00:00:00:00:08 2000::1 dhcpv6-snooping 2 Gi1/0/1

00:00:00:00:00:09 3000::1 dhcpv6-snooping 3 Gi1/0/1

00:00:00:00:00:0A 4000::1 dhcpv6-snooping 4 Gi1/0/1

show ipv6 verify

Use the show ipv6 verify command to display the IPv6 Source Guard

configuration on all interfaces or the specified interface.

Syntax

show ipv6 verify [interface if-id]

• if-id—A valid interface ID (physical)

Layer 2 Switching Commands 369

Default Configuration

There is no default configuration for this command.

Command Modes

User Exec, Privileged Exec (all show modes)

User Guidelines

The filter type is one of the following values:

• ipv6-mac: User has configure MAC address filtering on this interface

• ipv6: IPv6 address filtering is configured on this interface

• N/A: No filtering is configured on the interface

Example

console(config-if-Gi1/0/5)#show ipv6 verify

Interface Filter Type

----------- -----------

Gi1/0/1 ipv6

Gi1/0/2 ipv6-mac

Gi1/0/3 N/A

Gi1/0/4 N/A

Gi1/0/5 ipv6-mac

Gi1/0/6 N/A

Gi1/0/7 N/A

Gi1/0/8 N/A

Gi1/0/9 N/A

console(config-if-Gi1/0/5)#show ipv6 verify interface gi1/0/5

Interface Filter Type

----------- -----------

Gi1/0/5 ipv6-mac

show ipv6 verify source

Use the show ipv6 verify source command to display the IPv6 Source Guard

configurations on all ports.

Layer 2 Switching Commands 370

Syntax

show ipv6 verify source

Default Configuration

There is no default configuration for this command.

Command Modes

User Exec, Privileged Exec (all show modes)

User Guidelines

If MAC address filtering is not configured on the interface, the MAC Address

field is empty. If port security is disabled on the interface, the MAC Address

field displays permit-all.

The filter type is one of the following:

• ipv6-mac: User has configured MAC address filtering on this interface.

• ipv6: Only IPv6 address filtering is configured on this interface.

Example

show ipv6 verify source

Interface Filter Type IPv6 Address MAC Address Vlan

--------- ----------- --------------- ----------------- -----

Gi1/0/1 ipv6-mac 2000::1/64 00:02:B3:06:60:80 10

Gi1/0/1 ipv6-mac 3000::1/64 00:0F:FE:00:13:04 10

Layer 2 Switching Commands 371

Dynamic ARP Inspection

Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Dynamic ARP Inspection (DAI) is a security feature that rejects invalid and

malicious ARP packets. The feature prevents a class of man-in-the-middle

attacks, where an unfriendly station intercepts traffic for other stations by

poisoning the ARP caches of its neighbors. The attacker sends ARP requests

or responses mapping another station IP address to its own MAC address.

DAI drops ARP packets whose sender MAC address and sender IP address do

not match an entry in the DHCP Snooping bindings database.

Commands in this Section

This section explains the following commands:

arp access-list

Use the arp access-list command to create an ARP ACL. It will place the user

in ARP ACL Configuration mode. Use the “no” form of this command to

delete an ARP ACL.

Syntax

arp access-list acl-name

no arp access-list acl-name

arp access-list ip arp inspection vlan

clear ip arp inspection statistics permit ip host mac host

ip arp inspection filter show arp access-list

ip arp inspection limit show ip arp inspection

ip arp inspection trust 12 Enabled Disabled

ip arp inspection validate

–

Layer 2 Switching Commands 372

• acl-name — A valid ARP ACL name (Range: 1–31 characters).

Default Configuration

There are no ARP ACLs created by default.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console(config)#arp access-list tier1

clear ip arp inspection statistics

Use the clear ip arp inspection statistics command to reset the statistics for

Dynamic Address Resolution Protocol (ARP) inspection on all VLANs.

Syntax

clear ip arp inspection statistics

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

There are no user guidelines for this command.

Example

console#clear ip arp inspection statistics

Layer 2 Switching Commands 373

ip arp inspection filter

Use the ip arp inspection filter command to configure the ARP ACL to be

used for a single VLAN or a range of VLANs to filter invalid ARP packets. If

the static keyword is given, packets that do not match a permit statement are

dropped without consulting the DHCP snooping bindings. Use the “no” form

of this command to unconfigure the ARP ACL.

Syntax

ip arp inspection filter acl-name vlan vlan-list [static]

no ip arp inspection filter acl-name vlan vlan-list [static]

• acl-name —The name of a valid ARP ACL. (Range: 1–31 characters)

• vlan-list —A list of VLAN identifiers. List separate, non-consecutive

VLAN IDs separated by commas (without spaces). Use a hyphen to

designate a range of IDs. (Range: 1–4093)

Default Configuration

No ARP ACL is configured.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console(config)#ip arp inspection filter tier1 vlan 2-10 static

console(config)#ip arp inspection filter tier1 vlan 20-30

ip arp inspection limit

Use the ip arp inspection limit command to configure the rate limit and

burst interval values for an interface.

Configuring none for the limit means the interface is not rate limited for

Dynamic ARP Inspection.

Layer 2 Switching Commands 374

Syntax

ip arp inspection limit {none | rate pps [burst interval seconds]}

no ip arp inspection limit

•none — To set no rate limit.

• pps — The number of packets per second (Range: 0–300).

• seconds — The number of seconds (Range: 1–15).

Default Configuration

The default rate limit is 15 packets per second.

The default burst interval is 1 second.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

If Dynamic ARP Inspection packets are received on a port at a rate that

exceeds the threshold for a specified time, that port will be diagnostically

disabled. The threshold is configurable up to 300 pps, and the burst is

configurable up to 15s long. The default is 15 pps and 1s burst.

Use the no shut command to bring the port back in to service.

Example

console(config-if-Gi1/0/1)#ip arp inspection limit none

console(config-if-Gi1/0/1)#ip arp inspection limit rate 100 burst interval 2

ip arp inspection trust

The ip arp inspection trust command configures an interface as trusted for

Dynamic ARP Inspection. Use the no form of this command to configure an

interface as untrusted.

Syntax

ip arp inspection trust

no ip arp inspection trust

Layer 2 Switching Commands 375

Default Configuration

Interfaces are configured as untrusted by default.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

There are no user guidelines for this command.

Example

console(config-if-Gi1/0/3)#ip arp inspection trust

ip arp inspection validate

Use the ip arp inspection validate command to enable additional validation

checks like source MAC address validation, destination MAC address

validation or IP address validation on the received ARP packets. Each

command overrides the configuration of the previous command. For

example, if a command enables source MAC address and destination MAC

address validations and a second command enables IP address validation only,

the source MAC address and destination MAC address validations are

disabled as a result of the second command. Use the “no” form of this

command to disable additional validation checks.

Syntax

ip arp inspection validate {[src-mac] [dst-mac] [ip]}

no ip arp inspection validate {[src-mac] [dst-mac] [ip]}

•src-mac

—

For validating the source MAC address of an ARP packet.

•dst-mac

—

For validating the destination MAC address of an ARP packet.

•ip

—

For validating the IP address of an ARP packet.

Default Configuration

There is no additional validation enabled by default.

Layer 2 Switching Commands 376

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command

Example

console(config)#ip arp inspection validate src-mac dst-mac ip

console(config)#ip arp inspection validate src-mac ip

console(config)#ip arp inspection validate dst-mac ip

console(config)#ip arp inspection validate ip

ip arp inspection vlan

Use the ip arp inspection vlan command to enable Dynamic ARP Inspection

on a single VLAN or a range of VLANs. Use the no form of this command to

disable Dynamic ARP Inspection on a single VLAN or a range of VLANs.

Syntax

ip arp inspection vlan vlan-list [logging]

no ip arp inspection vlan vlan-list [logging]

• vlan-

list

—A list of VLAN identifiers. List separate, non-consecutive

VLAN IDs separated by commas (without spaces). Use a hyphen to

designate a range of IDs. (Range: 1–4093)

•logging — Use this parameter to enable logging of invalid packets.

Default Configuration

Dynamic ARP Inspection is disabled by default.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Layer 2 Switching Commands 377

Example

console(config)#ip arp inspection vlan 200-300

console(config)#ip arp inspection vlan 200-300 logging

permit ip host mac host

Use the permit ip host mac host command to configure a rule for a valid IP

address and MAC address combination used in ARP packet validation. Use

the “no” form of this command to delete an ARP ACL rule.

Syntax

permit ip host sender-ip mac host sender-mac

no permit ip host sender-ip mac host sender-mac

• sender-ip — Valid IP address used by a host.

• sender-mac —Valid MAC address in combination with the above sender-ip

used by a host.

Default Configuration

There are no ARP ACL rules created by default.

Command Mode

ARP Access-list Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console(Config-arp-access-list)#permit ip host 1.1.1.1 mac host

00:01:02:03:04:05

show arp access-list

Use the show arp access-list command to display the configured ARP ACLs

with the rules. Giving an ARP ACL name as the argument would display only

the rules in that ARP ACL.

Layer 2 Switching Commands 378

Syntax

show arp access-list [acl-name]

• acl-name — A valid ARP ACL name (Range: 1–31 characters).

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show arp access-list

ARP access list H2

permit ip host 1.1.1.1 mac host 00:01:02:03:04:05

permit ip host 1.1.1.2 mac host 00:03:04:05:06:07

ARP access list H3

ARP access list H4

permit ip host 2.1.1.2 mac host 00:03:04:05:06:08

show ip arp inspection

Use the show ip arp inspection command to display the Dynamic ARP

Inspection and status.

Syntax

show ip arp inspection [interfaces [interface-id] | statistics [vlan vlan-list] |

vlan vlan-list]

•

interfaces [interface-id]

—

Display the Dynamic ARP Inspection

configuration on all the DAI enabled interfaces. Giving an interface

argument, it displays the values for that interface only.

Layer 2 Switching Commands 379

•

statistics [vlan vlan-list]

—

Display the statistics of the ARP packets

processed by Dynamic ARP Inspection. Given vlan-list argument, it

displays the statistics on all DAI-enabled VLANs in that range. In the

case of no argument, it lists the summary of the forwarded and dropped

ARP packets.

•

vlan vlan-list

—

Display the Dynamic ARP Inspection configuration on

all the VLANs in the given VLAN list. It also displays the global

configuration values for source MAC validation, destination MAC

validation and invalid IP validation.

List separate, non-consecutive VLAN

IDs separated by commas (without spaces). Use a hyphen to designate a

range of IDs. (Range: 1–4093)

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The following information is displayed for each VLAN when a VLAN range is

supplied:

Field Description

VLAN The VLAN-ID for each displayed row.

DHCP Drops The number of packets dropped due to DHCP Snooping binding

database match failure.

ACL Drops The number of packets dropped due to ARP ACL rule match failure.

DHCP Permits The number of packets permitted due to DHCP snooping binding

database match.

ACL Permits The number of packets permitted due to ARP ACL rule match.

Bad Src MAC The number of packets dropped due to Source MAC validation

failure.

Bad Dest

MAC

The number of packets dropped due to Destination MAC validation

failure.

Layer 2 Switching Commands 380

Example

Following is an example of the show ip arp inspection command.

console#show ip arp inspection

Source MAC Validation................. Disabled

Destination MAC Validation............ Disabled

IP Address Validation................. Disabled

VLAN Configuration Log Invalid ACL Name Static flag

---- ------------- ----------- -------------------------------- ----------

1 Disabled Enabled

Following is an example of the show ip arp inspection interfaces command.

console#show ip arp inspection interfaces

Interface Trust State Rate Limit Burst Interval

(pps) (seconds)

--------------- ----------- ---------- ---------------

Gi1/0/1 Untrusted 15 1

Gi1/0/2 Untrusted 10 10

Following is an example of the show ip arp inspection statistics command.

console#show ip arp inspection statistics

VLAN Forwarded Dropped

---- --------- -------

10 90 14

20 10 3

console#show ip arp inspection statistics vlan 10,20

VLAN DHCP ACL DHCP ACL Bad Src Bad Dest Invalid

Drops Drops Permits Permits MAC MAC IP

---- ---------- ---------- ---------- ---------- ---------- ---------- ------

10 11 1 65 25 1 1 0

20 1 0 8 2 0 1 1

Invalid IP The number of packets dropped due to invalid IP checks.

Layer 2 Switching Commands 381

The following global parameters are displayed when no parameters are given:

The following fields are displayed for each VLAN:

Example

console#show ip arp inspection vlan 10-12

Source Mac Validation : Disabled

Destination Mac Validation : Disabled

IP Address Validation : Disabled

Vlan Configuration Log Invalid ACL Name Static flag

---- ------------- ----------- --------- ----------

10 Enabled Enabled H2 Enabled

11 Disabled Enabled

12 Enabled Disabled

Parameter Description

Source Mac Validation If Source Mac validation of ARP frame is enabled.

Destination Mac

Validation

If Destination Mac validation of ARP Response frame is

enabled.

IP Address Validation If IP address validation of ARP frame is enabled.

Field Description

VLAN The VLAN-ID for each displayed row.

Configuration Whether DAI is enabled on the VLAN.

Log Invalid Whether logging of invalid ARP packets is enabled on the

VLAN.

ACL Name ARP ACL Name if configured on the VLAN.

Static flag If the ARP ACL is configured static on the VLAN.

Layer 2 Switching Commands 382

Ethernet Configuration Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Dell EMC Networking switches support a variety of configuration options to

optimize network operations. Features such as flow-control and jumbo frames

are supported along with a variety of commands to display traffic statistics as

well as limit the effects of network loops or other network issues.

Jumbo frame technology is employed in certain situations to reduce the task

load on a server CPU and to transmit large amounts of data efficiently. Jumbo

frames technology predominantly appears where certain applications would

benefit from using a larger frame size, e.g. Network File System (NFS). The

larger frame size eliminates some of the need for fragmentation, leading to

greater throughput. The increase in throughput is particularly valuable on

data center servers where the larger frame size increases efficiency of the

system and allows processing of more requests. The Dell EMC Networking

jumbo frames feature extends the standard Ethernet MTU (Max Frame Size)

from 1518 (1522 with VLAN header) bytes to 9216 bytes. However, any device

connecting to the same broadcast domain should support the same or larger

MTU.

Flow control is a mechanism or protocol used to temporarily suspend

transmission of data to a device to avoid overloading the device receive path.

Dell EMC Networking switching implements the flow control mechanism

defined in IEEE 802.3 Annexes 31A and 31B (formerly IEEE 802.3x). Dell

EMC Networking switches implement receive flow control only. They never

issue a flow control PAUSE frame when congested, but do respect flow

control PAUSE frames received from other switches. Disabling flow control

causes the switch to ignore received PAUSE frames. Flow control is enabled

by default for all ports.

Storm control allows for rate limiting of specific types of packets through the

forwarding plane. The administrator can configure the absolute rate in

packets-per-second for the Storm control threshold. Each classified packet

type (broadcast, multicast, or unicast) can be enabled/disabled per port, and

the threshold level at which Storm-Control is active is also configurable per-

port and per-type (as a percentage of interface speed).

Layer 2 Switching Commands 383

On a storm control enabled interface, if the ingress rate of that type of packet

(L2 broadcast, multicast, or unicast) is greater than the configured threshold

level (as a percentage of port speed or as an absolute packets-per-second rate),

the switch forwarding-plane discards the excess traffic.

The

speed

command controls interface link speeds and auto-negotiation. If

speed is set to something other than auto, auto-negotiation is disabled on the

interface. Auto-negotiation will link at the highest possible speed supported

on the interface at full duplex.

Commands in this Section

This section explains the following commands:

clear counters

Use the clear counters command to clear statistics on an interface.

Syntax

clear counters [vrf vrf-name | stack-ports | switchport | interface-id]

• vrf-name—The name of the VRF instance on which the command

operates.

•stack-ports—Clears stack-port statistics.

•switchport—Clear all the interface counters

clear counters show interfaces

configuration

show storm-control

description show interfaces counters show storm-control action

flowcontrol show interfaces debounce shutdown

interface show interfaces description speed

interface range show interfaces detail switchport protected

link debounce time show interfaces status switchport protected name

rate-limit cpu show interfaces transceiver show switchport protected

show interfaces show statistics show system mtu

show interfaces advertise show statistics switchport system jumbo mtu

Layer 2 Switching Commands 384

• interface-id—An Ethernet or port-channel identifier. If specified, counters

are cleared for the individual interface.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

Use of the clear counters command with no parameters indicates that both

switch and all interface statistics are to be cleared. This command clears the

individual component counters. If a port-channel is specified, the command

clears the port channel counters, including the flap counters.

The VRF identified in the parameter must have been previously created or an

error is returned.

Example

In the following example, the counters for port Gi1/0/1 are cleared.

console#clear counters gigabitethernet 1/0/1

description

Use the description command in Interface Configuration mode to add a

description to an interface. To remove the description use the no form of this

command.

Syntax

description string

no description

• string — Comment or a description of the port attached to this interface.

(Range: 1 to 64 characters)

Default Configuration

By default, the interface does not have a description.

Layer 2 Switching Commands 385

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

This command has no user guidelines.

Example

The following example adds a description to the Ethernet port 5.

console(config)#interface gigabitethernet 1/0/5

console(config-if-Gi1/0/5)# description RD_SW#3

duplex

Use the duplex command in Interface Configuration mode to configure the

duplex operation of a given Ethernet interface. To restore the default, use the

no form of this command.

Syntax

duplex {auto | half | full}

no duplex

•auto—Enable auto-negotiation for the port.

•half—Force half-duplex operation and disable auto-negotiation.

•full—Force full-duplex operation and disable auto-negotiation.

Default Configuration

Auto-negotiation is enabled by default on copper ports.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

When both speed and duplex are configured to auto, auto negotiation is

enabled for the port. To disable auto-negotiation on a port, it is necessary to

enter either the speed or duplex commands without using the auto

Layer 2 Switching Commands 386

parameter. 10G/40G fiber ports do not support auto-negotiation and

therefore require the operator to enter the duplex full command and the

speed command with the desired operating bandwidth. Auto-negotiation is

required on 1G/10G/40G copper ports and 1G fiber ports.

The duplex command is only available on the Dell EMC Networking N1500

Series switches. Other switch models support full duplex operation only.

Example

The following example configures the duplex operation of TenGigabit

Ethernet port Te 1/0/5 to force full duplex operation, disable auto-

negotiation, and set the speed to 1000M.

console(config)# interface te1/0/5

console(config-if-Te1/0/5)# duplex full

console(config-if-Te1/0/5)# speed 1000

flowcontrol

Use the flowcontrol command in Global Configuration mode to configure

the flow control. To disable flow control, use the no form of this command.

Syntax

flowcontrol receive {on | off}

no flowcontrol receive

Default Configuration

Flow Control is enabled by default.

Command Mode

Global Configuration and Interface Configuration modes

User Guidelines

Dell EMC Networking switches implement receive flow control only. They

never issue a flow control PAUSE frame when congested, but do respect

received flow control PAUSE frames received from other switches. Disabling

flow control causes the switch to ignore received PAUSE frames.

Interface specific configuration overrides any global configuration.

Layer 2 Switching Commands 387

Changing the flow control setting on a copper port restarts auto-negotiation

and causes a brief link-flap while auto-negotiation occurs. Changing the flow

control setting on a fiber port may cause a brief link flap as the PHY is reset.

Enabling flow control on some ports and not others can lead to excessive

packet loss in situations where some ports on the switch have been paused

and the internal packet buffers are consumed. This situation may cause traffic

loss on other ports that are not congested or flow controlled.

Example

console(config)#flowcontrol receive off

console(config)#flowcontrol receive on

interface

Use this command to configure parameters for the Gigabit Ethernet and ten-

Gigabit Ethernet ports, and for port-channels. While in Global Configuration

mode, enter the interface command (with a specific interface). To exit to

Global Configuration mode, enter exit. To return to Privileged Exec mode,

press Ctrl-Z or enter end.

Additional forms of the interface command enable configuring VLANs, tunnels, the

loopback interface, the out-of-band interface, and ranges of interfaces. See

interface vlan

interface tunnel

arp

, and

interface range

Syntax

interface {gigabitethernet unit/slot/port |

port-channel port-channel-number

| tengigabitethernet unit/slot/port | fortygigabitethernet unit/slot/port}

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration, Interface Configuration

Layer 2 Switching Commands 388

User Guidelines

Dell EMC Networking switches implement receive flow control only. They

never issue a flow control PAUSE frame when congested, but will respect

received flow control PAUSE frames received from other switches. Disabling

flow control causes the switch to ignore received PAUSE frames.

Interface specific configuration overrides any global configuration.

Changing the flow control setting on a copper port will restart auto-

negotiation and cause a brief link-flap while auto-negotiation occurs.

Changing the flow control setting on a fiber port may cause a brief link flap as

the PHY is reset.

Enabling flow control on some ports and not others can lead to excessive

packet loss in situations where some ports on the switch have been paused

and the internal packet buffers are consumed. This situation may cause traffic

loss on other ports that are not congested or flow controlled. See

http://www.ieee802.org/3/cm_study/public/september04/thaler_3_0904.pdf

for more information.

Example

The following example enables Gigabit port 2 on stack member 1 for

configuration.

console(config)# interface gigabitethernet 1/0/2

interface range

Use the interface range command in Global Configuration mode to execute a

command on multiple ports at the same time.

NOTE: An additional form of this command enables configuring a range of VLANs.

See

interface range vlan

Syntax

interface range {interface-range-specifier | interface-type all}

• port-range—A list of valid ports to configure. Separate non-consecutive

ports with a comma and no spaces; use a hyphen to designate a range of

ports. For more detailed information, see Command line parameters are

entered by the user to choose an individual value or range of values for the

specific command. Command line parameters are not syntax or range

Layer 2 Switching Commands 389

checked until the carriage return is entered. In some cases, the user may

need to enter special characters, most often in a string parameter such as a

password or a label. Special characters are one of the following characters

(`! $ % ^ & * ( ) _ - + = { [ } ] : ; @ ' " ~ # | \ < , > . / ) or a blank. In

these cases, it may be necessary to enclose the entire string in double or

single quotes for the command line parser to properly interpret the

parameter.. The command line buffer parses up to the maximum number

of command line characters possible in the port-range parameter.

• port-type—Shows all interfaces of the specified type.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration, Interface Range and Interface modes

User Guidelines

Commands under the interface range context are executed independently on

each active interface in the range. If the command returns an error on one of

the active interfaces, it does not stop executing commands on other active

interfaces.

If a range of interfaces is specified using the dash notation, the beginning

range number (to the left of the hyphen) must be less than or equal to the

last number (to the right of the hyphen).

Example

The following example shows how gigabitethernet ports 5/0/18 to 5/0/20 and

3/0/1 to 3/0/24 are ranged to receive the same command.

console(config)# interface range gigabitethernet 5/0/18-20,Gi3/0/1-24

console(config-if-range)#

The following example shows how all gigabitethernet ports can be configured

at once.

console(config)# interface range gigabitethernet all

console(config-if-range)#

The following examples demonstrate various valid interface ranges:

console(config)#interface range gigabitEthernet 1/0/1-20

Layer 2 Switching Commands 390

console(config)#interface range gi1/0/20-48

console(config)#interface range gi1/0/1,gi1/0/48

console(config)#interface range gi2/0/1-10,gi1/0/30

console(config)#interface range gi1/0/1-10,gi1/0/30-48

console(config)#interface range gi1/0/1,te1/1/1

console(config)#interface range gigabitEthernet 1/0/10,te1/1/2

link debounce time

Use the link debounce time command to configure the debounce timer for

one or multiple interfaces. Use the no form of the command to set the link

debounce time to the default (disabled).

Syntax

link debounce time [ timeout ]

no link debounce time

• timeout—An integer value in the range of 100–5000 milliseconds. The

timeout value must be a multiple of 100.

Default Configuration

Physical interfaces do not have debounce enabled by default.

Command Mode

Interface (Physical) Configuration mode, Interface Range mode.

User Guidelines

The link bounce time configures a link bounce hysteresis on link loss of link.

Loss of link signal starts a link bounce timer. If the link is restored prior to

expiry of the timer, operation continues and the system is not notified that

that link connectivity has been lost. Hysteresis can be used to mitigate link

flaps caused by bad cabling or partially inserted optics or cables.

The debounce timer resolution is approximately 10 ms. Setting a value will

start the timer when loss of link is detected.

Ports operating at lower speeds may benefit from debounce values larger than

the default. Ports operating over fiber generally do not require larger

debounce times.

Layer 2 Switching Commands 391

Use the show interfaces debounce command to display the link debounce

time or to display the link flap count (the number of notifications sent to the

system that link signal was lost). The link flap count is also displayed by the

show interfaces command (Link Debounce Flaps).

The link debounce counter is cleared by the clear counters command and the

clear counters interface-id command.

In general, a debounce time above 300 ms is recommended for copper

interfaces with link flaps.

Command History

Introduced in version 6.2.0.1 firmware.

Example

The following example disables the link debounce timer for interface gi1/0/1.

switch# conf t

console(config)#interface gi1/0/1

console(config-if-Gi1/0/1)#no link debounce time

The following example sets the link debounce timer for interface gi1/0/1 to

500 ms.

switch# conf t

console(config)#interface gi1/0/1

console(config-if-Gi1/0/1)#link debounce time 500

rate-limit cpu

Use the rate-limit cpu command to reduce the amount of unknown

unicast/multicast packets forwarded to the CPU. Use the no form of the

command to set the rate limit to the default value.

Syntax

rate-limit cpu direction input pps pps_value

no rate-limit cpu direction input pps

• pps_value—The packets per second. The range is 100-1024 packets per

second (100-3000 packets per second for N4000 series switches).

Layer 2 Switching Commands 392

Default Configuration

The default ingress rate limit is 1024 packets per second (3000 for

N4000

series switches

Command Modes

Global Configuration mode

User Guidelines

Unknown unicast and multicast packets are copied to the CPU on the lowest

priority QoS queue. Unknown packets are those that do not have hardware

forwarding entries. Known unicast/multicast packets are hardware forwarded

and are not queued to the CPU. Control plane packets (e.g. spanning tree

BPDUs) are copied or forwarded to the CPU on higher priority queues. The

rate limiting for unknown packets occurs on the internal CPU port and does

not affect hardware based traffic routing/forwarding in any way. Typically, the

switch examines the received packets in software to check if there is a

forwarding entry, create a forwarding entry (e.g., add a L2 MAC address or

ARP response), and then either discard the packet or software forward the

packet (only occurs during the brief transitional period when the system is

actively adding a hardware forwarding entry but the hardware is not yet

updated). Processing delays for higher priority packets may occur when the

internal CPU queue is continually kept busy handling low priority packets.

This command does not affect the rate limits for control plane packets. It is

almost never necessary to use this command to change from the default

value. The use of this command should be restricted to situations in which

moderate to high rates of unknown unicast/multicast are continually sent to

the switch CPU as evidenced by the show process cpu command and where

the ipMapForwardingTask is showing high CPU usage. This occurs most

frequently in networks where a high number of ARPs are continually received

on untrusted ports, high numbers of L2 stations are timing out and

reappearing or multicast flooding is occurring in the network. If problems

with L2, L3 or multicast learning occur after changing this value, set the rate

limit back to the default value and take other steps to correct or mitigate the

underlying network issue directly.

Use the show system internal pktmgr command to show the configured

value.

Layer 2 Switching Commands 393

Example

The following example shows output with higher than normal CPU usage due

to packets copied to the software forwarding task.

console#show process cpu

Memory Utilization Report

status bytes

------ ----------

free 1053933568

alloc 673873920

CPU Utilization:

PID Name 5 Secs 60 Secs 300 Secs

---------- ------------------- -------- -------- --------

1129 osapiTimer 0.00% 0.00% 0.01%

1133 _interrupt_thread 0.09% 0.01% 0.00%

1137 bcmCNTR.0 0.24% 0.31% 0.31%

1142 bcmRX 23.00% 27.01% 18.01%

1147 ipMapForwardingTas 32.97% 37.11% 29.92%

1155 bcmLINK.0 0.34% 0.36% 0.36%

1156 cpuUtilMonitorTask 0.09% 0.05% 0.04%

1170 nim_t 0.09% 0.08% 0.07%

1208 dot1s_timer_task 0.00% 0.00% 0.01%

1222 snoopTask 0.00% 0.00% 0.01%

1291 RMONTask 0.00% 0.02% 0.03%

1293 boxs Req 0.00% 0.01% 0.01%

------------------------------ -------- -------- --------

Total CPU Utilization 27.31% 28.97% 31.01%

show interfaces

Use the show interfaces command to list the traffic statistics for one or

multiple interfaces. If no parameter is given, all interfaces are shown.

Syntax

show interfaces [ interface-id ]

• interface-id—A physical interface id (i.e., a 1G, 10G, or 40G interface) in

standard interface format.

Layer 2 Switching Commands 394

Default Configuration

There is no default configuration.

Command Mode

All modes, including Config mode and all config submodes.

User Guidelines

The show interface command shows the actual operational status of the

interface, which is not necessarily the same as the configuration.

Input/output rate statistics are collected every 10 seconds.

The link status field shows the hardware status followed by the keepalive

status. The hardware status show “Up” when link is detected, “Down” when

no link is detected, “Err-disable” when the port is error-disabled, and “Shut”

when the port is administratively shut down.

The keepalive status shows “None” when keepalives are disabled or the port is

down, “Up” when keepalives are enabled and no loop is detected and “Down”

when keepalives are enabled and a loop is detected. Some example values are:

Link Status : ................................. Up/Up

Link detected, keepalives enabled, no loop detected

Link Status : ................................. Shut/None

Port is administratively disabled

Link Status : ................................. Down/None

No link detected

Link Status : ................................. Err-disable/Down

Interface is error disabled due to loop detection

Link Status : ................................. Err-disable/None

The interface is error disabled due to a cause other than loop detection/

The err-disable cause field can take any of the following values:

• None – interface is not error disabled

• ARP Inspection – ARP inspection detected invalid ARP

• BPDU Guard – BPDU detected on access port

• Broadcast Storm – broadcast storm detected

• BPDU Storm – BPDU storm detected

Layer 2 Switching Commands 395

• DHCP Rate Limit – excessive DHCP packets detected

• Loop Protection – A loop was detected by the CTP protocol

• Multicast Storm – multicast storm detected

• Port security – port security violation detected

• SFP Mismatch – unsupported transceiver detected

• SFP Plus Mismatch –SFP+ transceiver detected in SFP port

• UDLD – UDLD disabled interface

• Unicast Storm – unicast storm detected

Command History

Introduced in version 6.2.0.1 firmware.

Updated in version 6.3.0.1 firmware.

Example

The following example shows the output for a 1G interface:

console#show interfaces gi1/0/1

Interface Name : .............................. Gi1/0/1

SOC Hardware Info :............................ BCM56342_A0

Link Status : ................................. Up/Up

Keepalive Enabled.............................. TRUE

Err-disable Cause : ........................... None

VLAN Membership Mode: ......................... Trunk Mode

VLAN Membership: .............................. (1),2-3,101-113,813,3232

MTU Size : .................................... 1518

Port Mode [Duplex] : .......................... Full

Port Speed : .................................. 1000

Link Debounce Flaps : ......................... 0

Auto-Negotation Status : ...................... Auto

Burned MAC Address : .......................... 001E.C9DE.B110

L3 MAC Address................................. 001E.C9DE.B112

Sample load interval : ........................ 300

Received Input Rate Bits/Sec : ................ 784

Received Input Rate Packets/Sec : ............. 1

Transmitted Input Rate Bits/Sec : ............. 1344

Transmitted Input Rate Packets/Sec : .......... 1

Total Packets Received Without Errors.......... 102792

Unicast Packets Received....................... 0

Multicast Packets Received..................... 102792

Layer 2 Switching Commands 396

Broadcast Packets Received..................... 0

Total Packets Received with MAC Errors......... 0

Jabbers Received............................... 0

Fragments/Undersize Received................... 0

Alignment Errors............................... 0

FCS Errors..................................... 0

Overruns....................................... 0

Total Received Packets Not Forwarded........... 7

Total Packets Transmitted Successfully......... 147070

Unicast Packets Transmitted.................... 0

Multicast Packets Transmitted.................. 147070

Broadcast Packets Transmitted.................. 0

Transmit Packets Discarded..................... 0

Total Transmit Errors.......................... 0

Total Transmit Packets Discarded............... 0

Single Collision Frames........................ 0

Multiple Collision Frames...................... 0

Excessive Collision Frames..................... 0

console#show interfaces po1

Channel Ports Ch-Type Hash Type Min-links Local Prf

------- ----------------------------- -------- --------- --------- --------

Po1 Active: Gi1/0/1 Dynamic 7 1 Disabled

Hash Algorithm Type

1 - Source MAC, VLAN, EtherType, source module and port Id

2 - Destination MAC, VLAN, EtherType, source module and port Id

3 - Source IP and source TCP/UDP port

4 - Destination IP and destination TCP/UDP port

5 - Source/Destination MAC, VLAN, EtherType, source MODID/port

6 - Source/Destination IP and source/destination TCP/UDP port

7 - Enhanced hashing mode

show interfaces advertise

Use the show interfaces advertise command to display information about

auto-negotiation advertisement. The display includes the local configuration

and link partner advertisement, in addition to the local advertisement.

Syntax

show interfaces advertise [{gigabitethernet unit/slot/port |

tengigabitethernet unit/slot/port | fortygigabitethernet unit/slot/port}]

Layer 2 Switching Commands 397

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The priority resolution field indicates the auto-negotiated link speed and

duplex. The clock field indicates whether the local interface has auto-

negotiated to clock master or clock slave. When the link is down, the field will

show No link.

When the link is down, the Oper Peer Advertisement and Priority

Resolution fields will show dashes.

Examples

The following examples display information about auto negotiation

advertisement.

Example #1

console#show interfaces advertise

Port Type Neg Operational Link Advertisement

--------- ------------------------------ -------- --------------------------

----

Gi1/0/1 Gigabit - Level Enabled 1000f, 100f, 10f

Gi1/0/2 Gigabit - Level Enabled 1000f, 100f, 10f

Gi1/0/3 Gigabit - Level Enabled 1000f, 100f, 10f

Gi1/0/4 Gigabit - Level Enabled 1000f, 100f, 10f

Gi1/0/5 Gigabit - Level Enabled 1000f, 100f, 10f

Gi1/0/6 Gigabit - Level Enabled 1000f, 100f, 10f

Example #2

console#show interfaces advertise gi1/0/1

Port: Gi1/0/1

Type: Gigabit - Level

Link State: Down

Auto Negotiation: Enabled

802.3az EEE: Disabled

Layer 2 Switching Commands 398

Clock: Master

10000f 1000f 1000h 100f 100h 10f 10h

------ ----- ----- ----- ----- ----- ----

Admin Local link Advertisement no yes no yes no yes no

Oper Local link Advertisement no yes no yes no yes no

Oper Peer Advertisement no yes no yes no yes no

Priority Resolution - - - yes - - -

show interfaces configuration

Use the show interfaces configuration command in User Exec mode to

display the configuration for all configured interfaces.

Syntax

show interfaces configuration [{gigabitethernet unit/slot/port|

port-channel

port-channel-number

| tengigabitethernet unit/slot/port |

fortygigabitethernet unit/slot/port}]

Default Configuration

This command has no default configuration.

Command Mode

User Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The displayed port configuration information includes the following:

Field Description

Port The port number.

Description The port designated IEEE shorthand identifier. For example

1000Base-T refers to 1000 Mbps baseband signaling including both

Tx and Rx transmissions.

Duplex Displays the port Duplex status.

Speed Refers to the port speed.

Layer 2 Switching Commands 399

Example

The following example displays the configuration for all configured

interfaces:

console#show interfaces configuration gigabitethernet 1/0/1

Port Description Duplex Speed Neg MTU Admin

State

--------- ------------------------------ ------ ------- ---- ----- -----

Gi1/0/1 Full 1000 Auto 1518 Up

show interfaces counters

Use the show interfaces counters command in User Exec mode to display

traffic seen by the interface.

Syntax

show interfaces counters [errors] [gigabitethernet unit/slot/port |

port-

channel port-channel-number

| tengigabitethernet unit/slot/port |

fortygigabitethernet unit/slot/port]

•errors—Show the error counts (frame discards and reasons) in the in and

out direction.

•gigabitethernet—Shows the traffic for the specified Gigabit Ethernet port.

•port-channel—Shows the traffic for the specified port channel port.

•tengigabitethernet—Shows the traffic for the specified 10-Gigabit

Ethernet port.

•fortygigabitethernet—Shows the traffic for the specified 40-Gigabit

Ethernet port.

Default Configuration

This command has no default configuration.

Neg Describes the Auto-negotiation status.

MTU The Maximum Transmission Unit.

Admin State Displays whether the port is enabled or disabled.

Field Description

Layer 2 Switching Commands 400

Command Mode

User Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The following table describes the fields shown in the display:

Field Description

InOctets Counted received octets.

InUcastPkts Counted received Unicast packets.

InMcastPkts Counted received Multicast packets.

InBcastPkts Counted received Broadcast packets.

OutOctets Counted transmitted octets.

OutUcastPkts Counted transmitted Unicast packets.

OutMcastPkts Counted transmitted Multicast packets.

OutBcastPkts Counted transmitted Broadcast packets.

Alignment Errors A count of frames received that are not an integral number

of octets in length and do not pass the FCS check.

FCS Errors Counted frames received that are an integral number of

octets in length but do not pass the FCS check.

Single Collision Frames Counted frames that are involved in a single collision, and

are subsequently transmitted successfully.

Multiple Collision

Frames

A count of frames that are involved in a multiple collision,

and are subsequently transmitted successfully

Late Collisions Counted times that a collision is detected later than one

slot time into the transmission of a packet.

Excessive Collisions Counted frames for which transmission fails due to

excessive collisions.

Received packets

dropped > MTU

Count of received frames dropped due to frame length

greater than the configured MTU.

Transmitted oversized

packets

Count of frames transmission > 1518 octets.

Layer 2 Switching Commands 401

Example

The following example displays traffic seen by the physical interface:

console>show interfaces counters

Port InTotalPkts InUcastPkts InMcastPkts InBcastPkts

--------- ---------------- ---------------- ---------------- ---------------

Gi1/0/1 0 0 0 0

Gi1/0/2 0 0 0 0

Gi1/0/3 0 0 0 0

Gi1/0/4 0 0 0 0

Gi1/0/5 0 0 0 0

Gi1/0/6 0 0 0 0

Gi1/0/7 0 0 0 0

Gi1/0/8 0 0 0 0

Gi1/0/9 0 0 0 0

Gi1/0/10 0 0 0 0

Gi1/0/11 0 0 0 0

Gi1/0/12 0 0 0 0

Gi1/0/13 11447 6867 4580 0

Gi1/0/14 0 0 0 0

Gi1/0/15 0 0 0 0

Gi1/0/16 51119 12196 38917 6

Gi1/0/17 0 0 0 0

Gi1/0/18 0 0 0 0

Internal MAC Rx Errors A count of frames for which reception fails due to an

internal MAC sublayer receive error.

Received Pause Frames A count of MAC Control frames received with an opcode

indicating the PAUSE operation.

Transmitted Pause

Frames

Counted MAC Control frames transmitted on this

interface with an opcode indicating the PAUSE operation.

Received PFC Frames A count of the received Priority Flow Control (PFC)

frames.

Transmitted PFC

Frames

A count of the transmitted PFC frames.

Receive Packets

Discarded

Count of frames discarded on receipt due to any reason.

Transmit Packets

Discarded

Count of packets queued for transmission and discarded for

any reason.

Field Description

Layer 2 Switching Commands 402

Gi1/0/19 0 0 0 0

Gi1/0/20 0 0 0 0

Port OutTotalPkts OutUcastPkts OutMcastPkts OutBcastPkts

--------- ---------------- ---------------- ---------------- ---------------

Gi1/0/1 0 0 0 0

Gi1/0/2 0 0 0 0

Gi1/0/3 0 0 0 0

Gi1/0/4 0 0 0 0

Gi1/0/5 0 0 0 0

Gi1/0/6 0 0 0 0

Gi1/0/7 0 0 0 0

Gi1/0/8 0 0 0 0

Gi1/0/9 0 0 0 0

Gi1/0/10 0 0 0 0

Gi1/0/11 0 0 0 0

Gi1/0/12 0 0 0 0

The following example displays counters for Ethernet port Te1/0/1.

console(config-if-Te1/0/1)#show interfaces counters tengigabitethernet

1/0/13

Port InTotalPkts InUcastPkts InMcastPkts InBcastPkts

--------- ---------------- ---------------- ---------------- ---------------

Te1/0/13 21614369 21614360 9 0

Port OutTotalPkts OutUcastPkts OutMcastPkts OutBcastPkts

--------- ---------------- ---------------- ---------------- ---------------

Te1/0/13 40620964 40620547 19 398

FCS Errors: ................................... 0

Single Collision Frames: ...................... 0

Late Collisions: .............................. 0

Excessive Collisions: ......................... 0

Multiple Collisions: .......................... 0

Received packets dropped > MTU: ............... 0

Transmitted oversized packets: ................ 40618318

Internal MAC Rx Errors: ....................... 0

Received Pause Frames: ........................ 0

Transmitted Pause Frames: ..................... 0

Receive Packets Discarded: .................... 0

Transmit Packets Discarded: ................... 0

Received PFC Frames: .......................... 0

Transmitted PFC Frames: ....................... 0

Layer 2 Switching Commands 403

show interfaces debounce

Use the show interfaces debounce command to list the debounce

information for one or multiple interfaces. If no parameter is given, all

physical interfaces are shown.

Syntax

show interfaces debounce [ interface-id ]

• interface-id—A physical interface identifier (i.e., a 1G, 10G, or 40G

Ethernet interface) in standard interface format.

Default Configuration

Physical interfaces have a 100 ms debounce time enabled.

Command Mode

Exec mode, Privileged Exec, Global Configuration and all show modes.

User Guidelines

Use the link debounce time command to configure the debounce time for an

interface.

Command History

Introduced in version 6.2.0.1 firmware.

Example

The following example shows the output for representative interfaces.

console#show interfaces debounce

Interface Debounce Time (ms) Flaps

--------- ------------------ -------

Gi1/0/1 500 0

show interfaces description

Use the show interfaces description command in User Exec mode to display

the description for all configured interfaces.

Layer 2 Switching Commands 404

Syntax

show interfaces description [gigabitethernet unit/slot/port |

port-channel

port-channel-number

| tengigabitethernet unit/slot/port |

fortygigabitethernet unit/slot/port]

Default Configuration

This command has no default configuration.

Command Mode

User Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays the description for all interfaces.

console>show interfaces description

Port Description

---- ------------------------------------------------

Gi1/0/1 Port that should be used for management only

Gi2/0/1

Gi2/0/2

Port Description

----- ----------------------------------------------------------------------

Po1

show interfaces detail

Use the show interfaces detail command to display detailed status and

configuration of the specified interface.

Syntax

show interfaces detail interface-id

•interface-id—

An Ethernet interface identifier or port channel identifier.

Layer 2 Switching Commands 405

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays detailed status and configuration of the

specified interface.

console#show interfaces detail gi1/0/1

Port Description Duplex Speed Neg MTU Admin Link

State State

--------- --------------------------- ------ ------- ---- ----- ----- -----

Gi1/0/1 N/A Unknown Auto 1518 Up Down

Port Description

--------- ------------------------------------------------------------------

----

Gi1/0/1

Flow Control: Enabled

Port: Gi1/0/1

VLAN Membership mode: Access Mode

Operating parameters:

PVID: 1

Ingress Filtering: Enabled

Acceptable Frame Type: Admit All

Default Priority: 0

GVRP status: Disabled

Protected: Disabled

Port Gi1/0/1 is member in:

VLAN Name Egress rule Type

---- --------------------------------- ----------- --------

1 default Untagged Default

Static configuration:

PVID: 1

Ingress Filtering: Enabled

Acceptable Frame Type: Admit All

Port Gi1/0/1 is statically configured to:

VLAN Name Egress rule

Layer 2 Switching Commands 406

---- --------------------------------- -----------

Forbidden VLANS:

VLAN Name

---- ---------------------------------

Port Gi1/0/1 Enabled

State: Disabled Role: Disabled

Port id: 128.1 Port Cost: 0

Port Fast: No (Configured: no ) Root Protection: No

Designated bridge Priority: 32768 Address: 1418.7715.2368

Designated port id: 0.0 Designated path cost: 0

CST Regional Root: 80:00:14:18:77:15:23:68 CST Port Cost: 0

BPDUs: Sent: 0, Received: 0

show interfaces status

Use the show interfaces status command to display the status for all

configured interfaces.

Syntax

show interfaces status

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

Port channels are only displayed if configured. Use the

show interfaces port-

channel

command to display configured and unconfigured port channels.

Interfaces configured as stacking ports will show as detached in the output of

the

show interfaces status

command.

The link state indicates the physical connectivity state of the link. It is

possible that the link is connected physically yet frames are not able to pass

over the link. Possible causes of this condition are speed or duplex mismatch.

The displayed port status information includes the following:

Layer 2 Switching Commands 407

The following table displays the interface mode codes and VLAN output

format for the interface mode:

Example

The following example displays the status for all configured interfaces.

console(config-if-Po1)#show interfaces status

Port Description Duplex Speed Neg Link Flow M VLAN

State Ctrl

Field Description

Port The port or port channel number. Oob means Out-of-Band

Management Interface.

Description Description of the port. This field may be truncated in the command

output.

Duplex Displays the port Duplex status.

VLAN The VLAN membership for the port. The native VLAN is enclosed in

parentheses.

Speed Refers to the port speed.

Neg Describes the Auto-negotiation status.

Link State Displays the Link status, either Up or Down.

Flow Ctrl

Status

Displays the Flow Control status, either Active or Inactive.

Mode VLAN

A – Access Native

T – Trunk (Native),List

D – Dot1q tunnel Outer

P – Private VLAN

Promiscuous

(Primary), Secondary List

H–Private VLAN Host (Primary), Secondary

G– General (PVID), All the tagged and untagged VLANs.

Layer 2 Switching Commands 408

--------- --------------- ------ ------- ---- ------ ----- - ---------------

Gi1/0/1 N/A Unknown Auto Down Off A 1

Gi1/0/2 N/A Unknown Auto Down Off T (11),1,3,5,7,9

15,19,25-4093

Gi1/0/3 N/A Unknown Auto Down Off A 1

Gi1/0/4 N/A Unknown Auto Down Off G (1),2,4,6,8,10

14,16,20,22,24

Gi1/0/5 N/A Unknown Auto Down Off A 1

Gi1/0/6 N/A Unknown Auto Down Off A 1

Gi1/0/7 N/A Unknown Auto Down Off A 1

Gi1/0/8 N/A Unknown Auto Down Off A 1

Gi1/0/9 N/A Unknown Auto Down Off A 1

Oob Type Link

State

--- ------------------------------ -----

oob Out-Of-Band Up

Port Description Link M VLAN

Channel State

------- ------------------------------ ------- - -------------------

Po1 Down H (4),5

show interfaces transceiver

Use the show interfaces transceiver command to display the optic static

parameters as well as the Dell EMC qualification.

Syntax

show interfaces transceiver [properties]

• properties—Displays the static parameters for the optics.

Default Configuration

This command has no default configuration.

Command Modes

User Exec, Privileged Exec modes.

User Guidelines

This command only supports the display of 10G and 40G transceivers.

Layer 2 Switching Commands 409

Example

The following example shows the qualifications status of the optics on the

switch.

console#show interfaces transceiver

Port Dell Qualified

------------- ----------------

Te1/0/9 Yes

Te1/0/11 Yes

Te1/0/13 N/A

Te1/0/15 No

Te1/0/17 No

The following example shows static parameters of the optics along with the

qualifications status.

console#show interfaces transceiver properties

Yes: Dell Qualified No: Not Qualified

N/A : Not Applicable

Port Type Media Serial Number Dell Qualified

------------ ------- --------------- -------------------- --------------

Te1/0/9 SFP+ 10GBASE-LRM ANF0L5J Yes

Te1/0/11 SFP+ 10GBASE-LRM ANF0L5R Yes

Te1/0/13 SFP 1GBASE-SX PCC1PT5 N/A

Te1/0/15 SFP+ 10GBASE-SR AD1125A002R No

Te1/0/17 SFP+ 10GBASE-SR AD0815E00PC No

show statistics

Use the show statistics command to display detailed statistics for a specific

port or for the internal CPU interface.

Syntax

show statistics {gigabitethernet unit/slot/port |switchport |

port-channel

port-channel-number

| tengigabitethernet unit/slot/port |

fortygigabitethernet unit/slot/port}

• unit/slot/port—

A valid physical interface identifier. See

Interface Naming

Conventions

for interface representation.

• port-channel-number—

A port channel identifier.

•switchport—Displays statistics for the internal switch CPU interface.

Layer 2 Switching Commands 410

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

Statistics are only collected for physical interfaces, port-channel interfaces,

and the switch CPU interface.

Examples

The following example shows statistics for port Te1/0/1.

console(config-if-Te1/0/1)#show statistics te1/0/1

Total Packets Received (Octets)................ 0

Packets Received 64 Octets..................... 0

Packets Received 65-127 Octets................. 0

Packets Received 128-255 Octets................ 0

Packets Received 256-511 Octets................ 0

Packets Received 512-1023 Octets............... 0

Packets Received 1024-1518 Octets.............. 0

Packets Received > 1518 Octets................. 0

Packets RX and TX 64 Octets.................... 0

Packets RX and TX 65-127 Octets................ 0

Packets RX and TX 128-255 Octets............... 0

Packets RX and TX 256-511 Octets............... 0

Packets RX and TX 512-1023 Octets.............. 0

Packets RX and TX 1024-1518 Octets............. 0

Packets RX and TX 1519-2047 Octets............. 0

Packets RX and TX 2048-4095 Octets............. 0

Packets RX and TX 4096-9216 Octets............. 0

Total Packets Received Without Errors.......... 0

Unicast Packets Received....................... 0

Multicast Packets Received..................... 0

Broadcast Packets Received..................... 0

Received Packets Discarded..................... 0

Total Packets Received with MAC Errors......... 0

Jabbers Received............................... 0

Fragments/Undersize Received................... 0

Layer 2 Switching Commands 411

Alignment Errors............................... 0

FCS Errors..................................... 0

Overruns....................................... 0

Total Received Packets Not Forwarded........... 0

802.3x Pause Frames Received................... 0

Unacceptable Frame Type........................ 0

Total Packets Transmitted (Octets)............. 0

Packets Transmitted 64 Octets.................. 0

Packets Transmitted 65-127 Octets.............. 0

Packets Transmitted 128-255 Octets............. 0

Packets Transmitted 256-511 Octets............. 0

Packets Transmitted 512-1023 Octets............ 0

Packets Transmitted 1024-1518 Octets........... 0

Packets Transmitted > 1518 Octets.............. 0

Max Frame Size................................. 1518

Total Packets Transmitted Successfully......... 0

Unicast Packets Transmitted.................... 0

Multicast Packets Transmitted.................. 0

Broadcast Packets Transmitted.................. 0

Transmit Packets Discarded..................... 0

Total Transmit Errors.......................... 0

Total Transmit Packets Discarded............... 0

Single Collision Frames........................ 0

Multiple Collision Frames...................... 0

Excessive Collision Frames..................... 0

802.3x Pause Frames Transmitted................ 0

GVRP PDUs received............................. 0

GVRP PDUs Transmitted.......................... 0

GVRP Failed Registrations...................... 0

GMRP PDUs Received............................. 0

GMRP PDUs Transmitted.......................... 0

GMRP Failed Registrations...................... 0

BPDU: sent 0, received 0

EAPOL Frames Transmitted....................... 0

EAPOL Start Frames Received.................... 0

Time Since Counters Last Cleared............... 0 day 13 hr 20 min 24 sec

Layer 2 Switching Commands 412

show statistics switchport

Use the show statistics command to display detailed statistics for a specific

port or for the entire switch.

Syntax

show statistics {interface-id |switchport}

• interface-id—The

interface ID. See

Interface Naming Conventions

for

interface representation.

•switchport—Displays statistics for the entire switch.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

It is possible to enter interface configuration mode from global configuration

mode or from interface configuration mode.

RFC Cross Reference

Textual Explanation RFC 2863 MIB Identifier

Total Packets Received (Octets) ifHCInOctets

Unicast Packets Received ifHCInUcastPkts

Multicast Packets Received ifHCInMulticastPkts

Broadcast Packets Received ifHCInBroadcastPkts

Receive Packets Discarded ifInDiscards

Octets Transmitted ifHCOutOctets

Unicast Packets Transmitted ifHCOutUcastPkts

Layer 2 Switching Commands 413

Multicast Packets Transmitted ifHCOutMulticastPkts

Broadcast Packets Transmitted ifHCOutBroadcastPkts

Transmit Packets Discarded ifOutDiscards

Example

The following example shows statistics for the CPU interface.

console#show statistics switchport

Total Packets Received (Octets)................ 0

Packets Received Without Error................. 0

Unicast Packets Received....................... 0

Multicast Packets Received..................... 0

Broadcast Packets Received..................... 0

Receive Packets Discarded...................... 0

Octets Transmitted............................. 0

Packets Transmitted Without Errors............. 0

Unicast Packets Transmitted.................... 0

Multicast Packets Transmitted.................. 0

Broadcast Packets Transmitted.................. 0

Transmit Packets Discarded..................... 0

Most Address Entries Ever Used................. 3

Address Entries Currently in Use............... 3

Maximum VLAN Entries........................... 1024

Most VLAN Entries Ever Used.................... 2

Static VLAN Entries............................ 2

Dynamic VLAN Entries........................... 0

VLAN Deletes................................... 0

Time Since Counters Last Cleared............... 0 day 18 hr 1 min 59 sec

Layer 2 Switching Commands 414

show storm-control

Use the show storm-control command to display the configuration of storm

control.

Syntax

show storm-control [all | {gigabitethernet unit/slot/port |

tengigabitethernet unit/slot/port | fortygigabitethernet unit/slot/port}]

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Examples

The following example shows storm control configurations for a Gigabit

Ethernet port. The second example shows flow control mode status.

console#show storm-control

802.3x Flow Control Mode....................... Disable

console#show storm-control gigabitethernet 1/0/1

Bcast Bcast Mcast Mcast Ucast Ucast Flow

Intf Mode Level Mode Level Mode Level Ctrl

---------- -------- --------- -------- --------- -------- --------- --------

Gi1/0/1 Disable 5 Disable 5 Disable 5 Disabled

switch-top(config)#show storm-control all

Bcast Bcast Mcast Mcast Ucast Ucast Flow

Port Mode Level Mode Level Mode Level Ctrl

---------- -------- --------- -------- --------- -------- --------- --------

Gi1/0/1 Enable 90 Enable 5 Enable 10 Enabled

Layer 2 Switching Commands 415

Gi1/0/2 Disable 5 Disable 5 Disable 5 Enabled

Gi1/0/3 Disable 5 Disable 5 Disable 5 Enabled

Gi1/0/4 Disable 5 Disable 5 Disable 5 Enabled

Gi1/0/5 Disable 5 Disable 5 Disable 5 Enabled

Gi1/0/6 Disable 5 Disable 5 Disable 5 Enabled

Gi1/0/7 Disable 5 Disable 5 Disable 5 Enabled

Gi1/0/8 Disable 5 Disable 5 Disable 5 Enabled

show storm-control action

Use the show storm-control action command to display the storm control

action configuration for one or all interfaces.

Syntax

show storm-control action {all | interface-id}

•

all

—Show the storm control action configuration for all interfaces.

• interface-id—A physical interface on which storm control is enabled.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode and all show modes

User Guidelines

This command has no user guidelines.

Examples

console#show storm-control action all

Bcast Mcast Ucast

Port Action Action Action

-------- ---------- ---------- ----------

Gi1/0/1 Shutdown

Gi1/0/2

Gi1/0/3

Gi1/0/4

Gi1/0/5

Gi1/0/6

Gi1/0/7

Gi1/0/8

Layer 2 Switching Commands 416

shutdown

Use the shutdown command in Interface Configuration mode to disable an

interface. To restart a disabled interface, use the no form of this command.

Syntax

shutdown

no shutdown

Default Configuration

The interface is enabled.

Command Mode

Interface Configuration (Ethernet, Port-Channel, Tunnel, Loopback) mode

User Guidelines

This command has no user guidelines.

Examples

The following example disables Gigabit Ethernet port 1/0/5.

console(config)#interface gigabitethernet 1/0/5

console(config-if-Gi1/0/5)# shutdown

The following example reenables Gigabit Ethernet port 1/0/5.

console(config)#interface gigabitethernet 1/0/5

console(config-if-Gi1/0/5)# no shutdown

speed

Use the speed command in Interface Configuration mode to configure the

speed of a given Ethernet interface. To restore the default, use the no form of

this command.

Syntax

speed {10 | 100 | 1000 | 10000 | 40000 | auto [10 | 100 | 1000 | 2500 |

5000| 10000]}

no speed

Layer 2 Switching Commands 417

•10—Configures the port to 10 Mbps operation.

•100—Configures the port to 100 Mbps operation.

•1000—Configures the port to 1000 Mbps operation.

•10000—Configures the port to 10 Gbps operation.

•40000—Configures the port to 40 Gbps operation.

•auto—The port automatically negotiates the highest common speed with

the port at the other end of the link. If you use the 10, 100, 1000, 2500,

5000, or 10000 keywords with the auto keyword, the port only advertises

the specified speeds.

Default Configuration

Auto-negotiation is enabled by default on copper ports and SFP ports.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

Not all interfaces are capable of supporting all speeds. Refer to the Hardware

Overview section of the Users Configuration Guide for a description of the

capabilities of a particular interface.

Use the auto parameter to enable auto-negotiation on an interface. Auto-

negotiation on copper interfaces selects a clock master, performs link training

to tune the pre-emphasis settings to the individual switch and cable,

negotiates the internal media, and may enable a decision feedback equalizer

(DFE) to correct burst errors if the PHY has the capability. To disable auto-

negotiation on a port, it is necessary to enter the speed command without

using the auto parameter. Disabling auto-negotiation on 1G copper ports

may lead to random frame loss as the clock master and media have not been

arbitrated by the auto-negotiation process. Auto-negotiation is required on

2.5G/5G/10G/40G copper ports and is always recommended for copper ports

regardless of the speed setting. Auto-negotiation is also required on 1000Base-

X ports (including SFP fiber ports.)

When the auto parameter is configured with a set of speeds, only those

speeds are advertised during auto-negotiation. Alternatively, if no speed

arguments are configured, then all the speeds which the port is capable of

Layer 2 Switching Commands 418

supporting are advertised. Not all ports support all speeds, even if they are

available in the command. Entering an unsupported speed will produce the

following error message An invalid interface has been used

for this function.

Fiber ports (other than 1000Base-X) do not support auto-negotiation and

therefore require the operator to enter the speed command with the desired

operating bandwidth. The link partner must be similarly configured.

SFP+/QSFP fiber ports do not support auto-negotiation, although it may be

enabled when using Direct Attach Copper cables if the link partner also

supports auto-negotiation. 1G SFP fiber ports should have auto-negotiation

enabled. SFP transceivers in an SFP+ port should have auto-negotiation

enabled. The default behavior is to enable auto-negotiation when an SFP

transceiver is inserted into an SFP+ port, unless a fixed speed is configured.

Likewise, SFP+ ports connected via copper Direct Attach Cables should have

auto-negotiation enabled if the link partner is also capable of performing

auto-negotiation. If the link partner cannot perform auto-negotiation, then a

fixed speed must be utilized. In all cases, the link partners need compatible

settings, e.g., both sides must be set to use auto-negotiation or a fixed speed.

In the case of a fixed speed link, both sides must be set to the same speed.

Failure to set both sides of a link to the same speed/duplex values (auto-

negotiation disabled) or compatible speed/duplex values (auto-negotiation

enabled) may give a false link-up indication when configured or when the link

is brought up (no shut). Setting one end of a link to auto-negotiate and the

link partner to a fixed speed is not supported.

Example

The following example configures Gigabit Ethernet port 1/0/5 to advertise

100-Mbps operation only via auto-negotiation.

console(config)#interface gigabitethernet 1/0/5

console(config-if)#speed auto 100

Command History

The speed 10000 syntax was introduced in the 6.3.6 release.

The 2500 and 5000 speeds were introduced in the 6.3.5 release. The

description was updated in the 6.4 release.

Layer 2 Switching Commands 419

switchport protected

Use the switchport protected command in Interface Configuration mode to

configure a protected port. The groupid parameter identifies the set of

protected ports to which this interface is assigned. You can only configure an

interface as protected in one group. You are required to remove an interface

from one group before adding it to another group.

Port protection occurs within a single switch. Protected port configuration

does not affect traffic between ports on two different switches. No traffic

forwarding is possible between two protected ports. Ports in a protected group

will not forward traffic to other ports in the group.

Syntax

switchport protected groupid

no switchport protected

• groupid--Identifies which group this port will be protected in. (Range: 0-2)

Default Configuration

No protected switchports are defined.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

When an interface is enabled for routing using the interface vlan command,

the port will no longer be operationally enabled as a protected port on the

interface. Likewise, making an interface a member of a LAG or a probe

(monitor session or RSPAN destination) port operationally disables port

protection.

Example

The following example configures Ethernet port 1/0/1 as a member of

protected group 1.

console(config)#interface gigabitethernet 1/0/1

console(config-if-Gi1/0/1)#switchport protected 1

Layer 2 Switching Commands 420

switchport protected name

Use the switchport protected name command in Global Configuration mode

to adds the port to the protected group 1 and also sets the group name to

“protected”.

Syntax

switchport protected groupid name name

no switchport protected groupid name

• groupid — Identifies which group the port is to be protected in.

(Range: 0–2)

• name — Name of the group. (Range: 0-32 characters)

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example assigns the name “protected” to group 1.

console(config)#switchport protected 1 name protected

show switchport protected

Use the show switchport protected command to display the status of all the

interfaces, including protected and unprotected interfaces.

Syntax

show switchport protected groupid

• groupid — Identifies which group the port is to be protected in.

(Range: 0–2)

Layer 2 Switching Commands 421

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example identifies test as the protected group.

console#show switchport protected 0

Name......................................... test

show system mtu

Use the show system mtu command to display the configured MTU. The

MTU is set using the global system jumbo mtu command. This command

deprecates the show interfaces mtu command.

Syntax

show system mtu

Default Configuration

The default mtu size is 1518 bytes (1522 bytes for VLAN tagged frames).

Command Modes

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no usage guidelines.

Example

console #show system mtu

Layer 2 Switching Commands 422

System Jumbo MTU size is 9216 bytes

system jumbo mtu

Use the system jumbo mtu command to globally configure the link

Maximum Transmission Unit (MTU) on all interfaces, IP/IPv6 interfaces,

VLAN interfaces, and port channel interfaces for forwarded and system-

generated frames. The link MTU is the size of the largest Ethernet frame that

can be transmitted on an interface without fragmentation. Frames received

on an interface are dropped if they exceed the link MTU. Frames larger than

this size generated by the system are fragmented before transmission.

This command deprecates the mtu, ip mtu, and ipv6 mtu commands.

Use the no form of the command to reset the MTU to the default.

Syntax

system jumbo mtu frame size

no system jumbo mtu

• frame size —The maximum frame size, in bytes, received by the system

which is not forwarded.

Default Configuration

The default MTU size is 1518 bytes (1522 bytes for VLAN tagged frames).

Command Modes

Global Configuration mode

User Guidelines

Dell EMC Networking N-Series switches do not fragment received packets.

The IPv4 and IPv6 MTU are set to the link MTU minus 18 bytes. IP packets

forwarded in software are dropped if they exceed the IP MTU. Packets

originated on the router, such as OSPF packets, may be fragmented by the IP

stack. OSPF advertises the IP MTU in the Database Description packets it

sends to its neighbors during database exchange. If two OSPF neighbors

Layer 2 Switching Commands 423

advertise different IP MTUs, they will not form an adjacency (unless OSPF

has been instructed to ignore differences in IP MTU with the ip ospf

mtuignore command).

The allowed range is 1298 to 9216. This allows for configuration of an IPv4

and IPv6 MTU of 1280 to 9198.

In conformance with RFC 2460, the system performs IPv6 path MTU

discovery for IPv6 packets originated by the switch. This may result in

individual connections using an IPv6 MTU less than that configured by the

network operator.

Layer 2 Switching Commands 424

Ethernet CFM Commands

Dell EMC Networking N4000 Series Switches

Connectivity Fault Management (CFM) is the OAM Protocol provision for

end-to-end service layer OAM in carrier Ethernet networks. CFM provides

mechanisms to support the operator in performing connectivity checks, fault

detection, fault verification and isolation, and fault notification per service in

the network domain of interest. Unlike Ethernet OAM defined in IEEE

802.3ah, where the faults are detected and notified on a single point-to-point

IEEE Std. 802.3 LAN, this capability deals with the fault diagnosis at service

layer across networks comprising multiple LANs, including LANs other than

802.3 media. Refer to IEEE 802.1ag for an explanation of CFM. Typically, the

MEP ID and maintenance association levels are assigned by the top level

network service provider.

Dell EMC Networking CFM is only available on the N4000 series switches.

CFM is not compatible with iSCSI optimization. Disable iSCSI optimization

before enabling CFM.

Dell EMC Networking CFM supports the following functionality:

• Path discovery (linktrace message)

• Fault detection (continuity check message)

• Fault verification and isolation (loopback and linktrace messages)

• Fault notification (alarm indication signal or SNMP trap)

Commands in this Section

This section explains the following commands:

ethernet cfm domain ping ethernet cfm

service traceroute ethernet cfm

ethernet cfm cc level show ethernet cfm errors

ethernet cfm mep level show ethernet cfm domain

ethernet cfm mep enable show ethernet cfm maintenance-points

local

Layer 2 Switching Commands 425

ethernet cfm domain

Use the ethernet cfm domain command in Global Configuration mode to

enter into Maintenance Domain Configuration mode for an existing domain.

Use the optional level parameter to create a domain and enter into

maintenance domain Configuration mode. In maintenance domain

Configuration mode, maintenance associations are created and per-

maintenance domain services can be configured. Use the no form of the

command to delete a maintenance domain.

Syntax

ethernet cfm domain domain-name [level 0-7]

• domain-name—Name of the maintenance domain. Alphanumeric string

of up to 43 characters.

Default Configuration

No CFM domains are preconfigured.

Command Mode

Global Configuration mode

User Guidelines

Each domain must have a unique name and level, for example, one cannot

create a domain qwerty at level 2 if domain qwerty already exists at level 1.

Likewise, one cannot create a domain dvorak at level 2 if a domain of any

name exists at level 2.

Example

In this example, a domain “vin” is created at level 1.

console(config)#ethernet cfm domain vin level 1

ethernet cfm mep active show ethernet cfm maintenance-points

remote

ethernet cfm mep archive-hold-time show ethernet cfm statistics

ethernet cfm mip level

–

Layer 2 Switching Commands 426

console(config-cfm-mdomain)#

service

Use the service command in Maintenance Domain Configuration mode to

associate a VLAN with a maintenance domain. Use the no form of the

command to remove the association.

Syntax

service service-name vlan vlan-id

• service-name—Unique service identifier.

• vlan-id—VLAN ID representing a service instance that is monitored by

this maintenance association. The range is 1-4093.

Default Configuration

No VLANs are associated with a maintenance domain by default.

Command Mode

Maintenance Domain Configuration mode

User Guidelines

This command has no user guidelines.

Example

console(config-cfm-mdomain)#service serv1 vlan 10

ethernet cfm cc level

Use the ethernet cfm cc level command in Global Configuration mode to

initiate sending continuity checks (CCMs) at the specified interval and level

on a VLAN monitored by an existing domain. Use the no form of the

command to cease send CCMs.

Syntax

ethernet cfm cc level 0-7 vlan vlan-id interval secs

Layer 2 Switching Commands 427

• vlan-id—VLAN ID representing a service instance that is monitored by

this maintenance association. The range is 1-4093.

• secs—Time interval between successive transmissions. The range is 1, 10,

60, and 600 seconds. The default is 1 second.

Default Configuration

CCMs are not sent by default.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

console(config)#ethernet cfm cc level 1 vlan 15 interval 10

ethernet cfm mep level

Use the ethernet cfm mep level command in Interface Configuration mode

to create a Maintenance End Point (MEP) on an interface at the specified

level and direction. MEPs are configured per Maintenance Association per

Maintenance Domain. Use the no form of the command to delete a MEP.

Syntax

ethernet cfm mep level 0-7 direction up|down mpid 1-8191 vlan vlan-id

•level—Maintenance association level

•direction—

Up indicates the MEP is facing towards Bridge Relay Entity. Down

indicates the MEP is facing towards the LAN.

•mpid—

Maintenance entity identifier

•vlan-id—

VLAN on which the MEP operates. The range is 1-4093.

Default Configuration

No MEPs are preconfigured.

Layer 2 Switching Commands 428

Command Mode

Interface Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example creates a maintenance endpoint at level 1 with mpid

1010 on vlan 10.

console(config-if-Gi1/0/3)#ethernet cfm mep level 1 direction up mpid 1010

vlan 10

ethernet cfm mep enable

Use the ethernet cfm mep enable command in Interface Configuration mode

to enable a MEP at the specified level and direction. Use the no form of the

command to disable the MEP.

Syntax

ethernet cfm mep enable level 0-7 vlan vlan-id mpid 1-8191

•level—Maintenance association level

•mpid—

Maintenance entity identifier

•vlan—

VLAN on which the MEP operates. The range is 1-4093.

Default Configuration

No MEPs are preconfigured.

Command Mode

Interface Configuration mode

User Guidelines

The maintenance domain must exist for it to be enabled.

Layer 2 Switching Commands 429

Example

The following example enables a maintenance endpoint at level 1 with mpid

1010 on vlan 10.

console(config-if-Gi1/0/3)#ethernet cfm mep enable level 1 vlan 10 mpid 1010

ethernet cfm mep active

Use the ethernet cfm mep active command in Interface Configuration mode

to activate a MEP at the specified level and direction. Use the no form of the

command to deactivate the MEP.

Syntax

ethernet cfm mep active level 0-7 vlan vlan-id mpid 1-8191

•level—Maintenance association level

•mpid—

Maintenance entity identifier

•vlan—

VLAN on which the MEP operates. The range is 1-4093.

Default Configuration

No MEPs are preconfigured.

Command Mode

Interface Configuration

User Guidelines

This command has no user guidelines.

ethernet cfm mep archive-hold-time

Use the ethernet cfm mep archive-hold-time command in Interface

Configuration mode to maintain internal information on a missing MEP. Use

the no form of the command to return the interval to the default value.

Syntax

ethernet cfm mep archive-hold-time hold-time

Layer 2 Switching Commands 430

• hold-time—The time in seconds to maintain the data for a missing MEP

before removing the data. The default value is 600 seconds.

Default Configuration

No MEPs are preconfigured.

Command Mode

Interface Configuration

User Guidelines

The hold time should generally be less than the CCM message interval.

Example

The following example sets the hold time for maintaining internal

information regarding a missing MEP.

console(config)#ethernet cfm mep archive-hold-time 1200

ethernet cfm mip level

Use the ethernet cfm mip level command in Interface Configuration mode

to create a Maintenance Intermediate Point (MIP) at the specified level. The

MEPs are configured per Maintenance Domain per interface. Use the no

form of the command to delete a MIP.

Syntax

ethernet cfm mip level 0-7

•level—Maintenance association level

Default Configuration

No MIPs are preconfigured.

Command Mode

Interface Configuration

Layer 2 Switching Commands 431

User Guidelines

Refer to IEEE 802.1ag for an explanation of maintenance association levels.

Typically, this value is assigned by the top level network service provider.

Example

console(config-if-Gi1/0/1)# ethernet cfm mip level 7

ping ethernet cfm

Use the ping ethernet cfm command to generate a loopback message (LBM)

from the configured MEP.

Syntax

ping ethernet cfm {mac mac-addr| remote-mpid 1-8191} {domain domain

name | level 0-7} vlan vlan-id mpid 1-8191 [count 1-255]

•level—Maintenance association level

• mac-addr—

The destination MAC address for which the connectivity needs to

be verified. Either MEP ID or the MAC address option can be used.

•remote-mpid—

The MEP ID for which connectivity is to be verified; i.e. the

destination MEP ID.

•domain—

Name of the maintenance domain (an alphanumeric string of up to

43 characters in length).

• vlan-id—

A VLAN associated with the maintenance domain. Range: 1-4093.

•mpid—

The MEP ID from which the loopback message needs to be

transmitted.

•count—

The number of LBMs to be transmitted. The default number is 1.

Default Configuration

By default, this command will transmit one loopback message with a time-out

of five seconds.

Command Mode

Privileged Exec

Layer 2 Switching Commands 432

User Guidelines

This command has no user guidelines.

Example

console #ping ethernet cfm mac 00:11:22:33:44:55 level 1 vlan 10 mpid 1 count

traceroute ethernet cfm

Use the traceroute ethernet command to generate a link trace message

(LTM) from the configured MEP.

Syntax

traceroute ethernet cfm {mac mac-addr| remote-mpid 1-8191} {domain

domain name | level 0-7} vlan vlan-id mpid 1-8191 [ttl 1-255]

•level—Maintenance association level

• mac-addr—

The destination MAC address for which the connectivity needs to

be verified. Either MEP ID or the MAC address option can be used.

•remote-mpid—

The MEP ID for which connectivity is to be verified; i.e. the

destination MEP ID.

•domain—

Name of the maintenance domain (an alphanumeric string of up to

43 characters in length).

• vlan-id—

A VLAN associated with the maintenance domain. Range: 1-4093.

•mpid—

The MEP ID from which the loopback message needs to be

transmitted.

•ttl—

The number of hops over which the LTM is expected to be transmitted.

The default number is 64.

Default Configuration

By default, the traceroute command will send loopback trace messages with a

TTL of 64.

Command Mode

Privileged Exec

Layer 2 Switching Commands 433

User Guidelines

This command has no user guidelines.

Example

console # traceroute ethernet cfm remote-mpid 32 level 7 vlan 11 mpid 12

show ethernet cfm errors

Use the show ethernet cfm errors command to display the cfm errors.

Syntax

show ethernet cfm errors {domain domain-id | level 0-7}

•level—Maintenance association level

•domain—Name of the maintenance domain (an alphanumeric string of

up to 43 characters in length).

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

• Level—The maintenance association level

• SVID—The service identifier

• MPID—The maintenance endpoint identifier

• DefRDICcm—A remote MEP reported the RDI bit in a CCM.

• DefMACStatus—Some remote MEP reported its Interface Status TLV as

something other then isUp.

• DefRemoteCCM—The MEP did not receive valid CCMs from at least

one of the remote MEPs

• DefErrorCCM—The MEP has received at least one invalid CCM whose

CCM interval has not yet timed out.

Layer 2 Switching Commands 434

• DevXconCCM—The MEP has received at least one CCM from either

another MAID or a lower MD level whose CCM interval has not yet timed

out.

Example

console#show ethernet cfm errors

----- ---- ---- --------- ------------ ------------ ----------- ----------

Level SVID MPID DefRDICcm DefMACStatus DefRemoteCCM DefErrorCCM DefXconCCM

----- ---- ---- --------- ------------ ------------ ----------- ----------

show ethernet cfm domain

Use the show ethernet cfm domain command to display the configured

parameters in a maintenance domain.

Syntax

show ethernet cfm domain {brief |domain-id}

•domain—Name of the maintenance domain (an alphanumeric string of

up to 43 characters in length).

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

This command has no user guidelines.

Example

console # show Ethernet cfm domain domain1

Domain Name : domain1

Level : 1

Total Services : 1

---- ----------------------------------- ------------------

VLAN ServiceName CC-Interval (secs)

---- ----------------------------------- ------------------

10 serv1 1

Layer 2 Switching Commands 435

show ethernet cfm maintenance-points local

Use the show ethernet cfm maintenance-points local command to display

the configured local maintenance points.

Syntax

show ethernet cfm maintenance-points local {level 0-7 | interface interface-

id | domain domain-name}

•level—Maintenance association level

•domain—Name of the maintenance domain (an alphanumeric string of

up to 43 characters in length).

• interface-id—

Show all MPs associated with the interfa

ce. This command

accepts physical interface identifiers and port channel interface identifiers.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

Refer to IEEE 802.1ag for an explanation of the maintenance association

level and MEP ID. Typically, these are assigned by the top level network

service provider.

• MPID—The maintenance endpointoint identifier

• Level—The MEP level

• Type—Maintenance endpoint (MEP) or maintenance intermediate point

(MIP)

• VLAN—The configured VLAN id

• Port—The port on which the MEP association is configured

• Direction—(Up)stream or (Do)wnstream

• CC Transmit—Continuity check enabled

• MEP-Active—The MEP administrative status

Layer 2 Switching Commands 436

• Operational Status—The MEP operational status

• MAC—The MAC address associated with the MEP.

Example

show ethernet cfm maintenance-points local level 1

---- ----- ---- ---- ------ ----- -------- ------ ----------- -----

MPID Level Type VLAN Port Dire- CC MEP- Operational MAC

ction Transmit Active Status

---- ----- ---- ---- ------ ----- -------- ------ ----------- -----

1 1 MEP 10 Gi1/0/1 UP Enabled True 00:02:bc:02:02:02

----- ---- ------ -----------------

Level Type Port MAC

----- ---- ------ -----------------

show ethernet cfm maintenance-points remote

Use the show ethernet cfm maintenance-points remote command to display

the configured remote maintenance points.

Syntax

show ethernet cfm maintenance-points remote {level 0-7 | domain domain-

name | detail [mac mac-address | mep mpid] [domain domain-name | level

0-7] [vlan vlan-id]}

•domain—Name of the maintenance domain (an alphanumeric string of

up to 43 characters in length).

•level—Maintenance association level

• mac-addr—

The destination MAC address for which the connectivity needs to

be verified. Either MEP ID or the MAC address option can be used.

• vlan-id—

A VLAN associated with the maintenance domain. Range: 1-4093.

• mpid—

The MEP ID from which the loopback message needs to be transmitted.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

Layer 2 Switching Commands 437

User Guidelines

Refer to IEEE 802.1ag for an explanation of the maintenance association

level and MEP ID. Typically, these are assigned by the top level network

service provider.

• MEP Id—Local MEP identifier

• RMep Id—Remote MEP identifier

• Level—Connectivity association level

• MAC—Destination MAC address

• VLAN—VLAN on which the MEP is configured

• Expiry timer—The configured MEP expiry timer

• Service Id—The configured service identifier

Example

console# show ethernet cfm maintenance-points remove level 1

------ ------- ----- ----------------- ---- ----------------- -----------

MEP Id RMEP Id Level MAC VLAN Expiry Timer(sec) Service Id

------ ------- ----- ----------------- ---- ----------------- -----------

1 2 1 00:11:22:33:44:55 10 25 serv1

show ethernet cfm statistics

Use the show ethernet cfm maintenance-points remote command to display

the CFM statistics.

Syntax

show ethernet cfm statistics [domain domain-name | level 0-7]

• domain-name—Name of the maintenance domain (an alphanumeric

string of up to 43 characters in length).

•level—Maintenance association level

Default Configuration

This command has no default configuration.

Layer 2 Switching Commands 438

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

Refer to IEEE 802.1ag for an explanation of the maintenance association

level. Typically, maintenance levels are assigned by the top level network

service provider.

• Out-of-sequence CCM's received—Count of the out-of-sequence

continuity check messages (CCM's) received

• CCM's transmitted—Count of the CCMs transmitted

• In order Loopback replies received—Count of the in order loopback replies

received

• Bad MSDU Loopback Replies received—Count of the number of

loopback replies received with a MAC Service Data Unit that did not

match the corresponding LBM

• Unexpected LTR's received—A count of the number of Link Trace Replies

fore which no LTM was sent

Example

show Ethernet cfm statistics [domain <domain-name> | level <0-7>]

Console# show ethernet cfm statistics

------------------------------------------------------------------

Statistics for 'Domain: domain1, Level: 1, Vlan: 11, MEP Id: 1'

------------------------------------------------------------------

Out-of-sequence CCM's received : 0

CCM's transmitted : 259

In-order Loopback Replies received : 5

Out-of-order Loopback Replies received: 0

Bad MSDU Loopback Replies received : 0

Loopback Replies transmitted : 5

Unexpected LTR's received : 0

------------------------------------------------------------------

Statistics for 'Domain: domain1, Level: 1, Vlan: 11, MEP Id: 2'

------------------------------------------------------------------

Out-of-sequence CCM's received : 0

CCM's transmitted : 1

In-order Loopback Replies received : 5

Layer 2 Switching Commands 439

Out-of-order Loopback Replies received: 5

Bad MSDU Loopback Replies received : 0

Loopback Replies transmitted : 0

Unexpected LTR's received : 0

------------------------------------------------------------------

Statistics for 'Domain: domain1, Level: 1, Vlan: 11, MEP Id: 3'

------------------------------------------------------------------

Out-of-sequence CCM's received : 0

CCM's transmitted : 1

In-order Loopback Replies received : 0

Out-of-order Loopback Replies received: 0

Bad MSDU Loopback Replies received : 0

Loopback Replies transmitted : 5

Unexpected LTR's received : 0

Layer 2 Switching Commands 440

Green Ethernet Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Dell EMC Networking switches support various Green Ethernet modes, i.e.,

power saving modes, namely:

•Energy-Detect Mode

•Energy Efficient Ethernet

These modes can enable significant operational cost reductions through

direct power savings and reducing cooling costs. Green mode commands are

only valid for copper physical interfaces.

Energy-Detect Mode

With this mode enabled, when the port link is down the PHY automatically

goes down for short periods of time and then wakes up periodically to check

for link pulses. This reduces power consumption when no link partner is

present. This feature is currently available only on GE copper ports.

Energy Efficient Ethernet

Energy Efficient Ethernet (EEE) combines the MAC with a family of PHYs

that support operation in a Low Power Mode as defined by the IEEE 802.3az

Energy Efficient Ethernet Task Force. Lower Power Mode enables both the

send and receive sides of the link to disable some functionality for power

savings when lightly loaded. Transition to Low Power Mode does not change

the link status. Frames in transit are not dropped or corrupted in transition to

and from Low Power Mode. Transition time is transparent to upper layer

protocols and applications. LLDP must be enabled in order to EEE to operate

on a link. This feature is currently available only on copper ports.

Commands in this Section

This section explains the following commands:

clear counters show green-mode interface-id

Layer 2 Switching Commands 441

green-mode energy-detect

This command enables a Dell EMC proprietary mode of power reduction on

ports that are not connected to another interface. Use the green-mode

energy-detect command in Interface Configuration mode to enable energy-

detect mode on an interface or all the interfaces. Energy-detect mode is

enabled by default on 1G copper interfaces and enabled by default on 10G

copper interfaces.

On combo ports, it is possible to configure energy-detect mode even if the

fiber port is enabled. If enabled, energy-detect mode will become active when

the copper port is used.

Use the no form of the command to disable energy-detect mode on the

interface(s).

Syntax

green-mode energy-detect

no green-mode energy-detect

Default Configuration

On N1100-ON, N1500, N2000, N2100-ON, N3000, and N3100-ON switches,

energy-detect is enabled by default. Energy detect mode is enabled by default

and cannot be disabled on N4000 10G copper interfaces.

Command Mode

Interface Configuration mode

User Guidelines

This command is available in Ethernet interface configuration mode. Cable

diagnostics (show copper-ports tdr command) may give misleading results if

green mode is enabled on the port. Disable green mode prior to running any

cable diagnostics. EEE and energy-detect modes are only supported on N4000

green-mode eee show green-mode

description show green-mode eee-lpi-history interface

green-mode eee-lpi-history

–

Layer 2 Switching Commands 442

Series 10G ports and on N1100-ON/N1500/N2000/N2100-ON/N3000/N3100-

ON 1G copper ports. Energy-detect mode is always enabled on N4000 series

10G ports and cannot be disabled. An error message (Unable to set

energy-detect mode) will be displayed if the user attempts to configure

energy-detect on a 10G port on a N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON series switch.

green-mode eee

Use the green-mode eee command in Interface Configuration mode to

enable EEE low power idle mode on an interface. The command enables both

send and receive sides of a link to disable some functionality for power savings

when lightly loaded. The transition to Low Power Idle mode does not change

the link status. Frames in transit are not dropped or corrupted in transition to

and from Low Power Idle mode.

On combo ports, eee mode can be enabled even if the port is using the fiber

interface. If enabled, eee mode is only active when the copper interface is

active.

Use the no form of the command to disable the feature.

Syntax

green-mode eee

no green-mode eee

Default Configuration

The default value is Enabled.

Command Mode

Interface Configuration

User Guidelines

This command is available in Ethernet interface configuration mode. Cable

diagnostics (show copper-ports commands) may give misleading results if

green mode is enabled on the port. Disable green mode prior to running any

Layer 2 Switching Commands 443

cable diagnostics. EEE mode is supported on N4000 series 10G copper ports

and on N1100-ON/N1500/N2000/N2100-ON/N3000/N3100-ON 1G copper

interfaces.

green-mode eee { tx-idle-time | tx-wake-time}

Use the green-mode eee {tx-idle-time | tx_wake-time} command in

Interface Configuration mode to control the transmit idle and wake time

parameters on an interface.

Use the no form of the command to return the configuration to the default.

Syntax

green-mode eee tx-idle-time <600-4294967295>

green-mode eee tx-wake-time <0-65535>

no green-mode eee {tx-idle-time|tx-wake-time}

Default Configuration

By default, the transmit idle time is 600 micro-seconds and the transmit wake

time is 8 micro-seconds.

Command Mode

Interface Configuration mode, Interface Range Configuration mode

User Guidelines

The tx-idle-time parameter sets the amount of time the link must be idle

before transitioning to the low power idle state. The tx-wake-time configures

the delay before transitioning to the active state (and transmitting the

pending packet) after transmitting a wake symbol to the link partner. The

transmit idle time and transmit wake time are configured in micro-seconds.

The default values are recommended unless there is good reason to adjust

them. Excessive wake times may cause link congestion. Excessive idle times

will reduce the savings from low power idle mode.

Layer 2 Switching Commands 444

This command is available in Ethernet interface configuration mode for

copper ports that are EEE capable. Configuring the values on interfaces that

do not support EEE will return an error.

Command History

Syntax added in 6.4 release.

clear green-mode statistics

Use the clear green-mode statistics command to clear:

• The EEE LPI event count, and LPI duration

• The EEE LPI history table entries

• The Cumulative Power savings estimates

for a specified interface or for all the interfaces based upon the argument.

Syntax

clear green-mode statistics {interface-id | all}

• interface-id—An Ethernet interface identifier.

See

Interface Naming

Conventions

for interface representation.

•all—All Ethernet interfaces.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec

User Guidelines

This command has no user guidelines.

green-mode eee-lpi-history

Use the green-mode eee-lpi-history command in Global Configuration mode

to configure the Global EEE LPI history collection interval and buffer size.

This value is applied globally on all interfaces on the stack. LPI history is only

Layer 2 Switching Commands 445

collected on combo ports when the copper port is enabled. Use the no form of

the command to set the sampling interval or max-samples values to the

default.

Syntax

green-mode eee-lpi-history {sampling-interval 30 sec – 36000 sec| max-

samples 1 - 168}

•sampling-interval—The interval in seconds at which power consumption

data needs to be collected.

•max-samples—Maximum number of samples to keep.

Default Configuration

The sampling-interval default value is 3600 seconds and the max-samples

default value is 168.

Command Mode

Global Configuration

User Guidelines

EEE and energy-detect modes are only supported on N4000 series 10G

copper ports and on N1100-ON/N1500/N2000/N2100-ON/N3000/N3100-ON

1G copper ports.

Examples

Use the command below to set the EEE LPI History sampling interval to the

default.

console(config)# no green-mode eee-lpi-history sampling-interval

Use the command below to set the EEE LPI History max-samples to the

default.

console(config)#no green-mode eee-lpi-history max-samples

Layer 2 Switching Commands 446

show green-mode interface-id

Use the show green-mode interface-id command to display the green-mode

configuration and operational status of the port. This command is also used

to display the per port configuration and operational status of the green-

mode. The status is shown only for the modes supported on the

corresponding hardware platform whether enabled or disabled.

Syntax

show green-mode interface-id

•

interface-id

—An Ethernet interface identifier. See Interface Naming

Conventions for interface representation.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

This command output provides the following information.

Term Description

Energy Detect

Energy-detect

admin mode

Energy-detect mode is enabled or disabled.

Energy-detect

operational status

Energy detect mode is currently active or inactive. The energy

detect mode may be administratively enabled, but the

operational status may be inactive. The reasons for the

operational status are described below.

Layer 2 Switching Commands 447

Reason for Energy-

detect current

operational status

The energy detect mode may be administratively enabled, but

the operational status may be inactive. The possible reasons are:

Port is currently operating in the fiber mode

Link is up.

If the energy-detect operational status is active, then the reason

field shows up as:

No energy Detected

EEE

EEE Admin Mode EEE Admin Mode is enabled or disabled.

Rx Low Power Idle

Event Count

This field is incremented each time MAC RX enters LP IDLE

state. Shows the total number of Rx LPI Events since EEE

counters are last cleared.

Rx Low Power Idle

Duration (μSec)

This field indicates duration of Rx LPI state in 10us

increments. Shows the total duration of Rx LPI since the EEE

counters are last cleared.

Tx Low Power Idle

Event Count

This field is incremented each time MAC TX enters LP IDLE

state. Shows the total number of Tx LPI Events since EEE

counters are last cleared.

Rx Low Power Idle

Duration (μSec)

This field indicates duration of Tx LPI state in 10us

increments. Shows the total duration of Tx LPI since the EEE

counters are last cleared.

Tw_sys_tx (μSec) Integer that indicates the value of Tw_sys that the local system

can support. This value is updated by the EEE DLL

Transmitter state diagram. This variable maps into the

aLldpXdot3LocTxTwSys attribute.

Tw_sys Echo (μSec) Integer that indicates the remote system’s Transmit Tw_sys that

was used by the local system to compute the Tw_sys that it

wants to request from the remote system. This value maps into

the aLldpXdot3LocTxTwSysEcho attribute.

Tw_sys_rx (μSec) Integer that indicates the value of Tw_sys that the local system

requests from the remote system. This value is updated by the

EEE Receiver L2 state diagram. This variable maps into the

aLldpXdot3LocRxTwSys attribute.

Term Description

Layer 2 Switching Commands 448

Tw_sys_rx Echo

(μSec)

Integer that indicates the remote systems Receive Tw_sys that

was used by the local system to compute the Tw_sys that it can

support. This value maps into the

aLldpXdot3LocRxTwSysEcho attribute.

Fallback Tw_sys

(μSec)

Integer that indicates the value of fallback Tw_sys that the local

system requests from the remote system. This value is updated

by the local system software.

Remote Tw_sys_tx

(μSec)

Integer that indicates the value of Tw_sys that the remote

system can support. This value maps from the

aLldpXdot3RemTxTwSys attribute.

Remote Tw_sys

Echo (μSec)

Integer that indicates the value Transmit Tw_sys echoed back

by the remote system. This value maps from the

aLldpXdot3RemTxTwSysEcho attribute.

Remote Tw_sys_rx

(μSec)

Integer that indicates the value of Tw_sys that the remote

system requests from the local system. This value maps from

the aLldpXdot3RemRxTwSys attribute.

Remote Tw_sys_rx

Echo (μSec)

Integer that indicates the value of Receive Tw_sys echoed back

by the remote system. This value maps from the

aLldpXdot3RemRxTwSysEcho attribute.

Remote Fallback

Tw_sys (μSec)

Integer that indicates the value of fallback Tw_sys that the

remote system is advertising.This attribute maps to the variable

RemFbSystemValue as defined in 78.4.2.3.

Tx_dll_enabled Initialization status of the EEE transmit Data Link Layer

management function on the local system.

Tx_dll_ready Data Link Layer ready: This variable indicates that the tx

system initialization is complete and is ready to update/receive

LLDPDU containing EEE TLV. This variable is updated by the

local system software.

Rx_dll_enabled Status of the EEE capability negotiation on the local system.

Rx_dll_ready Data Link Layer ready: This variable indicates that the rx

system initialization is complete and is ready to update/receive

LLDPDU containing EEE TLV. This variable is updated by the

local system software.

Power Saving (%) Percentage of Power saved by enabling EEE on the interface

since EEE counters are last cleared.

Term Description

Layer 2 Switching Commands 449

Example

console#show green-mode gi1/0/1

Energy Detect Admin Mode............ Enabled

Operational Status.................. Active

Reason.............................. No Energy Detected

Short Reach Feature................. Not Available

EEE Admin Mode...................... Enabled

Rx Low Power Idle Event Count....... 0

Rx Low Power Idle Duration (uSec)... 0

Tx Low Power Idle Event Count.... 0

Tx Low Power Idle Duration (uSec) 0

Tw_sys_tx (usec)..................17

Tw_sys_tx Echo(usec)..............17

Tw_sys_rx (usec)..................17

Tw_sys_tx Echo(usec)..............17

Fallback Tw_sys (usec)............17

Remote Tw_sys_tx (usec)...........21

Remote Tw_sys_tx Echo(usec).......21

Remote Tw_sys_rx (usec)...........21

Remote Tw_sys_tx Echo(usec).......21

Remote fallback Tw_sys (usec).....21

Tx DLL enabled....................Yes

Tx DLL ready......................Yes

Rx DLL enabled....................Yes

Rx DLL ready......................Yes

Cumulative Energy Saving (W * H)..2.37

Time Since Counters Last Cleared..1 day 20 hr 47 min 34 sec

show green-mode

Use the show green-mode command to display the green-mode configuration

for the whole system. The status is shown only for the modes supported on

the corresponding hardware platform whether enabled or disabled.

Time Since

Counters Last

Cleared

Time Since Counters Last Cleared (since the time of power up,

or after clear eee counters is executed)

Term Description

Layer 2 Switching Commands 450

Syntax

show green-mode

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

This command output provides the following information.

Example

console#show green-mode

Current Power Consumption (mW)................. 11545

Power Saving /Stack (%)........................ 3

Cumulative Energy Saving /Stack (W * H)........ 17

Unit Green Ethernet Features Supported

---- -----------------------------------------------------------------------

1 Energy-Detect EEE LPI-History LLDP-Cap-Exchg Pwr-Usg-Est

Interface Energy-Detect Short-Reach-Config Short-Reach EEE

Config Opr Auto Forced Opr Config

--------- --------- --------- --------- --------- ----------- --------

Gi1/0/1 Enabled Active Enabled Disabled In-Active Enabled

Gi1/0/2 Enabled Active Enabled Disabled In-Active Enabled

Term Description

Energy Detect

Energy-detect

Config

Energy-detect Admin mode is enabled or disabled.

Energy-detect Opr Energy detect mode is currently active or inactive. The energy

detect mode may be administratively enabled, but the

operational status may be inactive.

EEE

EEE Config EEE Admin Mode is enabled or disabled.

Layer 2 Switching Commands 451

Gi1/0/3 Enabled Active Enabled Disabled In-Active Enabled

Gi1/0/4 Enabled Active Enabled Disabled In-Active Enabled

Gi1/0/5 Enabled Active Enabled Disabled In-Active Enabled

Gi1/0/6 Enabled Active Enabled Disabled In-Active Enabled

Gi1/0/7 Enabled Active Enabled Disabled In-Active Enabled

Gi1/0/8 Enabled Active Enabled Disabled In-Active Enabled

show green-mode eee-lpi-history interface

Use the show green-mode eee-lpi-history interface command to display the

interface green-mode EEE LPI history.

Syntax

show green-mode eee-lpi-history interface interface-id

•

interface-id

—An Ethernet interface identifier. See Interface Naming

Conventions for interface representation.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

On combo ports, samples are only collected on the copper ports when

enabled.

The following fields are displayed by this command.

Term Description

Sampling Interval Interval at which EEE LPI statistics is collected.

Total No. of

Samples to Keep

Maximum number of samples to keep.

Percentage LPI

Time per Stack

Percentage of total time spent in LPI mode by all ports in the

stack when compared to total time since reset.

Sample No. Sample index.

Layer 2 Switching Commands 452

Example

This example is on a platform capable of providing power consumption

details.

console#show green-mode eee-lpi-history interface gi1/0/1

Sampling Interval (sec)........................ 30

Total No. of Samples to Keep................... 10

Percentage LPI time per stack.................. 0

Percentage of Percentage of

Sample Time Since Time spent in Time spent in

No. The Sample LPI mode since LPI mode since

Was Recorded last sample last reset

------ -------------------- -------------- --------------

3 00:00:00:09 3 3

2 00:00:00:40 4 7

1 00:00:01:11 3 10

Sample Time Time since last reset.

%Time Spent in LPI

Mode Since Last

Sample

Percentage of time spent in LPI mode on this port when

compared to sampling interval.

%Time Spent in LPI

Mode Since Last

Reset

Percentage of total time spent in LPI mode on this port when

compared to time since reset.

Term Description

Layer 2 Switching Commands 453

GMRP Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

The GARP Multicast Registration Protocol (GMRP) provides a mechanism

that allows networking devices to dynamically register (and deregister) Group

membership information with the MAC networking devices attached to the

same segment, and for that information to be disseminated across all

networking devices in the bridged LAN that support Extended Filtering

Services. The operation of GMRP relies upon the services provided by the

Generic Attribute Registration Protocol (GARP). GMRP is supported as

described below.

The information registered, deregistered and disseminated via GMRP is in

the following forms:

Group Membership information: This indicates that there exists one or

more GMRP participants which are members of a particular Group, and

carry the group MAC addresses associated with the Group.

Group service requirements information: This indicates that one or more

GMRP participants require Forward all Groups or Forward Unregistered to

be the default filtering behavior.

NOTE: The Group Service capability is not supported.

Registration of group membership information allow networking devices to

be made aware that frames destined for that group MAC address concerned

should be forwarded in the direction of registered members of the group.

Forwarding of frames destined for that group MAC address occur on ports on

which such membership registration has been received.

Registration of group services requirement information allow networking

devices to be made aware that any of their ports that can forward frames in

the direction from which the group service requirement information has been

received should modify their default group behavior in accordance with the

group service requirement expressed.

The registration and deregistration of membership results in the multicast

table being updated with a new entry or the existing entry modified.

Layer 2 Switching Commands 454

This ensures that the networking device receives multicast frames from all

ports but forwards them through only those ports for which GMRP has

created Group registration entry (for that multicast address). Registration

entries created by GMRP ensures that frames are not transmitted on LAN

segments which neither have registered GMRP participants nor are in the

path through the active topology between the sources of the frames and the

registered group members.

NOTE: This feature is not available on the N3000 when loaded with the

AGGREGATION ROUTER enabled firmware (e.g., N3000_BGPvA.B.C.D.stk).

Commands in this Section

This section explains the following commands:

gmrp enable

Use the gmrp enable command in Global Configuration mode to enable

GMRP globally or Interface Configuration mode to enable GMRP on a port.

Syntax

gmrp enable

no gmrp enable

Default Configuration

GMRP is disabled by default.

Command Mode

Global Configuration and Interface Configuration modes

User Guidelines

IGMP snooping is incompatible with GMRP and must be disabled on any

VLANs running GMRP.

gmrp enable show gmrp configuration

clear gmrp statistics

–

Layer 2 Switching Commands 455

Example

In this example, GMRP is globally enabled.

console(config)#gmrp enable

clear gmrp statistics

Use the clear gmrp statistics command to clear all the GMRO statistics

information.

Syntax

clear gmrp statistics [{gigabitethernet unit/slot/port | port-channel port-

channel-number | tengigabitethernet unit/slot/port | fortygigabitethernet

unit/slot/port}]

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

This command has no user guidelines.

Example

The following example clears all the GMRP statistics information on port

Gi1/0/8.

console# clear gmrp statistics gigabitethernet 1/0/8

show gmrp configuration

Use the show gmrp configuration command in Global Configuration mode

and Interface Configuration mode to display GMRP configuration.

Syntax

show gmrp configuration

Layer 2 Switching Commands 456

Default Configuration

GMRP is disabled by default.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

console#show gmrp configuration

Global GVRP Mode: Disabled

Join Leave LeaveAll Port VLAN

Interface Timer Timer Timer GVRP Mode Create Register

(centisecs) (centisecs) (centisecs) Forbid Forbid

----------- ----------- ----------- ----------- ----------- ------ ------

Gi1/0/1 20 60 1000 Disabled

Gi1/0/2 20 60 1000 Disabled

Gi1/0/3 20 60 1000 Disabled

Gi1/0/4 20 60 1000 Disabled

Gi1/0/5 20 60 1000 Disabled

Gi1/0/6 20 60 1000 Disabled

Gi1/0/7 20 60 1000 Disabled

Gi1/0/8 20 90 1000 Enabled X

Gi1/0/9 20 60 1000 Disabled

Gi1/0/10 20 60 1000 Disabled

Gi1/0/11 20 60 1000 Disabled

Gi1/0/12 20 60 1000 Disabled

Gi1/0/13 20 60 1000 Disabled

Gi1/0/14 20 60 1000 Disabled

Gi1/0/15 20 60 1000 Disabled

Gi1/0/16 20 60 1000 Disabled

Gi1/0/17 20 60 1000 Disabled

Layer 2 Switching Commands 457

GVRP Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

GARP VLAN Registration Protocol (GVRP) is used to propagate VLAN

membership information throughout the network. GVRP is based on the

Generic Attribute Registration Protocol (GARP), which defines a method of

propagating a defined attribute (that is, VLAN membership) throughout the

network. GVRP allows both end stations and the networking device to issue

and revoke declarations relating to membership in VLANs. End stations that

participate in GVRP register VLAN membership using GARP Protocol Data

Unit (GPDU) messages. Networking devices that implement the GVRP

protocol and enable GVRP then process the GPDUs. The VLAN registration

is made in the context of the port that receives the GPDU. The networking

device propagates this VLAN membership on all of its other ports in the

active topology. Thus, the end station VLAN ID is propagated throughout the

network. GVRP is an application defined in the IEEE 802.1p standard that

allows for the control of 802.1Q VLANs.

NOTE: This feature is not available on the N3000 when loaded with the

AGGREGATION ROUTER enabled firmware (e.g., N3000_BGPvA.B.C.D.stk).

Commands in this Section

This section explains the following commands:

clear gvrp statistics

Use the clear gvrp statistics command to clear all the GVRP statistics

information.

clear gvrp statistics gvrp vlan-creation-forbid

garp timer show gvrp configuration

gvrp enable (Global Configuration) show gvrp error-statistics

gvrp enable (Interface Configuration) show gvrp statistics

gvrp registration-forbid

–

Layer 2 Switching Commands 458

Syntax

clear gvrp statistics [interface-id]

• interface-id—An Ethernet interface identifier or a port channel identifier

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

This command has no user guidelines.

Example

The following example clears all the GVRP statistics information on interface

Gi1/0/8.

console# clear gvrp statistics gigabitethernet 1/0/8

garp timer

Use the garp timer command in Interface Configuration mode to adjust the

GARP application join, leave, and leaveall GARP timer values. To reset the

timer to default values, use the no form of this command.

Syntax

garp timer {join | leave | leaveall} timer_value

no garp timer

•join — Indicates the time in centiseconds that PDUs are transmitted.

•leave — Indicates the time in centiseconds that the device waits before

leaving its GARP state.

•leaveall — Used to confirm the port within the VLAN. The time is the

interval between messages sent, measured in centiseconds.

• timer_value — Timer values in centiseconds. The range is 10-100 for join,

20-600 for leave, and 200-6000 for leaveall.

Layer 2 Switching Commands 459

Default Configuration

The default timer values are as follows:

• Join timer — 20 centiseconds

• Leave timer — 60 centiseconds

• Leaveall timer — 1000 centiseconds

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

This command is available in Ethernet interface configuration mode and port

channel interface configuration mode. The following relationships for the

various timer values must be maintained:

• Leave time must be greater than or equal to three times the join time.

• Leaveall time must be greater than the leave time.

Set the same GARP timer values on all Layer 2-connected devices. If the

GARP timers are set differently on Layer 2-connected devices, the GARP

application will not operate successfully.

The timer_value setting must be a multiple of 10.

Example

The following example sets the leave timer for port 1/0/8 to 90 centiseconds.

console (config)# interface gigabitethernet 1/0/8

console (config-if-Gi1/0/8)# garp timer leave 90

gvrp enable (Global Configuration)

Use the gvrp enable (global) command in Global Configuration mode to

enable GVRP globally on the switch. To disable GVRP globally on the switch,

use the no form of this command.

Syntax

gvrp enable

Layer 2 Switching Commands 460

no gvrp enable

Default Configuration

GVRP is globally disabled.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example globally enables GVRP on the device.

console(config)#gvrp enable

gvrp enable (Interface Configuration)

Use the gvrp enable command in Interface Configuration mode to enable

GVRP on an interface. To disable GVRP on an interface, use the no form of

this command.

Syntax

gvrp enable

no gvrp enable

Default Configuration

GVRP is disabled on all interfaces by default.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

Layer 2 Switching Commands 461

User Guidelines

This command is available in Ethernet interface configuration mode and port

channel interface configuration mode. An Access port cannot join

dynamically to a VLAN because it is always a member of only one VLAN.

Membership in untagged VLAN would be propagated in a same way as a

tagged VLAN. In such cases it is the administrator’s responsibility to set the

PVID to be the untagged VLAN VID.

Example

The following example enables GVRP on Gigabit Ethernet 1/0/8.

console(config)#interface gigabitethernet 1/0/8

console(config-if-Gi1/0/8)#gvrp enable

gvrp registration-forbid

Use the gvrp registration-forbid command in Interface Configuration mode

to deregister all VLANs on a port and prevent any dynamic registration on the

port. To allow dynamic registering for VLANs on a port, use the no form of

this command.

Syntax

gvrp registration-forbid

no gvrp registration-forbid

Default Configuration

Dynamic registering and deregistering for each VLAN on the port is not

forbidden.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

This command is available in Ethernet interface configuration mode and port

channel interface configuration mode.

Layer 2 Switching Commands 462

Example

The following example shows how default dynamic registering and

deregistering is forbidden for each VLAN on port 1/0/8.

console(config)#interface gigabitethernet 1/0/8

console(config-if-Gi1/0/8)#gvrp registration-forbid

gvrp vlan-creation-forbid

Use the gvrp vlan-creation-forbid command in Interface Configuration mode

to disable dynamic VLAN creation. To enable dynamic VLAN creation, use

the no form of this command.

Syntax

gvrp vlan-creation-forbid

no gvrp vlan-creation-forbid

Default Configuration

By default, dynamic VLAN creation is enabled.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

This command is available in Ethernet interface configuration mode and port

channel interface configuration mode.

Example

The following example disables dynamic VLAN creation on port 1/0/8.

console(config)#interface gigabitethernet 1/0/8

console(config-if-Gi1/0/8)#gvrp vlan-creation-forbid

Layer 2 Switching Commands 463

show gvrp configuration

Use the show gvrp configuration command to display GVRP configuration

information. Timer values are displayed. Other data shows whether GVRP is

enabled and which ports are running GVRP.

Syntax

show gvrp configuration [ interface-id ]

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command is valid for Ethernet and port-channel interfaces. If no

interface-id parameter is given, all interfaces are shown.

Example

The following example shows how to display GVRP configuration

information:

console# show gvrp configuration

Global GVRP Mode: Disabled

Join Leave LeaveAll Port VLAN

Interface Timer Timer Timer GVRP Mode Create Register

(centisecs) (centisecs) (centisecs) Forbid Forbid

----------- ----------- ----------- ----------- ----------- ------ ------

Gi1/0/1 20 60 1000 Disabled

Gi1/0/2 20 60 1000 Disabled

Gi1/0/3 20 60 1000 Disabled

Gi1/0/4 20 60 1000 Disabled

Gi1/0/5 20 60 1000 Disabled

Gi1/0/6 20 60 1000 Disabled

Gi1/0/7 20 60 1000 Disabled

Gi1/0/8 20 60 1000 Disabled

Gi1/0/9 20 60 1000 Disabled

Gi1/0/10 20 60 1000 Disabled

Layer 2 Switching Commands 464

Gi1/0/11 20 60 1000 Disabled

Gi1/0/12 20 60 1000 Disabled

Gi1/0/13 20 60 1000 Disabled

Gi1/0/14 20 60 1000 Disabled

show gvrp error-statistics

Use the show gvrp error-statistics command in User Exec mode to display

GVRP error statistics.

Syntax

show gvrp error-statistics [interface-id]

• interface-id—An Ethernet interface identifier or a port channel interface

identifier.

Default Configuration

This command has no default configuration.

Command Mode

User Exec mode, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

If no interface-id parameter is given, all interfaces are shown.

Example

The following example displays GVRP error statistics information.

console>show gvrp error-statistics

GVRP error statistics:

----------------

Legend:

INVPROT: Invalid Protocol Id INVATYP: Invalid Attribute Type

INVALEN: Invalid Attribute Length INVAVAL: Invalid Attribute Value

INVEVENT: Invalid Event

Port INVPROT INVATYP INVAVAL INVALEN INVEVENT

---- ------- ------- ------- ------- --------

Layer 2 Switching Commands 465

Gi1/0/1 0 0 0 0 0

Gi1/0/2 0 0 0 0 0

Gi1/0/3 0 0 0 0 0

Gi1/0/4 0 0 0 0 0

show gvrp statistics

Use the show gvrp statistics command in User Exec mode to display GVRP

statistics.

Syntax

show gvrp statistics [interface-id]

• interface-id —A physical interface identifier or a port channel interface

identifier.

Default Configuration

This command has no default configuration.

Command Mode

User Exec mode, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

This command has no user guidelines.

Example

This example shows output of the show gvrp statistics command.

console>show gvrp statistics

GVRP statistics:

------------------------------

Legend:

rJE : Join Empty Received rJIn : Join In Received

rEmp : Empty Received rLIn : Leave In Received

rLE : Leave Empty Received rLA : Leave All Received

sJE : Join Empty Sent JIn : Join In Sent

sEmp : Empty Sent sLIn : Leave In Sent

sLE : Leave Empty Sent sLA : Leave All Sent

Layer 2 Switching Commands 466

Port rJE rJIn rEmp rLIn rLE rLA sJE sJIn sEmp sLIn sLE sLA

---- --- ---- ---- ---- --- --- --- --- --- ---- ---- ---

Gi1/0/1 0 0 0 0 0 0 0 0 0 0 0 0

Gi1/0/2 0 0 0 0 0 0 0 0 0 0 0 0

Gi1/0/3 0 0 0 0 0 0 0 0 0 0 0 0

Gi1/0/4 0 0 0 0 0 0 0 0 0 0 0 0

Gi1/0/5 0 0 0 0 0 0 0 0 0 0 0 0

Gi1/0/6 0 0 0 0 0 0 0 0 0 0 0 0

Gi1/0/7 0 0 0 0 0 0 0 0 0 0 0 0

Gi1/0/8 0 0 0 0 0 0 0 0 0 0 0 0

Layer 2 Switching Commands 467

IGMP Snooping Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Snooping of Internet Group Management Protocol (IGMP) messages is a

feature that allows Dell EMC Networking switches to forward multicast

traffic intelligently on the switch. Multicast traffic is traffic that is destined to

a host group. Host groups are identified by the destination MAC address, i.e.

the range 01:00:5e:00:00:00-01:00:5e:7f:ff:ff:ff for IPv4 multicast traffic or

33:33:xx:xx:xx:xx for IPv6 multicast traffic. Based on the IGMP query and

report messages, the switch forwards traffic only to the ports that request the

multicast traffic. This prevents the switch from broadcasting the traffic to all

ports and possibly affecting network performance.

IGMP snooping switches build forwarding lists by monitoring for, and in

some cases intercepting, IGMP messages. Although the software processing

the IGMP messages could maintain state information based on the full IP

group addresses, the forwarding tables in Dell EMC Networking are mapped

to link layer addresses.

The Multicast Forwarding Database (MFDB) manages the forwarding

address table for Layer 2 multicast protocols, such as IGMP Snooping.

The IGMP Snooping code in the CPU ages out IGMP entries in the MFDB.

If a report for a particular group on a particular interface is not received

within a certain time interval (query interval), the IGMP Snooping code

deletes that interface from the group. The value for query interval time is

configurable using management.

If an IGMP Leave Group message is received on an interface, the IGMP

Snooping code sends a query on that interface and waits a specified length of

time (maximum response time). If no response is received within that time,

that interface is removed from the group. The value for maximum response

time is configurable using management.

In addition to building and maintaining lists of multicast group

memberships, the snooping switch also maintains a list of multicast routers.

When forwarding multicast packets, they should be forwarded on ports that

have joined using IGMP and also on ports on which multicast routers are

attached. The reason for this is that in IGMP there is only one active query

mechanism. This means that all other routers on the network are suppressed

Layer 2 Switching Commands 468

and thus not detectable by the switch. If a query is not received on an

interface within a specified length of time (multicast router present

expiration time), that interface is removed from the list of interfaces with

multicast routers attached. The multicast router present expiration time is

configurable using management. The default value for the multicast router

expiration time is zero, which indicates an infinite time-out (that is, no

expiration).

Commands in this Section

This section explains the following commands:

ip igmp snooping

Use the ip igmp snooping command in Global Configuration mode without

parameters to globally enable Internet Group Management Protocol (IGMP)

snooping. Use the vlan form of the command to enable IGMP snooping on a

specific VLAN. Use the no form of this command to disable IGMP snooping

globally.

Syntax

ip igmp snooping [vlan vlan-id]

no ip igmp snooping [vlan vlan-id]

•

vlan-id

—Specifies a VLAN ID value.

ip igmp snooping ip igmp snooping vlan groupmembership-

interval

show ip igmp snooping ip igmp snooping vlan last-member-query-

interval

show ip igmp snooping groups ip igmp snooping vlan mcrtrexpiretime

show ip igmp snooping mrouter ip igmp snooping report-suppression

ip igmp snooping vlan immediate-leave ip igmp snooping unregistered floodall

–

ip igmp snooping vlan mrouter

Layer 2 Switching Commands 469

Default Configuration

IGMP snooping is enabled globally and on all VLANs by default.

Command Mode

Global Configuration mode

User Guidelines

Use this command without parameters to globally enable IGMP snooping.

Use the no form of the command to disable IGMP snooping. Use the vlan

parameter to enable IGMP snooping on a specific VLAN. GMRP is

incompatible with IGMP snooping and should be disabled on any VLANs on

which IGMP snooping is enabled. It is recommended that MLD snooping

should be enabled whenever IGMP snooping is enabled to ensure that

unwanted pruning of multicast protocol packets used by other protocols does

not occur.

Enabling IGMP snooping on a VLAN in which L3 multicast is enabled is

recommended. If a multicast source is connected to a VLAN on which both

L3 multicast and IGMP/MLD snooping are enabled, the multicast source is

forwarded to the mrouter ports, including the internal mrouter port. If IGMP

snooping is disabled, multicast data plane packets are flooded in the VLAN.

IGMP snooping (and IGMP querier) validates IGMP packets. As part of the

validation, IGMP checks for the router alert option. If other devices in the

network do not send IGMP packets with the router alert option, IGMP

snooping (and snooping querier) will discard the packet. Use the no ip igmp

snooping router-alert-check command to disable checking for the router alert

option. IGMP packets are intended to be confined to the local link, IGMP

snooping validates that the IP TTL is 1 and discards packets with other

values.

Example

console(config)#ip igmp snooping

console(config)#no ip igmp snooping vlan 1

Command History

Revised in 6.3.5 release.

Layer 2 Switching Commands 470

show ip igmp snooping

Use the show ip igmp snooping command to display the IGMP snooping

configuration and SSM statistics.

Syntax

show ip igmp snooping [vlan vlan-id]

•

vlan-id

—Specifies a VLAN ID value.

Default Configuration

This command has no default configuration.

Command Mode

User Exec, Privileged Exec, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

console(config)#show ip igmp snooping

Admin Mode..................................... Enable

IGMP Router-Alert check........................ Enabled

Multicast Control Frame Count.................. 0

SSM FDB Capacity............................... 0

SSM FDB Current Entries........................ 0

SSM FDB High Water Mark. ...................... 0

Flooding Unregistered to All Ports............. Disabled

Vlan 1:

--------

IGMP Snooping Admin Mode....................... Enabled

Immediate Leave Mode........................... Disabled

Group Membership Interval...................... 260

Last Member Query Interval..................... 10

Multicast Router Expiry Time................... 300

Report Suppression Mode........................ Enabled

Layer 2 Switching Commands 471

show ip igmp snooping groups

Use the show ip igmp snooping groups command in User Exec mode to

display the Multicast groups learned by IGMP snooping and IGMP SSM

entries.

Syntax

show ip igmp snooping groups [vlan vlan-id] [address ip-multicast-address]

• vlan-id — Specifies a VLAN ID value.

• ip-multicast-address — Specifies an IP Multicast address.

Default Configuration

This command has no default configuration.

Command Mode

User Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

To see the full Multicast address table (including static addresses) use the

show mac address-table

command.

Example

This example shows IGMPv2 snooping entries

console(config)#show ip igmp snooping groups

Vlan Group Type OIFs

---- ----------------------- ------- ------------------------------------

1 224-239.129|1.2.3 Dynamic Te1/0/1,Te1/0/17

IGMP SSM Entries:

-------------------

VLAN Group Reporter Filter IIF Source Address

---- ------------------ ----------------- ------- ---------- ---------------

1 224.2.2.2 192.168.10.2 include Te1/0/1 1.1.1.2

2.2.2.2

Layer 2 Switching Commands 472

1 224.3.3.3 192.168.10.2 include Te1/0/1 4.4.4.4

VLAN Group Reporter Filter IIF Source Address

---- --------------------- ----------------- ------- ---------- -----------

1 224.2.2.2 192.168.10.2 include Te1/0/1 1.1.1.2

console(config)#show ip igmp snooping

Admin Mode..................................... Enable

IGMP Router-Alert check........................ Disabled

Multicast Control Frame Count.................. 6847

SSM FDB Capacity............................... 128

SSM FDB High Water Mark........................ 1

SSM FDB Current Entries........................ 1

Flooding Unregistered to All Ports............. Disabled

Vlan 1:

--------

IGMP Snooping Admin Mode....................... Enabled

Immediate Leave Mode........................... Disabled

Group Membership Interval...................... 260

Last Member Query Interval..................... 10

Multicast Router Expiry Time................... 300

Report Suppression Mode........................ Enabled

show ip igmp snooping mrouter

Use the show ip igmp snooping mrouter command to display information on

dynamically learned Multicast router interfaces.

Syntax

show ip igmp snooping mrouter

Default Configuration

This command has no default configuration.

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

Layer 2 Switching Commands 473

User Guidelines

This command has no user guidelines.

Example

The following example shows IGMP snooping mrouter information.

console#show ip igmp snooping mrouter

VLAN ID Port

------- -----------

10 Gi2/0/1

ip igmp snooping vlan immediate-leave

This command enables or disables IGMP Snooping immediate-leave mode

on a selected VLAN. Enabling immediate-leave allows the switch to

immediately remove the layer 2 LAN interface from its forwarding table entry

upon receiving an IGMP leave message for that multicast group without first

sending out MAC-based general queries to the interface. The no form of this

command disables IGMP Snooping immediate-leave mode on a VLAN.

You should enable immediate-leave admin mode only on VLANs where only

one host is connected to each layer 2 LAN port. This setting prevents the

inadvertent dropping of the other hosts that were connected to the same layer

2 LAN port but were still interested in receiving multicast traffic directed to

that group. Also, immediate-leave processing is supported only with IGMP

version 2 hosts.

Syntax

ip igmp snooping vlan vlan-id immediate-leave

no ip igmp snooping vlan vlan-id immediate-leave

• vlan id — A VLAN identifier (range 1-4093).

Default Configuration

IGMP snooping immediate-leave mode is disabled on VLANs by default.

Command Mode

Global Configuration mode

Layer 2 Switching Commands 474

User Guidelines

This command has no user guidelines.

Example

The following example enables IGMP snooping immediate-leave mode on

VLAN 2.

console(config)#ip igmp snooping vlan 2 immediate-leave

ip igmp snooping vlan groupmembership-interval

This command sets the IGMP Group Membership Interval time on a VLAN.

The Group Membership Interval time is the amount of time in seconds that a

switch waits for a report from a particular group on a particular interface

before deleting the interface from the entry. This value must be greater than

the IGMPv3 Maximum Response time value. The range is 2 to 3600 seconds.

The no form of this command sets the IGMPv3 Group Membership Interval

time to the default value.

Syntax

ip igmp snooping vlan vlan-id groupmembership-interval time

no ip igmp snooping vlan vlan-id groupmembership-interval

• vlan-id — A VLAN identifier (Range 1-4093).

• time — IGMP group membership interval time in seconds. (Range: 2–

3600)

Default Configuration

The default group membership interval time is 260 seconds.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Layer 2 Switching Commands 475

Example

The following example configures an IGMP snooping group membership

interval of 1500 seconds on VLAN 2.

console(config)#ip igmp snooping vlan 2 groupmembership-interval 1500

ip igmp snooping vlan last-member-query-

interval

This command sets the last-member-query interval on a particular VLAN.

The last-member-query-interval is the amount of time in seconds after which

a host is considered to have left the group. This value must be less than the

IGMP Query Interval time value. The range is 1 to 25 seconds. The no form

of this command sets the last-member-query-interval on the VLAN to the

default value.

Syntax

ip igmp snooping vlan vlan-id last-member-query-interval time

no ip igmp snooping vlan vlan-id last-member-query-interval

• vlan-id — A VLAN identifier (Range 1-4093).

• time — Number of seconds after which a host is considered to have left

the group. (Range: 1-25)

Default Configuration

The default maximum response time is 10 seconds.

Command Mode

Global Configuration mode

User Guidelines

When using IGMP Snooping Querier, this parameter should be less than the

value for the IGMP Snooping Querier query interval.

Example

The following example sets the maximum response time to 7 seconds on

VLAN 2.

Layer 2 Switching Commands 476

console(config)#ip igmp snooping vlan 2 last-member-query-interval 7

ip igmp snooping vlan mcrtrexpiretime

This command sets the Multicast Router Present Expiration time. The time

is set on a particular VLAN. This is the amount of time in seconds that a

switch waits for a query to be received on an interface before the interface is

removed from the list of interfaces with multicast routers attached. The range

is 1–2147483647 seconds. A value of 0 indicates an infinite time-out (no

expiration). The no form of this command sets the Multicast Router Present

Expiration time to 0. The time is set for a particular VLAN.

Syntax

ip igmp snooping vlan vlan-id mcrtexpiretime time

no ip igmp snooping vlan vlan-id mcrtexpiretime time

• vlan-id — A VLAN identifier (Range 1-4093).

• time— Multicast router present expiration time. (Range: 1–3600)

Default Configuration

The default multicast router present expiration time is 300 seconds.

Command Mode

Global Configuration mode

User Guidelines

The mcrexpiretime should be less than the group membership interval.

Example

The following example sets the multicast router present expiration time on

VLAN 2 to 60 seconds.

console(config)#ip igmp snooping vlan 2 mcrtrexpiretime 1500

ip igmp snooping report-suppression

This command enables IGMP report suppression on a specific VLAN. The no

form of this command disables report suppression.

Layer 2 Switching Commands 477

Syntax

ip igmp snooping vlan vlan-id report-suppression

no ip igmp snooping vlan vlan-id report-suppression

• vlan-id — A VLAN identifier (Range 1-4093).

Default Configuration

Report suppression is enabled by default.

Command Mode

Global Configuration mode

User Guidelines

When IGMP report suppression is enabled, the switch only sends the first

report received for a group in response to a query. Report suppression is only

applicable to IGMPv1 and IGMPv2.

Example

The following example sets the snooping report suppressions time to 10

seconds.

console(config)#ip igmp snooping vlan 10 report-suppression

ip igmp snooping unregistered floodall

This command enables flooding of unregistered multicast traffic to all ports

in the VLAN. Use the no form of this command to only flood unregistered

multicast traffic to multicast router ports.

Syntax

ip igmp snooping unregistered floodall

no ip igmp snooping unregistered floodall

Default Configuration

Unregistered multicast traffic is only flooded to router ports by default.

Layer 2 Switching Commands 478

Command Mode

Global Configuration mode.

User Guidelines

There is no equivalent MLD command since this setting applies to both

protocols.

Example

console(config)#ip igmp snooping unregistered floodall

ip igmp snooping vlan mrouter

This command statically configures a port as connected to a multicast router

for a specified VLAN. Use the no form of this command to remove the static

binding.

Syntax

ip igmp snooping vlan vlan-id mrouter interface interface-id

no ip igmp snooping vlan vlan-id mrouter interface interface-id

• vlan-id — A VLAN identifier (Range 1-4093).

• interface-id—The next-hop interface to the multicast router. Ethernet

interface identifiers and port channel identifiers are allowed.

Default Configuration

There are no multicast router ports configured by default.

Command Mode

Global Configuration mode.

User Guidelines

It is preferable to configure mrouter ports for IGMP snooping as opposed to

configuring a static MAC address entry for the router. A static MAC address

entry is tied to a specific port whereas an mrouter configuration will

dynamically learn the MAC address of the router. Multiple mrouter ports may

be configured for a VLAN.

Layer 2 Switching Commands 479

IGMP snooping will consider that an mrouter is active if an mrouter port is

defined in the VLAN, regardless of whether the mrouter port is up or not. If

an mrouter port is defined, IGMP snooping will not flood multicast source

packets received in the VLAN. This behavior can be used to ensure that

IGMP snooping will selectively forward IPv4 multicast data traffic in a VLAN

even if no dynamically discovered IPv4 multicast router has been discovered.

Multicast data plane traffic from multicast sources in a VLAN is always

forwarded to the mrouter ports in the VLAN. Multicast control plane packets

(those addressed to the reserved 224.0.0.X address) are always flooded in the

VLAN, regardless of whether an mrouter port is defined or not.

Example

console(config)#ip igmp snooping vlan 10 mrouter interface Gi1/0/2

Layer 2 Switching Commands 480

IGMP Snooping Querier Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

The IGMP Snooping Querier is an extension to the IGMP Snooping feature.

IGMP Snooping Querier allows the switch to simulate an IGMP router in a

Layer 2-only network, thus removing the need to have an IGMP Router to

collect and refresh the multicast group membership information. The querier

function simulates a small subset of the IGMP router functionality. IGMP

Snooping Querier is not recommended for networks in which a multicast

router is reachable.

In a network with IP multicast routing, an IP multicast router acts as the

IGMP querier. However, if it is required that the IP-multicast traffic in a

VLAN be switched and no multicast router is present in the network, the Dell

EMC Networking switch can be configured as an IGMP querier. When IGMP

Snooping Querier is enabled, the Querier sends out periodic IGMP General

Queries that trigger the multicast listeners/members to send their joins to the

querier so as to receive the multicast data traffic. IGMP snooping listens to

these reports to establish the appropriate L2 forwarding table entries.

The Dell EMC Networking supports version IGMP V1 and 2 for snooping

IGMP queries.

Commands in this Section

This section explains the following commands:

ip igmp snooping querier

This command enables IGMP Snooping Querier on the system (Global

Configuration mode) or on a VLAN. Using this command, you can specify

the IP address that the snooping querier switch should use as the source

ip igmp snooping querier ip igmp snooping querier timer expiry

ip igmp snooping querier election

participate

ip igmp snooping querier version

ip igmp snooping querier query-interval show ip igmp snooping querier

Layer 2 Switching Commands 481

address when generating periodic queries. The no form of this command

disables IGMP Snooping Querier on the system. Use the optional address

parameter to set or reset the querier address.

If a VLAN has IGMP Snooping Querier enabled, and IGMP Snooping is

operationally disabled on the VLAN, IGMP Snooping Querier functionality is

disabled on that VLAN. IGMP Snooping Querier functionality is reenabled if

IGMP Snooping becomes operational on the VLAN.

The IGMP Snooping Querier application sends periodic general queries on

the VLAN to solicit membership reports.

Syntax

ip igmp snooping querier [vlan vlan-id] [address ip-address]

no ip igmp snooping querier [vlan vlan-id][address]

• vlan-id — A valid VLAN number.

• ip-address — An IPv4 address used for the source address.

Default Configuration

The IGMP Snooping Querier feature is globally disabled on the switch.

When enabled, the IGMP Snooping Querier stops sending queries if it

detects IGMP queries from a multicast-enabled router. The Snooping

Querier periodically (querier timer expiry) wakes up and listens for IGMP

queries, and if found, goes back to sleep. If no IGMP queries are heard, then

the Snooping Querier will resume querying.

Command Mode

Global Configuration mode

User Guidelines

When using the command in Global Configuration mode to configure a

snooping querier source address, the IPv4 address is the global querier

address. When using the command in VLAN Configuration mode to

configure a snooping querier source address, the IPv4 address is the querier

address for the VLAN. If there are no global or VLAN querier addresses

configured, then the management IP address is used as the IGMP snooping

querier source address. Using all zeros for the querier IP address disables it.

Layer 2 Switching Commands 482

The VLAN IP address takes precedence over the global IP address when both

are configured. IGMP Querier does not detect when the local switch is

configured as a multicast router. It is not recommended to configure both L3

multicast routing and IGMP Querier on the same switch.

IGMP snooping (and IGMP querier) validates IGMP packets. As part of the

validation, IGMP checks for the router alert option. If other devices in the

network do not send IGMP packets with the router alert option, IGMP

snooping (and snooping querier) will discard the packet. Use the no ip igmp

snooping router-alert-check command to disable checking for the router alert

option.

Example

The following example enables IGMP snooping querier in Global

Configuration mode.

console(config)#ip igmp snooping querier vlan 1 address 10.19.67.1

ip igmp snooping querier election participate

This command enables the Snooping Querier to participate in the Querier

Election process when it discovers the presence of another Snooping Querier

in the VLAN. When election mode is enabled, if the Snooping Querier finds

that the other Querier source address is numerically higher than the

Snooping Querier address, it stops sending periodic queries. The Snooping

Querier with the numerically lower IP address wins the election, and

continues sending periodic queries. The no form of this command sets the

snooping querier not to participate in the querier election but to stop sending

queries as soon as it discovers the presence of another querier in the VLAN.

Syntax

ip igmp snooping querier election participate vlan-id

no ip igmp snooping querier election participate vlan-id

Parameters

• vlan-id—The VLAN identifier on which the querier is expected to operate.

Range 1-4093.

Layer 2 Switching Commands 483

Default Configuration

The snooping querier is configured to not participate in the querier election

by default.

Command Mode

Global Configuration mode

User Guidelines

If the switch detects another querier in the VLAN, it will cease sending

queries for the querier timeout period.

Example

The following example configures the snooping querier to participate in the

querier election on VLAN 10.

console(config)#ip igmp snooping querier election participate 10

ip igmp snooping querier query-interval

This command sets the IGMP Querier Query Interval time, which is the

amount of time in seconds that the switch waits before sending another

periodic query. The no form of this command sets the IGMP Querier Query

Interval time to its default value.

Syntax

ip igmp snooping querier query-interval interval-count

no ip igmp snooping querier query-interval

• interval–count — Amount of time in seconds that the switch waits before

sending another general query. (Range: 1-1800)

Default Configuration

The query interval default is 60 seconds.

Command Mode

Global Configuration mode

Layer 2 Switching Commands 484

User Guidelines

The value of this parameter should be larger than the IGMP Max Response

Time value inserted into general query messages by the querier. The default

IGMP Max Response Time is defined in RFC 3376 as 10 seconds. Dell EMC

Networking queriers use this value when sending general query messages.

Use the show ip igmp snooping querier vlan command to display the

operational max response time value.

Example

The following example sets the query interval to 1800:

console(config)#ip igmp snooping querier query-interval 1800

ip igmp snooping querier timer expiry

This command sets the IGMP Querier timer expiration period which is the

time period that the switch remains in Non-Querier mode after it has

discovered that there is a Multicast Querier in the network. The no form of

this command sets the IGMP Querier timer expiration period to its default

value.

Syntax

ip igmp snooping querier timer expiry seconds

no ip igmp snooping querier timer expiry

• seconds — The time in seconds that the switch remains in Non-Querier

mode after it has discovered that there is a multicast querier in the

network. The range is 60–300 seconds.

Default Configuration

The query interval default is 60 seconds.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Layer 2 Switching Commands 485

Example

The following example sets the querier timer expiry time to 100 seconds.

console(config)#ip igmp snooping querier timer expiry 100

ip igmp snooping querier version

This command sets the IGMP version of the query that the snooping switch

is going to send periodically. The no form of this command sets the IGMP

Querier Version to its default value.

Syntax

ip igmp snooping querier version version

no ip igmp snooping querier version

• version — IGMP version. (Range: 1–2)

Default Configuration

The querier version default is 2.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example sets the IGMP version of the querier to 1.

console(config)#ip igmp snooping querier version 1

show ip igmp snooping querier

This command displays IGMP Snooping Querier information. Configured

information is displayed whether or not IGMP Snooping Querier is enabled.

If a querier is active in the network and IGMP snooping querier is enabled,

the querier’s IP address is shown in the Last Querier Address field.

Layer 2 Switching Commands 486

Syntax

show ip igmp snooping querier [detail | vlan vlan-id]

• vlan-id —Specifies a VLAN ID value.

Default Configuration

This command has no default configuration.

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

submodes

User Guidelines

When the optional argument vlan-id is not used, the command shows the

following information.

When a value is given for vlan-id, the following information appears.

Parameter Description

IGMP Snooping

Querier

Indicates whether or not IGMP Snooping Querier is active on

the switch.

IGMP Version Indicates the version of IGMP that will be used while sending

out the queries.

Querier Address Shows the IP address that is used in the IPv4 header when

sending out IGMP queries. It can be configured using the

appropriate command.

Querier Query

Interval

Shows the amount of time in seconds that a Snooping Querier

waits before sending out the periodic general query.

Querier Expiry

Interval

Displays the amount of time to wait in the Non-Querier

operational state before moving to a Querier state.

Parameter Description

IGMP Snooping

Querier VLAN

Mode

Indicates whether IGMP Snooping Querier is active on the

VLAN.

Layer 2 Switching Commands 487

If no querier has been elected, the Elected Querier output is not shown. If the

querier has not received any queries, then the Last Querier Address

information is not shown. When the optional argument detail is used, the

command shows the global information and the information for all Querier

enabled VLANs.

Example

The following example shows querier information for VLAN 1.

console#show ip igmp snooping querier vlan 1

Vlan 1 : IGMP Snooping querier status

----------------------------------------------

IGMP Snooping Querier Vlan Mode................ Enable

Querier Election Participate Mode.............. Disable

Querier Vlan Address........................... 10.19.67.1

Operational State Indicates whether IGMP Snooping Querier is in the Querier or

Non-Querier state. When the switch is in Querier state it sends

out periodic general queries. When in Non-Querier state it

waits for moving to Querier state and does not send out any

queries.

VLAN Operational

Max Response Time

Indicates the time to wait before removing a Leave from a host

upon receiving a Leave request. This value is calculated

dynamically from the Queries received from the network. If the

Snooping Switch is in Querier state, then it is equal to the

configured value.

Querier Election

Participate Mode

Indicates whether the IGMP Snooping Querier participates in

querier election if it discovers the presence of a querier in the

VLAN.

Last Address Indicates the IP address of the most recent Querier from which

a Query was received.

Operational Version Indicates the IGMP version of the most recent Querier from

which a Query was received on this VLAN.

Elected Querier Indicates the IP address of the Querier that has been

designated as the Querier based on its source IP address. This

field will be 0.0.0.0 when Querier Election Participate mode is

disabled.

Parameter Description

Layer 2 Switching Commands 488

Operational State.............................. Querier

Operational version............................ 1

Layer 2 Switching Commands 489

Interface Error Disable and Auto

Recovery

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Interface error disable automatically disables an interface when an error is

detected; no traffic is allowed until the interface is either manually re-enabled

or, if auto recovery is configured, the configured auto recovery time interval

has passed.

For interface error disable and auto recovery, when an error condition is

detected for an interface, the interface is placed in a diagnostic disabled state

by shutting down the interface. The error disabled interface does not allow

any traffic until the interface is re-enabled. The error disabled interface can

be manually enabled using the no shutdown command. Alternatively

administrator can enable auto recovery feature. Dell EMC Networking Auto

Recovery re-enables the interface after the expiry of configured time interval.

Commands in this Section

This section explains the following commands:

errdisable recovery cause

Use the errdisable recovery cause command to enable automatic recovery of

any interface when disabled from the listed cause. Use the no form of the

command to disable auto-recovery globally or for a specific cause.

Syntax

errdisable recovery cause {all | arp-inspection | bpduguard | dhcp-rate-

| mcast-storm | bpdustorm | loop-protect | port-security}

• All — Recovery for all possible causes is enabled.

errdisable recovery cause show errdisable recovery

errdisable recovery interval show interfaces status err-disabled

Layer 2 Switching Commands 490

• arp-inspection — Recovery for the dynamic ARP inspection cause is

enabled.

• dhcp-rate-limit — Recovery for the DHCP rate limit cause is enabled.

• bcast-storm — Recovery for broadcast storm disabled interfaces is enabled.

• bpdustorm — Recovery for BPDU storm disabled interfaces is enabled.

• bpduguard — Recovery for BPDU protection disabled interfaces is

enabled.

• loop-protect — Recovery for loop protection disabled interfaces is enabled.

• mcast-storm — Recovery for multicast storm disabled interfaces is

enabled.

• port-security — Recovery for port security violations is enabled.

• sfp-mismatch — Recovery for insertion of an unsupported transceiver.

• sfpplus-mismatch — Recovery for insertion of an SFP+ transceiver in an

SFP port.

• udld — Recovery for UDLD disabled interfaces is enabled.

• ucast-storm — Recovery for unicast storm disabled interfaces is enabled.

Default Configuration

No recovery causes are enabled by default.

Command Mode

Global Configuration mode

User Guidelines

Error disabled interfaces indicate that a problem occurred that must be

resolved by the administrator. This could be a configuration problem or a

physical problem (wiring) and does not necessarily indicate a problem with

the switch.

This command enables auto-recovery of an interface for the specified cause

(e.g., bpduguard) or all causes. An interface in the disabled state due to the

configured cause is recovered (link up) when the recovery interval expires. If

Layer 2 Switching Commands 491

the interface continues to encounter errors (from any listed cause), it may be

placed back in the diag-disable state and the interface will be disabled (link

down).

Interfaces in the disabled state due to a listed cause may be manually

recovered by entering the no shutdown command for the interface.

Interfaces in the disabled state may be manually shut down. These interfaces

will not be recovered.

Auto-recovery applies to physical interfaces and link aggregation groups.

Command History

Implemented in version 6.3.0.1 firmware.

Example

The following example enables auto-recovery for all causes.

console(config)#errdisable recovery cause all

errdisable recovery interval

Use the errdisable recovery interval command to configure the interval for

error recovery of interfaces disabled due to any cause. Use the no form of the

command to reset the interval to the default.

Syntax

errdisable recovery interval interval

• interval — The interval in seconds. The range is 30-3600 seconds. The

default is 300 seconds.

Default Configuration

The default interval is 300 seconds. Range 30-3600 seconds.

No recovery causes are enabled by default.

Command Mode

Global Configuration mode

Layer 2 Switching Commands 492

User Guidelines

Error disabled interfaces indicate that a problem that must be resolved by the

administrator. This could be a configuration problem or a physical problem

and does not necessarily indicate a problem with the switch.

When the interval expires, the system examines the error disabled interfaces

and recovers them if recovery for the indicated cause is enabled. Only a single

timer is used and recovery occurs when the timer expires, not when the

interface time expires.

Interfaces recovered by auto-recovery issue a log message indicating that

recovery is being attempted.

<13> Sep 25 14:38:32 10.130.135.107-1 UDLD[nim_t]: udld_util.c(1829) 87 %%

Interface Gi1/0/1 is restored from the error disabled state.

Command History

Implemented in version 6.3.0.1 firmware.

Example

The following example sets the error recovery timer to 30 seconds.

console(config)#errdisable recovery interval 30

show errdisable recovery

Use the show errdisable recovery command to display the error disable

configuration for each possible cause.

Syntax

show errdisable recovery

Default Configuration

By default, no recovery causes are enabled.

Command Mode

Global Configuration mode

Layer 2 Switching Commands 493

User Guidelines

Error disabled interfaces indicate that a problem that must be resolved by the

administrator. This could be a configuration problem or a physical problem

and does not necessarily indicate a problem with the switch.

When the interval expires, the system examines the error disabled interfaces

and recovers them if recovery for the indicated cause is enabled. Only a single

timer is used and recovery occurs when the timer expires, not when the

interface time expires.

Interfaces recovered by auto-recovery issue a log message indicating that

recovery is being attempted.

<13> Sep 25 14:38:32 10.130.135.107-1 UDLD[nim_t]: udld_util.c(1829) 87 %%

Interface Gi1/0/1 is restored from the error disabled state.

The following information is displayed.

Command History

Implemented in version 6.3.0.1 firmware.

Term Description

ARP inspection ARP inspection auto-recovery.

BPDU Guard BPDU guard auto-recovery.

Broadcast Storm Broadcast storm auto-recovery.

BPDU Storm BPDU storm auto-recovery.

DHCP Rate Limit DHCP rate limit auto-recovery.

Loop Protection Loop protection auto-recovery.

Multicast Storm Multicast storm auto-recovery.

SFP Mismatch SFP mismatch auto-recovery.

SFP Plus Mismatch SFP Plus mismatch auto-recovery.

UDLD UDLD auto-recovery.

Unicast Storm Unicast storm auto-recovery.

Port MAC Locking Port security auto-recovery.

Denial Of Service Denial of Service auto-recovery.

Time interval for auto-recovery in seconds.

Layer 2 Switching Commands 494

Example

console(config)#show errdisable recovery

Reason Auto-recovery Status

------------------ ---------------------

ARP Inspection Disabled

BPDU Guard Disabled

Broadcast Storm Disabled

BPDU Storm Disabled

DHCP Rate Limit Disabled

Loop Protect Disabled

Multicast Storm Disabled

SFP Mismatch Disabled

SFP Plus Mismatch Disabled

UDLD Disabled

Unicast Storm Disabled

Port MAC Locking Disabled

Denial of Service Disabled

Interval for auto-recovery of error disabled interfaces: 300 seconds

show interfaces status err-disabled

Use the show interfaces status err-disabled command to display the

interfaces that are error disabled by the system.

Syntax

show interfaces status err-disabled

Default Configuration

No recovery causes are enabled by default.

Command Mode

Privileged Exec mode, Global Configuration mode and all submodes

User Guidelines

Error disabled interfaces indicate that a problem that must be resolved by the

administrator. This could be a configuration problem or a physical problem

and does not necessarily indicate a problem with the switch.

Layer 2 Switching Commands 495

When the interval expires, the system examines the error disabled interfaces

and recovers them if recovery for the indicated cause is enabled. Only a single

timer is used and recovery occurs when the timer expires, not when the

interface time expires. The recovery delay time indicates the number of

seconds until the interface is eligible for recovery if auto-recovery is enabled

for the indicated cause.

Interfaces recovered by auto-recovery issue a log message indicating that

recovery is being attempted.

<13> Sep 25 14:38:32 10.130.135.107-1 UDLD[nim_t]: udld_util.c(1829) 87 %%

Interface Gi1/0/1 is restored from the error disabled state.

The possible causes for error disabled interfaces are:

Command History

Implemented in version 6.3.0.1 firmware.

Term Description

ARP inspection ARP inspection auto-recovery.

BPDU Guard BPDU guard auto-recovery.

Broadcast Storm Broadcast storm auto-recovery.

BPDU Storm BPDU storm auto-recovery.

DHCP Rate Limit DHCP rate limit auto-recovery.

Loop Protection Loop protection auto-recovery.

Multicast Storm Multicast storm auto-recovery.

SFP Mismatch SFP mismatch auto-recovery.

SFP Plus Mismatch SFP Plus mismatch auto-recovery.

UDLD UDLD auto-recovery.

Unicast Storm Unicast storm auto-recovery.

Port MAC Locking Port security auto-recovery.

Denial Of Service Denial of Service auto-recovery.

Time interval for auto-recovery in seconds.

Layer 2 Switching Commands 496

Example

The following example

console#show interfaces status err-disabled

Interface Reason Recovery Delay

---------- ----------------- --------------

Gi1/0/1 UDLD 279

Gi1/0/2 BPDU Guard 285

Gi1/0/3 BPDU Storm 291

Layer 2 Switching Commands 497

IPv6 Access List Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Access to a switch or router can be made more secure through the use of

Access Control Lists (ACLs) to control the type of traffic allowed into or out

of specific ports. An ACL consists of a series of rules, each of which describes

the type of traffic to be processed and the actions to take for packets that

meet the classification criteria. Rules within an ACL are evaluated

sequentially until a match is found, if any. Every ACL is terminated by an

implicit deny all rule, which covers any packet not matching a preceding

explicit rule. ACLs can help to ensure that only authorized users have access

to specific resources while blocking out any unwarranted attempts to reach

network resources.

ACLs may be used to restrict contents of routing updates, decide which types

of traffic are forwarded or blocked and, above all, provide security for the

network. ACLs are normally used in firewall routers that are positioned

between the internal network and an external network, such as the Internet.

They can also be used on a router positioned between two parts of the

network to control the traffic entering or exiting a specific part of the internal

network.

The Dell EMC Networking ACL feature allows classification of packets based

upon Layer 2 through Layer 4 header information. An Ethernet IPv6 packet is

distinguished from an IPv4 packet by its unique EtherType value; thus all

IPv6 classifiers implicitly include the EtherType field.

Multiple ACLs per interface are supported. The ACLs can be combination of

Layer 2 and/or Layer 3/4 ACLs. ACL assignment is appropriate for both

Ethernet ports and LAGs. ACLs can also be time based.

Commands in this Section

This section explains the following commands:

deny | permit (IPv6 ACL) ipv6 traffic-filter

ipv6 access-list show ipv6 access-lists

ipv6 access-list rename

–

Layer 2 Switching Commands 498

deny | permit (IPv6 ACL)

This command creates a new rule for the current IPv6 access list. Each rule is

appended to the list of configured rules for the list.

A rule may either deny or permit traffic according to the specified

classification fields. At a minimum, either the every keyword or the protocol,

source address, and destination address values must be specified. The source

and destination IPv6 address fields may be specified using the keyword any to

indicate a match on any value in that field. The remaining command

parameters are all optional, but the most frequently used parameters appear

in the same relative order as shown in the command format. An IPv6 ACL

implicitly includes the EtherType in the match criteria.

The assign-queue parameter allows specification of a particular hardware

queue for handling traffic that matches this rule. The assign-queue parameter

is valid only for a permit rule.

The command is enhanced to accept the optional time-range parameter. The

time-range parameter allows imposing a time limitation on the IPv6 ACL rule

as defined by the parameter

time-range-name

. If a time range with the

specified name does not exist, and the IPv6 ACL containing this ACL rule is

applied to an interface or bound to a VLAN, then the ACL rule is applied

immediately. If a time range with the specified name exists, and the IPv6

ACL containing this ACL rule is applied to an interface or bound to a VLAN,

then the ACL rule is applied when the time-range with a specified name

becomes active. The ACL rule is removed when the time-range with a

specified name becomes inactive.

Syntax

[sequence-number] deny | permit (IPV6 ACL)

[sequence number] {deny | permit} {ipv6-protocol | number | every}

{source-ipv6-prefix/prefix-length | any | host source-ipv6-address} [{range

{portkey | startport} {portkey | endport} | {eq | neq | lt | gt} {portkey | 0-

65535}] {destination-ipv6-prefix/prefix-length | any | host destination-ipv6-

address} [{range {portkey | startport} {portkey | endport} | {eq | neq | lt |

gt} {portkey | 0-65535}] [flag [+fin | -fin] [+syn | -syn] [+rst | -rst] [+psh

| -psh] [+ack | -ack] [+urg | -urg] [established]] [flow-label value] [icmp-

type icmp-type [icmp-code icmp-code] | icmp-message icmp-message]

Layer 2 Switching Commands 499

[routing] [fragments] [dscp dscp]}} [time-range time-range-name] [log]

[assign-queue queue-id] [{mirror | redirect} interface-id] [rate-limit rate

burst-size]

no [sequence-number]

• sequence-number — Identifies the order of application of the permit/deny

statement. If no sequence number is assigned, permit/deny statements are

assigned a sequence number beginning at 1000 and incrementing by 10.

Statements are applied in hardware beginning with the lowest sequence

number. Sequence numbers only have applicability within an access group,

i.e. the ordering applies within the access-group scope. The range for

sequence numbers is 1– 2147483647.

•{deny | permit}–Specifies whether the IP ACL rule permits or denies the

matching traffic.

• {ipv6-protocol | number| every }—Specifies the protocol to match for the

IP ACL rule.

– IPv6 protocols: icmpv6, ipv6, sctp, tcp and udp

–Every: Match any protocol (don’t care)

• source-ipv6-prefix/prefixlength | any | host src-ipv6-address—Specifies a

source IP address and netmask to match for the IP ACL rule.

– For IPv6 ACLs, “any” implies a 0::/128 prefix and a mask of all ones.

– Specifying “host X::X” implies a prefix length as “/128” and a mask of

0::/128.

• [{range {portkey | startport} {portkey | endport} | {eq | neq | lt | gt}

{portkey | 0-65535}]—Specifies the layer 4 destination or source port

match condition for the IP/TCP/UDP ACL rule. A source or destination

port number, which ranges from 0-65535, can be entered, or a portkey,

which can be one of the following keywords: bgp, domain, echo, ftp, ftp-

data, http, ntp, pop2, pop3, rip, smtp, snmp, telnet, tftp, telnet, time, who

and www. Each of these keywords translates into its equivalent destination

port number.

– When “range” is specified, IPv6 ACL rule matches only if the layer 4

port number falls within the specified port range. The startport and

endport parameters identify the first and last ports that are part of the

port range. They have values from 0 to 65535. The ending port must

Layer 2 Switching Commands 500

have a value equal or greater than the starting port. The starting port,

ending port, and all ports in between will be part of the layer 4 port

range.

– When “eq” is specified, IPv6 ACL rule matches only if the layer 4 port

number is equal to the specified port number or portkey.

– When “lt” is specified, IPv6 ACL rule matches if the layer 4

destination port number is less than the specified port number or

portkey. It is equivalent to specifying the range as 0 to <specified port

number – 1>.

– When “gt” is specified, IPv6 ACL rule matches if the layer 4

destination port number is greater than the specified port number or

portkey. It is equivalent to specifying the range as <specified port

number + 1> to 65535.

– When “neq” is specified, IPv6 ACL rule matches only if the layer 4

destination port number is not equal to the specified port number or

portkey.

– IPv6 TCP port names: bgp, domain, echo, ftp, ftp-data, http, smtp,

telnet, www, pop2, pop3

– IPv6 UDP port names: domain, echo, ntp, rip, snmp, time, who

• destination-ipv6-prefix/prefix-length | any | host destination-ipv6-

address—Specifies a destination IP address and netmask for match

condition of the IP ACL rule.

– For IPv6 ACLs, “any” implies 0::/128 prefix and a mask of all ones.

– Specifying host implies prefix length as “/128” and a mask of 0::/128.

•[dscp dscp]—Specifies a match of DSCP values.

[+urg | -urg] [established]—Specifies that the IP/TCP/UDP ACL rule

matches on the TCP flags.

– When “+<tcpflagname>” is specified, a match occurs if specified

<tcpflagname> flag is set in the TCP header.

– When “-<tcpflagname>” is specified, a match occurs if specified

<tcpflagname> flag is *NOT* set in the TCP header.

– When “established” is specified, a match occurs if specified either

RST or ACK bits are set in the TCP header.

Layer 2 Switching Commands 501

– This option is visible only if the protocol is tcp.

–Ack – Acknowledgment bit

–Fin – Finished bit

–Psh – push bit

–Rst – reset bit

–Syn – Synchronize bit

–Urg – Urgent bit

• [icmp-type icmp-type [icmp-code icmp-code] | icmp-message icmp-

message]—Specifies a match condition for ICMP packets.

– When icmp-type is specified, IP ACL rule matches on the specified

ICMP message type, a number from 0 to 255.

– When icmp-code is specified, IP ACL rule matches on the specified

ICMP message code, a number from 0 to 255.

– Specifying icmp-message implies both icmp-type and icmp-code are

specified.

– ICMP message is decoded into corresponding ICMP type and ICMP

code within that ICMP type. This option is visible only if the protocol

is “icmpv6”.

– ICMPv6 message types: destination-unreachable echo-reply echo-

request header hop-limit mld-query mld-reduction mld-report nd-na

nd-ns next-header no-admin no-route packet-too-big port-

unreachable router-solicitation router-advertisement router-

renumbering time-exceeded unreachable

– The icmpv6 message types are available only if the protocol is icmpv6.

• flow-label—Specifies a match on the identified flow label. Range 0–

1048575.

• fragments—Specifies the rule matches packets that are non-initial

fragments (fragment bit asserted). Not valid for rules that match L4

information such as TCP port number since that information is carried in

the initial packet. IPv6 fragments contain an IPv6 Fragment extension

header.

• routing—Specifies that IP ACL rule matches on routed packets. Routed

packets contain an IPv6 “routing” extension header.

Layer 2 Switching Commands 502

• log—Specifies that this rule is to be logged when the rule has been

matched one or more times since the expiry of the last logging interval.

The logging interval is five minutes.

• time-range time-range-name—Allows imposing time limitation on the

ACL rule as defined by the parameter time-range-name. If a time range

with the specified name does not exist and the ACL containing this ACL

rule is applied to an interface or bound to a VLAN, then the ACL rule is

applied immediately. If a time range with specified name exists and the

ACL containing this ACL rule is applied to an interface or bound to a

VLAN, then the ACL rule is applied when the time-range with specified

name becomes active. The ACL rule is removed when the time-range with

specified name becomes inactive.

• assign-queue queue-id—Specifies the assign-queue, which is the queue

identifier to which packets matching this rule are assigned.

• {mirror | redirect} interface-id—Specifies the mirror or redirect Ethernet

interface to which packets matching this rule are copied or forwarded,

respectively.

• rate-limit rate burst-size—Specifies the allowed rate of traffic as per the

configured rate in Kbps, and burst-size in kbytes.

– Rate – the committed rate in kilobits per second

– Burst-size – the committed burst size in Kilobytes.

Default Configuration

An implicit deny all condition is added by the system after the last MAC or

IP/IPv6 access group if no route-map is configured on the interface.

Command Mode

IPv6-Access-List Configuration mode

User Guidelines

Users are permitted to add rules, but if a packet does not match any user-

specified rules, the packet is dropped by the implicit “deny all” rule.

In order to provide the greatest amount of flexibility in configuring ACLs, the

permit/deny syntax allows combinations of matching criteria that may not

make sense when applied in practice.

Layer 2 Switching Commands 503

Any – is equivalent to ::/0 for IPv6 access lists.

Host - indicates /128 prefix length for IPv6.

Port ranges are not supported for egress (out) IPv6 traffic-filters. This means

that only the eq operator is supported for egress (out) ACLs.

The protocol type must be SCTP, TCP or UDP to specify a port range. The

protocol type must be IPv6, SCTP, TCP, ICMPv6, or UDP to specify a flow

label.

The IPv6 “fragment” and “routing” keywords are not supported on egress

(out) access groups. The log action is supported for both permit and deny

rules.

If a permit|deny clause is entered with the same sequence number as an

existing rule, the configuration is denied with an error message.

An implicit deny all condition is added by the system after the last MAC or

IP/IPv6 access group if no route-map is configured on the interface.

Every permit/deny rule that does not have a rate-limit parameter is assigned a

counter. If counter resources become exhausted, a warning is issued and the

rule is applied to the hardware without the counter.

If a permit|deny clause is entered with the same sequence number as an

existing rule, an error is displayed and the existing rule is not updated with

the new information.

Since ACLs have an implicit deny all at the end of the last access-group, IPv6

ACLs need an explicit permit icmp any any nd-na and permit icmp any any

nd-ns statements as match conditions. These additional conditions allow for

ICMPv6 neighbor discovery to occur.

For the N4000 series:

• The IPv6 ACL “routing” keyword is not supported when an IPv6 address is

specified.

• For ingress (in) ACLs, the IPv6 ACL “fragment” keyword matches only on

the first two IPv6 extension headers for the fragment header (next header

code 44). If the fragment header appears in the third or subsequent header,

it is not matched.

The rate-limit command is not supported for egress (out) access groups.

Layer 2 Switching Commands 504

For the N1100-ON/N1500/N2000/N2100-ON/N3000/N3100-ON series

switches, for ingress (in) ACLs:

• The IPv6 ACL “fragment” keyword matches only on the first IPv6

extension header for the fragment header (next header code 44). If the

fragment header appears in the second or a subsequent header, it is not

matched.

• The IPv6 ACL “routing” keyword matches only on the first IPv6 extension

header for the routing header (next header code 43). If the fragment

header appears in the second or a subsequent header, it is not matched.

• For all series switches, port ranges are not supported on egress (out) ACLs.

Only the eq operator is supported in an egress ACL.

Command History

Updated in 6.3.0.1 firmware.

Example and description updated in the 6.4 release.

Example

The following example creates rules in an IPv6 ACL named "STOP_HTTP"

to discard any HTTP traffic from the 2001:DB8::0/32 network, but allow all

other traffic from that network:

console(config)#ipv6 access-list STOP_HTTP

console(Config-ipv6-acl)#deny tcp 2001:DB8::0/32 any eq http

console(Config-ipv6-acl)#permit every

ipv6 access-list

The ipv6 access-list command creates an IPv6 Access Control List (ACL)

consisting of classification fields defined for the IP header of an IPv6 frame.

The

name

parameter is a case-sensitive alphanumeric string from 1 to 31

characters uniquely identifying the IPv6 access list.

If an IPv6 ACL with this name already exists, this command enters Ipv6-

Access-List Configuration mode to update the existing IPv6 ACL.

Use the no form of the command to delete an IPv6 ACL from the system.

Layer 2 Switching Commands 505

Syntax

ipv6 access-list name

no ipv6 access-list name

• name — Alphanumeric string of 1 to 31 characters uniquely identifying

the IPv6 access list.

Default Configuration

There is no default configuration for this command.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command

Example

The following example creates an IPv6 ACL named “DELL_IP6” and enters

the IPv6-Access-List Configuration mode:

console(config)#ipv6 access-list DELL_IP6

console(Config-ipv6-acl)#

ipv6 access-list rename

The ipv6 access-list rename command changes the name of an IPv6 Access

Control List (ACL). This command fails if an IPv6 ACL with the new name

already exists.

Syntax

ipv6 access-list rename name newname

• name — the name of an existing IPv6 ACL.

• newname — alphanumeric string from 1 to 31 characters uniquely

identifying the IPv6 access list.

Default Configuration

There is no default configuration for this command.

Layer 2 Switching Commands 506

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console(config)#ipv6 access-list rename DELL_IP6 DELL_IP6_NEW_NAME

ipv6 traffic-filter

The ipv6 traffic-filter command either attaches a specific IPv6 Access

Control List (ACL) to an interface or associates it with a VLAN ID in a given

direction.

Dell EMC Networking switches support configuration of multiple access

groups on interfaces. An optional sequence number may be specified to

indicate the order of this access list relative to other IPv6 access lists already

assigned to this interface and direction. A lower number indicates higher

precedence order. If a sequence number is already in use for this interface and

direction, the specified IPv6 access list replaces the currently attached IPv6

access list using that sequence number. If the sequence number is not

specified for this command, a sequence number that is one greater than the

highest sequence number currently in use for this interface and direction is

used.

Use the “no” form of the command to remove an IPv6 ACL from the

interface(s) in a given direction.

Syntax

ipv6 traffic-filter name [in | out | control-plane][seq-num]

no ipv6 traffic-filter name [in | out | control-plane]

•name — Alphanumeric string of 1 to 31 characters uniquely identifying

the IPv6 access list.

• in — The access list is applied to ingress packets.

• out—The access list is applied to egress packets.

Layer 2 Switching Commands 507

• control-plane—The access list is applied to ingress control plane packets.

This parameter is only available in Global Configuration mode.

• seq-num — Order of access list relative to other access lists already

assigned to this interface and direction. (Range: 1–4294967295)

Default Configuration

No IPv6 traffic filters are configured by default.

Command Modes

Global Configuration mode, Interface Configuration (Ethernet, Port-

channel, VLAN) mode

User Guidelines

This command specified in Interface Configuration mode only affects a

single interface, whereas the Global Configuration mode setting is applied to

all interfaces. The optional control-plane keyword allows application of an

ACL on the CPU port ingress queue. Control plane packets (e.g., BPDUs) are

dropped because of the implicit deny all rule added at the end of every access

control list. To mitigate this behavior, permit rules must be added by the

operator to allow the appropriate control plane packets to ingress the CPU

(i.e., ARP, DHCP, LACP, STP BPDU, etc.). The control-plane keyword does

not filter traffic received over the out-of-band port.

Example

The following example attaches an IPv6 access control list to an interface.

console(config-if-Gi1/0/1)#ipv6 traffic-filter DELL_IP6 in

Command History

Syntax updated in the 6.4 release.

show ipv6 access-lists

Use the show ipv6 access-lists command in User Exec and Privileged Exec

mode to display an IPv6 access list and all of the rules that are defined for the

IPv6 ACL. Use the [name] parameter to identify a specific IPv6 ACL to

display.

Layer 2 Switching Commands 508

Syntax

show ipv6 access-lists [name]

•

name

—

The name used to identify the IPv6 ACL.

Default Configuration

There is no default configuration for this command.

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show ipv6 access-lists

Current number of ACLs: 4 Maximum number of ACLs: 100

ACL Name Rules Interface(s) Direction

Count

------------------------------- ----- ------------------------- --------- --

-------

IPv6-ACL 1 Gi1/0/8 Inbound

43981900

asdasd 2 Gi1/0/7 Inbound

3981901

console#show ipv6 access-lists IPv6-ACL

IPV6 ACL Name: IPv6-ACL

Inbound Interface(s):

Gi1/0/8

Rule Number: 1

Action......................................... permit

Match All...................................... FALSE

Protocol....................................... 6(tcp)

Layer 2 Switching Commands 509

Source IPV6 Address............................ fe80::2121/128

Destination IPV6 Address....................... fe80::1212/128

Destination Layer 4 Operator................... Equal To

Destination L4 Port Keyword.................... 800

Flow Label..................................... 65535

TCP Flags...................................... FIN (Set)

SYN (Ignore)

RST (Ignore)

PSH (Ignore)

ACK (Ignore)

URG (Ignore)

ACL Hit Count.................................. 43981900

Layer 2 Switching Commands 510

IPv6 MLD Snooping Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

In IPv6, Multicast Listener Discover (MLD) snooping performs functions

similar to IGMP snooping in IPv4. With MLD snooping, IPv6 multicast data

is selectively forwarded to a list of ports that want to receive the data, instead

of being flooded to all ports in a VLAN. This list is constructed by snooping

IPv6 multicast control packets.

MLD is a protocol used by IPv6 multicast routers to discover the presence of

multicast listeners (nodes wishing to receive IPv6 multicast packets) on its

directly-attached links and to discover which multicast packets are of interest

to neighboring nodes. MLD is derived from IGMP. MLD version 1 (MLDv1)

is equivalent to IGMPv2. MLD version 2 (MLDv2) is equivalent to IGMPv3.

MLD is a subprotocol of Internet Control Message Protocol version 6

(ICMPv6), and MLD messages are a subset of ICMPv6 messages, identified

in IPv6 packets by a preceding Next Header value of 58.

Dell EMC Networking switches can snoop on both MLDv1 and MLDv2

protocol packets and bridge IPv6 multicast data based on destination IPv6

Multicast MAC Addresses. The switch can be configured to perform MLD

Snooping and IGMP Snooping simultaneously. The Dell EMC Networking

implementation is compliant to RFC 4541.

Commands in this Section

This section explains the following commands:

ipv6 mld snooping vlan groupmembership-

interval

ipv6 mld snooping vlan mrouter

ipv6 mld snooping vlan immediate-leave ipv6 mld snooping (Global)

ipv6 mld snooping listener-message-

suppression

show ipv6 mld snooping

ipv6 mld snooping vlan last-listener-query-

interval

show ipv6 mld snooping groups

ipv6 mld snooping vlan mcrtrexpiretime show ipv6 mld snooping mrouter

Layer 2 Switching Commands 511

ipv6 mld snooping vlan groupmembership-

interval

The ipv6 mld snooping vlan groupmembership-interval command sets the

MLD Group Membership Interval time on a VLAN or interface. The Group

Membership Interval time is the amount of time in seconds that a switch

waits for a report from a particular group on a particular interface before

deleting the interface from the entry. This value must be greater than the

MLDv2 Maximum Response time value. The range is 2 to 3600 seconds.

Syntax

ipv6 mld snooping vlan vlan-id groupmembership-interval time

no ipv6 mld snooping vlan-id groupmembership-interval time

• vlan-id — A VLAN identifier (Range 1-4093).

•time — MLD group membership interval time in seconds. (Range: 2-

3600)

Default Configuration

The default group membership interval time is 260 seconds.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

console(config)#ipv6 mld snooping vlan 2 groupmembership-interval 1500

ipv6 mld snooping vlan immediate-leave

This command enables or disables MLD Snooping immediate-leave mode on

a selected VLAN. Enabling immediate-leave allows the switch to immediately

remove the layer 2 LAN interface from its forwarding table entry upon

receiving an MLD done message for that multicast group without first

sending out MAC-based general queries to the interface.

Layer 2 Switching Commands 512

You should enable immediate-leave admin mode only on VLANs where only

one host is connected to each layer 2 LAN port. This prevents the inadvertent

dropping of the other hosts that were connected to the same layer 2 LAN

port, but were still interested in receiving multicast traffic directed to that

group. Also, immediate-leave processing is supported only with MLD version

1 hosts.

Syntax

ipv6 mld snooping vlan vlan-id immediate-leave

• vlan-id— A VLAN identifier (Range 1-4093).

Default Configuration

Immediate leave is disabled on all VLANs by default.

Command Mode

Global Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

This example enables mld snooping immediate-leave for VLAN 2.

console(config)#ipv6 mld snooping vlan 2 immediate-leave

ipv6 mld snooping listener-message-suppression

This command enables MLD listener message suppression on a specific

VLAN. Use the no form of this command to disable listener message

suppression.

Syntax

ipv6 mld snooping vlan vlan-id listener-message-suppression

no ipv6 mld snooping vlan vlan-id listener-message-suppression

• vlan-id — A VLAN identifier (Range 1-4093).

Layer 2 Switching Commands 513

Default Configuration

Listener message suppression is enabled by default.

Command Mode

Global Configuration mode.

User Guidelines

MLD listener message suppression is equivalent to IGMP report suppression.

When MLD listener message suppression is enabled, the switch only sends

the first report received for a group in response to a query. Listener message

suppression is only applicable to MLDv1.

Example

console(config)#ipv6 mld snooping vlan 10 listener-message-suppression

ipv6 mld snooping vlan last-listener-query-

interval

The ipv6 mld snooping vlan last-listener-query-interval command sets the

number of seconds after which a host is considered to have left the group.

This value must be less than the MLD Query Interval time value. The range

is 1 to 25 seconds.

Syntax

ipv6 mld snooping vlan vlan-id last-listener-query-interval time

no ipv6 mld snooping vlan vlan-id last-listener-query-interval

• vlan-id — A VLAN identifier (Range 1-4093).

• time — The number of seconds after which a host is considered to have

left the group. (Range: 1–25 seconds)

Default Configuration

The default maximum response time is 10 seconds.

Command Mode

Global Configuration mode

Layer 2 Switching Commands 514

User Guidelines

This command has no user guidelines.

Example

console(config)#ipv6 mld snooping vlan 2 last-listener-query-interval 7

ipv6 mld snooping vlan mcrtrexpiretime

The ipv6 mld snooping mcrtrexpiretime command sets the Multicast Router

Present Expiration time. The time is set for a particular interface or VLAN.

This is the amount of time in seconds that a switch waits for a query to be

received on an interface before the interface is removed from the list of

interfaces with multicast routers attached. The range is 1 to 3600 seconds.

Syntax

ipv6 mld snooping vlan vlan-id mcrtrexpiretime time

no ipv6 mld snooping vlan vlan-id mcrtrexpiretime

• vlan-id — A VLAN identifier (Range 1-4093).

• time — Multicast router present expiration time in seconds. (Range: 1–

3600)

Default Configuration

The default multicast router present expiration time is 300 seconds.

Command Mode

Global Configuration mode.

User Guidelines

This command has no user guidelines

Example

console(config)#ipv6 mld snooping vlan 2 mcrtrexpiretime 1500

Layer 2 Switching Commands 515

ipv6 mld snooping vlan mrouter

This command statically configures a port as connected to a multicast router

for a specified VLAN. The no form of this command removes the static

binding.

Syntax

ipv6 mld snooping vlan vlan-id mrouter interface interface

no ipv6 mld snooping vlan vlan-id mrouter interface interface

• vlan-id — A VLAN identifier (Range 1-4093).

• interface-id— The next-hop interface to the Multicast router.

Default Configuration

There are no multicast router ports configured by default.

Command Mode

Global Configuration mode.

User Guidelines

MLD snooping will forward IPv6 multicast data packets in the VLAN if a

static mrouter port is configured. This behavior can be used to ensure that

MLD snooping will selectively forward IPv6 multicast data traffic even if no

dynamically discovered IPv6 multicast router has been discovered.

Example

console(config)#ipv6 mld snooping vlan 10 mrouter interface Gi1/0/2

ipv6 mld snooping (Global)

Use the ipv6 mld snooping (Global) command to globally enable MLD

Snooping on the system (Global Configuration Mode). Use the no form of

the command to disable MLD snooping. Use the vlan parameter to enable

MLD Snooping on a specific VLAN.

Syntax

ipv6 mld snooping [vlan vlan-id]

Layer 2 Switching Commands 516

no ipv6 mld snooping [vlan vlan-id]

• vlan-id — A VLAN identifier (Range 1-4093).

Default Configuration

MLD Snooping is enabled globally and on all VLANs by default.

Command Mode

Global Configuration mode.

User Guidelines

Use this command without parameters to globally enable MLD Snooping.

Use the no form of the command to disable MLD Snooping. Use the vlan

parameter to enable MLD Snooping on a specific VLAN.

It is recommended that IGMP snooping should be enabled whenever MLD

snooping is enabled to ensure that unwanted pruning of multicast protocol

packets used by other protocols does not occur.

Enabling MLD snooping on an IPv6 L3 multicast router is recommended. If a

multicast source is connected to a VLAN on which both L3 multicast and

IGMP/MLD snooping are enabled, the multicast source is forwarded to the

mrouter ports as well as the internal mrouter port. MLD snooping does not

flood IPv6 multicast data plane packets in the VLAN if IPv6 L3 routing is

enabled. If MLD snooping is disabled, the switch will flood multicast data

plane packets in the VLAN.

Example

console(config)#ipv6 mld snooping

console(config)#no ipv6 mld snooping vlan 1

show ipv6 mld snooping

The show ipv6 mld snooping command displays MLD Snooping information

and SSM statistics. Configured information is displayed whether or not MLD

Snooping is enabled.

Syntax

show ipv6 mld snooping [interface interface-id | vlan vlan-id}]

Layer 2 Switching Commands 517

• interface-id—A physical interface identifier or a port channel identifier

• vlan-id—A VLAN identifier.

Default Configuration

This command has no default configuration

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

With no optional arguments, the command displays the following

information:

• Admin Mode — Indicates whether or not MLD Snooping is active on the

switch.

• Multicast Control Frame Count— Displays the total number of IGMP or

PIM packets which have been received (same as IPv4).

• Flooding Unregistered to All Ports—Indicates if Flooding Unregistered to

All Ports is enabled. If enabled, multicast data traffic for which no listeners

have registered is flooded to all ports in a VLAN instead of only flooded to

multicast router ports.

• SSM FDB Capacity—The capacity of the SSM FDB.

• SSM FDB Current Entries—The current count of SSM FDB entries.

• SSM FDB High Water Mark—The highest count of FDB entries since the

last clear counters.

When you specify an interface or VLAN, the following information displays:

• MLD Snooping Admin Mode — Indicates whether MLD Snooping is

active on the interface or VLAN.

• Fast Leave Mode — Indicates whether MLD Snooping Fast-leave is active

on the VLAN.

• Group Membership Interval — Shows the amount of time in seconds that

a switch will wait for a report from a particular group on a particular

interface, which is participating in the VLAN, before deleting the interface

from the entry. This value may be configured.

Layer 2 Switching Commands 518

• Last Listener Query Interval—Displays the amount of time the switch

waits after it sends a query on an interface, participating in the VLAN,

because it did not receive a report for a particular group on that interface.

This value may be configured.

• Multicast Router Present Expiration Time — Displays the amount of time

to wait before removing an interface that is participating in the VLAN

from the list of interfaces with multicast routers attached. The interface is

removed if a query is not received. This value may be configured.

• Listener Message Suppression Mode—Sends only the first report received

in response to a query to the router.

Example

console(config)#show ipv6 mld snooping

Admin Mode..................................... Enable

Multicast Control Frame Count.................. 6255

SSM FDB Capacity............................... 64

SSM FDB High Water Mark........................ 1

SSM FDB Current Entries........................ 1

Flooding Unregistered to All Ports............. Disabled

Vlan 1:

--------

MLD Snooping Admin Mode........................ Enabled

Immediate Leave Mode........................... Disabled

Group Membership Interval...................... 260

Last Listener Query Interval................... 10

Multicast Router Expiry Time................... 300

Listener Message Suppression Mode.............. Enabled

show ipv6 mld snooping groups

The show ipv6 mld snooping groups command displays the MLD Snooping

and SSM entries in the MFDB table.

Syntax

show ipv6 mld snooping groups [{vlan vlan-id | address ipv6-multicast-

address}]

• vlan-id — A VLAN identifier (Range 1-4093).

• ipv6-multicast-address — Specifies an IPv6 Multicast address.

Layer 2 Switching Commands 519

Default configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This user guideline applies to all switch models.To see the full Multicast

address table (including static addresses) use the

show mac address-table

multicast

command.

Example

This example shows MLDv2 snooping entries

console#show ipv6 mld snooping groups

Vlan Group Type OIFs

---- ----------------------- ------- ------------------------------------

1 3333.0000.0003 Dynamic Te1/0/1,Te1/0/17

MLD SSM Entries :

-----------------

VLAN Group Reporter Filter IIF Source Address

---- ---------------- ---------------- --------- ---------- ----------------

1 ff1e:2222:2222: fe80::200:3ff:f include Te1/0/1 2001::2

2222:2222:2222: e00:b00

2222:2222

show ipv6 mld snooping mrouter

Use the show ipv6 mld snooping mrouter command to display information

on dynamically learned Multicast router interfaces.

Syntax

show ipv6 mld snooping mrouter

Layer 2 Switching Commands 520

Default configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

MLD snooping forwards IPv6 multicast data plane packets to mrouter ports,

including statically configured mrouter ports. If a static mrouter port is

configured in a VLAN, MLD snooping will forward multicast data plane

packets received on the VLAN even if the interface is down. This behavior can

be used to ensure that MLD snooping will selectively forward IPv6 multicast

data traffic even if no dynamically discovered IPv6 multicast router has been

discovered.

Example

console#show ipv6 mld snooping mrouter

VLAN ID Port

-------- ----------

10 Gi1/0/2 (static)

Layer 2 Switching Commands 521

IPv6 MLD Snooping Querier

Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

The MLD Snooping Querier is an extension of the MLD Snooping feature.

MLD Snooping Querier allows the switch to simulate an MLD router in a

Layer 2-only network, thus removing the need to have an MLD Router to

collect the multicast group membership information. The querier function

simulates a small subset of the MLD router functionality.

In a network with IP multicast routing, the IP multicast router acts as the

MLD querier. However, if it is required that the IP-multicast traffic in a

VLAN be switched, the switch can be configured as an MLD querier. When

MLD Snooping Querier is enabled, the Querier sends out periodic MLD

General Queries that trigger the Multicast listeners/member to send their

joins so as to receive the Multicast data traffic. MLD Snooping listens to

these reports to establish the appropriate forwarding table entries.

Commands in this Section

This section explains the following commands:

ipv6 mld snooping querier

Use the ipv6 mld snooping querier command to enable MLD Snooping

Querier on the system. Use the no form of this command to disable MLD

Snooping Querier.

ipv6 mld snooping querier ipv6 mld snooping querier query-interval

ipv6 mld snooping querier (VLAN mode) ipv6 mld snooping querier timer expiry

ipv6 mld snooping querier address show ipv6 mld snooping querier

ipv6 mld snooping querier election

participate

–

Layer 2 Switching Commands 522

Syntax

ipv6 mld snooping querier

no ipv6 mld snooping querier

Default Configuration

MLD Snooping Querier is disabled by default.

Command Mode

Global Configuration mode

User Guidelines

It is not recommended the MLD Snooping Querier be enabled on a switch

enabled for IPv6 multicast routing.

Example

console(config)#ipv6 mld snooping querier

ipv6 mld snooping querier (VLAN mode)

Use the ipv6 mld snooping querier command in VLAN mode to enable MLD

Snooping Querier on a VLAN. Use the no form of this command to disable

MLD Snooping Querier on a VLAN.

Syntax

ipv6 mld snooping querier vlanvlan-id

no ipv6 mld snooping querier vlan vlan-id

• vlan-id — A VLAN identifier. (Range: 1–4093)

Default Configuration

MLD Snooping Querier is disabled by default on all VLANs.

Command Mode

Global Configuration mode

Layer 2 Switching Commands 523

User Guidelines

There are no user guidelines for this command.

Example

console(config)#ipv6 mld snooping querier vlan 10

ipv6 mld snooping querier address

Use the ipv6 mld snooping querier address command to set the global MLD

Snooping Querier address. Use the no form of this command to reset the

global MLD Snooping Querier address to the default.

Syntax

ipv6 mld snooping querier address prefix[/prefix-length]

no ipv6 mld snooping querier address

• prefix — An IPv6 address prefix.

• prefix-length — Designates how many of the high-order contiguous bits of

the address make up the prefix.

Default Configuration

There is no global MLD Snooping Querier address configured by default.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console(config)#ipv6 mld snooping querier address Fe80::5

ipv6 mld snooping querier election participate

Use the ipv6 mld snooping querier election participate command to enable

the Snooping Querier to participate in the Querier Election process when it

discovers the presence of another Querier in the VLAN. When this mode is

Layer 2 Switching Commands 524

enabled, if the Snooping Querier finds that the other Querier's source address

is numerically lower than the Snooping Querier's address, it stops sending

periodic queries. If the Snooping Querier wins the election then it will

continue sending periodic queries. Use the no form of this command to

disable election participation on a VLAN.

Syntax

ipv6 mld snooping querier election participate vlan-id

no ipv6 mld snooping querier election participate vlan-id

• vlan-id — A VLAN identifier (Range: 1 - 4093)

Default Configuration

Election participation is disabled by default.

Command Mode

Global Configuration mode

User Guidelines

If there is another querier in the network and the local querier is in election

mode, then the querier with the lower IP address is elected and the other

querier stops querying. If the local querier is not in election mode and

another querier is detected, the local querier stops querying.

Example

console(config-vlan)#ipv6 mld snooping querier election participate 10

ipv6 mld snooping querier query-interval

Use the ipv6 mld snooping querier query-interval command to set the MLD

Querier Query Interval time. It is the amount of time in seconds that the

switch waits before sending another general query. Use the no form of this

command to reset the Query Interval to the default.

Syntax

ipv6 mld snooping querier query-interval interval

ipv6 mld snooping querier query-interval

Layer 2 Switching Commands 525

• interval — Amount of time that the switch waits before sending another

general query. (Range: 1–1800 seconds)

Default Configuration

The default query interval is 60 seconds.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command

Example

console(config)#ipv6 mld snooping querier 120

ipv6 mld snooping querier timer expiry

Use the ipv6 mld snooping querier timer expiry command to set the MLD

Querier timer expiration period. It is the time period that the switch remains

in Non-Querier mode once it has discovered that there is another Multicast

Querier in the network. Use the no form of this command to reset the timer

expiration period to the default.

Syntax

ipv6 mld snooping querier timer expiry timer

ipv6 mld snooping querier timer expiry

• timer — The time that the switch remains in Non-Querier mode after it

has discovered that there is a multicast querier in the network. (Range: 60–

300 seconds)

Default Configuration

The default timer expiration period is 60 seconds.

Command Mode

Global Configuration mode

Layer 2 Switching Commands 526

User Guidelines

There are no user guidelines for this command.

Example

console(config)#ipv6 mld snooping querier timer expiry 222

show ipv6 mld snooping querier

Use the show ipv6 mld snooping querier command to display MLD

Snooping Querier information. Configured information is displayed whether

or not MLD Snooping Querier is enabled.

Syntax

show ipv6 mld snooping querier [detail | vlan vlan-id]

• vlan-id — A VLAN identifier (Range: 1 - 4093)

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

When the optional argument vlan vlan-id is not used, the command shows

the following information:

Parameter Description

MLD Snooping Querier

Mode

Indicates whether or not MLD Snooping Querier is

active on the switch.

Querier Address Shows the IP Address which will be used in the IPv6

header while sending out MLD queries.

MLD Version Indicates the version of MLD that will be used while

sending out the queries. This is defaulted to MLD v1

and it can not be changed.

Layer 2 Switching Commands 527

When the optional argument vlan vlan-id is used, the following additional

information appears:

When the optional argument detail is used, the command shows the global

information and the information for all Querier enabled VLANs as well as the

following information:

Querier Query Interval Shows the amount of time that a Snooping Querier

waits before sending out a periodic general query.

Querier Expiry Interval Displays the amount of time to wait in the Non-Querier

operational state before moving to a Querier state.

Parameter Description

MLD Snooping Querier

VLAN Mode

Indicates whether MLD Snooping Querier is active on

the VLAN.

Querier Election

Participate Mode

Indicates whether the MLD Snooping Querier

participates in querier election if it discovers the

presence of a querier in the VLAN.

Querier VLAN Address Shows the IP Address which will be used in the IPv6

header while sending out MLD queries.

Operational State Indicates whether MLD Snooping Querier is in

“Querier” or “Non-Querier” state. When the switch is

in Querier state it will send out periodic general queries.

When in Non-Querier state it will wait for moving to

Querier state and does not send out any queries.

Operational Version Indicates the version of MLD that will be used while

sending out the queries. This is defaulted to MLD v1

and it can not be changed.

Operational Max Response

Time

Displays the maximum response time the local querier

waits for a response from a multicast router.

Last Querier Address Indicates the IP address of the most recent Querier from

which a Query was received.

MLD Version Indicates the version of MLD.

Layer 2 Switching Commands 528

IP Source Guard Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

IP Source Guard (IPSG) is a security feature that filters IP packets based on

source ID. The source ID may either be source IP address or a {source IP

address, source MAC address} pair. The network administrator configures

whether enforcement includes the source MAC address. The network

administrator can configure static authorized source IDs. The DHCP

Snooping binding database and static IPSG entries identify authorized source

IDs. IPSG may be enabled on physical and LAG ports. IPSG is disabled by

default.

If the network administrator enables IPSG on a port where DHCP snooping is

disabled or where DHCP snooping is enabled but the port is trusted, all IP

traffic received on that port is dropped depending upon the admin-

configured IPSG entries. IPSG cannot be enabled on a port-based routing

interface.

IPSG uses two enforcement mechanisms: the L2FDB to enforce the source

MAC address and ingress VLAN and an ingress classifier to enforce the source

IP address or {source IP, source MAC} pair.

Commands in this Section

This section explains the following commands:

ip verify source

Use the ip verify source command in Interface Configuration mode to enable

filtering of IP packets from hosts which have not been assigned an IP address

via DHCP on the specified interface.

Use the no form of the command to enable unverified traffic to flow over the

interfaces.

ip verify source show ip verify

ip verify binding show ip verify source

–

show ip source binding

Layer 2 Switching Commands 529

Syntax

ip verify source {port-security}

no ip verify source

•

port-security

—Enables filtering based on IP address, VLAN, and MAC

address. When not specified, filtering is based upon IP address.

Default Configuration

By default, no sources are blocked.

Command Mode

Interface Configuration mode (physical and port channel)

User Guidelines

DHCP snooping should be enabled on any ports for which ip verify source is

configured. If ip verify source is configured on an interface for which DHCP

snooping is disabled, or for which DHCP snooping is enabled and the port is

trusted, incoming traffic on the interface is dropped.

Incoming traffic is filtered based on the source IP address and VLAN. When

the port-security keyword is configured, filtering occurs based upon source IP

address, VLAN and source MAC address.

IP source guard also interacts with the port security component. Use the

switchport port-security command in interface mode to optionally add

checking of learned MAC addresses. When port security is enabled, MAC

learning coordinates with the IP Source Guard to verify that the MAC address

is in the DHCP binding database. If it is not, port security is notified that the

frame is in violation of the security policy.

Example

console(config)#ip dhcp snooping

console(config)#ip dhcp snooping vlan 1

console(config)#interface gi1/0/1

console(config-if-Gi1/0/1)#ip verify source

Layer 2 Switching Commands 530

ip verify binding

Use the ip verify binding command in Global Configuration mode to

configure static bindings. Use the no form of the command to remove the

IPSG entry.

Syntax

ip verify binding

macaddr

vlan

ipaddr

interface

Default Configuration

By default, there are no static bindings configured.

Command Mode

Global Configuration mode

User Guidelines

The configured IP address and MAC address are used to match the source IP

address and source MAC address for packets received on the interface. Hosts

sending packets using the configured source IP address and source MAC

address are trusted on the interface.

Example

console(config)#ip verify binding 00:11:22:33:44:55 vlan 1 1.2.3.4 interface

gigabitethernet 1/0/2

show ip verify

Use the show ip verify command to display the IP Source Guard

configuration on all interfaces or the specified interface.

Syntax

show ip verify [interface interface-id]

• interface-id—An Ethernet interface identifier or a port channel interface

identifier.

Layer 2 Switching Commands 531

Default Configuration

There is no default configuration for this command.

Command Modes

User Exec, Privileged Exec (all show modes)

User Guidelines

The filter type is one of the following values:

• ipv4-mac: IPv4 plus MAC address filtering

• ip: IPv4 address filtering

• ipv6: IPv6 address filtering

• ipv6-mac: IPv6 plus MAC address filtering

• N/A: No filtering is configured on the interface

Example

console(config-if-Gi1/0/5)#show ip verify

Interface Filter Type

----------- -----------

Gi1/0/1 ip

Gi1/0/2 ipv4-mac

Gi1/0/3 N/A

Gi1/0/4 N/A

Gi1/0/5 ipv4-mac

Gi1/0/6 N/A

Gi1/0/7 N/A

Gi1/0/8 N/A

Gi1/0/9 N/A

console(config-if-Gi1/0/5)#show ip verify interface gi1/0/5

Interface Filter Type

----------- -----------

Gi1/0/5 ipv6-mac

show ip verify source

Use the show ip verify source command to display the bindings configured on

a particular interface or all interfaces.

Layer 2 Switching Commands 532

Syntax

show ip verify source [interface interface-id]

• interface-id: A valid physical interface identifier or port-channel identifier

Default Configuration

There is no default configuration for this command.

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

This command has no user guidelines.

Example

console#show ip verify source interface gigabitethernet 1/0/1

Interface Filter Type IP Address MAC Address Vlan

----------- ----------- --------------- ----------------- -----

Gi1/0/1 ip 1.2.3.4 00:12:32:43:54:66 1

show ip source binding

Use the show ip source binding command to display all bindings (static and

dynamic).

Syntax

show ip source binding

Default Configuration

There is no default configuration for this command.

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

Layer 2 Switching Commands 533

User Guidelines

This command has no user guidelines.

Example

console#show ip source binding

MAC Address IP Address Type VLAN Interface

------------ ---------- ----- ----- -------------

0011.2233.4455 1.2.3.4 static 1 Gi1/0/2

Layer 2 Switching Commands 534

iSCSI Optimization Commands

Dell EMC Networking N2000/N2100-ON/N3000/N3100-ON/N4000

Series Switches

iSCSI Optimization provides a means of performing configuration specific to

storage traffic and optionally giving traffic between iSCSI initiator and target

systems special Quality of Service (QoS) treatment.

iSCSI Optimization is best applied to mixed-traffic networks where iSCSI

packets constitutes a portion of overall traffic. In these cases, the assignment

of iSCSI packets to non-default CoS queues can provide flows with lower

latency and avoid queue resource contention.

If iSCSI frames comprise most of the traffic passing through the switch, the

system provides optimal throughput when all traffic is assigned to the default

queue. An example of this situation is a Storage Area Network (SAN) where

the switch is dedicated to interconnecting iSCSI Targets with Initiators.

Using the default queue for this homogeneous traffic provides the best

performance in traffic burst handling and the most accurate 802.3x Flow

Control Pause Frame generation. In these cases, the application of QoS

treatment other than the default policy may result in less overall throughput

or more packet loss.

By default, iSCSI optimization is enabled and iSCSI QoS treatment is

disabled.

LLDP is used to detect the presence of EqualLogic storage arrays. When

iSCSI optimization is enabled, and LLDP detects an EQL array on a port,

that port configuration is changed to enable portfast and disable unicast

storm control. Configuration changes appear in the running config and are

not removed by disabling the feature or disconnecting the EQL array.

QoS treatment is accomplished by monitoring traffic to detect packets used

by iSCSI stations to establish iSCSI sessions and connections. Data from

these exchanges is used to create classification rules that assign the traffic

between the stations to a configured traffic class. Packets in the flow are

queued and scheduled for egress on the destination port based on these rules.

In addition, if configured, the packets can be updated with IEEE 802.1p or

IP-DSCP values. This is done by enabling remark. Remarking packets with

priority data provides special QoS treatment as the packets continue through

the network.

Layer 2 Switching Commands 535

iSCSI Optimization borrows ACL lists from the global system pool. ACL lists

allocated by iSCSI Optimization reduce the total number of ACLs available

for use by the network operator. Enabling iSCSI Optimization uses one ACL

list to monitor for iSCSI sessions. Each monitored iSCSI session utilizes two

rules from additional ACL lists up to a maximum of two ACL lists. This

means that the maximum number of ACL lists allocated by iSCSI is three.

NOTE: This feature is not available on the N3000 when loaded with the

AGGREGATION ROUTER-enabled firmware (e.g., N3000_BGPvA.B.C.D.stk).

Commands in this Section

This section explains the following commands:

iscsi aging time

The iscsi aging time command sets the time out value for iSCSI sessions. To

reset the aging time to the default value, use the no form of this command.

Syntax

iscsi aging time time

no iscsi aging time

• time — The number of minutes a session must not be active prior to it's

removal. (Range: 1-43,200)

Default Configuration

The default aging time is 10 minutes.

Command Mode

Global Configuration mode.

iscsi aging time iscsi target port

iscsi cos show iscsi

iscsi enable show iscsi sessions

Layer 2 Switching Commands 536

User Guidelines

Changing the aging time has the following behavior:

• When aging time is increased, current sessions will be timed out according

to the new value.

• When aging time is decreased, any sessions that have been dormant for a

time exceeding the new setting will be immediately deleted from the table.

All other sessions will continue to be monitored against the new time out

value.

Example

The following example sets the aging time for iSCSI sessions to 100 minutes.

console(config)#iscsi aging time 100

iscsi cos

Use the iscsi cos command in Global Configuration mode to set the quality

of service profile that will be applied to iSCSI flows. To return the VPT/DSCP

setting to the default value, use the no form of this command. VPT/DSCP

values can be configured independently from the application of QoS

treatment.

Syntax

iscsi cos {enable | disable | vpt vpt | dscp dscp} [remark]

no iscsi cos

•enable—Enables application of preferential QoS treatment to iSCSI

frames.

•disable—Disables application of preferential QoS treatment to iSCSI

frames.

• vpt/dscp—The VLAN Priority Tag or DSCP value to assign received iSCSI

session packets.

•remark—Mark the iSCSI frames with the configured DSCP when

egressing the switch.

Layer 2 Switching Commands 537

Default Configuration

By default, frames are not remarked. The default vpt setting for iSCSI is 4,

which the default class of service 802.1p mapping assigns to queue 2.

Command Mode

Global Configuration mode.

User Guidelines

The remark option only applies to DSCP values. Remarking is not available

for vpt values.

In general, the use of iSCSI CoS is not required. By default, iSCSI flows are

assigned to the highest VPT/DSCP value that is mapped to the highest queue

not used for stack management or the voice VLAN. Make sure you configure

the relevant Class of Service parameters for the queue in order to complete

the setting.

Configuring the VPT/DSCP value sets the QoS profile which selects the

egress queue to which the frame is mapped. The default setting for egress

queues scheduling is Weighted Round Robin (WRR).

You may alter the QoS setting by configuring the relevant ports to work in

other scheduling and queue management modes via the Class of Service

settings. These choices may include strict priority for the queue used for

iSCSI traffic. The downside of strict priority is that, in certain circumstances

(under heavy high priority traffic), other lower priority traffic may get starved.

In WRR, the queue to which the flow is assigned to can be set to get the

required percentage using the min-bandwidth settings.

If an EqualLogic array is detected when QoS is enabled, two additional TCP

ports receive preferential QoS treatment (TCP ports 25555 and 9876). This

QoS policy is applied globally. The iscsi cos enable command enables

the generation of the iSCSI Application Priority TLV over DCBX using the

value set by the iscsi cos vpt command on switches that support

DCBX.

Example

The following example configures iSCSI packets to receive CoS treatment

using DiffServ Code Point AF 41 and configures remarking of transmitted

iSCSI packets.

Layer 2 Switching Commands 538

console(config)#iscsi cos dscp 41 remark

iscsi enable

The iscsi enable command globally enables iSCSI optimization. To disable

iSCSI optimization, use the no form of this command.

Syntax

iscsi enable

no iscsi enable

Default Configuration

iSCSI is enabled by default.

Command Mode

Global Configuration mode

User Guidelines

This command modifies the running config to enable flow control on all

interfaces.

Connectivity fault management is not compatible with iSCSI monitoring.

Disable CFM before enabling iSCSI monitoring.

Monitoring for EqualLogic Storage arrays via LLDP is also enabled by this

command. Upon detection of an EQL array, the specific interface involved

will have spanning-tree portfast enabled and unicast storm control disabled.

These changes appear in the running config. Disabling iSCSI Optimization

does not disable flow control, portfast or storm control configuration applied

as a result of enabling iSCSI Optimization.

On the N4000 switches, enabling iSCSI will locally generate a DCBX

Application Priority TLV with the following parameters when the following

conditions are met:

• DCBX is enabled

• CoS Queuing is enabled on the port using VPT (

iscsi cos enable

)

The Application Priority TLV sent will contain the following information in

addition to any other information contained in the TLV:

Layer 2 Switching Commands 539

AE Selector = 1

AE Protocol = 3260

AE Priority = priority configured for iSCSI PFC (the VPT value above). This

TLV is sent in addition to any Application Priority TLV information received

from the configuration source. If the configuration source is sending iSCSI

application priority information, it is not necessary to enable iscsi cos to send

the iSCSI Application Priority TLV.

Example

In the following example, iSCSI is globally enabled.

console(config)#iscsi enable

iscsi target port

Use the iscsi target port command in Global Configuration mode to

configure iSCSI port(s), target addresses and names. To delete iSCSI port(s)

or target ports, use the no form of this command.

Syntax

iscsi target port tcp-port-1 [tcp-port-2.… tcp-port-16 [address ip-address]

[name targetname]

no iscsi target port tcp-port-1 [tcp-port-2.… tcp-port-16 [address ip-address]

• tcp-port —TCP port number or list of TCP port numbers on which iSCSI

target(s) listen to requests. Up to 16 TCP ports can be defined in the

system in one command or by using multiple commands.

• ip-address—IP address of the iSCSI target. When the no form is used, and

the tcp port to be deleted is one bound to a specific IP address, the address

field must be present.

• targetname—iSCSI name of the iSCSI target. The name can be statically

configured; however, it can be obtained from iSNS or from sendTargets

response. The initiator MUST present both its iSCSI Initiator Name and

the iSCSI Target Name to which it wishes to connect in the first login

request of a new session or connection. The target name can consist of any

printable character except for a question mark as the first character. The

name can contain embedded blanks if enclosed in double quotes.

Layer 2 Switching Commands 540

Default Configuration

iSCSI well-known ports 3260 and 860 are configured by default but can be

removed as any other configured target.

Command Mode

Global Configuration mode.

User Guidelines

• When working with private iSCSI ports (not IANA assigned iSCSI ports

3260/860), it is recommended to specify the target IP address as well, so

the switch will only snoop frames with which the TCP destination port is

one of the configured TCP ports, AND their destination IP is the target's

IP address. This way the CPU is not be falsely loaded by non-iSCSI flows

(if by chance other applications also choose to use these {non-standard}

ports).

• When a port is already defined and not bound to an IP address, and you

want to bind the port to an IP address, first remove the port by using the

no form of the command and then add it again, this time together with

the relevant IP address.

• Target names are only for display when using the show iscsi command.

These names are not used to match (or for doing any sanity check) with

the iSCSI session information acquired by snooping.

• A maximum of 16 TCP ports can be configured either bound to IP or not.

Example

The following example configures TCP Port 49154 to target IP address

172.16.1.20.

console(config)#iscsi target port 49154 address 172.16.1.20

show iscsi

Use the show iscsi command to display the iSCSI configuration.

Syntax

show iscsi

Layer 2 Switching Commands 541

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

The following example displays the iSCSI configuration.

console#show iscsi

iSCSI enabled

iSCSI CoS enabled

iSCSI vpt is 5

Session aging time: 10 min

Maximum number of sessions is 192

------------------------------------------------

iSCSI Targets and TCP Ports:

------------------------------------------------

TCP Port Target IP Address Name

860 - -

3260 - -

30001 172.16.1.1iqn.1993-11.com.disk

vendor:diskarrays.sn.45678.tape:sys1.xyz

30033172.16.1.10

------------------------------------------------

iSCSI Static Rule Table

------------------------------------------------

Index TCP Port IP Address IP Address Mask

TCP Port Target IP AddressName

show iscsi sessions

Use the show iscsi sessions command to display the iSCSI status.

Syntax

show iscsi sessions [detailed]

•detailed — Displayed list has additional data when this option is used.

Layer 2 Switching Commands 542

Default Configuration

If not specified, sessions are displayed in short mode (not detailed).

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The N2000/N2100-ON/N3000/N3100-ON Series switches support monitoring

for up to 1024 sessions. The N4000 switches support monitoring for up to 512

sessions.

Example

The following examples show summary and detailed information about the

iSCSI sessions.

console#show iscsi sessions

Target: iqn.1993-11.com.disk-vendor:diskarrays.sn.45678

-----------------------------------------------------

Initiator: iqn.1992-04.com.os-vendor.plan9:cdrom.12

ISID: 11

Initiator: iqn.1995-05.com.os-vendor.plan9:cdrom.10

ISID: 222

-----------------------------------------------------

Target: iqn.103-1.com.storage-vendor:sn.43338.

storage.tape:sys1.xyz

Session 3:

Initiator: iqn.1992-04.com.os-vendor.plan9:cdrom.12

Session 4:

Initiator: iqn.1995-05.com.os-vendor.plan9:cdrom.10

Console# show iscsi sessions detailed

Target: iqn.1993-11.com.disk-vendor:diskarrays.sn.45678

-----------------------------------------------------

Session 1:

Initiator: iqn.1992-04.com.os

vendor.plan9:cdrom.12.storage:sys1.xyz

-----------------------------------------------------

Time started: 17-Jul-2008 10:04:50

Time for aging out: 10 min

ISID: 11

Layer 2 Switching Commands 543

Initiator Initiator Target Target

IP address TCP port IP address IP port

172.16.1.3 49154 172.16.1.20 30001

172.16.1.4 49155 172.16.1.21 30001

172.16.1.5 49156 172.16.1.22 30001

Session 2:

-----------------------------------------------------

Initiator: iqn.1995-05.com.os-vendor.plan9:cdrom.10

Time started: 17-Aug-2008 21:04:50

Time for aging out: 2 min

ISID: 22

Initiator Initiator Target Target

IP address TCP port IP address IP port

172.16.1.30 49200 172.16.1.20 30001

172.16.1.30 49201 172.16.1.21 30001

Layer 2 Switching Commands 544

Link Dependency Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Link dependency allows the link status of a group of interfaces to be made

dependent on the link status of other interfaces. The effect is that the link

status of a group that depends on another interface either mirrors or inverts

the link status of the depended-on interface. Circular dependencies are not

allowed. For example, if port-channel 1 in group 1 depends on port-channel 2.

Then the system will not allow the operator to configure another link

dependency group where port-channel 2 depends on port-channel 1.

Commands in this Section

This section explains the following commands:

action

Use the action command in Link Dependency mode to indicate if the link-

dependency group should mirror or invert the status of the depended-on

interfaces.

Syntax

action {down|up}

•down—Mirror the depended on interface(s) status.

•up—Invert the depended on interface(s) status.

Default Configuration

The default configuration for a group is down, i.e. the group members will

mirror the depended-on link status by going down when all depended-on

interfaces are down.

action

–

link-dependency group depends-on

add show link-dependency

Layer 2 Switching Commands 545

Command Mode

Link Dependency mode

User Guidelines

The action up command will cause the group members to be up when no

depended-on interfaces are up.

Example

console(config-depend-1)#action up

link-dependency group

Use the link-dependency group command to enter the link-dependency

mode and configure a link-dependency group.

Syntax

link-dependency group GroupId

no link-dependency group GroupId

• GroupId — Link dependency group identifier. (Range: 1–72)

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

The preference of a group is to remain in the up state. A group will be in the

up state if any depends-on interface is up and will be in the down state only if

all depends-on interfaces are down.

Example

console(config)#link-dependency group 1

console(config-linkDep-group-1)#

Layer 2 Switching Commands 546

add

Use this command to add member ten Gigabit or Gigabit Ethernet port(s) or

port channels to the dependency list.

Syntax

add intf-list

• intf-list — List of Ethernet interface identifiers or port channel identifiers

or ranges. Separate nonconsecutive ports with a comma and no spaces. Use

a hyphen to designate the range of ports.

Default Configuration

This command has no default configuration.

Command Mode

Link Dependency mode

User Guidelines

Adding an interface to a dependency list brings the interface down until the

depends-on command is entered. The link status will then follow the

interface specified in the depends-on command.

To avoid bringing down interfaces, enter the depends-on command prior to

entering the add command.

Example

console(config-depend-1)#add gigabitethernet 1/0/1

console(config-depend-1)#add tengigabitethernet 1/0/1

console(config-depend-1)#add port-channel 10-12

depends-on

Use this command to add the dependent Ethernet ports or port channels list.

Use the no depends-on command to remove the dependent Ethernet ports or

port-channels list.

Syntax

depends-on intf-list

Layer 2 Switching Commands 547

no depends-on intf-list

• intf-list — List of Ethernet interface identifiers or port channel interface

identifiers or ranges.Separate nonconsecutive items with a comma and no

spaces. Use a hyphen to designate the range of ports or port-channel

numbers.

Default Configuration

This command has no default configuration.

Command Mode

Link Dependency mode

User Guidelines

Circular dependencies are not allowed, i.e. interfaces added to the group may

not also appear in the depends-on list of the same group or a different group.

If an interface appears in the add list of any group, the interfaces in the

corresponding depends-on list may not refer back to the interfaces in the add

group.

Examples

console(config-linkDep-group-1)#depends-on gigabitethernet 1/0/10

console(config-linkDep-group-1)#depends-on port-channel 6

show link-dependency

Use the show link-dependency command to show the link dependencies

configured for a particular group. If no group is specified, then all the

configured link-dependency groups are displayed.

Syntax

show link-dependency [group GroupId] [detail]

• GroupID—Link dependency group identifier. (Range: Valid Group Id, 1–

16)

•detail—Show detailed information about the state of members and the

dependent ports.

Layer 2 Switching Commands 548

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

Configure a link dependency group prior to using this command.

Example

The following command shows link dependencies for all groups.

console#show link-dependency

GroupId Member Ports Ports Depended On Link Action Group State

------- -----------------------------------------------------

1 Gi4/0/2-3,Gi4/0/5 Gi4/0/10-12 Link Up Up/Down

The following command shows link dependencies for group 1 only.

console#show link-dependency group 1

GroupId Member Ports Ports Depended On Link Action Group State

------- -----------------------------------------------------

1 Gi4/0/2-3,Gi4/0/5 Gi4/0/10-12 Link Up Up/Down

The following command shows detailed information for group 1.

console#show link-dependency group 1 detail

GroupId: 1

Link Action: Link UpGroup

State: Up

Ports Depended On State:

Link Up: Gi4/0/10

Link Down: Gi4/0/11-12

Member Ports State:

Link Up: Gi4/0/2-3

Link Down: Gi4/0/5

Layer 2 Switching Commands 549

LLDP Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

The IEEE 802.1AB standard defines the Link Layer Discovery Protocol

(LLDP). This protocol allows stations residing on an IEEE802 LAN to

advertise major capabilities, physical descriptions, and management

information to physically adjacent devices, allowing a network management

system (NMS) to access and display this information.

The standard is designed to be extensible, providing for the optional

exchange of organizational specific information and data related to other

IEEE standards. The base implementation supports only the required basic

management set of type length values (TLVs).

LLDP is a one-way protocol; there are no request/response sequences.

Information is advertised by stations implementing the transmit function.

The information is received and processed by stations implementing the

receive function. Devices are not required to implement both transmit and

receive functions and each function can be enabled or disabled separately by

the network manager. Dell EMC Networking supports both the transmit and

receive functions in order to support device discovery.

The LLDP component transmit and receive functions can be

enabled/disabled separately per physical port. By default, both transmit and

receive functions are enabled on all ports. The application starts each

transmit and receive state machine appropriately based on the configured

status and operational state of the port.

The transmit function is configurable with respect to packet construction and

timing parameters. The required Chassis ID, Port ID, and Time to Live

(TTL) TLVs are always included in the Link Layer Discovery Protocol Data

Unit (LLDPDU). However, inclusion of the optional TLVs in the

management set is configurable by the administrator. By default, they are not

included. The transmit function extracts the local system information and

builds the LLDPDU based on the specified configuration for the port. In

addition, the administrator has control over timing parameters affecting the

TTL of LLDPDUs and the interval in which they are transmitted.

Layer 2 Switching Commands 550

The receive function accepts incoming LLDPDU frames and stores

information about the remote stations. Both local and remote data may be

displayed by the user interface and retrieved using SNMP as defined in the

LLDP MIB definitions. The component maintains one remote entry per

physical network connection.

The LLDP component manages a number of statistical parameters

representing the operation of each transmit and receive function on a per-port

basis. These statistics may be displayed by the user interface and retrieved

using SNMP as defined in the MIB definitions.

Commands in this Section

This section explains the following commands:

clear lldp remote-data

Use the clear lldp remote-data command to delete all LLDP information

from the remote data table.

Syntax

clear lldp remote-data

clear lldp remote-data lldp notification-interval show lldp local-device

clear lldp statistics lldp receive show lldp med

dcb enable lldp timers show lldp med interface

lldp med lldp transmit show lldp med local-device

detail

lldp med confignotification lldp transmit-mgmt show lldp med remote-

device

lldp med

faststartrepeatcount

lldp transmit-tlv show lldp remote-device

lldp med transmit-tlv show lldp show lldp statistics

lldp notification show lldp interface

–

Layer 2 Switching Commands 551

Default Configuration

By default, data is removed only on system reset.

Command Mode

Privileged Exec mode

User Guidelines

This command has no user guidelines.

Example

The following example displays how to clear the LLDP remote data.

console#clear lldp remote-data

clear lldp statistics

Use the clear lldp statistics command to reset all LLDP statistics.

Syntax

clear lldp statistics

Default Configuration

By default, the statistics are only cleared on a system reset.

Command Mode

Privileged Exec mode

User Guidelines

This command has no user guidelines.

Example

The following example displays how to reset all LLDP statistics.

console#clear lldp statistics

Layer 2 Switching Commands 552

dcb enable

This command enables the sending of DCBX information in LLDP frames.

Syntax

dcb enable

no dcb enable

Command Mode

Global Configuration mode

Default Value

The sending of DCBX information in enabled by default.

User Guidelines

Use this command to disable the sending of DCBX information when it is

desirable to utilize legacy QoS and disable the automatic configuration of

CNAs based on transmitted DCBX information.

Example

console(config)#no dcb enable

lldp med

This command is used to enable/disable LLDP-MED on an interface. By

enabling MED, the transmit and receive functions of LLDP are effectively

enabled.

Syntax

lldp med

no lldp med

Command Mode

Interface Configuration (Ethernet) mode

Layer 2 Switching Commands 553

Default Value

Transmission and reception of LLDP-MED TLVs is enabled on all supported

interfaces.

User Guidelines

No specific guidelines.

Example

console(config)#interface gigabitethernet 1/0/1

console(config-if-Gi1/0/1)#lldp med

lldp med confignotification

This command is used to enable sending topology change notifications.

Syntax

lldp med confignotification

no lldp med confignotification

Command Mode

Interface Configuration (Ethernet) mode

Default Value

By default, notifications are disabled on all physical interfaces.

User Guidelines

There are no guidelines for this command.

Example

console(config)#lldp med confignotification

lldp med faststartrepeatcount

This command is used to set the value of the fast start repeat count.

Layer 2 Switching Commands 554

Syntax

lldp med faststartrepeatcount count

no lldp med faststartrepeatcount

• count — Number of LLDPPDUs that are transmitted when the protocol is

enabled. (Range 1–10)

Command Mode

Global Configuration

Default Value

User Guidelines

No specific guidelines.

Example

console(config)# lldp med faststartrepeatcount 2

lldp med transmit-tlv

This command is used to specify which optional TLVs in the LLDP MED set

are transmitted in the LLDPDUs. There are certain conditions that have to

be met for a port to be MED compliant. These conditions are explained in

the normative section of the ANSI/TIA-1057 specification. For example, the

MED TLV 'capabilities' is mandatory. By disabling transmission of the MED

capabilities TLV, MED is effectively disabled on the interface.

Syntax

lldp med transmit-tlv [capabilities] [network-policy] [ex-pse] [ex-pd]

no lldp med transmit-tlv [capabilities] [network-policy] [ex-pse] [ex-pd]

Command Mode

Interface Configuration (Ethernet)

Layer 2 Switching Commands 555

User Guidelines

The optional ex-pse (extended PSE) and ex-pd (extended PD) parameters are

only available on PoE capable switches.

Default Value

By default, the capabilities and network policy TLVs are included in LLDP

packets sent on interfaces enabled for MED. On PoE capable switches, the

extended PD TLV and extended PSE TLV are transmitted.

Example

console(config)#interface gigabitethernet 1/0/1

console(config-if-Gi1/0/1)#lldp med transmit-tlv capabilities

console(config-if-Gi1/0/1)#lldp med transmit-tlv network-policies

lldp notification

Use the lldp notification command in Interface Configuration mode to

enable remote data change notifications. To disable notifications, use the no

form of this command.

Syntax

lldp notification

no lldp notification

Default Configuration

By default, notifications are disabled on all supported interfaces.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

This command has no user guidelines.

Example

The following example displays how to enable remote data change

notifications.

Layer 2 Switching Commands 556

console(config-if-Gi1/0/3)#lldp notification

lldp notification-interval

Use the lldp notification-interval command in Global Configuration mode

to limit how frequently remote data change notifications are sent. To return

the notification interval to the factory default, use the no form of this

command.

Syntax

lldp notification-interval interval

no lldp notification-interval

• interval — The smallest interval in seconds at which to send remote data

change notifications. (Range: 5–3600 seconds)

Default Configuration

The default value is 5 seconds.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example displays how to set the interval value to 10 seconds.

console(config)#lldp notification-interval 10

lldp receive

Use the lldp receive command in Interface Configuration mode to enable the

LLDP receive capability. To disable reception of LLDPDUs, use the no form

of this command.

Syntax

lldp receive

Layer 2 Switching Commands 557

no lldp receive

Default Configuration

The default lldp receive mode is enabled.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

This command has no user guidelines.

Example

The following example displays how to enable the LLDP receive capability.

console(config-if-Gi1/0/3)#lldp receive

lldp timers

Use the lldp timers command in Global Configuration mode to set the

timing parameters for local data transmission on ports enabled for LLDP. To

return any or all parameters to factory default, use the no form of this

command.

Syntax

lldp timers [interval transmit-interval] [hold hold-multiplier] [reinit reinit-

delay]

no lldp timers [interval] [hold] [reinit]

• transmit-interval — The interval in seconds at which to transmit local data

LLDPDUs. (Range: 5–32768 seconds)

• hold-multiplier — Multiplier on the transmit interval used to set the TTL

in local data LLDPDUs. (Range: 2–10)

• reinit-delay — The delay in seconds before reinitialization. (Range: 1–10

seconds)

Default Configuration

The default transmit interval is 30 seconds.

Layer 2 Switching Commands 558

The default hold-multiplier is 4.

The default delay before reinitialization is 2 seconds.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Examples

The following example displays how to configure LLDP to transmit local

information every 1000 seconds.

console(config)#lldp timers interval 1000

The following example displays how to set the timing parameter at 1000

seconds with a hold multiplier of 8 and a 5 second delay before

reinitialization.

console(config)#lldp timers interval 1000 hold 8 reinit 5

lldp transmit

Use the lldp transmit command in Interface Configuration mode to enable

the LLDP advertise (transmit) capability. To disable local data transmission,

use the no form of this command.

Syntax

lldp transmit

no lldp transmit

Default Configuration

LLDP is enabled on all supported interfaces.

Command Mode

Interface Configuration (Ethernet) mode

Layer 2 Switching Commands 559

User Guidelines

This command has no user guidelines.

Example

The following example displays how enable the transmission of local data.

console(config-if-Gi1/0/3)#lldp transmit

lldp transmit-mgmt

Use the lldp transmit-mgmt command in Interface Configuration mode to

include transmission of the local system management address information in

the LLDPDUs. To cancel inclusion of the management information, use the

no form of this command.

Syntax

lldp transmit-mgmt

no lldp transmit-mgmt

Default Configuration

By default, management address information is not included.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

This command has no user guidelines.

Example

The following example displays how to include management information in

the LLDPDU.

console(config-if-Gi1/0/3)#lldp transmit-mgmt

Layer 2 Switching Commands 560

lldp transmit-tlv

Use the lldp transmit-tlv command in Interface Configuration mode to

specify which optional type-length-value settings (TLVs) in the AB basic

management set will be transmitted in the LLDPDUs. To remove an optional

TLV, use the no form of this command.

Syntax

lldp transmit-tlv [sys-desc][sys-name][sys-cap][port-desc]

no lldp transmit-tlv [sys-desc][sys-name][sys-cap][port-desc]

•sys-name — Transmits the system name TLV. This is the configured host

name for the system.

•sys-desc — Transmits the system description TLV

•sys-cap — Transmits the system capabilities TLV

•port-desc — Transmits the port description TLV

Default Configuration

By default, the port-desc and sys-name TLVs are transmitted.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

The string configured by the hostname command is transmitted by in the sys-

name TLV.

Use the show lldp remote-device all command to see the advertised LLDP

neighbor information.

Example

The following example shows how to include the system description TLV in

local data transmit.

console(config-if-Gi1/0/3)#lldp transmit-tlv sys-desc

Layer 2 Switching Commands 561

show lldp

Use the show lldp command to display the current LLDP configuration

summary.

Syntax

show lldp

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays the current LLDP configuration summary.

console#show lldp

LLDP Global Configuration

Transmit Interval............................ 30 seconds

Transmit Hold Multiplier..................... 4

Reinit Delay................................. 2 seconds

Notification Interval........................ 5 seconds

Command History

Example updated in the 6.4 release.

show lldp interface

Use the show lldp interface command to display the current LLDP interface

state.

Layer 2 Switching Commands 562

Syntax

show lldp interface {gigabitethernet unit/slot/port | tengigabitethernet

unit/slot/port | fortygigabitethernet unit/slot/port| all}

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Examples

This example show how the information is displayed when you use the

command with the all parameter.

console#show lldp interface all

Interface Link Transmit Receive Notify TLVs Mgmt

--------- ---- -------- -------- -------- ------- ----

Gi1/0/1 Up Enabled Enabled Enabled 0,1,2,3 Y

Gi1/0/2 Down Enabled Enabled Disabled Y

Gi1/0/3 Down Disabled Disabled Disabled 1,2 N

TLV Codes: 0 – Port Description, 1 – System Name, 2 – System Description, 3 –

System Capability

console# show lldp interface Gi1/0/1

Interface Link Transmit Receive Notify TLVs Mgmt

--------- ---- -------- -------- -------- ------- ----

Gi1/0/1 Up Enabled Enabled Enabled 0,1,2,3 Y

TLV Codes: 0 – Port Description, 1 – System Name, 2 – System Description, 3 –

System Capability

show lldp local-device

Use the show lldp local-device command to display the advertised LLDP

local data. This command can display summary information or detail for each

interface.

Layer 2 Switching Commands 563

Syntax

show lldp local-device {detail interface | interface | all}

•detail — includes a detailed version of the local data.

• interface — Specifies a valid physical interface on the device. Specify

either

gigabitethernet

unit/slot/port

or tengigabitethernet

unit/slot/port

or fortygigabitethernet

unit/slot/port.

•all — Shows lldp local device information on all interfaces.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Examples

These examples show advertised LLDP local data in two levels of detail.

console#show lldp local-device all

LLDP Local Device Summary

Interface Port ID Port Description

--------- -------------------- --------------------

Gi1/0/1 Gi1/0/1

console# show lldp local-device detail Gi1/0/1

LLDP Local Device Detail

Interface: Gi1/0/1

Chassis ID Subtype: MAC Address

Chassis ID: 00:62:48:00:00:00

Port ID Subtype: Interface Name

Port ID: Gi1/0/1

System Name:

System Description: Routing

Port Description:

System Capabilities Supported: bridge, router

System Capabilities Enabled: bridge

Layer 2 Switching Commands 564

Management Address:

Type: IPv4

Address: 192.168.17.25

show lldp med

This command displays a summary of the current LLDP MED configuration.

Syntax

show lldp med

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

Default Value

Not applicable

User Guidelines

No specific guidelines.

Example

console(config)#show lldp med

LLDP MED Global Configuration

Fast Start Repeat Count: 3

Device Class: Network Connectivity

show lldp med interface

This command displays a summary of the current LLDP MED configuration

for a specific interface.

Syntax

show lldp med interface {gigabitethernet unit/slot/port | tengigabitethernet

unit/slot/port| all}

•all — Shows information for all valid LLDP interfaces.

Layer 2 Switching Commands 565

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

Default Value

Not applicable

Example

console#show lldp med interface all

LLDP MED Interface Configuration

Interface Link configMED operMED ConfigNotify TLVsTx

--------- ------ --------- -------- ------------ -----------

Gi1/0/1 Detach Enabled Enabled Enabled0,1

Gi1/0/2 Detach Disabled Disabled Disabled 0,1

Gi1/0/3 Detach Disabled Disabled Disabled 0,1

Gi1/0/4 Detach Disabled Disabled Disabled 0,1

Gi1/0/5 Detach Disabled Disabled Disabled 0,1

console #show lldp med interface gi1/0/1

LLDP MED Interface Configuration

Interface Link configMED operMED ConfigNotify TLVsTx

--------- ------ -------- -------- -------- -------

Gi1/0/1 Up Enabled Enabled Disabled 0,1

TLV Codes: 0- Capabilities, 1- Network Policy

2-Location, 3- Extended PSE, 4- Extended PD, 5-Inventory

show lldp med local-device detail

This command displays the advertised LLDP local data in detail.

Syntax

show lldp med local-device detail {gigabitethernet unit/slot/port |

tengigabitethernet unit/slot/port}

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

Layer 2 Switching Commands 566

Default Value

Not applicable

Example

Console#show lldp med local-device detail gi1/0/8

LLDP MED Local Device Detail

Interface: Gi1/0/8

Network Policies

Media Policy Application Type : voice

Vlan ID: 10

Priority: 5

DSCP: 1

Unknown: False

Tagged: True

Media Policy Application Type : streamingvideo

Vlan ID: 20

Priority: 1

DSCP: 2

Unknown: False

Tagged: True

Inventory

Hardware Rev: xxx xxx xxx

Firmware Rev: xxx xxx xxx

Software Rev: xxx xxx xxx

Serial Num: xxx xxx xxx

Mfg Name: xxx xxx xxx

Model Name: xxx xxx xxx

Asset ID: xxx xxx xxx

Location

Subtype: elin

Info: xxx xxx xxx

Extended POE

Device Type: pseDevice

Extended POE PSE

Available: 0.3 watts

Source: primary

Priority: critical

Layer 2 Switching Commands 567

Extended POE PD

Required: 0.2 watts

Source: local

Priority: low

show lldp med remote-device

This command displays the current LLDP MED remote data. This command

can display summary information or detail for each interface.

Syntax

show lldp med remote-device {gigabitethernet unit/slot/port |

tengigabitethernet unit/slot/port | all}

show lldp med remote-device detail {gigabitethernet unit/slot/port |

tengigabitethernet unit/slot/port}

•all — Indicates all valid LLDP interfaces.

•detail — Includes a detailed version of remote data for the indicated

interface.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

Default Value

Not applicable

Example

console#show lldp med remote-device all

LLDP Remote Device Summary

Local

Interface RemoteID Device Class

--------- ---------- --------------------

Gi1/0/13 1 Class I

Gi1/0/16 2 Class II

Gi1/0/23 6 Not Defined

Console#show lldp med remote-device detail Gi1/0/1

LLDP MED Remote Device Detail

Layer 2 Switching Commands 568

Local Interface: 1/0/1

Capabilities

MED Capabilities Supported: capabilities, networkpolicy, location,

extendedpse

MED Capabilities Enabled: capabilities, networkpolicy

Device Class: Endpoint Class I

Network Policies

Media Policy Application Type : voice

Vlan ID: 10

Priority: 5

DSCP: 1

Unknown: False

Tagged: True

Media Policy Application Type : streamingvideo

Vlan ID: 20

Priority: 1

DSCP: 2

Unknown: False

Tagged: True

Inventory

Hardware Rev: xxx xxx xxx

Firmware Rev: xxx xxx xxx

Software Rev: xxx xxx xxx

Serial Num: xxx xxx xxx

Mfg Name: xxx xxx xxx

Model Name: xxx xxx xxx

Asset ID: xxx xxx xxx

Location

Subtype: elin

Info: xxx xxx xxx

Extended POE

Device Type: pseDevice

Extended POE PSE

Available: 0.3 Watts

Source: primary

Priority: critical

Extended POE PD

Layer 2 Switching Commands 569

Required: 0.2 Watts

Source: local

Priority: low

show lldp remote-device

Use the lldp remote-device command to display the current LLDP remote

data. This command can display summary information or detail for each

interface.

Syntax

show lldp remote-device {detail interface | interface | all}

• detail — Includes detailed version of remote data.

• interface — Specifies a valid physical interface on the device. Substitute

gigabitethernet

unit/slot/port

or tengigabitethernet

unit/slot/port

fortygigabitethernet

unit/slot/port

}

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Examples

These examples show current LLDP remote data, including a detailed

version.

console#show lldp remote-device all

LLDP Remote Device Summary

Local

Interface RemID Chassis ID Port ID System Name

-------- ------- ------------------ ------------------- -----------------

Gi1/0/7 12 14:18:77:15:23:68 14:18:77:15:23:6A console

Layer 2 Switching Commands 570

Gi1/0/19 7 00:1E:C9:AA:AB:FD Gi1/0/5

console#show lldp remote-device detail Gi1/0/13

LLDP Remote Device Detail

Local Interface: Gi1/0/13

Remote Identifier: 1

Chassis ID Subtype: MAC Address

Chassis ID: F8:B1:56:2B:A4:FA

Port ID Subtype: Interface Name

Port ID: Gi1/0/13

System Name:

System Description:

Port Description: Gi1/0/13

System Capabilities Supported:

System Capabilities Enabled:

Time to Live: 113 seconds

show lldp statistics

Use the show lldp statistics command to display the current LLDP traffic

statistics.

Syntax

show lldp statistics {unit/slot/port | all}

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Examples

The following examples shows an example of the display of current LLDP

traffic statistics. The output is abbreviated for the all form of the command.

console#show lldp statistics all

Layer 2 Switching Commands 571

LLDP Device Statistics

Last Update.................................. 0 days 22:58:29

Total Inserts................................ 1

Total Deletes................................ 0

Total Drops.................................. 0

Total Ageouts................................ 1

Tx Rx TLV TLV TLV TLV TLV

Interface Total Total Discards Errors Ageout Discards Unknowns MED 802.3 UPOE

--------- ----- ----- -------- ------ ------ -------- -------- ---- ----- -----

Gi1/0/1 29395 82562 0 0 1 0 0 0 1 4

Gi1/0/2 0 0 0 0 0 0 0 0 0 0 0

Gi1/0/3 0 0 0 0 0 0 0 0 0 0 0

Gi1/0/4 0 0 0 0 0 0 0 0 0 0 0

console#show lldp statistics Gi1/0/7

LLDP Device Statistics

Last Update.................................. 0 days 00:38:16

Total Inserts................................ 13

Total Deletes................................ 0

Total Drops.................................. 0

Total Ageouts................................ 0

Tx Rx TLV TLV TLV TLV TLV

Interface Total Total Discards Errors Ageout Discards Unknowns MED 802.1 802.3

--------- ----- ----- -------- ------ ------ -------- -------- ---- ----- -----

Gi1/0/7 2297 2298 0 0 0 0 0 0 0 10

The following table explains the fields in this example.

Fields Description

Last Update The value of system of time the last time a remote data entry

was created, modified, or deleted.

Total Inserts The number of times a complete set of information advertised

by a remote device has been inserted into the table.

Layer 2 Switching Commands 572

Total Deletes The number of times a complete set of information advertised

by a remote device has been deleted from the table.

Total Drops Number of times a complete set of information advertised by a

remote device could not be inserted due to insufficient

resources.

Total Ageouts Number of times any remote data entry has been deleted due to

time-to-live (TTL) expiration.

Transmit Total Total number of LLDP frames transmitted on the indicated

port.

Receive Total Total number of valid LLDP frames received on the indicated

port.

Discards Number of LLDP frames received on the indicated port and

discarded for any reason.

Errors Number of non-valid LLDP frames received on the indicated

port.

Ageouts Number of times a remote data entry on the indicated port has

been deleted due to TTL expiration.

TLV Discards Number LLDP TLVs (Type, Length, Value sets) received on the

indicated port and discarded for any reason by the LLDP agent.

TLV Unknowns Number of LLDP TLVs received on the indicated port for a type

not recognized by the LLDP agent.

TLV MED Number of OUI specific MED (Media Endpoint Device) TLVs

received.

TLV Number of OUI specific TLVs received.

TLV 802.3 Number of OUI specific 802.3 specific TLVs received.

TLV UPOE Number of PoE TLVs received

Fields Description

Layer 2 Switching Commands 573

Loop Protection

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Loop protection detects physical and logical loops between Ethernet ports on

a device. Loop protection must be enabled globally before it can be enabled at

the interface level.

Commands in this Section

This section explains the following commands:

keepalive (Interface Config)

Use the keepalive command in Interface Configuration mode to enable loop

protection on an interface. Use the no form of the command to return the

configuration to the defaults.

Syntax

keepalive

no keepalive

Default Configuration

Loop protection is disabled globally by default and disabled on all interfaces

by default.

Command Mode

Interface (Physical) Configuration mode

keepalive (Interface Config) show keepalive

keepalive (Global Config) show keepalive statistics

keepalive action

–

Layer 2 Switching Commands 574

User Guidelines

Loop protection operates by unicasting a Configuration Test Protocol (CTP)

reply packet with the following field settings:

• Source MAC Address:switch L3 MAC address

• Destination MAC Address: Switch L3 MAC address

• Ether Type: 0x0900 (LOOP)

• Skip Count: 0

• Functions: Reply

• Receipt Number: 0

• Data: 0

Since all switch ports share the same MAC address, if any interface receives

CTP packets transmitted by the switch in excess of the configured limit, that

interface is error disabled with a Loop Protection cause.

The switch never sends a response to received CTP packets. The switch may

flood the first few CTP packets it receives until a MAC address entry is placed

in the CAM.

The CTP protocol operates on physical Ethernet interfaces only. It does not

operate over Link Aggregation Groups. It may be configured to operate on

LAG members.

The CTP protocol does not operate over the out-of-band interface.

Command History

Implemented in version 6.3.0.1 firmware.

Example

The following example enables loop protection on an interface:

console(config)#keepalive

console(config)#interface gi1/0/1

console(config-if-Gi1/0/1)#keepalive

This example disables loop protection on an interface:

console(config)#interface gi1/0/1

console(config-if-Gi1/0/1)#no keepalive

Layer 2 Switching Commands 575

keepalive (Global Config)

Use the keepalive command in Global Configuration mode to enable

keepalive or to configure the loop protection timer and packet count. Use the

no form of the command to return the configuration to the defaults.

Syntax

keepalive [ period [ count ] ]

no keepalive

• period – Configures the interval for the transmission of keepalive packets.

Default: 10 seconds

• count – Configures the number of consecutive CTP packets addressed to

and received by the local switch before the interface is error disabled.

Default: 3 packets.

Default Configuration

Loop protection is disabled globally by default.

The default period is 10 seconds.

The default count is 3 packets.

Command Mode

Global Configuration mode

User Guidelines

Loop protect must be enabled individually on a physical interface as well as

globally.

If only the period parameter is specified, the count parameter remains

unchanged.

Loop protection may only be enabled on physical interfaces, not on port

channels or any virtual interfaces.

Command History

Implemented in version 6.3.0.1 firmware.

Layer 2 Switching Commands 576

Example

The following example configures the CTP transmit interval to transmit CTP

packets every 5 seconds.

console(config)#keepalive 5

This example configures the CTP transmit interval to 5 seconds. If an

interface receives two CTP packets, it error disables the interface.

console(config)#keepalive 5 2

In the next example, if the CTP transmit interval is configured to 5 seconds,

if an interface receives three CTP packets, it will error disable the interface.

console(config)#no keepalive

keepalive action

Use the keepalive action command to configure the action taken when a loop

is detected on an interface. Use the no form of the command to return the

action to the default.

Syntax

keepalive action {error-disable | log-only}

no keepalive action

•

error-disable

— When a loop is detected, the interface is disabled and a

log message is issued.

•

log-only

— When a loop is detected, a log message is issued and the

interface is not error disabled.

Default Configuration

The default is to error disable the interface when a loop is detected.

Command Mode

Interface Configuration mode

Layer 2 Switching Commands 577

User Guidelines

Error disabled interfaces can be configured to auto-recover using the

errdisable recovery cause loop-protect command. Keep-alive should only be

configured on interfaces that do not participate in spanning-tree. Keep-alive

may disable interfaces in the spanning-tree designated (blocked) role.

Command History

Implemented in version 6.3.0.1 firmware. Syntax corrected in 6.4 release.

Example

The following example configures loop protection to log detected loop

conditions without error disabling the port.

console(config)#interface gi1/0/1

console(config-if-Gi1/0/1)#keepalive action log

show keepalive

Use the show keepalive command to display the global loop protect

configuration.

Syntax

show keepalive

Default Configuration

There is no default configuration.

Command Mode

Privileged Exec mode and configuration submodes.

User Guidelines

The following information is displayed.

Field Description

Keepalive Service The Keepalive service configuration

(Enabled, Disabled).

Layer 2 Switching Commands 578

Command History

Implemented in version 6.3.0.1 firmware. Example updated in 6.4 version.

Example

console#show keepalive

Keepalive Service.............................. Enabled

Transmit Interval.............................. 10

Retry Count.................................... 3

show keepalive statistics

Use the show keepalive statistics command to display the loop protect status

for one or all interfaces.

Syntax

show keepalive statistics {interface-id | all}

•

interface-id

— Displays the statistics for the specified Ethernet (Physical)

interface.

•

all

— Displays statistics for all interfaces.

Default Configuration

There is no default configuration.

Command Mode

Privileged Exec mode and all configuration sub modes

Transmit Interval The transmission interval in seconds.

Retry Count The number of times a keepalive packet

must be seen before a looped state is

declared.

Field Description

Layer 2 Switching Commands 579

User Guidelines

The following information is displayed.

Command History

Implemented in version 6.3.0.1 firmware.

Example

console#show keepalive statistics gi1/0/3

Keep Loop Loop Time Since Rx Port

Port Alive Detected Count Last Loop Action Status

-------- --------- ----------- -------- ------------- ------------- --------

Gi1/0/3 Yes No Error disable Enable

Field Description

Port The interface identifier.

Keep Alive Are keepalives transmitted on this interface (Yes,

No)?

Loop Detected Has a loop been detected (Yes, No)?

Loop Count The number of CTP packets detected.

Time Since Last Loop The last time a loop was detected.

Rx Action Action when a loop is detected (Error disable, Log).

Port Status Current port status (Enable, Disable).

Layer 2 Switching Commands 580

MLAG Commands

Dell EMC Networking N2000/N2100-ON/N3000/N3100-ON/N4000

Series Switches

MLAG enables a LAG to be created across two independent switches, so that

some member ports of a MLAG can reside on one switch and the other

members of a MLAG can reside on another switch. The partner switch on the

remote side can be a MLAG-unaware unit. To the MLAG unaware switch, the

MLAG appears to be a single LAG connected to a single switch.

NOTE: This feature is not available on the N3000 when loaded with the

AGGREGATION ROUTER-enabled firmware (e.g., N3000_BGPvA.B.C.D.stk).

Commands in this Section

This section explains the following commands:

clear vpc statistics

Use the clear vpc statistics command to clear the counters for the keepalive

messages transmitted and received by the MLAG switch.

Syntax

clear vpc statistics {peer-keepalive | peer-link}

clear vpc statistics show vpc consistency-parameters

feature vpc show vpc consistency-features

peer detection enable show vpc peer-keepalive

peer detection interval show vpc role

peer-keepalive destination show vpc statistics

peer-keepalive enable system-mac

peer-keepalive timeout system-priority

role priority vpc

show vpc vpc domain

show vpc brief vpc peer-link

Layer 2 Switching Commands 581

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec mode

User Guidelines

There are no user guidelines for this command.

Example

console#clear vpc statistics

feature vpc

The feature vpc command globally enables MLAG. Use the no form of the

command to globally disable MLAG.

Syntax

feature vpc

no feature vpc

Default Configuration

By default, the MLAG feature is not globally enabled.

Command Modes

Global Configuration mode

User Guidelines

The MLAG configuration is retained even when the feature is disabled. The

peer link will not be enabled if the VPC feature is not enabled.

MLAG role election occurs if the MLAG feature is enabled and the keepalive

state machine is enabled.

Example

console#configure terminal

console(config)#feature vpc

Layer 2 Switching Commands 582

peer detection enable

Use the peer detection enable command to enable the Dual Control Plane

Detection Protocol. This enables the detection of peer MLAG switches and

suppresses state transitions out of the secondary state in the presence of peer

link failures.

Use the no form of the command to disable the dual control plane detection

protocol.

Syntax

peer detection enable

no peer detection enable

Default Configuration

Dual Control Plane Detection Protocol is disabled by default.

Command Modes

MLAG Domain Configuration mode

Usage Guidelines

Use of the Dual Control Plane Detection Protocol is optional. It provides a

second layer of redundancy beyond that provided by the peer link protocol.

System that operate without the DCPDP protocol enabled (and use static

LAGs) run the risk of a split brain scenario in the case of peer link failure.

Example

console(config)#vpc domain 1

console(config-vpc 1)#peer-keepalive enable

console(config-vpc 1)#peer-keepalive destination 192.168.0.2 source

192.168.0.1

console(config-vpc 1)#peer detection enable

console(config-vpc 1)#exit

peer detection interval

Use this command to configure the peer detection transmission interval and

the detection interval. Use the no form of the command to return the

transmission and detection intervals to the default.

Layer 2 Switching Commands 583

Syntax

peer detection interval interval-msecs timeout timeout-msecs

no peer detection interval

• interval-msecs—The peer keepalive timeout in seconds. The range is 200–

4000 milliseconds.

• timeout-msecs—The peer timeout value in milliseconds. The range is

700–14000 milliseconds.

Default Configuration

The default transmission interval is 1000 milliseconds. The default reception

timeout is 3500 milliseconds.

Command Modes

VPC Domain mode

User Guidelines

This command configures the DCPDP transmission and timeout values. If an

MLAG switch does not receive DCPDP messages from the peer for the

configured timeout value, it takes the decision to transition its role (if

required).

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config-vpc 1)#peer detection interval 750 timeout 3000

peer-keepalive destination

Use the peer-keepalive destination command to enable the Dual Control

Plane Detection Protocol with the configured IP address of the peer MLAG,

the local source address and the peer timeout value. The UDP port on which

the MLAG switch listens to the Dual Control Plane Detection Protocol

messages is also configurable with this command.

Use the no form of the command to return the configuration to the default.

Layer 2 Switching Commands 584

Syntax

peer-keepalive destination ipaddress source srcaddr [udp-port port]

no peer-keepalive destination

• ipaddress—The ip address of the MLAG peer.

• port—The UDP port number to use to listen for peer Dual Control Plane

Detection Protocol packets.

• srcaddr—The local source address to use.

Default Configuration

There are no Dual Control Plane Detection Protocol peers configured by

default.

Command Modes

MLAG Domain Configuration mode

User Guidelines

Changes to the DCPDP configuration do not take effect until the protocol is

disabled and then re-enabled. Both the local switch and the MLAG peer

switch must be configured identically. The recommended procedure to

update these parameters is to disable the DCPDP protocol on both switches,

configure the new parameters on both switches, and then re-enable the

DCPDP protocol on both switches.

The Dual Control Plane Detection Protocol is a UDP-based protocol. The

administrator must configure this protocol on an IP interface with a VLAN

that is not shared with any of the MLAG interfaces. This can include the out-

of-band port. When enabled, the dual-control plane detection protocol sends

a control plane detection message to the peer once every second. The

message is unidirectional and contains the sender’s MAC address. When a

switch receives a control plane detection message it sets the ‘peer is UP’

variable to TRUE to indicate that a peer is detected.

Do not configure DCPDP to use a port reserved by the switch. UDP, TCP and

RAW ports reserved by the switch and unavailable for use or configuration

are:

Ports 1, 17, 58, 255, 546, 547, 2222, 4567, 6343, 49160

Layer 2 Switching Commands 585

Example

console(config)#vpc domain 1

console(config-vpc 1)#peer-keepalive enable

console(config-vpc 1)#peer-keepalive destination 192.168.0.2 source

192.168.0.1

console(config-vpc 1)#peer detection enable

console(config-vpc 1)#exit

peer-keepalive enable

Use the peer-keepalive enable command to enable the peer keepalive

protocol on the peer link. When enabled, if an MLAG switch does not receive

keepalive messages from the peer within the timeout value and DCPDP is

disabled, the switch begins the process of transitioning to the primary role (if

standby).

Use the no form of the command to disable the peer keepalive protocol.

Syntax

peer-keepalive enable

no peer-keepalive enable

Default Configuration

The peer keepalive protocol is disabled by default.

Command Modes

MLAG Domain Configuration mode

User Guidelines

MLAG will not become operational until the peer keepalive protocol detects

a peer and syncs the peer information. Peer keepalive timeout state

transitions are suppressed if the Dual Control Plan Detection (DCPDP) is

enabled and detects that the peer is still alive.

Two failure situations cause state transitions:

• The peer device fails: A peer does not receive any more advertisements and

the timeout timer expires.

Layer 2 Switching Commands 586

• Secondary device fails: All MLAG members’ port information

regarding the secondary device that the primary switch maintains are

removed from the primary switch. Forwarding and control processing

continues on the local MLAG ports on the primary switch. Once the

secondary comes back up again, it starts the keepalive protocol and, if

successful in contacting the primary device, moves to the secondary

state. It then initiates an FDB sync and becomes operational again.

• Primary device fails: The secondary device transitions to primary state

and continues forwarding traffic on its local MLAG ports. It also starts

processing control messages. The MLAG connected devices see a

change in the source MAC address. Once the peer device comes up

again, it starts the keepalive protocol and transitions to the secondary

state.

• The peer-link fails: This occurs when either switch cannot contact the peer

through the peer keepalive protocol and the DCPDP protocol. The

secondary switch transitions to a primary role which results in two primary

switches. Both primaries continue forwarding traffic. Each primary also

processes control traffic and sends LACP and BPDU packets with a unique

source MAC address (the system MAC of the local switch). The MLAG

connected devices become aware that they are connected to two devices

and, if LACP is enabled, block the links to one of the peers as a new actor

ID is received. STP re-convergence may also occur in this scenario.

Example

console(config)#vpc domain 1

console(config-vpc 1)#peer-keepalive enable

console(config-vpc 1)#peer-keepalive destination 192.168.0.2 source

192.168.0.1

console(config-vpc 1)#peer detection enable

console(config-vpc 1)#exit

peer-keepalive timeout

Use this command to configure the peer keepalive timeout value, in seconds.

Use the no form of this command to return the timeout value to the default.

Syntax

peer-keepalive timeout value

Layer 2 Switching Commands 587

no peer-keepalive timeout

• value—The peer keepalive timeout value in seconds. The range is 2 to 15

seconds.

Default Configuration

By default, the keepalive timeout value is 5 seconds.

Command Modes

VPC Domain

User Guidelines

This command configures the peer keepalive timeout value (in seconds). If an

MLAG switch does not receive keepalive messages from the peer for this

timeout value, it takes the decision to transition its role (if required).

The keepalive state machine is not restarted if keepalive priority is modified

post election.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config-vpc 1)# peer-keepalive timeout 10

role priority

Use the role priority command to configure the priority value used on a

switch for primary/secondary role selection. The primary switch is responsible

for maintaining and propagating spanning-tree and link-aggregation to the

secondary switch.

Use the no form of the command to return the switch priority to the default

value.

Syntax

role priority value

no role priority

Layer 2 Switching Commands 588

• Value—The local switch priority value. (The range is 1-255.)

Default Configuration

The default priority value is 100.

Command Modes

MLAG Domain Configuration mode

User Guidelines

This value is used for the MLAG role election and is sent to the MLAG peer

in the MLAG keepalive messages. The MLAG switch with the numerically

lower priority value becomes the Primary and the switch with higher priority

becomes the Secondary. If both the MLAG peer switches have the same role

priority, the device with lower system MAC address becomes the Primary

switch.

Changes to the priority value are not preemptive. The keepalive role selection

state machine is not restarted even if the keepalive priority is modified post

election. This means that priority value changes in a running MLAG domain

do not affect the selection of the primary and secondary switches. In order for

changes to take effect, disable the VPC with the no feature vpc command

and re-enable it.

Example

console(config-vpc 1)#role priority 30

show vpc

Use the show vpc command to display MLAG information. The

configuration and operational modes of the MLAG are displayed. The MLAG

is operationally enabled if all preconditions are met. The port channel

configured as an MLAG interface is also displayed along with the member

ports on the current switch and peer switch (plus their link status).

Syntax

show vpc id

• id—A valid MLAG identifier.

Layer 2 Switching Commands 589

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec mode and above

User Guidelines

There are no user guidelines for this command.

Example

(console)# show vpc 10

VPC Id 10

-----------------

Configuration mode......................Enabled

Operational mode........................Enabled

Port channel................................Po1

Self member ports Status

------------------------ ---------

Gi1/0/2 Up

Gi1/0/6 Down

show vpc brief

Use the show vpc brief command to display the MLAG global status. The

command displays the current MLAG operational mode as well as the

peerlink and keepalive status is also displayed. The number of configured and

operational MLAGs along with the system MAC and role are also displayed.

Syntax

show vpc brief

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec mode and above

Layer 2 Switching Commands 590

User Guidelines

A VPC domain ID must be configured for this command to display the VPC

status.

Only the Primary switch maintains the member status of the Secondary

switch. The Secondary switch does not maintain or show the status of the

Primary switch peer members.

A VPC instance may show as enabled even if all of the port-channels that are

members of the VPC are disabled or all of the links in the port channels are

disabled. A VPC will show as disabled if peer-link (or DCPDP) connectivity is

lost.

The Keepalive admin status field shows the status of the peer-link protocol.

The VPC operational status shows the overall MLAG status.

The Peer detection admin status field shows the status of the DCPDP

protocol.

Example

console#show vpc brief

VPC domain id is not configured.

console#show vpc brief

VPC Domain ID...................................2

VPC admin status................................Disabled

Keepalive admin status..........................Disabled

VPC operational status..........................Disabled

Self role.......................................None

Peer role.......................................None

Peer detection admin status.....................Disabled

Operational VPC MAC.............................F8B1.562B.A1D6

Operational VPC system priority................ 100

Peer-Link details

-----------------

Interface.......................................Po1

Peer-link admin status..........................Enabled

Peer-link STP admin status......................Disabled

Configured VLANs................................1,10,11,12,13,14,15,16,17

VPC Details

-----------

Layer 2 Switching Commands 591

Number of VPCs configured...................... 2

Number of VPCs operational..................... 2

VPC id# 1

-----------

Interface...................................... Po2

Configured Vlans............................... 1,10,11,12,13,14,15,16,17

VPC Interface State............................ Active

Local MemberPorts Status

----------------- ------

Gi1/0/23 UP

Gi1/0/24 UP

Peer MemberPorts Status

---------------- ------

Gi1/0/23 UP

Gi1/0/24 UP

VPC id# 2

-----------

Interface...................................... Po3

Configured Vlans............................... 1,10,11,12,13,14,15,16,17

VPC Interface State............................ Active

show vpc consistency-parameters

Use the show vpc consistency parameters on both MLAG peers to display

MLAG related configuration information in a format suitable for comparison

with the other MLAG peer.

Syntax

show vpc consistency-parameters { global | interface port-channel-number }

• port-channel-number—A valid port-channel identifier.

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec mode and above

Layer 2 Switching Commands 592

User Guidelines

There are no user guidelines for this command.

Command History

Introduced in 6.2.0.1 firmware.

Updated in 6.3.0.1 firmware.

Example

console# show vpc consistency-parameters global

Parameter Value

--------------------- -------------------------------------------

STP Mode Enabled

STP Version IEEE 802.1s

BPDU Filter Mode Enabled

BPDU Guard Mode Enabled

MST Instances 1,2,4

FDB Aging Time 300 seconds

VPC System MAC Address <AA:BB:CC:DD:EE:FF>

VPC System Priority 32767

VPC System MAC Address 00:1E:C9:DE.A2:08

VPC System Priority 32767

VPC Domain ID 1

MST VLAN Configuration

Instance Associated VLANs

------------- -----------------------------------

1 7,8,10,20

2 4,5,40-50

4 30,32,34-38

RSTP-PV Configuration

Direct Rapid Convergence: Enabled/Disabled

DRC Update Rate: <0-32000> per second

Indirect Rapid Convergence: Enabled/Disabled

VLAN STP STP Hello Forward Maximum Priority

Mode Root Time Time Age

----- -------- ------- ----- ------- -------- ---------

4 Enabled Primary 2 15 15 0

switch# show vpc consistency-parameters interface port-channel 2

Layer 2 Switching Commands 593

Parameter

Name Value

---------------- ---------------------------

Port Channel Mode Enabled

STP Mode Enabled

BPDU Filter Mode Enabled

BPDU Flood Mode Enabled

Auto-edge FALSE

TCN Guard True

Port Cost 2

Edge Port True

Root Guard True

Loop Guard True

Hash Mode 3

Minimum Links 1

Channel Type Static

Configured VLANs 4,5,7,8

MTU 1518

Active Port Speed Duplex

------------ --------- --------

Gi1/0/1 100 Full

Gi1/0/2 100 Full

MST VLAN Configuration

Instance Associated VLANS

------------- -----------------------------------

1 7,8

2 4,5

RSTP-PV Configuration:

STP Port Priority: <0-240>

VLAN Port Priority Cost

------- ----------------- ---------------------------

show vpc consistency-features

Use the show vpc consistency parameters on both MLAG peers to display

MLAG related configuration information in a format suitable for comparison

with the other MLAG peer.

Layer 2 Switching Commands 594

Syntax

show vpc consistency-features { global | interface port-channel-number }

• port-channel-number—A valid port-channel identifier.

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec mode and above

User Guidelines

There are no user guidelines for this command.

show vpc peer-keepalive

Use the show vpc peer-keepalive command to display the peer MLAG

switch’s IP address used by the Dual Control Plane Detection Protocol. The

port used for the Dual Control Plane Detection Protocol is shown, as well as if

peer detection is enabled or not. If enabled, the detection status is displayed.

Syntax

show vpc peer-keepalive

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec mode and above

User Guidelines

A VPC domain ID must be configured for this command to display the

keepalive status.

Example

(Switching) # show vpc peer-keepalive

Layer 2 Switching Commands 595

Peer IP address............................10.130.14.55

Source IP address..........................10.130.14.54

UDP port...................................50000

Peer detection admin status................Enabled

Peer detection operational status..........Up

Peer is detected...........................True

Configured Tx interval.....................500 milliseconds

Configured Rx timeout......................2000 milliseconds

Operational Tx interval....................500 milliseconds

Operational Rx timeout.....................2000 milliseconds

show vpc role

Use the show vpc role command to display information about the keepalive

status and parameters. The role of the MLAG switch as well as the system

MAC and priority are displayed.

Syntax

show vpc role

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec mode and above

User Guidelines

A VPC domain ID must be configured for this command to display the VPC

role.

Example

console# show vpc role

Self

----

VPC domain ID...................................1

Keepalive config mode.......................... Enabled

Keepalive operational mode..................... Enabled

Role Priority.................................. 100

Configured VPC MAC..............................<AA:BB:CC:DD:EE:FF>

Operational VPC MAC.............................<AA:BB:CC:DD:EE:FF>

Layer 2 Switching Commands 596

Configured VPC system priority..................32767

Operational VPC system priority.................32767

Local System MAC..................................... 00:10:18:82:18:63

Timeout........................................ 5

VPC State...................................... Primary

VPC Role....................................... Primary

Peer

----

VPC Domain ID.................................. 1

Role Priority.................................. 100

Configured VPC MAC..............................<AA:BB:CC:DD:EE:FF>

Operational VPC MAC.............................<AA:BB:CC:DD:EE:FF>

Configured VPC system priority..................32767

Operational VPC system priority.................32767

Role............................................Secondary

Local System MAC................................00:10:18:82:1b:ab

show vpc statistics

Use the show vpc statistics command to display the counters for the keepalive

messages transmitted and received by the MLAG switch.

Syntax

show vpc statistics {peer-keepalive | peer-link}

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec mode and above

User Guidelines

There are no user guidelines for this command.

Example

(console)# show vpc statistics peer-keepalive

Total transmitted.......................................123

Tx successful...........................................118

Tx errors...............................................5

Layer 2 Switching Commands 597

Total received..........................................115

Rx successful...........................................108

Rx Errors...............................................7

Timeout counter.........................................6

(console)# show vpc statistics peer-link

Peer link control messages transmitted..................123

Peer link control messages Tx errors................... 5

Peer link control messages Tx timeout.................. 4

Peer link control messages ACK transmitted............. 34

Peer link control messages ACK Tx errors............... 5

Peer link control messages received.................... 115

Peer link data messages transmitted.................... 123

Peer link data messages Tx errors...................... 5

Peer link data messages Tx timeout..................... 4

Peer link data messages ACK transmitted................ 34

Peer link data messages ACK Tx errors.................. 5

Peer link data messages received....................... 115

Peer link BPDU’s transmitted to peer................... 123

Peer link BPDU’s Tx error.............................. 9

Peer link BPDU’s received from peer.................... 143

Peer link BPDU’s Rx error.............................. 1

Peer link LACPDU’s transmitted to peer................. 123

Peer link LACPDU’s Tx error............................ 9

Peer link LACPDU’s received from peer.................. 143

Peer link LACPDU’s Rx error............................ 1

(console)#show vpc statistics peer-link

Peer link control messages transmitted......... 24

Peer link control messages Tx errors........... 0

Peer link control messages Tx timeout.......... 0

Peer link control messages ACK transmitted..... 23

Peer link control messages ACK Tx errors....... 0

Peer link control messages received............ 23

Peer link data messages transmitted............ 73

Peer link data messages Tx errors.............. 0

Peer link data messages Tx timeout............. 0

Peer link data messages received............... 73

Peer link BPDU's transmitted to peer........... 0

Peer link BPDU's Tx errors..................... 0

Peer link BPDU's received from peer............ 0

Peer link BPDU's Rx errors..................... 0

Peer link LACPDU's transmitted to peer......... 73

Peer link LACPDU's Tx errors................... 0

Peer link LACPDU's received from peer.......... 73

Peer link LACPDU's Rx errors................... 0

Layer 2 Switching Commands 598

system-mac

Use this command to manually configures the MAC address for the VPC

domain. Use the no form of the command to revert the domain MAC address

to the default value.

Syntax

system-mac mac-address

no system-mac

• mac-address—The system MAC address for the VPC domain.

Default Configuration

By default, the domain uses a pre-configured MAC address.

Command Modes

VPC domain mode

User Guidelines

The VPC domain MAC address must be the same on both MLAG peer

devices. The MAC address is a unicast MAC address in aa:bb:cc:dd:ee:ff

format and is not equal to the physical MAC address of either the primary

VPC or secondary VPC device. The configured VPC domain MAC address is

exchanged during role election and, if configured differently on the peer

devices, VPC does not become operational.

The configured domain MAC address is present in the LACP PDUs and STP

BPDUs that are sent on VPC member ports if VPC primary device election

takes place after the VPC MAC address is configured. When the VPC MAC

address is configured after the VPC primary device is elected, already agreed

upon operational VPC MAC address is used in the LACP PDUs and STP

BPDUs instead of the configured VPC MAC address.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config-vpc 1)system-mac 00A2.64B3.A245

Layer 2 Switching Commands 599

system-priority

Use this command to manually configure the priority for the VPC domain.

Use the no form of the command to revert the priority to the default value.

Syntax

system-priority priority

no system-priority

• priority—The priority for the VPC domain. Range is 1-65535.

Default Configuration

By default, the system priority is 32767.

Command Modes

VPC domain mode

User Guidelines

The system priority must be configured identically on all VPC peers. If the

configured VPC system priority is different on any VPC peer, the VPC will

not come up.

The system-priority is present in the LACP PDUs that are sent out on VPC

member ports. When the VPC system priority is configured after a VPC

primary device is elected, the already agreed operational VPC system priority

is used in the LACP PDUs instead of the newly configured VPC system

priority.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config-vpc 1) system-priority 2774

Layer 2 Switching Commands 600

vpc

Use the vpc command to configure a port-channel (LAG) as part of an

MLAG instance. Upon issuing this command, the port-channel is down until

the port-channel member information is exchanged and agreed between the

MLAG peer switches.

Use the no form of the command to remove the LAG from the MLAG

domain.

Syntax

vpc vpc-id

no vpc vpc-id

• vpc-id—The MLAG identifier.

Default Configuration

LAGs are not members of an MLAG domain by default. It is expected that all

links belonging to an MLAG instance are connected to switch (or switches)

which consider the links to be members of a single LAG.

This configuration must be present on both the primary and secondary

switches.

The port channel number and VPC number can be different from each other

but the mapping must be the same on the primary and secondary MLAG

peers (i.e., the port channel number must map to the same VPC number on

both MLAG peers).

Command Modes

Port-channel mode

User Guidelines

The peer keepalive protocol is required for MLAG operation. Configure a

LAG between the two MLAG peers as an MLAG peer link before executing

this command.

Example

console(config)#interface po3

console(config-if-Po3)#switchport mode trunk

Layer 2 Switching Commands 601

console(config-if-Po3)#switchport trunk allowed vlan 1-99,101-4093

console(config-if-Po3)#vpc 2

console(config-if-Po3)#exitconsole(config)#interface po3

console(config-if-Po3)#switchport mode trunk

console(config-if-Po3)#switchport trunk allowed vlan 1-99,101-4093

console(config-if-Po3)#vpc 2

console(config-if-Po3)#exit

vpc domain

Use the vpc domain command to enter into MLAG configuration mode. This

command creates an MLAG domain and enters into MLAG configuration

mode. Use the no form of the command to delete the VPC domain, disable

peer-keepalive and peer detection in the domain, and reset all the configured

parameters (role priority, VPC MAC address and VPC system priority) for the

VPC domain.

Syntax

vpc domain domain-id

• domain-id—The MLAG domain instance. The range is 1-255.

Default Configuration

By default, no MLAG domains are configured.

Command Modes

Global Configuration mode

User Guidelines

Only one MLAG domain per MLAG is supported. This command creates a

VPC domain with the specified domain-id and enters into the VPC domain

configuration mode. Only one VPC domain can be created on a given device.

The domain-id of the VPC domain should be equal to the one configured on

the other VPC peer with this device wants to form a VPC pair. The configured

VPC domain-ids are exchanged during role election and if they are configured

differently on the peer devices, then VPC does not become operational.

The administrator needs to ensure that the no two VPC domains share the

same VPC domain-id. The domain-id is used to derive the auto-generated

VPC MAC address used in the actor ID field in the LACP PDUs and STP

Layer 2 Switching Commands 602

BPDUs sent out on VPC interfaces. If two VPC domains have the identical

domain-ids, the resulting actor IDs may lead to LACP or STP convergence

issues.

Example

console(config)#vpc domain 1

console(config-vpc 1)#peer-keepalive enable

console(config-vpc 1)#peer-keepalive destination 192.168.0.2 source

192.168.0.1

console(config-vpc 1)#peer detection enable

console(config-vpc 1)#exit

vpc peer-link

Use the vpc peer-link command to configure a port channel as the MLAG

peer link for a domain and enables the peer link protocol.

Use the no form of the command to remove the peer link configuration from

an MLAG domain and disable the peer link protocol.

Syntax

vpc peer-link

no vpc peer-link

Default Configuration

There are no peer links configured by default.

Command Modes

Port-channel configuration mode

User Guidelines

This configuration must the present on both the primary and secondary

switches. The peer keepalive protocol is required for MLAG operation.

Configure and enable a LAG between the two MLAG peers as an MLAG peer

link before executing this command.

Example

console(config)#interface port-channel 1

console(config-if-Po1)#description "MLAG-Peer-Link"

Layer 2 Switching Commands 603

console(config-if-Po1)#spanning-tree disable

console(config-if-Po1)#switchport mode trunk

console(config-if-Po1)#switchport trunk allowed vlan 1-99,101-4093

console(config-if-Po1)#vpc peer-link

console(config-if-Po1)#exit

Layer 2 Switching Commands 604

Multicast VLAN Registration

Commands

Dell EMC Networking N1100-ON/N2000/N2100-ON/N3000/N3100-

ON/N4000 Series Switches

Multicast VLAN registration (MVR) is a method for consolidating multicast

traffic from multiple VLANs onto a single VLAN. A typical usage scenario

would be the distribution of a multicast group to a switch using a single

VLAN where the switch has users in different VLANs subscribing to the

multicast group. MVR enables the distribution of the multicast group from

the single consolidated VLAN onto the multiple user VLANs.

MVR, like the IGMP Snooping protocol, allows a Layer 2 switch to snoop on

the IGMP control protocol. Both protocols operate independently from each

other. Both protocols may be enabled on the switch interfaces at the same

time. In such a case, MVR is listening to the join and report messages only for

groups configured statically. All other groups are managed by IGMP snooping.

There are two types of MVR ports: source and receiver.

• Source port is the port to which the multicast traffic is flowing using the

multicast VLAN.

• Receiver port is the port where a listening host is connected to the switch.

It can utilize any (or no) VLAN, except the multicast VLAN. This implies

that the MVR switch will perform VLAN tag substitution from the

multicast VLAN Source port to the VLAN tag used by the receiver port.

The Multicast VLAN is the VLAN that is configured in the specific network

for MVR purposes. It must be manually specified by the operator for all

multicast source ports in the network. It is this VLAN that is used to transfer

multicast traffic over the network to avoid duplication of multicast streams

for clients in different VLANs.

NOTE: MVR can only be enabled on physical interfaces, not on LAGs or VLANs.

NOTE: This feature is not available on the N3000 when loaded with the

AGGREGATION ROUTER-enabled firmware (e.g., N3000_BGPvA.B.C.D.stk).

Layer 2 Switching Commands 605

Commands in this Section

This section explains the following commands:

mvr

Use the mvr command in Global Configuration and Interface Configuration

modes to enable MVR. Use the no form of this command to disable MVR.

Syntax

mvr

no mvr

Default Configuration

The default value is Disabled.

Command Mode

Global Configuration, Interface Configuration

User Guidelines

MVR can only be configured on physical interfaces.

mvr group

Use the mvr group command in Global Configuration mode to add an MVR

membership group. Use the no form of the command to remove an MVR

membership group.

mvr mvr type

mvr group mvr vlan group

mvr mode show mvr

mvr querytime show mvr members

mvr vlan show mvr interface

mvr immediate show mvr traffic

Layer 2 Switching Commands 606

Syntax

mvr group A.B.C.D [count]

no mvr group A.B.C.D [count]

• A.B.C.D—Specify a multicast group.

• count—Specifies the number of multicast groups to configure. Groups are

configured contiguously by incrementing the first group specified.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration

User Guidelines

The following table lists the completion messages.

Example

console(config)#mvr

console(config)#mvr group 239.0.1.0 31

console(config)#mvr vlan 10

mvr mode

Use the mvr mode command in Global Configuration mode to change the

MVR mode type. Use the no form of the command to set the mode type to

the default value.

Syntax

mvr mode {compatible | dynamic}

Message Type Message Description

Successful Completion Message None

Error Completion Message

• Not an IP multicast group address

• Illegal IP multicast group address

Layer 2 Switching Commands 607

no mvr mode

•compatible—Do not allow membership joins on source ports.

•dynamic—Send IGMP joins to the multicast source when IGMP joins are

received on receiver ports.

Default Configuration

The default mode is compatible.

Command Mode

Global Configuration

User Guidelines

This command has no user guidelines.

mvr querytime

Use the mvr querytime command in Global Configuration mode to set the

MVR query response time. The query time is the maximum time to wait for

an IGMP membership report on a receiver port before removing the port from

the multicast group after receiving a leave message. The query time only

applies to receiver ports and is specified in tenths of a second.

Use the no form of the command to set the MVR query response time to the

default value.

Syntax

mvr querytime 1–100

no mvr querytime

Default Configuration

The default value is 5 tenths of a second.

Command Mode

Global Configuration

Layer 2 Switching Commands 608

User Guidelines

The following table lists the completion messages.

Example

console(config)#interface Gi1/0/1

console(config-if-Gi1/0/1)#switchport access vlan 2

console(config-if-Gi1/0/1)#mvr

console(config-if-Gi1/0/1)#mvr type receiver

console(config-if-Gi1/0/1)#exit

console(config)#mvr mode dynamic

console(config)#mvr querytime 10

mvr vlan

Use the mvr vlan command in Global Configuration mode to set the MVR

multicast VLAN. Use the no form of the command to set the MVR multicast

VLAN to the default value.

Syntax

mvr vlan vlan-id

no mvr vlan

•

vlan-id

—

Specifies the port on which multicast data is expected to be received.

Source ports should belong to this VLAN.

Default Configuration

The default value is 1.

Command Mode

Global Configuration

User Guidelines

The following table lists the completion messages.

Message Type Message Description

Successful Completion Message Defaulting MVR query response time.

Error Completion Message None

Layer 2 Switching Commands 609

mvr immediate

Use the mvr immediate command in Interface Configuration mode to enable

MVR Immediate Leave mode. Use the no form of this command to set the

MVR multicast VLAN to the default value.

Syntax

mvr immediate

no mvr immediate

Default Configuration

The default value is Disabled.

Command Mode

Interface Configuration

User Guidelines

Immediate leave should only be configured on ports with a single receiver.

When immediate leave is enabled, a receiver port will leave a group on receipt

of a leave message. Without immediate leave, upon receipt of a leave

message, the port sends an IGMP query and waits for an IGMP membership

report.

Example

console(config)#interface Gi1/0/1

console(config-if-Gi1/0/1)#switchport access vlan 10

console(config-if-Gi1/0/1)#mvr

console(config-if-Gi1/0/1)#mvr type receiver

console(config-if-Gi1/0/1)#mvr immediate

console(config-if-Gi1/0/1)#exit

console(config)#mvr mode dynamic

Message Type Message Description

Successful Completion Message MVR multicast VLAN ID is set to the

default value which is equal to 1.

Error Completion Message Receiver port in mVLAN, operation failed.

Layer 2 Switching Commands 610

mvr type

Use the mvr type command in Interface Configuration mode to set the MVR

port type. Use the no form of this command to set the MVR port type to

None.

Syntax

mvr type {receiver | source}

no mvr type

•receiver—Configure the port as a receiver port. Receiver ports are ports

over which multicast data will be sent but not received.

•source—Configure the port as a source port. Source ports are ports over

which multicast data is received or sent.

Default Configuration

The default value is None.

Command Mode

Interface Configuration

User Guidelines

The following table lists the completion messages.

Example

console(config)#mvr

console(config)#mvr group 239.1.1.1

console(config)#vlan 99

console(config-vlan99)#exit

console(config)#interface Gi1/0/1

console(config-if-Gi1/0/1)#switchport access vlan 10

console(config-if-Gi1/0/1)#mvr

Message Type Message Description

Successful Completion Message None

Error Completion Message

• Port is a Trunk port, operation failed.

• Receiver port in mVLAN, operation failed.

Layer 2 Switching Commands 611

console(config-if-Gi1/0/1)#mvr type receiver

console(config-if-Gi1/0/1)#interface Gi1/0/24

console(config-if-Gi1/0/24)#switchport mode trunk

console(config-if-Gi1/0/24)#switchport trunk native vlan 99

console(config-if-Gi1/0/24)#switchport trunk allowed vlan add 99

console(config-if-Gi1/0/24)#mvr

console(config-if-Gi1/0/24)#mvr type source

console(config-if-Gi1/0/24)#exit

mvr vlan group

Use the mvr vlan group command in Interface Configuration mode to

participate in the specific MVR group. Use the no form of this command to

remove the port participation from the specific MVR group.

Syntax

mvr vlan

vlan-id

group A.B.C.D

no mvr vlan

vlan-id

group A.B.C.D

• vlan-id—The VLAN over which multicast data from the specified group is

to be received.

• A.B.C.D.—The multicast group for which multicast data is to be received

over the specified VLAN.

Default Configuration

This command has no default configuration.

Command Mode

Interface Configuration

User Guidelines

This command statically configures a port to receive the specified multicast

group on the specified VLAN. This command only applies to receiver ports in

compatible mode. It also applies to source ports in dynamic mode. In

dynamic mode, receiver ports can also join multicast groups using IGMP

messages.

Example

console(config)#vlan 2000

Layer 2 Switching Commands 612

console(config-vlan2000)#exit

console(config)#mvr vlan 2000

console(config)#interface gi1/0/24

console(config-if-Gi1/0/24)#switchport mode trunk

console(config-if-Gi1/0/24)#switchport trunk native vlan 2000

console(config-if-Gi1/0/24)#switchport trunk allowed vlan add 2000

console(config-if-Gi1/0/24)#mvr

console(config-if-Gi1/0/24)#mvr type source

console(config-if-Gi1/0/24)#mvr vlan 2000 group 239.1.1.1

show mvr

Use the show mvr command to display global MVR settings.

Syntax

show mvr

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

The following table lists the completion messages.

The following table explains the output parameters.

Message Type Message Description

Successful Completion Message None

Error Completion Message MVR disabled

Parameter Description

MVR Running MVR running state. It can be enabled or

disabled.

MVR Multicast VLAN Current MVR multicast VLAN. It can be in

the range from 1 to 4093.

Layer 2 Switching Commands 613

Example

console #show mvr

MVR Running.............................. TRUE

MVR multicast VLAN....................... 1200

MVR Max Multicast Groups................. 64

MVR Current multicast groups............. 1

MVR Global query response time........... 10 (tenths of sec)

MVR Mode................................. compatible

show mvr members

Use the show mvr members command to display the MVR membership

groups allocated.

Syntax

show mvr members [A.B.C.D]

•

A.B.C.D

—A valid multicast address in IPv4 dotted notation.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

The following table lists the completion messages.

MVR Max Multicast Groups The maximum number of multicast groups

that is supported by MVR.

MVR Current Multicast groups The current number of MVR groups

allocated.

MVR Query Response Time The current MVR query response time.

MVR Mode The current MVR mode. It can be

compatible or dynamic.

Parameter Description

Layer 2 Switching Commands 614

The following table explains the output parameters.

Examples

console#show mvr members

MVR Group IP Status Members

------------------ --------------- ---------------------

224.1.1.1 INACTIVE Gi1/0/1, Gi1/0/2, Gi1/0/3

console#show mvr members 224.1.1.1

MVR Group IP Status Members

------------------ --------------- ---------------------

224.1.1.1 INACTIVE Gi1/0/1, Gi1/0/2, Gi1/0/3

show mvr interface

Use the show mvr interface command to display the MVR enabled interfaces

configuration.

Syntax

show mvr interface [interface-id [members [vlan

vlan-id

]]]

• interface-id—Identifies a specific interface.

• vlan-id—VLAN identifier.

Default Configuration

This command has no default configuration.

Message Type Message Description

Successful Completion Message None

Error Completion Message MVR disabled

Parameter Description

MVR Group IP MVR group multicast IP address.

Status The status of the specific MVR group. It can

be active or inactive.

Members The list of ports which participates in the

specific MVR group.

Layer 2 Switching Commands 615

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

The following table lists the completion messages.

The following table explains the output parameters.

Examples

console#show mvr interface

Port Type Status Immediate Leave

--------- --------------- --------------------- --------------------

Gi1/0/9 RECEIVER ACTIVE/inVLAN DISABLED

console#show mvr interface gi1/0/9

Type: RECEIVER Status: ACTIVE Immediate Leave: DISABLED

console#show mvr interface gi1/0/23 members

235.0.0.1 STATIC ACTIVE

Message Type Message Description

Successful Completion Message None

Error Completion Message MVR disabled

Parameter Description

Port Interface number

Type The MVR port type. It can be None,

Receiver, or Source type.

Status The interface status. It consists of two

characteristics:

active or inactive indicating if port is

forwarding.

inVLAN or notInVLAN indicating if the

port is part of any VLAN

Immediate Leave The state of immediate mode. It can be

enabled or disabled.

Layer 2 Switching Commands 616

console#show mvr interface gi1/0/23 members vlan 12

235.0.0.1 STATIC ACTIVE

235.1.1.1 STATIC ACTIVE

show mvr traffic

Use the show mvr traffic command to display global MVR statistics.

Syntax

show mvr traffic

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

The following table lists the completion messages.

Examples

The following table explains the output parameters.

Message Type Message Description

Successful Completion Message None

Error Completion Message MVR disabled

Parameter Description

IGMP Query Received Number of received IGMP Queries.

IGMP Report V1 Received Number of received IGMP Reports V1.

IGMP Report V2 Received Number of received IGMP Reports V2.

IGMP Leave Received Number of received IGMP Leaves.

IGMP Query Transmitted Number of transmitted IGMP Queries.

IGMP Report V1 Transmitted Number of transmitted IGMP Reports V1.

Layer 2 Switching Commands 617

console#show mvr traffic

IGMP Query Received............................ 2

IGMP Report V1 Received........................ 0

IGMP Report V2 Received........................ 3

IGMP Leave Received............................ 0

IGMP Query Transmitted......................... 2

IGMP Report V1 Transmitted..................... 0

IGMP Report V2 Transmitted..................... 3

IGMP Leave Transmitted......................... 1

IGMP Packet Receive Failures................... 0

IGMP Packet Transmit Failures.................. 0

IGMP Report V2 Transmitted Number of transmitted IGMP Reports V2.

IGMP Leave Transmitted Number of transmitted IGMP Leaves.

IGMP Packet Receive Failures Number of failures on receiving the IGMP

packets.

IGMP Packet Transmit Failures Number of failures on transmitting the

IGMP packets.

Parameter Description

Layer 2 Switching Commands 618

Port Channel Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

A port channel is a set of one or more links that can be aggregated together to

form a bonded channel (Link Aggregation Group or LAG or port channel).

Individual conversations in a particular direction always travel over a single

link in the port channel, however, in aggregate, the bandwidth usage of all of

the links is fairly evenly distributed. Port channels have the advantage of

allowing incremental bandwidth to be added as needed (by adding additional

links) and supporting a form of fault tolerance (traffic on failed links is

redistributed among other links in the LAG). LAGs are formed from similarly

configured physical links, i.e. the speed, duplex, auto-negotiation, PFC

configuration, DCBX configuration, etc. must be compatible on all member

links. Per IEEE 802.1AX, only links with the same operational characteristics,

such as speed and duplex setting, may be aggregated. Dell EMC Networking

switches aggregate links only if they have the same operational speed and

duplex setting, as opposed to the configured speed and duplex setting. This

allows operators to aggregate links that use auto negotiation to set values for

speed and duplex or to aggregate ports with SFP+ technology operating at a

lower speeds, e.g., 1G. Dissimilar ports will not become active in the LAG if

their operational settings do not match those of the first member of the LAG.

In practice, some ports in a LAG may auto-negotiate a different operational

speed than other ports depending on the far end settings and any link

impairments. Per the above, these ports will not become active members of

the LAG. On a reboot or on flapping the LAG links, a lower speed port may

be the first port selected to be aggregated into the LAG. In this case, the

higher speed ports are not aggregated. Use the lacp port-priority command to

select one or more primary link to lead the formation of the aggregation

group.

While it is a requirement of a LAG that the link members operate at the same

duplex and speed settings, administrators should be aware that copper ports

have larger latencies than fiber ports. If fiber and copper ports are aggregated

together, packets sent over the fiber ports may arrive significantly sooner at

the destination than packets sent over the copper ports. This can cause

significant issues in the receiving host (e.g. a TCP receiver) as it would be

required to buffer a potentially large number of out-of-order frames. Devices

Layer 2 Switching Commands 619

unable to buffer the requisite number of frames will show excessive frame

discard. Configuring copper and fiber ports together in an aggregation group

is not recommended.

If a dynamic LAG member sees an LACPDU that contains information

different from the currently configured default partner values, that particular

member drops out of the LAG. This configured member does not aggregate

with the LAG until all the other active members see the new information.

When each of the other active members sees the new information, they

continue to drop out of the LAG. When all the members have dropped out of

the LAG, they form an aggregate with the new information.

Static LAGS

A static LAG is fundamentally no different from a dynamically configured

LAG. All the requirements for the member ports hold true (member ports

must have same duplex settings, same speed, and so on). The only difference

is this LAG has an additional parameter static which makes this LAG not

require a partner system running Link Aggregation Control Protocol (LACP)

to be able to aggregate it's member ports.

Care must be taken while enabling this type of configuration. If the Partner

System is not 802.3AD compliant or the Link Aggregation Control protocol is

not enabled, there may be network instability. Network instability occurs

when one side assumes that the members in an aggregation are one single

link, while the other side is oblivious to this aggregation and continues to

treat the 'members' as individual links.

A static LAG does not transmit or process received LACPDUs, that is, the

member ports do not transmit LACPDUs and all the LACPDUs it receives

are dropped. A dropped counter is maintained to count the number of such

PDUs.

Configured members are added to the LAG (active participation)

immediately if the LAG is configured to be static. There is no wait time

before we add the port to the LAG.

A LAG can be either static or dynamic, but not both. It cannot have some

member ports participate in the protocol while other member ports do not

participate. Additionally, it is not possible to change a LAG from static to

dynamic via the CLI. You must remove the member ports from the static

LAG and then add them to the dynamic LAG.

Layer 2 Switching Commands 620

VLANs and LAGs

When Ethernet interfaces are added to a LAG, they are removed from all

existing VLAN membership and take on the VLAN membership of the LAG.

When members are removed from a LAG, the members regain the Ethernet

interface VLAN membership as per the configuration.

LAG Thresholds

In many implementations, a LAG is declared as up if any one of its member

ports is active. This enhancement provides configurability for the minimum

number of member links to be active to declare a LAG up. Network

administrators can also utilize this feature to automatically declare a LAG

down when only some of the links have failed.

LAG Hashing

The purpose of link aggregation is to increase bandwidth between two

switches. It is achieved by aggregating multiple ports in one logical group. A

common problem of port channels is the possibility of changing packets order

in a particular TCP session. The resolution of this problem is correct selection

of an Ethernet port within the port channel for transmitting the packet to

keep the original packet order.

The hashing algorithm is configurable for each LAG. Typically, an

administrator is able to choose from hash algorithms utilizing the following

attributes of a packet to determine the outgoing port:

• Source MAC, VLAN, EtherType, and incoming port associated with the

packet.

• Source IP and Source TCP/UDP fields of the packet.

• Destination MAC, VLAN, EtherType, and incoming port associated with

the packet.

• Source MAC, Destination MAC, VLAN, EtherType, and incoming port

associated with the packet.

• Destination IP and Destination TCP/UDP Port fields of the packet.

• Source/Destination MAC, VLAN, EtherType, and incoming port

associated with the packet.

Layer 2 Switching Commands 621

• Source/Destination IP and source/destination TCP/UDP Port fields of the

packet.

Enhanced LAG Hashing

Dell EMC Networking devices based on Broadcom XGS-IV silicon support

configuration of hashing algorithms for each LAG interface. The hashing

algorithm is used to distribute traffic load among the physical ports of the

LAG while preserving the per-flow packet order.

NOTE: Enhanced hashing mode is not supported on the N1100-

ON/N1500 Series switches.

One limitation with earlier LAG hashing techniques is that the packet

attributes were fixed for all type of packets. Also, there was no MODULO-N

operation involved, which can result in poor load balancing performance.

The LAG hashing support supports an enhanced hashing mode, which has

the following advantages:

• MODULO-N operation based on the number of ports in the LAG.

• Packet attributes selection based on the packet type. For L2 packets,

Source and Destination MAC address are used for hash computation. For

IP packets, Source IP, Destination IP address, TCP/UDP ports are used.

• Non-Unicast traffic and Unicast traffic is hashed using a common hash

algorithm.

• Excellent load balancing performance.

• Enhanced LAG hashing is the default hashing mode for LAGs on switches

that support it.

Manual Aggregation of LAGs

Dell EMC Networking switching supports the manual addition and deletion

of links to aggregates.

In the manual configuration of aggregates, the ports send their Actor

Information (LACPDUs) to the partner system in order to find a suitable

Partner to form an aggregation. When the Partner System neglects to respond

using LACPDUs, the Dell EMC Networking switching aggregates manually.

The Dell EMC Networking switching uses the currently configured default

Partner Values for Partner Information.

Layer 2 Switching Commands 622

Flexible Assignment of Ports to LAGs

Assignment of interfaces to dynamic LAGs is based upon a maximum of 144

interfaces assigned to dynamic LAGs, a maximum of 128 dynamic LAGs and

a maximum of 8 interfaces per dynamic LAG. For example, 128 LAGs may be

assigned 2 interfaces each or 18 LAGs may be assigned 8 interfaces each.

NOTE: The N1100-ON/N1500 Series switches support 64 port channels.

Commands in this Section

This section explains the following commands:

channel-group

Use the channel-group command in Interface (Ethernet) Configuration

mode to associate a port with a port channel. To remove the channel-group

configuration from the interface, use the no form of this command.

Syntax

channel-group port-channel-number mode {on | active}

no channel-group

• port-channel-number — Number of a valid port-channel with which to

associate the current interface.

•on — Forces the port to join a channel without LACP (static LAG).

•active — Forces the port to join a channel with LACP (dynamic LAG).

channel-group lacp timeout

feature vpc port-channel local-preference

interface range port-channel port-channel min-links

hashing-mode show interfaces port-channel

lacp port-priority show lacp

lacp system-priority show statistics port-channel

Layer 2 Switching Commands 623

Default Configuration

This command has no default configuration.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

This command has no user guidelines.

Example

The following example shows how port gi1/0/5 is configured in port-channel 1

without LACP

(static LAG)

console(config)# interface gigabitethernet 1/0/5

console(config-if-Gi1/0/5)# channel-group 1 mode on

The following example shows how port gi1/0/6 is configured to port-channel 2

with LACP (dynamic LAG).

console(config)# interface gigabitethernet 1/0/6

console(config-if-Gi1/0/6)# channel-group 2 mode active

interface port-channel

Use the interface port-channel command in Global Configuration mode to

enter port-channel configuration mode.

Syntax

interface

port-channel port-channel-number

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

Layer 2 Switching Commands 624

User Guidelines

Port channel numbers range from 1 to 128 for all switches except the N1500

which supports 64 port channels.

Example

The following example enters the context of port-channel 1.

console(config)# interface port-channel 1

console(config-if-po1)#

interface range port-channel

Use the interface range port-channel command in Global Configuration

mode to execute a command on multiple port channels at the same time.

Syntax

interface range port-channel {port-channel-range | all}

• port-channel-range — List of port-channels to configure. Separate non-

consecutive port-channels with a comma and no spaces. A hyphen

designates a range of port-channels. (Range: valid port-channel)

•all — All the channel-ports.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

Commands in the interface range context are executed independently on

each interface in the range. If the command returns an error on one of the

interfaces, it stops the execution of the command on subsequent interfaces.

Example

The following example shows how port-channels 1, 2 and 8 are grouped to

receive the same command.

Layer 2 Switching Commands 625

console(config)# interface range port-channel 1-2,8

console(config-if)#

hashing-mode

Use the hashing-mode command to set the hashing algorithm on trunk ports.

Use the no hashing-mode command to set the hashing algorithm on trunk

ports to the default.

Syntax

hashing-mode mode

• mode — Mode value in the range of 1 to 7.

Range: 1–7:

• 1 — Source MAC, VLAN, EtherType, source module, and port ID

• 2 — Destination MAC, VLAN, EtherType, source module, and port ID

• 3 — Source IP and source TCP/UDP port

• 4 — Destination IP and destination TCP/UDP port

• 5 — Source/destination MAC, VLAN, EtherType, and source

MODID/port

• 6 — Source/destination IP and source/destination TCP/UDP port

• 7 — Enhanced hashing mode. This mode is not available on Dell EMC

Networking N1100-ON/N1500 Series switches.

Default Configuration

The default hashing mode is 7—Enhanced hashing mode. On Dell EMC

Networking

N1100-ON/

N1500 Series switches, the default hashing mode is 5.

Command Mode

Interface Configuration (port-channel) mode

Layer 2 Switching Commands 626

User Guidelines

Enhanced hashing mode is recommended, however, depending on the

specific traffic patterns present in the network, a different hashing mode may

give better bandwidth distribution across the LAG member links. Use the

show interfaces utilization command to view link utilization.

Example

console(config)#interface port-channel l

console(config-if-po1)#hashing-mode 4

console(config-if-po1)#no hashing mode

lacp port-priority

Use the lacp port-priority command to configure the priority value for

physical ports. To reset to default priority value, use the no form of this

command.

Syntax

lacp port-priority value

no lacp port-priority

• value — Port priority value. (Range: 1–65535)

Default Configuration

The default port priority value is 1.

Command Mode

Interface Configuration (Ethernet) mode

Interface Range mode

User Guidelines

Per IEEE 802.1AX-2008 Section 5.6, ports are selected for aggregation by each

switch based upon the port priority assigned by the switch with the higher

system priority, starting with the highest priority port of the switch with the

higher switch priority, and working downward through the ordered list of port

priority values for the ports.

Layer 2 Switching Commands 627

The port priority of each port is a four octet binary number, formed by using

the configured port priority as the two most significant octets and the port

number as the two least significant octets. For any given set of ports, the port

with the numerically lower value of port priority has the higher priority.

The selection algorithm is reapplied upon changes in the membership of the

port channel (for example, if a link fails, or if a new link joins the group) and

any subsequent changes to the set of active links are made according to the

above algorithm.

Example

The following example configures the priority value for port 1/0/8 to 247.

console(config)#interface gigabitethernet 1/0/8

console(config-if-Gi1/0/8)#lacp port-priority 247

lacp system-priority

Use the lacp system-priority command in Global Configuration mode to

configure the Link Aggregation system priority. To reset to default, use the no

form of this command.

Syntax

lacp system-priority value

no lacp system-priority

• value — System priority value. (Range: 1–65535)

Default Configuration

The default system priority value is 1.

Command Mode

Global Configuration mode

Layer 2 Switching Commands 628

User Guidelines

Per IEEE 802.1AX-2008 Section 5.6, ports are selected for aggregation by each

switch based upon the port priority assigned by the switch with the higher

system priority, starting with the highest priority port of the switch with the

higher switch priority, and working downward through the ordered list of port

priority values for the ports.

The system priority of each switch is an eight octet binary number, formed by

using the configured system priority as the two most significant octets and

the switch id (MAC address) as the least significant six octets. For a given

switch and link aggregation partner, the switch with the numerically lower

value of system priority has the higher priority.

The selection algorithm is reapplied upon changes in the membership of the

port channel (for example, if a link fails, or if a new link joins the group) and

any subsequent changes to the set of active links are made according to the

above algorithm.

Example

The following example configures the system priority to 120.

console(config)#lacp system-priority 120

lacp timeout

Use the lacp timeout command to assign an administrative LACP timeout.

To reset the administrative LACP timeout to the default, use the no form of

this command.

Syntax

lacp timeout {long | short}

no lacp timeout

•long — Specifies a long timeout value.

•short — Specifies a short timeout value.

Default Configuration

The default port timeout value is long.

Layer 2 Switching Commands 629

Command Mode

Interface Configuration (Ethernet) mode

Interface Range mode

User Guidelines

The LACP time-out setting indicates a local preference for the rate of

LACPDU transmission and the period of time before invalidating received

LACPDU information. This setting is negotiated with the link partner. Long

time-outs are 90 seconds with a transmission rate of once every 30 seconds.

Short time-outs are 3 seconds with a transmission rate of once every second.

For further information, refer to the LACP_Timeout setting in IEEE Std.

802.1AX-2008.

Example

The following example assigns an administrative LACP timeout for port

Gi1/0/8 to a long timeout value.

console(config)#interface gigabitethernet 1/0/8

console(config-if-Gi1/0/8)#lacp timeout long

port-channel local-preference

Use the port-channel local-preference command in Interface Configuration

mode to enable the local-preference mode on a port-channel (LAG) interface

or range of port-channel interfaces.

Use the no form of the command to remove the local preference.

Syntax

port-channel local-preference

no port-channel local-preference

Default Configuration

By default, port channels are not configured with local preference.

Command Mode

Interface Configuration (port-channel) mode

Layer 2 Switching Commands 630

User Guidelines

For a LAG that contains links distributed across stacking units, the default

behavior is to distribute locally received ingress traffic across all LAG links in

the stack per the selected hashing algorithm. When enabled, this command

disables forwarding of ingress unicast traffic across stacking links for a LAG

that is comprised of links on multiple stack units. It does this by restricting

LAG hashing to only select egress links on the stack unit where the traffic

ingresses.

CAUTION: If the capacity of the local egress LAG links is exceeded, traffic will

be discarded. Therefore, use of this option should be carefully considered, and the

operator must ensure that sufficient egress bandwidth is available in the LAG links

on every stack member to avoid excessive discards.

By default, the local-preference mode for a port-channel is disabled. This

command can be used only on port-channel interfaces.

Example

console(config)#interface port-channel 1

console(config-if-Po1)#port-channel local-preference

console(config-if-Po1)#no port-channel local-preference

Command History

Example added in the 6.4 release.

port-channel min-links

Use the port-channel min-links command in Interface Configuration (port-

channel) mode to set the minimum number of links that must be up in order

for the port channel interface to be declared up. Use the no form of the

command to return the configuration to the default value (1).

Syntax

port-channel min-links <1-8>

no port-channel min-links

•min-links—The minimum number of links that must be active before the

link is declared up. Range 1-8. The default is 1.

Layer 2 Switching Commands 631

Default Configuration

The default minimum links is 1.

Command Mode

Interface Configuration (port-channel) mode

User Guidelines

This command has no user guidelines.

Example

console(config)#interface port-channel 1

console(config-if-Po1)#port-channel min-links 3

console(config-if-Po1)#no port-channel min-links

show interfaces port-channel

Use the show interfaces port-channel command to show port-channel

information.

Syntax

show interfaces port-channel [

port-channel-number

]

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

The command displays the following information.

Layer 2 Switching Commands 632

Example #1

console#show interfaces port-channel 1

Channel Ports Ch-Type Hash Type Min-links Local Prf

------- ----------------------------- -------- ---------- --------- --------

Po1 Inactive: Gi1/0/1, Gi1/0/2, Dynamic 3 1 Enabled

Gi1/0/3, Gi1/0/4

Hash Algorithm Type

1 - Source MAC, VLAN, EtherType, source module and port ID

2 - Destination MAC, VLAN, EtherType, source module and port ID

3 - Source IP and source TCP/UDP port

4 - Destination IP and destination TCP/UDP port

5 - Source/Destination MAC, VLAN, EtherType, source MODID/port

6 - Source/Destination IP and source/destination TCP/UDP port

7 - Enhanced hashing mode

show lacp

Use this command to display LACP information for Ethernet ports.

Syntax

show lacp {gigabitethernet unit/slot/port| tengigabitethernet unit/slot/port |

fortygigabitethernet unit/slot/port}[parameters | statistics]

Parameter Description

Channel Number of the port channel to show. This parameter is

optional. If the port channel number is not given, all the

channel groups are displayed. (Range: Valid port-channel

number, 1 to 48).

• Ports—The ports that are members of the port-channel.

• Ch-Type—The aggregation scheme. Dynamic indicates that

the LACP protocol is run.

• Hash Algorithm Type—The hashing used to assign a

conversation to a particular aggregation link.

•

Local Prf

—

An additional field added to support the display

of the local preference.

Layer 2 Switching Commands 633

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example shows how to display LACP Ethernet interface

information.

console#show lacp gi1/0/1

port Gi1/0/1 LACP parameters:

Actor:

system priority: 1

port Admin key: 0

port oper key: 1

port oper priority: 1

port oper timeout: LONG

port Admin timeout: LONG

LACP Activity: ACTIVE

Aggregation: AGGREGATABLE

synchronization: FALSE

collecting: FALSE

distributing: FALSE

expired: FALSE

Partner:

port Admin key: 0

port oper key: 0

port Admin priority: 0

port oper priority: 0

port Oper timeout: LONG

LACP Activity: PASSIVE

Aggregation: NOTAGGREGATABLE

synchronization: FALSE

collecting: FALSE

distributing: FALSE

expired: FALSE

port Gi1/0/1 LACP Statistics:

Layer 2 Switching Commands 634

LACP PDUs send: 0

LACP PDUs received: 0

show statistics port-channel

Use the show statistics port-channel command to display statistics about a

specific port-channel.

Syntax

show statistics

port-channel port-channel-number

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example shows statistics about port-channel 1.

console#show statistics port-channel 1

Total Packets Received (Octets)................ 0

Packets Received 64 Octets..................... 0

Packets Received 65-127 Octets................. 0

Packets Received 128-255 Octets................ 0

Packets Received 256-511 Octets................ 0

Packets Received 512-1023 Octets............... 0

Packets Received 1024-1518 Octets.............. 0

Packets Received > 1518 Octets................. 0

Packets RX and TX 64 Octets.................... 0

Packets RX and TX 65-127 Octets................ 0

Packets RX and TX 128-255 Octets............... 0

Packets RX and TX 256-511 Octets............... 0

Packets RX and TX 512-1023 Octets.............. 0

Packets RX and TX 1024-1518 Octets............. 0

Packets RX and TX 1519-2047 Octets............. 0

Layer 2 Switching Commands 635

Packets RX and TX 2048-4095 Octets............. 0

Packets RX and TX 4096-9216 Octets............. 0

Total Packets Received Without Errors.......... 0

Unicast Packets Received....................... 0

Multicast Packets Received..................... 0

Broadcast Packets Received..................... 0

Receive Packets Discarded...................... 0

Total Packets Received with MAC Errors......... 0

Jabbers Received............................... 0

Fragments/Undersize Received................... 0

Alignment Errors............................... 0

FCS Errors..................................... 0

Overruns....................................... 0

Total Received Packets Not Forwarded........... 0

802.3x Pause Frames Received................... 0

Unacceptable Frame Type........................ 0

Total Packets Transmitted (Octets)............. 0

Packets Transmitted 64 Octets.................. 0

Packets Transmitted 65-127 Octets.............. 0

Packets Transmitted 128-255 Octets............. 0

Packets Transmitted 256-511 Octets............. 0

Packets Transmitted 512-1023 Octets............ 0

Packets Transmitted 1024-1518 Octets........... 0

Packets Transmitted > 1518 Octets.............. 0

Max Frame Size................................. 1518

Total Packets Transmitted Successfully......... 0

Unicast Packets Transmitted.................... 0

Multicast Packets Transmitted.................. 0

Broadcast Packets Transmitted.................. 0

Transmit Packets Discarded..................... 0

Total Transmit Errors.......................... 0

FCS Errors..................................... 0

Underrun Errors................................ 0

Total Transmit Packets Discarded............... 0

Single Collision Frames........................ 0

Multiple Collision Frames...................... 0

Excessive Collision Frames..................... 0

802.3x Pause Frames Transmitted................ 0

GVRP PDUs received............................. 0

Layer 2 Switching Commands 636

GVRP PDUs Transmitted.......................... 0

GVRP Failed Registrations...................... 0

GMRP PDUs Received............................. 0

GMRP PDUs Transmitted.......................... 0

GMRP Failed Registrations...................... 0

BPDUs: Sent: 0, Received: 0

Time since counters last cleared............... 0 day 6 hr 19 min 42 sec

Layer 2 Switching Commands 637

Port Monitor Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Dell EMC Networking switches allow the user to monitor traffic with an

external network analyzer. The external network analyzer can use any of the

Ethernet ports as a probe port. The probe port transmits a mirror copy of the

traffic being probed. Network traffic transmission is always disrupted

whenever a configuration change is made for port monitoring. Therefore,

whenever port monitoring is enabled, the probe port does not always forward

traffic as a normal port. When diagnosing problems, an operator should

always check the status of port monitoring.

The port monitoring feature allows the user to configure a session. A session

consists of one destination or probe port and one or multiple source ports.

When a session is enabled, any traffic entering or leaving the source ports of

that session is copied (mirrored) onto the corresponding destination port. A

network traffic analyzer can be attached to destination ports to analyze the

traffic patterns of source ports.

A session is operationally active only if both a destination port and at least

one source port are configured. If neither is true, the session is inactive. A port

configured as a destination port acts as a mirroring port when the session is

operationally active. If it is not, the port acts as a normal port and participates

in all normal operation with respect to transmitting traffic.

The port mirroring logic stage occurs after the after the VLAN tag processing

stage on ingress and before the VLAN tag processing stage on egress. When

mirroring packets associated with DVLAN/QinQ SP or CE ports, the outer

VLAN tag may or may not appear in the frame. Due to the internal processing

of QinQ tagging, the TPID of ingress frames mirrored from the SP port will

always be 0x8100. In addition, packets forwarded internally across a stacking

link may have different tags applied than packets forwarded on a local egress

port. This is due to the processing required for forwarding across a stack.

Any Ethernet port may be configured as a source port.

Caveats:

• Platforms may behave unpredictably if an attempt is made to mirror a port

of greater speed than the probe port.

Layer 2 Switching Commands 638

• Once configured, there is no network connectivity on the probe

(destination) port. The probe port does not forward any traffic and does

not receive any traffic. The probe tool attached to the probe port is unable

to ping the networking device or ping through the networking device, and

no device is able to ping the probe tool.

• ACL attributes redirect, mirror, log, rate-limit, assign-queue, time-range,

IGMP type, ICMP type, ICMP code, routing, fragments, and TCP

established are not supported when applied to a mirroring session.

Commands in this Section

This section explains the following commands:

monitor capture (Global Configuration)

Use the monitor capture command to capture packets transmitted or

received from the CPU. This facility captures switch control plane traffic and

is useful in monitoring network control traffic and analyzing network security.

No monitor capture file size returns the capture file size to the defaults.

No monitor capture remote port returns the TCP port to the default.

Syntax

monitor capture {file size max-size | remote port id | line wrap}

no monitor capture {file size |remote port |line wrap}

• max-size—

The size of the capture file in bytes.

•id—

The local (switch) TCP port for use with Wireshark.

Default Configuration

Capture is not enabled by default.

monitor capture (Global Configuration) remote-span

monitor capture (Privileged Exec) show monitor capture

monitor capture mode show monitor session

monitor session show vlan remote-span

Layer 2 Switching Commands 639

The in memory buffer is 128 packets.

The file system buffer is 524288 bytes and is named cpuPktCapture.pcap.

The remote monitor capture port is 2002.

Command Modes

Global Configuration mode

User Guidelines

Packets that are transmitted or received by the switch CPU may be captured

to the switch file system, to local memory, or sent to a WireShark client.

Packets captured to the switch file system are stored in pcap format and may

be copied from the system and opened with WireShark or TShark or other

utilities. Packets sent to the console are written in ASCII hex format.

When WireShark is configured and connected to the switch, packet capture

is controlled by WireShark. See the Users Configuration Guide for an

example of how to configure WireShark for packet capture.

Changes to configuration take effect on the next execution of the monitor

capture start command.

Only one of file, remote, or line may be specified. Setting the file, remote, or

line stops the capture.

No monitor capture file size returns the capture file size to the defaults

No monitor capture remote port returns the TCP port to the default

The administrator can capture packets into one of the following locations:

memory, switch NVRAM, or directly to a Wireshark analyzer.

Example

Configure capture for Wireshark remote access on port 2020:

console(config)#monitor capture remote port 2020

console(config)#monitor capture mode remote

console(config)#exit

console#monitor capture start

Copy the local capture file to a TFTP server

console#copy flash://cpuPktCapture.pcap tftp://10.267.9.99/mypkts.pcap

Layer 2 Switching Commands 640

monitor capture (Privileged Exec)

Use the monitor capture command to capture packets transmitted or

received from the CPU. This facility captures switch control plane traffic and

is useful in monitoring network control traffic and analyzing network security.

Remote packet capture is not supported when the packets are received via

Service Port.

Syntax

monitor capture {start [transmit | receive | all] | stop}

•Transmit—Capture packets transmitted by the switch CPU.

•Receive—Capture packets forwarded to the switch CPU.

•All—Capture both transmitted and received packets.

Default Configuration

Capture is not enabled by default.

By default, both transmitted and received packets are captured.

Command Modes

Privileged Exec mode

User Guidelines

In general, starting packet capture erases the previous capture buffer

contents.

Example

console# monitor capture start all

monitor capture mode

Use the monitor capture mode command to select the destination for

captured packets transmitted or received from the CPU. This facility captures

switch control plane traffic and is useful in monitoring network control traffic

and analyzing network security.

Use the no form of the command to return the capture mode to the default.

Layer 2 Switching Commands 641

Syntax

monitor capture mode {line | remote | file}

no monitor capture mode

•line—

Captured packets are sent to the console.

•remote—

Captured packets are sent to a remote WireShark network

analyzer.

•file—

Captured packets are sent to the file system.

Default Configuration

By default, remote capture is configured.

Command Modes

Global Configuration mode

User Guidelines

Only one file, remote, or line may be specified. Setting the mode takes effect

immediately.

Use the monitor capture start command to start the capture.

Memory Capture:

Captured packets can be displayed on the console using the show monitor

capture packets command. Captured packets can be displayed when actively

capturing or when stopped. When a capture session is active, it is possible to

display only the captured packets which were not previously displayed as the

show command empties the capture buffer. When a capture session is

stopped, it is possible to display all saved packets as often as required. The

command show monitor capture packets always displays the captured packets

in chronological order.

The memory buffer only stores the first 128 bytes of each packet captured.

The switch displays the following information from the captured packet when

it is displayed on CLI:

• Packet is transmitted or received.

• ID of interface through which the packet was passed.

Layer 2 Switching Commands 642

• The time when packet passed through CPU.

• The first 128 bytes of packet.

• The length of full packet (if greater than 128 bytes).

The in-memory capture buffer can be configured to stop when full. This

mode is configured with the command no monitor capture line wrap.

Capturing packets is started by the monitor capture start command.

Capturing packets is stopped automatically when 128 packets are captured

and saved into the RAM. Capturing packets can be stopped manually before

128 packets have been captured using the monitor capture stop command to

halt packet capture.

If capturing is in progress, the show monitor capture packets command

displays only captured packets that have not yet been displayed during

capturing session. If capturing is stopped, the first (after stopping) show

monitor capture packets command displays packets which have not yet been

displayed during capturing session. The next show monitor capture packets

command displays all saved packets.

If the capturing session is stopped automatically during the period packet

display is in progress, the packets display continues until all saved packets are

shown and then the buffer is cleared. The next invocation of the show

capture packets command will not display any packets. Please note that this

behavior is observed only if the capturing session is stopped automatically

when the packet displaying is in progress.

The in-memory capture can also be configured to wrap. This makes it possible

to display more than 128 packets per capture session if the command show

capture packets is periodically executed while capture is in progress. Saved

packets that have been already displayed during the capturing session are

overwritten in RAM by new captured packets if capturing is still in progress.

In this manner, the limit of displaying 128 packets per session can be

overcome (but only in monitor capture line wrap mode). Packets that have

not been displayed are not overwritten.

Capturing packets is stopped automatically when 128 packets are captured

and have not yet been displayed during capturing session. It is guaranteed

that no one packet will be lost (not be displayed or not be saved) when

capturing is in progress. In this case, the last 128 packets are saved into the

RAM and can be displayed many number of times by executing the command

show monitor capture packets.

Layer 2 Switching Commands 643

If capturing is in progress and more than 128 packets are captured and the

user configures no monitor capture line wrap mode, capturing is stopped

automatically. No packets are lost when capturing is in progress.

All captured packets can be displayed. No captured and not yet displayed

packets are lost. Captured packets can be displayed when capturing is in

progress or after the moment when capturing is stopped. Only packets saved

in RAM (up to 128) can be displayed when capturing is stopped.

If capturing is in progress, the show monitor capture packets command

displays only the captured packets that have not yet been displayed during the

capturing session. If capturing is stopped, the first (after stopping) show

monitor capture packets command displays the packets that have not yet

been displayed during the capturing session. The next show monitor capture

packets command displays up to 128 captured packets.

If the capturing session is stopped automatically when the packet display is in

progress, then packet display continues until all packets are shown. The next

call of the show capture packets command displays nothing. Please note that

such behavior is observed only if the capturing session is stopped

automatically when the packet display is in progress.

NVRAM Capture:

After packet capture is activated, packets are stored in NVRAM until the

capture file reaches its maximum size, or until the capture is stopped

manually. When the capture is started the capture file from the previous

capture is deleted.

The captured file can be uploaded via TFTP, SFTP, SCP via CLI, and SNMP

using the copy command. The name of the capture file is

cpuPktCapture.pcap.

Remote Capture:

Remote Packet Capture works with the Wireshark network analyzer tool. A

packet capture server runs on the switch and sends the captured packets via a

TCP connection to the Wireshark tool. Once a connection is established,

packet capture is started and stopped via Wireshark commands.

Layer 2 Switching Commands 644

Remote capture can be enabled or disabled using the CLI. The network

operator should obtain a computer with the Wireshark tool to display the

captured traffic. When using remote capture mode, the switch doesn’t store

any captured data locally.

The local TCP port number can be configured for connecting Wireshark to

the switch. The default port number is 2002. If a firewall is installed between

the Wireshark PC and the switch, these ports must be allowed to pass

through the firewall. The Firewall must be configured to allow the Wireshark

PC to initiate a TCP connection to the switch.

The remote capture application listens on the configured TCP port for a

connection request. Wireshark must send a request to that port to establish a

connection. Once the socket connection to Wireshark has been established,

captured CPU packets are written to the data socket. Wireshark receives the

packets and processes them locally. This continues until the session is

terminated by either end.

The following Wireshark request packets are supported:

• Request to list all the remote interfaces

• Request to open a remote device

• Request to start a capture on a remote device

• Request to close the connection with the remote peer

• Message that keeps the authentication parameters

• Request to get network statistics

• Request to stop the current capture, keeping the device open

The following Wireshark replies are supported:

• Reply that sends the list of all the remote interfaces

• Reply that the remote device has been opened correctly

• Reply that capturing has started correctly

• Reply that says 'ok, authorization successful'

• Reply that keeps network statistics

• Reply that confirms capturing stopped successfully

Remote capture is not supported for packets received via out-of-band ports.

Layer 2 Switching Commands 645

Example

This example sends capture output to the console.

console(config)#monitor capture line

console(config)#exit

console#monitor capture start all

monitor session

Use the monitor session command in Global Configuration mode to

configure the source and destination for mirroring. Packets are copied from

the source to the destination. Use the no form of the command to disable the

monitoring session.

Syntax

monitor session session-number source {interface interface–id |vlan vlan-id

| remote vlan rspan-vlan-id}[rx | tx]

no monitor session session_number source {interface interface–id | vlan

vlan-id | remote vlan rspan-vlan-id}

[no] monitor session session_number destination {interface interface–id

[remove-rspan-tag] | remote vlan rspan-vlan-id}

[no] monitor session session_number filter {ip access-group [acl-name | acl-

number] | mac access-group acl-name}

no monitor session session_number mode

• session-number— Session identification number. (Range: 1-4)

•interface interface–id — Ethernet interface (Range: Any valid Ethernet

Port), CPU interface. CPU interface is not supported as a destination

interface or a source interface for RSPAN.

•vlan vlan-id— The source VLAN identifier. All the ports in this VLAN are

mirrored in the ingress direction only. The source VLAN must not be the

RSPAN VLAN.

• acl-name— An IP or MAC ACL name.

•remote vlan rspan-vlan-id— An RSPAN VLAN configured on the source

switch.

•rx — Mirrors received packets only. If no option specified, monitors both rx

and tx.

Layer 2 Switching Commands 646

•tx — Mirrors transmitted packets only. If no option is specified, monitors

both rx and tx.

•both—Mirrors both ingress and egress. This is the default.

•mode—Enable session mirroring. Use the no form of the command to

disable monitoring.

•

remove-rspan-tag

—Remove the RSPAN tag from packets transmitted on

the probe port. This option is not available on the N4000 Series switches.

Default Configuration

The default is to

mirror

both transmit and receive directions. If neither tx or

rx is configured, both directions are monitored.

Command Mode

Global Configuration mode

User Guidelines

Use the source interlace parameter to specify the interface to monitor. Use rx

to monitor only ingress packets, or use tx to monitor only egress packets. If

you do not specify an rx or tx option, the session monitors both ingress and

egress packets. Use the destination interface to specify the interface to receive

the monitored traffic. Use the mode parameter to enabled the administrative

mode of the session. If enabled, the destination (probe) port monitors all the

traffic received and transmitted on the physical monitored port. The probe

port should not be connected to a network. Connect it to a monitoring tool or

a standalone (static IP address) workstation running a monitoring program.

Up to four sessions

mirroring

traffic in a single direction and with unique

destinations are supported on the Dell EMC Networking N2000, N2100-ON,

N3000, N3100-ON, and N4000 Series switches. The Dell EMC Networking

N1100-ON and N1500 Series switches support a single unidirectional or

bidirectional session. Each session supports multiple sources. However, the

destination interface for a session may not overlap with other sessions. The

internal CPU port cannot be configured as an RSPAN source.

The session limitations are as follows (N2000, N2100-ON, N3000, N3100-

ON, N4000 only):

• Up to 4 sessions in ingress (RX) traffic mirroring may be active.

Layer 2 Switching Commands 647

• Up to 4 sessions with egress (TX) traffic mirroring may be active.

• Up to 2 sessions with both (RX and TX) traffic mirroring may be active.

• Any other combination of up to 4 total ingress or egress mirroring may be

active.

Destination (probe) interfaces do not perform MAC learning and drop

ingress traffic (forwarding is disabled and incoming packets are dropped).

Destination interfaces must be dedicated to the monitoring function (i.e.,

connected to a PC running WireShark or some other packet decoder).

VLAN based mirroring is applicable only for ingress (RX) traffic. If neither rx,

tx, nor both are specified in a source session, both ingress and egress traffic

are monitored

Mirrored traffic is subject to the same QoS constraints as normal traffic.

Oversubscribed traffic (both mirrored and un-mirrored) will be dropped in

accordance with the configured or default policy. The operator may assign

CoS or Diffserv policies to the mirrored traffic in the same manner as for

normal traffic. RSPAN traffic is transmitted with a PCP of 0.

On ingress, the port mirroring logic stage is after the VLAN tag processing

stage in the hardware. This means that, on ingress, packets may not appear as

they do on the wire if processing such as VLAN or CoS value rewriting is

programmed or DVLAN tunneling is enabled on the source interface.

Examples of ingress VLAN tag processing are DVLAN tunneling (QinQ) or

VLAN rewriting. Likewise, on egress, the port mirroring logic stage is before

the egress VLAN tag processing stage. This means that, on egress, packets

may not appear as they do on the wire if processing such as VLAN or CoS

value rewriting is programmed.

Reserve a few VLANs across the network for the exclusive use of RSPAN. The

RSPAN VLANs should only be configured on the reflector interfaces

(generally the uplink/transit/downlink interface). RSPAN VLANs are used

exclusively to carry the mirrored traffic across the network and cannot have

source or destination interfaces as members of the RSPAN VLAN. RSPAN

destination interfaces will continue to transmit mirrored traffic even if

blocked by spanning-tree. Each RSPAN session must use a unique reflector

port, destination port and RSPAN VLAN. Reflector ports

(source/transit/destination) should be configured as trunk or general mode

Layer 2 Switching Commands 648

ports, and be members of the RSPAN VLAN. Do not assign other ports to the

RSPAN VLANs (for example, trunk ports that are not reflector ports).

Additionally, reflector ports may not be port channels.

Monitored traffic is encapsulated in the RSPAN VLAN on the reflector port

on the source switch. On a source switch, when both an RSPAN VLAN and

reflector port are configured on a trunk or general mode port with other

VLANs, the interface can also carry traffic on the other VLANs. For example,

an uplink interface (trunk port) can carry both the RSPAN traffic and other

traffic. Do not configure the RSPAN VLAN as a native VLAN on interfaces

other than the uplink/transit/downlink interfaces. Be sure to remove the

RSPAN VLAN from ports on which mirrored traffic should not be

encapsulated and transported. The RSPAN tag is not transmitted on the

destination (probe) port, except on the N4000, where the RSPAN tag appears

on the probe port due to hardware limitations.

For VLAN mirroring, the source VLAN cannot be the same as the RSPAN

VLAN. The source VLAN and the RSPAN VLAN cannot be configured on the

same port. The source VLAN is monitored in the ingress direction only.

Careful consideration to placement of source mirroring sessions will allow

bidirectional traffic to be monitored. Another alternative is to use port

mirroring and a VLAN ACL filter if duplicate packets are received on the

probe device.

The reflector port must be configured as the only member of the RSPAN

VLAN on the source switch.

Multiple source interfaces may mirror traffic onto the RSPAN VLAN on both

source switches and transmit switches (but not the destination switch). Be

aware that the RSPAN VLAN floods mirrored traffic in the RSPAN VLAN. If

an intermediate switch mirrors traffic onto the RSPAN VLAN, the traffic is

flooded to both the destination and the other sources. Configuration of an

ACL on the reflector port may mitigate this behavior. The source interface

must be configured as the only member of the RSPAN VLAN on the

destination (probe) switch. Mirroring a source to the RSPAN VLAN on the

destination switch is not supported.

If an ACL filter is specified, the ACL must be created prior to its use in an

RSPAN configuration. The ACL filter is configured on the source switch.

ACL filters are internally configured as an egress ACL on the destination

interface/reflector port. All the criteria in the ACL are marked with the mirror

attribute (and the RSPAN VLAN) to match the mirrored traffic (including

Layer 2 Switching Commands 649

the implicit deny all). If configuring an egress ACL on the destination port,

care must be taken with the ACL numbering to ensure the mirrored traffic is

properly processed.

Bidirectional mirroring of multiple ports in a network may result in duplicate

packets transmitted on the probe port (one copy for the receive side and

another copy for the transmit side). Configuring the mirroring as rx only may

help to reduce this issue.

RSPAN VLANs must be configured with the remote-span command prior to

configuration in an RSPAN session. RSPAN intermediate switches may also

be configured with multiple sources feeding into an existing RSPAN VLAN.

The source configuration requires an interface parameter, so traffic mirrored

on the intermediate switch is not flooded across the entire RSPAN VLAN.

Place probe ports upstream of the intermediate switch in this case.

Configuring a second session on a source switch that mirrors RSPAN traffic

from the reflector port is not supported. Configuring a second session on a

source switch that mirrors an RSPAN source port to a local probe port is

supported.

VLAN mirroring is not recommended for RSPAN if sources on multiple

switches are members of the VLAN. This is because, as stations communicate

with each other over the mirrored VLAN, duplicate packets will be sent to the

probe, once for the source port and once for each switch over which the

packet is received in the source VLAN.

Example

This example shows how to configure a source switch using VLAN 723 as the

destination RSPAN VLAN and Gi1/0/3 as the source interface. Te1/0/1 is

configured as the reflector port. It is recommended that interface Te1/0/1 be

configured as a trunk port. Interface Te1/0/1 must be configured as a member

of VLAN 723 and may also carry traffic on other VLANs. No other interface

should be configured as a member of VLAN 723.

console(config)#vlan 723

console(config-vlan723)#remote-span

console(config-vlan723)#exit

console(config)#interface Te1/0/1

console(config-if-Te1/0/1)#switchport mode trunk

console(config-if-Te1/0/1)#exit

console(config)#monitor session 1 source interface gi1/0/3 both

Layer 2 Switching Commands 650

console(config)#monitor session 1 destination remote vlan 723 reflector-port

Te1/0/1

console(config)#monitor session 1 mode

console(config)#show monitor session 1

Session : 1

Admin mode : Enabled

Type : Remote source session

Source ports :

Both : Gi1/0/48

Destination port : Te1/0/1

Destination RSPAN VLAN : 723

This example shows how to configure a destination switch using VLAN 723 as

the source RSPAN VLAN interface Te1/0/1 and Gi1/0/10 as the destination

interface. Interface Gi1/0/10 is dedicated to monitoring and has a PC running

WireShark attached. VLAN 723 should only be configured on interface

Te1/0/1.

console(config)#vlan 723

console(config-vlan723)#remote-span

console(config-vlan723)#exit

console(config)#interface Te1/0/1

console(config-if-Te1/0/1)#switchport mode trunk

console(config-if-Te1/0/10)#exit

console(config)# monitor session 1 source remote vlan 723

console(config)# monitor session 1 destination interface gi1/0/10

console(config)# monitor session 1 mode

console(config)#show monitor session 1

Session : 1

Admin mode : Enabled

Type : Remote destination session

Source RSPAN VLAN : 723

Destination port : Gi1/0/10

Command History

Revised in firmware release 6.3.6.

remote-span

Use this command to configure a VLAN as an RSPAN VLAN. Use the no

form of the command to remove the remote SPAN characteristics from a

VLAN and revert it to a normal MAC learning VLAN.

Layer 2 Switching Commands 651

Syntax

remote-span

no remote-span

Default Configuration

There is no default configuration for this command.

Command Modes

VLAN Configuration mode.

User Guidelines

Remote-span VLANs must be configured as a tagged VLAN on trunk or

general mode ports on RSPAN transit switches. Traffic in an RSPAN VLAN is

always flooded as MAC address learning and link local protocols are disabled

on RSPAN VLANs. VLANs on transit switches must be configured as remote-

span VLANs in order to ensure delivery of all mirrored packets. Remote-span

VLANs configured on transit switches may co-exist with other non remote-

span VLANs on trunk ports. Do not configure the RSPAN VLAN as a member

of spanning tree (RSTP-PV or MST).

Example

console#vlan 10

console(config-vlan10)#remote-span

show monitor capture

Use this command to display captured packets transmitted or received from

the CPU.

Syntax

show monitor capture [packets]

Default Configuration

This command has no default configuration.

Layer 2 Switching Commands 652

Command Modes

Privileged Exec mode (all SHOW modes)

User Guidelines

This command has no user guidelines.

Example

console#show monitor capture

Operational Status............................. Enabled

Current Capturing Type......................... Line

Capturing Traffic Mode......................... Tx/Rx

Line Wrap Mode................................. Disabled

RPCAP Listening Port........................... 2002

RPCAP dump file size (KB)...................... 45

console#show monitor capture packets

Gi1/0/1 Length = 94 [RECEIVE]

===================

02:29:23.0000

0000 33 33 00 00 00 01 00 11 88 2f 8e 82 81 00 00 01

0010 86 dd 60 00 00 00 00 24 00 01 fe 80 00 00 00 00

0020 00 00 00 00 88 ff fe 2f 8e 82 ff 02 00 00 00 00

0030 00 00 00 00 00 00 00 00 00 01 3a 00 05 02 00 00

0040 01 00 82 00 43 62 27 10 00 00 00 00 00 00 00 00

0050 00 00 00 00 00 00 00 00 00 00 ff ff 00 00

===================

Gi1/0/1 Length = 94 [RECEIVE]

===================

02:29:24.0000

0000 33 33 00 00 00 01 00 11 88 2f 8e 82 81 00 00 01

0010 86 dd 60 00 00 00 00 24 00 01 fe 80 00 00 00 00

0020 00 00 00 00 88 ff fe 2f 8e 82 ff 02 00 00 00 00

0030 00 00 00 00 00 00 00 00 00 01 3a 00 05 02 00 00

0040 01 00 82 00 43 62 27 10 00 00 00 00 00 00 00 00

0050 00 00 00 00 00 00 00 00 00 00 ff ff 00 00

===================

Gi1/0/1 Length = 94 [RECEIVE]

===================

02:29:25.0000

0000 33 33 00 00 00 01 00 11 88 2f 8e 82 81 00 00 01

Layer 2 Switching Commands 653

0010 86 dd 60 00 00 00 00 24 00 01 fe 80 00 00 00 00

0020 00 00 00 00 88 ff fe 2f 8e 82 ff 02 00 00 00 00

0030 00 00 00 00 00 00 00 00 00 01 3a 00 05 02 00 00

0040 01 00 82 00 43 62 27 10 00 00 00 00 00 00 00 00

0050 00 00 00 00 00 00 00 00 00 00 ff ff 00 00

===================

Gi1/0/1 Length = 94 [RECEIVE]

===================

02:29:26.0000

0000 33 33 00 00 00 01 00 11 88 2f 8e 82 81 00 00 01

0010 86 dd 60 00 00 00 00 24 00 01 fe 80 00 00 00 00

0020 00 00 00 00 88 ff fe 2f 8e 82 ff 02 00 00 00 00

0030 00 00 00 00 00 00 00 00 00 01 3a 00 05 02 00 00

0040 01 00 82 00 43 62 27 10 00 00 00 00 00 00 00 00

0050 00 00 00 00 00 00 00 00 00 00 ff ff 00 00

show monitor session

Use the show monitor session command to display status of port monitoring,

VLAN-based mirroring, Flow-based mirroring, and mirroring across RSPAN.

Syntax

show monitor session session_number [detail]

• session

_number

— Session identification number.

• detail—Displays additional information.

Default Configuration

This command has no default configuration.

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

This command has no user guidelines.

Examples

The following example shows port monitor status.

Layer 2 Switching Commands 654

console(config)#show monitor session 1

Session : 1

Admin mode : Disabled

Type : Local session

Source ports :

Both : Te1/0/10

Destination ports : Te2/0/20

IP access-group : a1

The following example shows the detailed status of the port based mirroring

session that is constrained to a local switch.

console(config)#show monitor session 1 detail

Session : 1

Admin mode : Disabled

Type : Local session

Source ports :

Rx only : None

Tx only : None

Both : Te1/0/10

Source VLANs :

Rx only : None

Source RSPAN VLAN : None

Destination ports : Te2/0/20

Destination RSPAN VLAN : None

IP access-group : a1

MAC access-group : None

The following example shows the detailed status of a VLAN session on source

switch, where session is span across multiple switches.

console# show monitor session 1 detail

Session : 1

Type : Remote Destination Session

Source Ports :

RX Only : None

TX Only : None

Both : None

Source VLANs :

RX Only : 100

Source RSPAN VLAN : None

Destination Ports : None

Dest RSPAN VLAN : 999

Layer 2 Switching Commands 655

The following example shows the detailed status of a VLAN session on

destination switch, where session is span across multiple switches.

console# show monitor session 1 detail

Session : 1

Type : Remote Destination Session

Source Ports :

RX Only : None

TX Only : None

Both : None

Source VLANs :

RX Only : None

Source RSPAN VLAN : 999

Destination Ports : Gi1/0/15

Dest RSPAN VLAN : None

show vlan remote-span

Use this command to display the RSPAN VLAN IDs.

Syntax

show vlan remote-span

Default Configuration

This command has no default configuration.

Command Modes

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

This command has no user guidelines.

Example

The following example shows the RSPAN VLANs configured on the switch.

console# show vlan remote-span

RSPAN Vlan

Layer 2 Switching Commands 656

-----------------------------------------------------

Layer 2 Switching Commands 657

QoS Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Quality of Service (QoS) technologies are intended to provide guaranteed

timely delivery of specific application data to a particular destination. In

contrast, standard IP-based networks are designed to provide best effort data

delivery service. Best effort service implies that the network delivers the data

in a timely fashion, although there is no guarantee. During times of

congestion, packets may be delayed, sent sporadically, or dropped. For typical

Internet applications, such as electronic mail and file transfer, a slight

degradation in service is acceptable and, in many cases, unnoticeable.

Conversely, any degradation of service has undesirable effects on applications

with strict timing requirements, such as voice or multimedia.

QoS is a means of providing consistent, predictable data delivery by

distinguishing between packets that have strict timing requirements from

those that are more tolerant of delay. Packets with strict timing requirements

are given special treatment in a QoS-capable network. To accomplish this, all

elements of the network must be QoS-capable. If one node is unable to meet

the necessary timing requirements, this creates a deficiency in the network

path and the performance of the entire packet flow is compromised.

Access Control Lists

The Dell EMC Networking ACL feature allows classification of packets based

upon Layer 2 through Layer 4 header information. An Ethernet IPv6 packet is

distinguished from an IPv4 packet by its unique Ether-type value; thus, all

IPv4 and IPv6 classifiers include the Ether-type field.

Multiple ACLs per interface are supported. The ACLs can be combination of

Layer 2 and/or Layer 3/4 ACLs.

ACL assignment is appropriate for both physical ports and LAGs.

A user configures an ACL permit rule to force its matching traffic stream to a

specific egress interface, bypassing any forwarding decision normally

performed by the device. The interface can be an Ethernet interface or a

LAG. The redirect interface rule action is independent of, but compatible

with, the assign queue rule action.

Layer 2 Switching Commands 658

ACLs can be configured to apply to a VLAN instead of an interface. Traffic

tagged with a VLAN ID (either receive-tagged or tagged by ingress process

such as PVID) is evaluated for a match regardless of the interface on which it

is received.

Layer 2 ACLs

The Layer 2 ACL feature provides access list capability by allowing

classification on the Layer 2 header of an Ethernet frame, including the

802.1Q VLAN tag(s). In addition, the rule action set is enhanced to designate

which (egress) CoS queue should handle the traffic, and whether the traffic

flow is to be redirected to a specific outgoing interface.

MAC access lists are identified by a user-specified name instead of a number.

Layer 3/4 IPv4 ACLs

The Layer 3/4 ACL feature supports extended IP access lists. These lists check

the Layer 3 portion of a packet, looking specifically at information contained

in the IP header and, in certain cases, the TCP or UDP header. An EtherType

of 0x0800 is assumed in the case of IP access lists. Permit and deny actions are

supported for each ACL rule.

Standard layer 3/4 ACLs can be classified based on the source IP address and

netmask or other extended classification criteria.

Class of Service (CoS)

The Dell EMC Networking CoS Queuing feature allows the user to directly

configure device queuing and, therefore, provide the desired QoS behavior

without the complexities of DiffServ. The CoS feature allows the user to

determine the following queue behavior:

• Queue Mapping

– Trusted Port Queue Mapping

– Untrusted Port Default Priority

• Queue Configuration

This enables Dell EMC Networking switches to support a wide variety of

delay sensitive video and audio multicast applications.

Layer 2 Switching Commands 659

CoS mapping tables, port default priority, and hardware queue parameters

may be configured on LAG interfaces as well as physical port interfaces.

Queue Mapping

The priority of a packet arriving at an interface is used to steer the packet to

the appropriate outbound CoS queue through a mapping table. Network

packets arriving at an ingress port are directed to one of n queues in an egress

port(s) based on the translation of packet priority to CoS queue. The CoS

mapping tables define the queue used to handle each enumerated type of

user priority designated in either the 802.1p User Priority, or IP DSCP

contents of a packet. If neither of these fields is trusted to contain a

meaningful COS queue designation, the ingress port can be configured to use

its default priority to specify the CoS queue.

CoS queue mappings use the concept of trusted and untrusted ports.

A trusted port is one that takes at face value a certain priority designation

within arriving packets. Specifically, a port may be configured to trust one of

the following packet fields:

• IEEE 802.1p User Priority

• IP Precedence

• IP DSCP

Packets arriving at the port ingress are inspected and their trusted field value

is used to designate the COS queue that the packet is placed when forwarded

to the appropriate egress port. A mapping table associates the trusted field

value with the desired COS queue.

Alternatively, a port may be configured as untrusted, whereby it does not trust

any incoming packet priority designation and uses the port default priority

value instead. All packets arriving at the ingress of an untrusted port are

directed to a specific COS queue on the appropriate egress port(s) in

accordance with the configured default priority of the ingress port. This

process is also used for cases where a trusted port mapping is unable to be

honored, such as when a non-IP packet arrives at a port configured to trust

the User Priority or IP DSCP value.

Layer 2 Switching Commands 660

DiffServ

Standard IP-based networks are designed to provide “best effort” data delivery

service. Best effort service implies that the network delivers the data in a

timely fashion, although there is no guarantee that it will meet the latency or

bandwidth requirements. During times of congestion, packets may be

delayed, sent sporadically, or dropped. For typical Internet applications, such

as email and file transfer, a slight degradation in service is acceptable and in

many cases unnoticeable. Conversely, any

degradation of service has undesirable effects on applications with strict

timing requirements, such as voice or multimedia.

Diffserv allows the network operator to classify and apply a distinguished

service to traffic based on a number of criteria. The distinguished service can

meter traffic and apply per hop behavior based upon the bandwidth

utilization and burstiness of traffic. In addition, preferential drop

characteristics can be configured in support of an assured forwarding

capability such that TCP clients are informed if they exceed the switch

buffering limits.

Commands in this Section

This section explains the following commands:

assign-queue mark ip-dscp match source-

address mac

show class-map

class mark ip-precedence match srcip show classofservice

dot1p-mapping

class-map match class-map match srcip6 show classofservice ip-

dscp-mapping

class-map rename match cos match srcl4port show classofservice

trust

classofservice

dot1p-mapping

match destination-

address mac

match vlan show diffserv

classofservice ip-

dscp-mapping

match dstip mirror show diffserv service

interface

Layer 2 Switching Commands 661

assign-queue

Use the assign-queue command in Policy-Class-Map Configuration mode to

modify the queue ID to which the associated traffic stream is assigned.

Syntax

assign-queue

queueid

• queueid — Specifies a valid queue ID. (Range: integer from 0–6.)

Default Configuration

This command has no default configuration.

Command Mode

Policy-Class-Map Configuration mode

User Guidelines

The queue id is the internal queue number (traffic class), not the CoS value.

Use the show classofservice command to display the assignment of CoS and

DSCP values to internal queue numbers.

classofservice trust match dstip6 police-simple show diffserv service

brief

conform-color match dstl4port police-single-rate show interfaces cos-

queue

cos-queue min-

bandwidth

match ethertype police-two-rate show interfaces

random-detect

cos-queue random-

detect

match ip6flowlbl policy-map show policy-map

cos-queue strict match ip dscp random-detect

queue-parms

show policy-map

interface

diffserv match ip

precedence

random-detect

exponential-

weighting-constant

show service-policy

drop match ip tos redirect traffic-shape

mark cos match protocol service-policy vlan priority

Layer 2 Switching Commands 662

Example

The following example displays how to change the queue ID to 4 for the

associated traffic stream.

console(config-policy-classmap)#assign-queue 4

class

Use the class command in Policy-Map Class Configuration mode to create an

instance of a class definition within the specified policy for the purpose of

defining treatment of the traffic class through subsequent policy attribute

statements.

Syntax

class classname

no class

• classname — Specifies the name of an existing DiffServ class. (Range: 1–

31 characters)

Default Configuration

This command has no default configuration.

Command Mode

Policy Map Configuration mode

User Guidelines

This command causes the specified policy to create a reference to the class

definition. The command mode is changed to Policy-Class-Map

Configuration when this command is executed successfully.

Example

The following example shows how to specify the DiffServ class name of

“DELL.”

console(config)#class-map match-all DELL

console(config-classmap)#exit

console(config)#policy-map DELL1 in

console(config-policy-map)#class DELL

Layer 2 Switching Commands 663

class-map

Use the class-map command in Global Configuration mode to define a new

DiffServ class of type match-all. To delete the existing class, use the no form

of this command.

Syntax

class-map match-all class-map-name [{ipv4 | ipv6}]

no class-map class-map-name

• class-map-name — a case-sensitive alphanumeric string from 1 to 31

characters uniquely identifying an existing DiffServ class.

Default Configuration

The class-map defaults to IPv4.

Command Mode

Global Configuration mode

User Guidelines

The match-all parameter indicates that all of the match criteria configured in

the class map must be met for the packet to be processed by the class map.

Example

The following example creates a class-map named “DELL” which requires all

ACE’s to be matched.

console(config)#class-map DELL

console(config-cmap)#exit

class-map rename

Use the class-map rename command in Global Configuration mode to

change the name of a DiffServ class.

Syntax

class-map rename

classname

newclassname

Layer 2 Switching Commands 664

• classname — The name of an existing DiffServ class. (Range: 1–31

characters)

• newclassname — A case-sensitive alphanumeric string. (Range: 1–31

characters)

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example displays how to change the name of a DiffServ class

from “DELL” to “DELL1.”

console(config)#class-map rename DELL DELL1

console(config)#

classofservice dot1p-mapping

Use the classofservice dot1p-mapping command in Global Configuration

mode to map an IEEE 802.1p user priority to an internal traffic class. In

Interface Configuration mode, the mapping is applied only to packets

received on that interface. Use the no form of the command to remove

mapping between an 802.1p priority and an internal traffic class.

Syntax

classofservice dot1p-mapping ppriority trafficclass

no classofservice dot1p-mapping

• ppriority — Specifies the user priority mapped to the specified traffic class

for this switch. (Range: 0–7)

• trafficclass — Specifies the traffic class for this switch. (Range: 0–6)

Layer 2 Switching Commands 665

Default Configuration

The default 802.1p mapping is as follows:

Command Mode

Global Configuration or Interface Configuration (Ethernet, Port-channel)

mode

User Guidelines

None

Example

The following example globally configures a mapping for user priority 1 and

traffic class 2. If trust mode is enabled for 802.1p (classofservice trust dot1p),

packets received on any interface marked with IEEE 802.1p priority 1 will be

assigned to internal CoS queue 2.

console(config)#classofservice dot1p-mapping 1 2

classofservice ip-dscp-mapping

Use the classofservice ip-dscp-mapping command in Global Configuration

mode to map an IP DSCP value to an internal traffic class. Use the no form of

the command to return the classofservice mapping to the default, and remove

a traffic class mapping for an IP DSCP value.

User Priority Traffic Class

Layer 2 Switching Commands 666

Syntax

classofservice ip-dscp-mapping ipdscp trafficclass

no classofservice ip-dscp-mapping

• ipdscp—Specifies the IP DSCP value which is to be mapped to the

specified traffic class. (Range: 0–63 or an IP DSCP keyword – af11, af12,

af13, af21, af22, af23, af31, af32, af33, af41, af42, af43, be, cs0, cs1, cs2,

cs3, cs4, cs5, cs6, cs7, ef).

• trafficclass—Specifies the traffic class for this value mapping. (Range: 0–

6).

Default Configuration

The default DSCP mapping is as follows:

IP DSCP Traffic Class (queue-id)

0(be/cs0) 1

8(cs1) 0

10(af11) 0

11 0

12(af12) 0

13 0

14(af13) 0

15 0

Layer 2 Switching Commands 667

16(cs2) 0

17 0

18(af21) 0

19 0

20(af22) 0

21 0

22(af23) 0

23 0

24(cs3) 1

25 1

26(af31) 1

27 1

28(af32) 1

29 1

30(af33) 1

31 1

32(cs4) 2

33 2

34(af41) 2

35 2

36(af42) 2

37 2

38(af43) 2

39 2

40(cs5) 2

41 2

42 2

43 2

IP DSCP Traffic Class (queue-id)

Layer 2 Switching Commands 668

Command Mode

Global Configuration mode

User Guidelines

The switch may be configured to trust either DSCP or CoS values, but not

both. Setting the trust mode does not affect ACL packet matching, e.g. it is

still possible to use an ACL that matches on a received CoS value and assigns

the packet to a queue even when DSCP is trusted.

44 2

45 2

46(ef) 2

47 2

48(cs6) 3

49 3

50 3

51 3

52 3

53 3

54 3

55 3

56(cs7) 3

57 3

58 3

59 3

60 3

61 3

62 3

63 3

IP DSCP Traffic Class (queue-id)

Layer 2 Switching Commands 669

Example

The following example globally configures the mapping for IP DSCP 1 to

traffic class 2. If trust mode is enabled for DSCP (classofservice trust ip-

dscp), packets received on any interface marked with DSCP 1 will be assigned

to internal CoS queue 2.

console(config)#classofservice ip-dscp-mapping 1 2

classofservice trust

Use the classofservice trust command in either Global Configuration mode

or Interface Configuration mode to set the class of service trust mode of an

interface. To set the interface mode to trust 802.1p markings, use the no form

of this command.

Syntax

classofservice trust {dot1p | untrusted | ip-dscp}

no classofservice trust

•dot1p — Specifies that the mode be set to trust IEEE 802.1p packet

markings.

•untrusted — Sets the Class of Service Trust Mode to Untrusted.

•ip-dscp — Specifies that the mode be set to trust IP DSCP packet

markings.

Default Configuration

By default, the switch trusts IEEE 802.1p markings.

Command Mode

Global Configuration mode or Interface Configuration (gigabitethernet,

port-channel, tengigabitethernet, fortygigabitethernet) mode

User Guidelines

This command has no user guidelines.

Layer 2 Switching Commands 670

Examples

The following example sets the class of service trust mode of all interfaces to

trust 802.1p packet markings.

console(config)#classofservice trust dot1p

The following example displays how to set the class of service trust mode of

all interfaces to trust IP DSCP packet markings.

console(config)#classofservice trust ip-dscp

conform-color

Use the conform-color command in Policy-Class-Map Configuration mode

to enable color-aware marking for a policy.

NOTE: This command is not available on the N1500 Series switches.

Syntax

conform-color {class-map-name} [exceed-color { class-map-name } ]

Default Configuration

This command has no default configuration.

Command Mode

Policy-Class-Map Configuration mode

User Guidelines

This command must be preceded by a police command. If the conform-color

command is not entered, the police algorithm uses the color-blind version,

meaning in the incoming color is ignored. The conform-color command can

be used with any of the three police algorithms. In the simple algorithm, only

the conform color class can be configured. The conform color class pre-colors

packets as green prior to metering. Non-conforming packets are pre-colored

red prior to metering. With the single-rate and two-rate police algorithm, the

conform color class pre-colors packets as green and the exceed color class pre-

colors packets as yellow. Non-conforming packets are pre-colored red. Per-

colored packets are then metered and re-colored based upon the meter

parameters.

Layer 2 Switching Commands 671

Color conforming classes must be one of the following types:

• Primary COS

• Secondary COS

• DSCP

• IP Precedence

This includes both the input and color aware classes. The conform color class

may not be the same as the input class, nor may the match criteria be of the

same type. The input class map may have a match type of “any.”

The exceed color class may only be specified for the two-rate police

algorithm.

Example

The following example uses a simple policer to color TCP packets that exceed

an average rate of 1000 Kbps or a burst size of 16 Kbytes as red. Conforming

packets (those in CoS queue 1) are pre-colored green prior to metering. After

metering, non-conforming packets are colored red. Both green and red

packets are transmitted, but may be subject to further color-based action on

egress. The example configuration below also shows the configuration of

WRED drop thresholds and probabilities for colored traffic.

console(config)#class-map match-all class-ipv4 ipv4

console(config-classmap)#match any

console(config-classmap)#exit

console(config)#class-map match-all class-cos1 ipv4

console(config-classmap)#match cos 1

console(config-classmap)#exit

console(config)#policy-map color in

console(config-policy-map)#class class-ipv4

console(config-policy-classmap)#police-simple 1000 16 conform-action

transmit violate-action transmit

console(config-policy-classmap)#conform-color class-cos1

console(config-policy-classmap)#exit

console(config-policy-map)#exit

Layer 2 Switching Commands 672

cos-queue min-bandwidth

Use the cos-queue min-bandwidth command in either Global Configuration

mode or Interface Configuration mode to specify the minimum transmission

bandwidth for each interface queue. To restore the default for each queue’s

minimum bandwidth value, use the no form of this command.

Syntax

cos-queue min-bandwidth bw-0 bw-1 … bw-n

no cos-queue min-bandwidth

• bw-0 — Specifies the minimum transmission bandwidth guarantee for an

interface. You must specify as many bandwidth parameters as there are

COS queues (bw-0 through bw-n). (Range: 0–100 in increments of 5)

Default Configuration

By default, all CoS queues are configured with a 0% minimum bandwidth

guarantee.

Command Mode

Global Configuration mode or Interface Configuration (gigabitethernet,

port-channel, tengigabitethernet, fortygigabitethernet) mode

User Guidelines

This command changes the scheduling policy for packet transmission of the

selected CoS queues. It does not change the packet buffering policy nor does

it reserve packet buffers to a CoS queue.

The maximum number of queues supported per interface is seven. It is

recommended that the operator avoid the use of queue 5-7 to avoid conflicts

with inter- and intra-network control traffic.

In order to better accommodate bursty traffic, it is recommended that the

sum of the configured min-bandwidths be much less than 100%. Configuring

the minimum bandwidths such that they sum to 100% effectively locks the

scheduler such that bandwidth sharing by lower priority queues cannot be

accommodated under congestion conditions.

Layer 2 Switching Commands 673

When ETS is operational on an N4000 series switch, this command overrides

the ETS assignments and assigns minimum bandwidth constraints across

traffic class groups. This allows the administrator to ensure that the frame

scheduler does not completely starve lower priority groups when strict priority

is enabled on a high numbered TCG. Specifically, assigning a minimum

bandwidth to a lower numbered TCG, even when strict priority is enabled on

a higher numbered TCG, will alter the normal scheduler behavior and cause

the scheduler to process frames from the lower numbered TCG to conform to

the min-bandwidth constraint.

Example

The following example displays how to specify the minimum transmission

bandwidth guarantee for cos-queues 0 through 6 as follows:

Cos Queue 0—5% scheduler capacity

CoS Queue 1—5% scheduler capacity

CoS Queue 2—10% scheduler capacity

CoS Queue 3—10% scheduler capacity

CoS Queue 4-7—Shared scheduler capacity.

console(config)#cos-queue min-bandwidth 5 5 10 10 0 0 0

cos-queue random-detect

Use the cos-queue random-detect command in Global Configuration or

Interface Configuration mode to enable WRED queue management policy

on an interface CoS queue. Use the no form of the command to disable

WRED policy for a CoS queue on an interface.

NOTE: On the N1500 Series switches, this command enables Simple

RED since the hardware is not capable of Weighted RED.

Syntax

cos-queue {random-detect queue-id1 [queue-id2..queue-idn]}

no cos-queue {random-detect queue-id1 [queue-id2..queue-idn]}

• queue-id—An integer indicating the internal CoS queue-id which is to be

enabled for WRED. Range 0-6. Up to 7 queues may be simultaneously

specified.

Layer 2 Switching Commands 674

Default Configuration

WRED queue management policy is disabled by default. Tail-drop queue

management policy is enabled by default. The threshold for invoking tail-

drop behavior when WRED is disabled is approximately 1/2 of the remaining

free packet buffer in the switch.

Command Mode

Interface Configuration (physical or port-channel) mode, Interface Range

mode, or Global Configuration mode

User Guidelines

When used on a port-channel, this command will override the settings on the

individual interfaces that are part of the port channel. Removing an interface

from the port channel restores the individual interface settings.

This command can be used in Interface Range mode.

Use the

cos-queue min-bandwidth

command to configure the minimum

scheduler bandwidth percentage guarantee for the CoS queues.

Use the

show interfaces random-detect

command to display the WRED

configuration, including ECN configuration.

Use the

policy-map

and

conform-color

commands to mark traffic with a color

other than default green color.

The drop probability scale supports values in the range 0-10% and the discrete

values 25%, 50%, 75%, and 100%. Other values are truncated to the next lower

value by the hardware.

N1500 Series Switches

N1500 Series switches support a simple RED capability. The N1500 Series

switch does not support configuration of the maximum threshold nor can the

threshold or drop probability be configured for non-TCP traffic. Only the

minimum threshold (min-thresh) and drop probability (drop-prob-scale) may

be configured for the TCP colors green/yellow/red. The maximum threshold

may not be configured nor can the threshold or drop probability be

configured for non-TCP traffic. ECN capability is supported.

Layer 2 Switching Commands 675

Simple RED may be enabled/disabled for any CoS queue on the Dell EMC

Networking N1500 Series switches, however, the drop probability must be one

of the values given below. The percentage before the dash indicates the actual

drop probability. The number after the dash indicates the value entered in the

drop-prob-scale parameter.

0.097% - 1

0.195% - 2

0.391% - 4

0.781% - 8

1.563% - 16

3.125% - 31

6.250% - 63

100% - 100

Examples

Example 1

This example enables WRED on internal CoS 0 queue for unmarked packets

and set the green, yellow, and red colored traffic to utilize WRED starting at

3% of port congestion with a drop probability of 1%, 2% and 3%, respectively.

In this configuration, non-TCP traffic uses tail-drop queue discipline with a

drop threshold at 100% of the statically calculated port queue length vs. the

dynamically calculated value used by the normal tail-drop mechanism

(approx. 1/2 remaining free packet buffer memory).

console(config)# cos-queue random-detect 0

console(config)# random-detect queue-parms 0 min-thresh 3 3 3 100 max-thresh

10 10 10 100 drop-prob-scale 1 2 3 0

Example 2

This example configures simple RED on an N1500 series switch. CoS queue 1

is globally configured for simple RED with a congestion threshold of 50% and

a drop probability of 0.781% for green colored traffic.

console(config)# random-detect queue-parms 1 min-thresh 50 0 0 drop-prob-

scale 8 0 0

console(config)#cos-queue random-detect 1

Layer 2 Switching Commands 676

cos-queue strict

Use the cos-queue strict command in either Global Configuration mode or

Interface Configuration mode to activate the strict priority scheduler mode

for the specified queue. To restore the default weighted scheduler mode for

each specified queue, use the no form of this command.

Syntax

cos-queue strict {queue-id-1} [{queue-id-2} … {queue-id-n}]

no cos-queue strict {queue-id-1} [{queue-id-2} … {queue-id-n}]

•queue-id-1 — Specifies the queue ID for which you are activating the

strict priority scheduler. You can specify a queue ID for as many queues as

you have (queue-id 1 through queue-id-n). (Range: 0–6)

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode or Interface Configuration (gigabitethernet,

port-channel, tengigabitethernet, fortygigabitethernet) mode

User Guidelines

Strict priority (SP) queues are scheduled in priority order ahead of WRR

queues. Strict priority queues are allocated unlimited bandwidth by default.

Configuring the min-bandwidth on a CoS queue also configured for strict

priority wastes the scheduler slots. Use the cos-queue min-bandwidth

command on lower priority SP and WRR queues to ensure fairness to lower

priority queues by reserving a specific amount of scheduler bandwidth. Use

the show interfaces cos-queue command to display the class of service

settings.

Strict priority scheduling is most useful when it is desirable that low-bit-rate

time-sensitive traffic be queued ahead of other traffic. The administrator

must be careful to limit the bandwidth assigned to the strict priority queue to

avoid potential denial of service attacks. See the “Enterprise Voice VLAN

Configuration With QoS” section in the Users Configuration Guide for a rate

limiting example. If using the min-bandwidth command to reserve

Layer 2 Switching Commands 677

bandwidth on other queues, ensure that the total of the minimum

bandwidths is less than 100% to allow the scheduler to handle bursts of

traffic.

Example

The following example displays how to activate the strict priority scheduler

mode for two queues.

console(config)#cos-queue strict 1 2

The following example displays how to activate the strict priority scheduler

mode for three queues (1, 2, and 4) and reserves a minimal amount of

bandwidth on the other four internal CoS queues (0, 3, 5 and 6).

console(config)#cos-queue strict 1 2 4

console(config)#cos-queue min-bandwidth 5 0 0 10 0 10 10

diffserv

Use the diffserv command in Global Configuration mode to set the DiffServ

operational mode to active. While disabled, the DiffServ configuration is

retained and can be changed, but it is not operational. When enabled,

DiffServ services are operational on queues configured for WRED. To set the

DiffServ operational mode to inactive, use the no form of this command.

NOTE: On the N1500 Series switches, enable Simple RED since the

hardware is not capable of Weighted RED.

Syntax

diffserv

no diffserv

Default Configuration

This command default is enabled.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Layer 2 Switching Commands 678

Example

The following example displays how to set the DiffServ operational mode to

active.

console(Config)#diffserv

drop

Use the drop command in Policy-Class-Map Configuration mode to specify

that all packets for the associated traffic stream are to be dropped at ingress.

NOTE: This command is not available on the N1500 Series switches.

Syntax

drop

Default Configuration

This command has no default configuration.

Command Mode

Policy-Class-Map Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example displays how to specify that matching packets are to

be dropped at ingress.

console(config-policy-classmap)#drop

mark cos

Use the mark cos command in Policy-Class-Map Configuration mode to

mark all packets for the associated traffic stream with the specified class of

service value in the user priority field of the 802.1p header. If the packet does

not already contain this header, one is inserted.

NOTE: This command is not available on the N1500 Series switches.

Layer 2 Switching Commands 679

Syntax

mark cos cos-value

• cos-value — Specifies the CoS value as an integer. (Range: 0–7)

Default Configuration

There is no default cos-value for this command. Packets are not remarked by

default.

Command Mode

Policy-Class-Map Configuration mode

User Guidelines

Received frames are assigned to an internal CoS queue on ingress depending

on configuration such as whether the ingress port is trusted for CoS, DSCP or

IP precedence value and it's mapping onto an internal CoS queue.

Frames may be remarked using either an in or an out policy map. Changing

the CoS value in the VLAN tag of a frame does not alter the internal CoS

assigned to the packet; it only rewrites the CoS value in the Ethernet frame

header.

Example

The following example displays how to mark all packets with a CoS value.

console(config-policy-classmap)#mark cos 7

mark ip-dscp

Use the mark ip-dscp command in Policy-Class-Map Configuration mode to

mark all packets for the associated traffic stream with the specified IP DSCP

value.

NOTE: This command is not available on the N1500 Series switches.

Syntax

mark ip-dscp dscpval

Layer 2 Switching Commands 680

• dscpval — Specifies a DSCP value (10, 12, 14, 18, 20, 22, 26, 28, 30, 34, 36,

38, 0, 8, 16, 24, 32, 40, 48, 56, 46) or a DSCP keyword (af11, af12, af13,

af21, af22, af23, af31, af32, af33, af41, af42, af43, be, cs0, cs1, cs2, cs3, cs4,

cs5, cs6, cs7, ef).

Default Configuration

This command has no default configuration.

Command Mode

Policy-Class-Map Configuration mode

User Guidelines

Received frames are assigned to a CoS queue on ingress depending on

configuration items such as whether the ingress port is trusted for CoS,

DSCP or IP precedence value and it's mapping onto an internal CoS queue.

IP packets may be remarked using either an in or an out policy map.

Changing the IP DSCP value in the ToS value of an IP packet does not alter

the internal CoS assigned to the packet; it only rewrites the ToS value in the

IP packet header.

Example

The following example displays how to mark all packets with an IP DSCP

value of “cs4.”

console(config-policy-classmap)#mark ip-dscp cs4

mark ip-precedence

Use the mark ip-precedence command in Policy-Class-Map Configuration

mode to mark all packets for the associated traffic stream with the specified

IP precedence value.

NOTE: This command is not available on the N1500 Series switches.

Syntax

mark ip-precedence prec-value

• prec-value — Specifies the IP precedence value as an integer. (Range: 0–7)

Layer 2 Switching Commands 681

Default Configuration

This command has no default configuration.

Command Mode

Policy-Class-Map Configuration mode

User Guidelines.

Received frames are assigned to a CoS queue on ingress depending on

configuration such as whether the ingress port is trusted for CoS, DSCP or IP

precedence value and it's mapping onto an internal CoS queue.

IP packets may be remarked using either an in or an out policy map.

Changing the IP precedence value in the ToS value field of an IP packet does

not alter the internal CoS assigned to the packet; it only rewrites the ToS

value in the IP packet header.

Example

The following example displays

console(config)#policy-map p1 in

console(config-policy-map)#class c1

console(config-policy-classmap)#mark ip-precedence 2

console(config-policy-classmap)#

match class-map

Use the match class-map command to add to the specified class definition

the set of match conditions defined for another class. Use the no form of this

command to remove from the specified class definition the set of match

conditions defined for another class.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match class-map refclassname

no match class-map refclassname

• refclassname — The name of an existing DiffServ class whose match

conditions are being referenced by the specified class definition.

Layer 2 Switching Commands 682

Default Configuration

This command has no default configuration.

Command Mode

Class-Map Configuration mode

User Guidelines

• The parameters refclassname and class-map-name can not be the same.

• Only one other class may be referenced by a class.

• Any attempts to delete the refclassname class while the class is still

referenced by any class-map-name fails.

• The combined match criteria of class-map-name and refclassname must

be an allowed combination based on the class type.

• Any subsequent changes to the refclassname class match criteria must

maintain this validity, or the change attempt fails.

• The total number of class rules formed by the complete reference class

chain (including both predecessor and successor classes) must not exceed

a platform-specific maximum. In some cases, each removal of a refclass

rule reduces the maximum number of available rules in the class definition

by one.

Example

The following example adds match conditions defined for the Dell class to

the class currently being configured.

console(config-classmap)#match class-map Dell

The following example deletes the match conditions defined for the Dell

class from the class currently being configured.

console(config-classmap)#no match class-map Dell

match cos

Use the match cos command in Class-Map Configuration mode to add a

match condition for the class of service value (the only tag in a single-tagged

packet or the first or outer 802.1Q tag of a double-VLAN tagged packet).

NOTE: This command is not available on the N1500 Series switches.

Layer 2 Switching Commands 683

Syntax

match cos

• cos-value — Specifies the CoS value as an integer (Range: 0–7)

Default Configuration

This command has no default configuration.

Command Mode

Class-Map Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example displays adding a match condition to the specified

class.

console(config-classmap)#match cos 1

match destination-address mac

Use the match destination-address mac command in Class-Map

Configuration mode to add a match condition based on the destination MAC

address of a packet.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match destination-address mac macaddr macmask

• macaddr — Specifies any valid layer 2 MAC address formatted as six two-

digit hexadecimal numbers separated by colons.

• macmask — Specifies a valid layer 2 MAC address bit mask formatted as

six two-digit hexadecimal numbers separated by colons. This address bit

mask does not need to be contiguous.

Layer 2 Switching Commands 684

Default Configuration

This command has no default configuration.

Command Mode

Class-Map Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example configures a match condition for the specified MAC

address and bit mask.

console(config-classmap)#match destination-address mac AA:ED:DB:21:11:06

FF:FF:FF:EF:EE:EE

match dstip

Use the match dstip command in Class-Map Configuration mode to add a

match condition based on the destination IP address of a packet.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match dstip ipaddr ipmask

• ipaddr — Specifies a valid IP address.

• ipmask — Specifies a valid IP address bit mask. Note that even though this

parameter is similar to a standard subnet mask, it does not need to be

contiguous.

Default Configuration

This command has no default configuration.

Command Mode

Class-Map Configuration mode

Layer 2 Switching Commands 685

User Guidelines

This command has no user guidelines.

Example

The following example displays adding a match condition using the specified

IP address and bit mask.

console(config-classmap)#match dstip 10.240.1.1 255.255.255.1

match dstip6

The match dstip6 command adds a match condition based on the

destination IPv6 address of a packet.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match dstip6 destination-ipv6-prefix/prefix-length

• destination-ipv6-prefix — IPv6 prefix in IPv6 global address format.

• prefix-length — IPv6 prefix length value.

Default Configuration

There is no default configuration for this command.

Command Mode

Ipv6-Class-Map Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-classmap)#match dstip6 2001:DB8::0/32

Layer 2 Switching Commands 686

match dstl4port

Use the match dstl4port command in Class-Map Configuration mode to add

a match condition based on the destination layer 4 port of a packet using a

single keyword or a numeric notation.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match dstl4port {portkey | port-number}

• portkey — Specifies one of the supported port name keywords. A match

condition is specified by one layer 4 port number. The currently supported

values are: domain, echo, ftp, ftpdata, http, smtp, snmp, telnet, tftp, and

www.

• port-number — Specifies a layer 4 port number (Range: 0–65535).

Default Configuration

This command has no default configuration.

Command Mode

Class-Map Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example displays adding a match condition based on the

destination layer 4 port of a packet using the “echo” port name keyword.

console(config-classmap)#match dstl4port echo

match ethertype

Use the match ethertype command in Class-Map Configuration mode to add

a match condition based on the value of the ethertype.

NOTE: This command is not available on the N1500 Series switches.

Layer 2 Switching Commands 687

Syntax

match ethertype {keyword |

0x0600-0xffff

}

•keyword — Specifies either a valid keyword or a valid hexadecimal number.

The supported keywords are appletalk, arp, ibmsna, ipv4, ipv6, ipx,

mplsmcast, mplsucast, netbios, novell, pppoe, rarp. (Range: 0x0600–

0xFFFF)

Default Configuration

This command has no default configuration.

Command Mode

Class-Map Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example displays how to add a match condition based on

ethertype.

console(config-classmap)#match ethertype arp

match ip6flowlbl

The match ip6flowlbl command adds to the specified class definition a

match condition based on the IPv6 flow label of a packet.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match ip6flowlbl label

• label - The value to match in the Flow Label field of the IPv6 header

(Range 0-1048575).

Default Configuration

There is no default configuration for this command.

Layer 2 Switching Commands 688

Command Mode

Ipv6-Class-Map Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

The following example adds a rule to match packets whose IPv6 Flow Label

equals 32312.

console(config-classmap)#match ip6flowlbl 32312

match ip dscp

Use the match ip dscp command in Class-Map Configuration mode to add to

the specified class definition a match condition based on the value of the IP

DiffServ Code Point (DSCP) field in a packet.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match ip dscp dscpval

• dscpval — Specifies an integer value or a keyword value for the DSCP

field. (Integer Range: 0–63) (Keyword Values: af11, af12, af13, af21, af22,

af23, af31, af32, af33, af41, af42, af43, be, cs0, cs1, cs2, cs3, cs4, cs5, cs6,

cs7, ef)

Default Configuration

This command has no default configuration.

Command Mode

Class-Map Configuration mode

User Guidelines

This DSCP field is defined as the high-order six bits of the Service type octet

in the IP header. The low-order two bits are not checked.

Layer 2 Switching Commands 689

The ip dscp, ip precedence, and ip tos match conditions are alternative ways

to specify a match criterion for the same Service Type field in the IP header

but with a slightly different user notation.

To specify a match on all DSCP values, use the match ip tos tosbits tosmask

command with tosbits set to “0” (zero) and tosmask set to hex “03.”

Example

The following example displays how to add a match condition based on the

DSCP field.

console(config-classmap)# match ip dscp 3

match ip precedence

Use the match ip precedence command in Class-Map Configuration mode to

add to the specified class definition a match condition based on the value of

the IP precedence field.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match ip precedence precedence

• precedence — Specifies the precedence field in a packet. This field is the

high-order three bits of the Service Type octet in the IP header. (Integer

Range: 0–7)

Default Configuration

This command has no default configuration.

Command Mode

Class-Map Configuration mode

User Guidelines

The ip dscp, ip precedence, and ip tos match conditions are alternative ways

to specify a match criterion for the same Service Type field in the IP header

but with a slightly different user notation.

Layer 2 Switching Commands 690

To specify a match on all precedence values, use the match ip tos tosbits

tosmask command with tosbits set to “0” (zero) and tosmask set to hex “1F.”

Example

The following example displays adding a match condition based on the value

of the IP precedence field.

console(config-classmap)#match ip precedence 1

match ip tos

Use the match ip tos command in Class-Map Configuration mode to add to

the specified class definition a match condition based on the value of the IP

TOS field in a packet. This field is defined as all eight bits of the Service Type

octet in the IP header.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match ip tos tosbits tosmask

• tosbits — Specifies a two-digit hexadecimal number. (Range: 00–ff)

• tosmask — Specifies the bit positions in the tosbits parameter that are

used for comparison against the IP TOS field in a packet. This value of this

parameter is expressed as a two-digit hexadecimal number. (Range: 00–ff)

Default Configuration

This command has no default configuration.

Command Mode

Class-Map Configuration mode

User Guidelines

The ip dscp, ip precedence, and ip tos match conditions are alternative ways

to specify a match criterion for the same Service Type field in the IP header

but with a slightly different user notation.

Layer 2 Switching Commands 691

This specification is the free form version of the IP DSCP/Precedence/TOS

match specification in that you have complete control of specifying which

bits of the IP Service Type field are checked.

Example

The following example displays adding a match condition based on the value

of the IP TOS field in a packet.

console(config-classmap)#match ip tos AA EF

match protocol

Use the match protocol command in Class-Map Configuration mode to add

to the specified class definition a match condition based on the value of the

IP Protocol field in a packet using a single keyword notation or a numeric

value notation.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match protocol {protocol-name | protocol-number}

• protocol-name — Specifies one of the supported protocol name keywords.

The supported values are icmp, igmp, ip, tcp, and udp.

• protocol-number — Specifies the standard value assigned by IANA.

(Range 0–255)

Default Configuration

This command has no default configuration.

Command Mode

Class-Map Configuration mode

User Guidelines

This command has no user guidelines.

Layer 2 Switching Commands 692

Example

The following example displays adding a match condition based on the “ip”

protocol name keyword.

console(config-classmap)#match protocol ip

match source-address mac

Use the match source-address mac command in Class-Map Configuration

mode to add to the specified class definition a match condition based on the

source MAC address of the packet.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match source-address mac address macmask

• macaddr — Specifies any valid layer 2 MAC address formatted as six two-

digit hexadecimal numbers separated by colons.

• macmask — Specifies a layer 2 MAC address bit mask formatted as six

two-digit hexadecimal numbers separated by colons. This bit mask does

not need to be contiguous.

Default Configuration

This command has no default configuration.

Command Mode

Class-Map Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example adds to the specified class definition a match

condition based on the source MAC address of the packet.

console(config-classmap)# match source-address mac 10:10:10:10:10:10

11:11:11:11:11:11

Layer 2 Switching Commands 693

match srcip

Use the match srcip command in Class-Map Configuration mode to add to

the specified class definition a match condition based on the source IP

address of a packet.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match srcip ipaddr ipmask

• ipaddr — Specifies a valid IP address.

• ipmask — Specifies a valid IP address bit mask. Note that although this IP

address bit mask is similar to a subnet mask, it does not need to be

contiguous.

Default Configuration

This command has no default configuration.

Command Mode

Class-Map Configuration mode

User Guidelines

Only one srcip matching criteria can be specified. To remove the matching

criteria, delete the class map.

Example

The following example displays adding a match condition for the specified IP

address and address bit mask.

console(config-classmap)#match srcip 10.240.1.1 10.240.0.0

match srcip6

The match srcip6 command adds to the specified class definition a match

condition based on the source IPv6 address of a packet.

NOTE: This command is not available on the N1500 Series switches.

Layer 2 Switching Commands 694

Syntax

match srcip6 source-ipv6-prefix/prefix-length

• source-ipv6-prefix — IPv6 prefix in IPv6 global address format.

• prefix-length — IPv6 prefix length value.

Default Configuration

There is no default configuration for this command.

Command Mode

Ipv6-Class-Map Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-classmap)#match srcip6 2001:DB8::0/32

match srcl4port

Use the match srcl4port command in Class-Map Configuration mode to add

to the specified class definition a match condition based on the source layer 4

port of a packet using a single keyword or a numeric notation.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match srcl4port {portkey | port-number}

• portkey — Specifies one of the supported port name keywords. A match

condition is specified by one layer 4 port number. The currently supported

values are: domain, echo, ftp, ftpdata, http, smtp, snmp, telnet, tftp, and

www.

• port-number — Specifies a layer 4 port number (Range: 0–65535).

Default Configuration

This command has no default configuration.

Layer 2 Switching Commands 695

Command Mode

Class-Map Configuration mode

User Guidelines

Only one srcl4port matching criteria can be specified. To remove the

matching criteria, delete the class map.

Example

The following example displays how to add a match condition using the

“snmp” port name keyword.

console(config-classmap)#match srcl4port snmp

match vlan

Use the match vlan command in Class-Map Configuration mode to add to

the specified class definition a match condition based on the value of the

layer 2 VLAN Identifier field. This field is the only tag in a single tagged

packet or the first or outer tag of a double VLAN packet.

NOTE: This command is not available on the N1500 Series switches.

Syntax

match vlan vlan-id

• vlan-id — Specifies a VLAN ID as an integer. (Range: 1–4093)

Default Configuration

This command has no default configuration.

Command Mode

Class-Map Configuration mode

User Guidelines

Only a single VLAN can be specified for each class map. To remove the

matching criteria, delete the class map.

Layer 2 Switching Commands 696

Example

The following example displays adding a match condition for the VLAN ID

“2.”

console(config-classmap)#match vlan 2

mirror

Use the mirror command in Policy-Class-Map Configuration mode to mirror

all the data that matches the class defined to the destination port specified.

NOTE: This command is not available on the N1500 Series switches.

Syntax

mirror interface

• interface — Specifies the Ethernet port to which data needs to be copied.

Default Configuration

This command has no default configuration.

Command Mode

Policy-Class-Map Configuration mode

User Guidelines

The port identified in this command is identical to the destination port of the

monitor command.

Example

The following example displays how to copy all the data to port Gi1/0/5.

console(config-policy-classmap)#mirror gi1/0/5

police-simple

Use the police-simple command in Policy-Class-Map Configuration mode to

applying a policing meter for the specified class.

NOTE: This command is not available on the N1500 Series switches.

Layer 2 Switching Commands 697

Syntax

police-simple {

datarate

burstsize

conform-action {drop | set-prec-transmit

cos

| set-dscp-transmit

dscpval

| transmit} [violate-action {drop | set-cos

transmit

cos

| set-prec-transmit

cos

| set-dscp-transmit

dscpval

transmit}]}

• datarate — Data rate in kilobits per second (Kbps). (Range: 1–

4294967295)

• burstsize — Burst size in Kbytes (Range: 1–128)

•conform action — Configures the action taken for packets that do not

exceed the data rate or the burst size:

–drop: Drop the packet.

–sec-prec-transmit ip-prec: Remark the IP precedence in the packet to

ip-prec and transmit. (Range 0-7)

–set-dscp-transmit dscp-val: Remark the DSCP in the packet to dscp-

val and transmit. (Range 0-63)

–set-cos-transmit 802.1p-priority: Remark the 802.1p priority in the

packet to 802.1p-priority and transmit. (Range 0-7)

–transmit: Transmit the packet unmodified.

The same actions are available for packets that violate the policing rule.

–violate- action — Configures the action taken for packets that exceed

the data rate or burst size.

• cos — Class of Service value. (Range: 0–7)

• dscpval — DSCP value. (Range: 0–63 or a keyword from this list: af11,

af12, af13, af21, af22, af23, af31, af32, af33, af41, af42, af43, be, cs0, cs1,

cs2, cs3, cs4, cs5, cs6, cs7, ef)

Default Configuration

This command has no default configuration.

Command Mode

Policy-Class-Map Configuration mode

Layer 2 Switching Commands 698

User Guidelines

The simple form of the police command uses a single data rate and burst size,

resulting in two outcomes: conform and violate. Conforming packets are

colored green and non-conforming packets are colored red for use by the

WRED mechanism. Only one style of police command (simple, single-rate or

two-rate) is allowed for a given class instance in a particular policy. The

conform-color

command can be used to pre-color packets prior to policing.

Packets pre-colored red are not re-colored by the policer.

Example

The following example configures a single rate ingress meter with packets

received at a rate below 1000 Kbps and 4096 byte burst size are transmitted

and packets above that rate are dropped. The transmitted packets are colored

green should the operator desire to configure a WRED drop policy.

console(config-policy-classmap)#police-simple 1000 64 conform-action

transmit violate-action drop

police-single-rate

Use the police-single-rate command to implement a single-rate Three Color

Market (srTCM) per RFC 2697.

NOTE: This command is not available on the N1500 Series switches.

Syntax

police-single-rate datarate burstsize excess-burstsize conform-action action

exceed-action action violate-action action

• datarate—Data rate in kilobits per second (Kbps). (Range 1-4294967295)

• burstsize—Burst size in kilobits per seconds (Kbps). (Range 1-128)

• excess-burstsize—Excess burst size in kilobits per seconds (Kbps). (Range

1-128)

• action—The action to take according to the color. Select one:

–drop: Drop the packet.

–set-prec-transmit ip-prec: Remark the IP precedence in the packet to

ip-prec and transmit. (Range 0-7)

Layer 2 Switching Commands 699

–set-dscp-transmit dscp-val: Remark the DSCP in the packet to dscp-

val and transmit. (Range 0-63)

–set-cos-transmit 802.1p-priority: Remark the 802.1p priority in the

packet to 802.1p-priority and transmit. (Range 0-7)

–transmit: Transmit the packet unmodified.

Default Configuration

There no default configuration for this command.

Command Modes

Policy-Class-Map Configuration mode

User Guidelines

An srTCM meters a traffic stream and colors packets according to three

parameters: Committed Information Rate (CIR), Committed Burst Size

(CBS), and Peak Burst Size (PBS). A packet is colored red if it exceeds the

CBS and the PBS, yellow if it exceeds the CBS, but not the PBS, and green if

it exceeds neither. An srTCM is useful in situations where only the length of

the burst, but not the peak rate, determines the service assignment.

The CIR is measured in Kbps, the CBS in Kbytes, and the PBS in Kbytes. It is

recommended that the CBS and PBS be configured to be larger than the

largest expected IP packet. A class command in policy-map mode must be

issued for an existing class-map before entering this command.

Example

console(config-policy-classmap)#police-single-rate 100000000 32 64 conform-

action set-cos-transmit 7 exceed-action set-prec-transmit 7 violate-action

drop

police-two-rate

Use the police-two-rate command to implement a two-rate Three Color

Market (trTCM) per RFC 2698.

NOTE: This command is not available on the N1500 Series switches.

Layer 2 Switching Commands 700

Syntax

police-two-rate datarate burstsize peak-data-rate excess-burstsize conform-

action action exceed-action action violate-action action

• datarate — Data rate in kilobits per second (Kbps). (Range: 1–

4294967295)

• burstsize — Burst size in Kbytes (Range: 1–128)

•peak-data-rate— Peak data rate in kilobits per second (Kbps). (Range 1-

4294967295)

• excess-burstsize — Excess burst size in kilobits per seconds (Kbps). (Range

1-128)

• action— The action to take according to the color. Select one of:

– drop— Drop the packet.

–set-prec-transmit ip-prec— Remark the IP precedence in the packet to

ip-prec and transmit. (Range 0-7)

–set-dscp-transmit dscp-val— Remark the DSCP in the packet to dscp-

val and transmit. (Range 0-63)

–set-cos-transmit 802.1p-priority— Remark the 802.1p priority in the

packet to 802.1p-priority and transmit. (Range 0-7)

– transmit— Transmit the packet unmodified.

Default Configuration

This command has no default configuration.

Command Mode

Policy-Class-Map Configuration mode

User Guidelines

A trTCM meters a traffic stream and colors packets according to four

parameters:

Committed Information Rate (CIR)

Committed Burst Size (CBS)

Peak Information Rate (PIR)

Layer 2 Switching Commands 701

Peak Burst Size (PBS)

A packet is colored red if it exceeds the PIR, yellow if it exceeds the CIR, but

not the PIR, and green if it does not exceed either. A trTCM is useful when a

peak rate needs to be enforced separately from a committed rate.

The CIR and PIR are measured in Kbps (not pps as indicated in the RFC),

the CBS in Kbytes, and the PBS in Kbytes. It is recommended that the CBS

and PBS be configured to be larger than the largest expected IP packet. A

class command in policy-map mode must be issued for an existing class-map

before entering this command.

Example

console(config-policy-classmap)#police-two-rate 100000000 64 1000000000 32

conform-action set-cos-transmit 7 exceed-action set-prec-transmit 7 violate-

action drop

policy-map

Use the policy-map command in Global Configuration mode to establish a

new DiffServ policy or to enter policy map configuration mode. To remove

the policy, use the no form of this command.

NOTE: This command is not available on the N1500 Series switches.

Syntax

policy-map policyname [in|out]

no policy-map policyname

• policyname— Specifies the DiffServ policy name as a unique case-

sensitive alphanumeric string of characters. (Range: 1–31 alphanumeric

characters.)

•in—The policy is applied on ingress. Must be specified to create new

DiffServ policies. An existing policy can be selected without specifying

“in” or “out”.

•out—The policy is applied on egress. Either “in” or “out” must be

specified to create a new DiffServ policy. An existing policy may be

selected without the “in” or “out” parameter.

Layer 2 Switching Commands 702

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

The CLI mode is changed to Policy-Class-Map Configuration when this

command is successfully executed.

The policy type dictates which of the individual policy attribute commands

are valid within the policy definition.

Example

The following example shows how to establish a new ingress DiffServ policy

named “DELL.”

console(config)#policy-map DELL in

console(config-policy-classmap)#

random-detect queue-parms

Use the random-detect queue-parms command to configure the WRED

green, yellow, and red TCP and non-TCP packet minimum and maximum

drop thresholds and corresponding drop probabilities on an interface or

globally.

NOTE: On the N1500 Series switches, enable Simple RED since the

hardware is not capable of Weighted Red.

Syntax

random-detect queue-parms queue-id [queue-id] ... min-thresh minthresh-

green minthresh-yellow minthresh-red minthresh-nontcp max-thresh max-

thresh-green max-thresh-yellow max-thresh-red maxthresh-nontcp drop-

prob-scale drop-scale-green drop-scale-yellow drop-scale-red drop-scale-

nontcp [ ecn ]

no random-detect queue-parms queue-id [queue-id] ...

Layer 2 Switching Commands 703

• queue-id—The internal class of service queue (range 0-6). The queue-id is

not the same as the CoS value received in incoming packets. Use the show

classofservice dot1p-mapping command to display the CoS value to

internal CoS queue mapping.

• min-thresh—The minimum threshold at which to begin dropping, based

on the configured maximum drop probability for each color and for non-

TCP packets. Range 0 to 250. At or below the minimum threshold, no

packets are dropped. The range between the minimum and maximum

thresholds is divided equally into eight increasing levels of drop probability.

• max-thresh—The maximum threshold to end dropping at the configured

maximum drop probability for each color and for non-TCP packets. Range

0 to 250. Above the maximum threshold, 100% of matching packets are

dropped.

• drop-prob-scale—The maximum drop probability. Range 0-100. This is the

drop probability for a packet when the maximum threshold is reached.

Above the maximum threshold, 100% of matching packets are dropped.

•ecn—Enables ECN marking for the selected CoS queues. Packets marked

as ECN capable are not dropped when selected for discard by WRED.

Default Configuration

The table below shows the default green, yellow, and red TCP and non-TCP

minimum/maximum drop thresholds and the green, yellow and red TCP and

non-TCP drop probabilities. The thresholds for each color and CoS queue are

configured independently and may overlap. By default, WRED is not enabled

for any CoS queue and ECN is not enabled for any CoS queue.

Queue ID WRED Minimum

Threshold

WRED Maximum

Threshold

WRED Drop

Probability Scale

ECN Enabled

0 40/30/20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 No

1 40/30/20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 No

2 40/30/20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 No

3 40/30/20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 No

4 40/30/20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 No

Layer 2 Switching Commands 704

Command Mode

Global Configuration mode, Interface Configuration mode (physical and

port-channel), Interface Range mode

User Guidelines

Interface configuration overrides the global configuration.

WRED Processing

WRED is intended to provide feedback to protocols (e.g. TCP) that depend

on packet loss to adjust their transmission rate. WRED drop behavior only

occurs when an interface is congested within the ranges specified. If

congestion exceeds the upper limit, queued packets will be dropped at the

rate of traffic ingressing the system, e.g. 100%. If the congestion is less than

the lower limit, no packets will be dropped.

Traffic ingressing the switch can be assigned to one of four drop precedences

based on a set of matching criteria. There are 3 drop precedences for TCP

traffic (green, yellow, and red) and one drop precedence for non-TCP traffic

(all colors). Users may configure the congestion thresholds at which packets

experiencing congestion are dropped randomly for each drop precedence and

may also configure the probability of a packet being dropped.

Packets are dropped at 100% when the egress queue size exceeds the

maximum value and at 0% when the queue size is below the minimum value.

Configuring a queue with a drop probability of 0% effectively applies tail-drop

behavior when the queue length exceeds the maximum threshold.

If the max-thresh parameter is less than the corresponding min-thresh

parameter, it is adjusted to be the min-thresh plus one.

For a given network, the minimum and maximum WRED thresholds should

be calculated to give a reasonable amount of buffering to TCP flows given the

switch buffer capacity. WRED thresholds are applied individually to each

5 40/30/20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 No

6 40/30/20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 No

Queue ID WRED Minimum

Threshold

WRED Maximum

Threshold

WRED Drop

Probability Scale

ECN Enabled

Layer 2 Switching Commands 705

physical interface. For the Dell EMC NetworkingN2000/N3000 Series

switches, a threshold of 100% corresponds to a buffer occupancy of 295428

bytes queued for transmission on an interface. For the N4000 Series switch, a

threshold of 100% corresponds to a buffer occupancy of 666757 bytes queued

for transmission on an interface.

Use the classofservice dot1p-mapping command or the classofservice ip-

dscp-mapping command in conjunction with the classofservice trust

command to assign packets to a CoS queue based upon values contained

within the packet.

WRED Drop Probabilities:

Between the minimum and maximum thresholds, the drop probability is

divided into eight discrete levels of increasing probability of packet drop. The

levels are as follows:

0 - 6.25% of maximum drop probability

1 - 18.75% of maximum drop probability

2 - 30.25% of maximum drop probability

3 - 43.75% of maximum drop probability

4 - 56.25% of maximum drop probability

5 - 68.75% of maximum drop probability

6 - 81.25% of maximum drop probability

7 - 92.75% of maximum drop probability

As an example, with a drop probability of 50%, a minimum threshold of 10%

and a maximum threshold of 90%, the drop probability from 10% to 20%

congestion is 3.125%, from 21% to 30% congestion is 9.375%, ...

The drop probability scale supports values in the range 0-10% and the discrete

values 25%, 50%, 75%, and 100%. Other values are silently truncated to the

next lower value by the hardware.

Layer 2 Switching Commands 706

Explicit Congestion Notification (ECN):

ECN capability is an end-to-end feedback mechanism. Both ends of the TCP

connection must participate. When ECN is enabled, packets marked as ECN

capable and selected for discard by WRED are marked CE and are not

dropped. In cases of extreme congestion, ECN capable packets may be

dropped.

Use the show interfaces traffic command to see color aware drops and

congestion levels.

ECN capability can be enabled in Windows Server 2008 and later releases

using the following command:

netsh interface tcp set global ecncapability=enabled

N1500 Series Switches

N1500 Series switches only support a simple RED capability. The N1500

Series switch does not support configuration of the maximum threshold nor

can the threshold or drop probability be configured for non-TCP traffic.

Dell EMC Networking N1500 Series switches implements a simple Random

Early Discard (RED) capability. Only the minimum threshold (min-thresh)

and drop probability (drop-prob-scale) may be configured for the TCP colors

green/yellow/red. The maximum threshold may not be configured nor can the

threshold or drop probability be configured for non-TCP traffic. ECN

capability is supported.

Simple RED may be enabled/disabled for any CoS queue on the Dell EMC

Networking N1500 Series switches, however, the drop probability must be one

of the values given below. The percentage before the dash indicates the actual

drop probability. The number after the dash indicates the value entered in the

drop-prob-scale parameter.

0.097%: 1

0.195%: 2

0.391%: 4

0.781%: 8

1.563%: 16

3.125%: 31

6.250%: 63

Layer 2 Switching Commands 707

100%: 100

Examples

This example configures simple RED on an N1500 series switch. CoS queue 1

is globally configured for simple RED with a congestion threshold of 50% and

a drop probability of 0.781% for green colored traffic.

console(config)# random-detect queue-parms 1 min-thresh 50 0 0 drop-prob-

scale 8 0 0

console(config)#cos-queue random-detect 1

random-detect exponential-weighting-constant

Use the random-detect exponential-weighting-constant command to

configure the decay in the calculation of the average queue size user for

WRED on an interface or all interfaces.

NOTE: This command is not available on the N1500 Series switches.

Syntax

random-detect exponential-weighting-constant 0-15

no random-detect exponential-weighting-constant

• 0–15 — The weighting constant is used to smooth the calculation of the

queue size using the following formula where the 0-15 value is N.

Default Configuration

The default value is 15. This value corresponds to maximum smoothing of

the average queue size.

Command Mode

Global Configuration mode, Interface Configuration mode (physical and

port-channel), Interface Range mode

User Guidelines

The exponential weighting constant configuration is global and applies to all

WRED colors and all CoS queues. To use the instantaneous queue size in the

calculation of WRED drops, set the weighting constant to 0. Larger values of

N reduce the effect of instantaneous changes. To update the current queue

Layer 2 Switching Commands 708

size to ½ the difference between the previous size and the current

instantaneous queue size, set the weighting constant to 1. To update the

current queue size to 1/4 the difference between the previous size and the

current instantaneous queue size, set the weighting constant to 2, ....

The average queue size is calculated for each physical interface

independently.

redirect

Use the redirect command in Policy-Class-Map Configuration mode to

specify that all incoming packets for the associated traffic stream are

redirected to a specific egress interface (physical port or port-channel).

NOTE: This command is not available on the N1500 Series switches.

Syntax

redirect interface

• interface — Specifies any valid interface. Interface is Ethernet port or

port-channel (Range: po1-po32 or gi1/0/1-gi1/0/24)

Default Configuration

This command has no default configuration.

Command Mode

Policy-Class-Map Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example shows how to redirect incoming packets to port

Gi1/0/1.

console(config-policy-classmap)#redirect gi1/0/1

Layer 2 Switching Commands 709

service-policy

Use the service-policy command in either Global Configuration mode (for all

system interfaces) or Interface Configuration mode (for a specific interface)

to attach a policy to an interface. To return to the system default, use the no

form of this command.

NOTE: This command is not available on the N1500 Series switches.

Syntax

service-policy {in|out} policymapname

no service-policy {in|out} policymapname

• policymapname—Specifies the DiffServ policy name as a unique case-

sensitive alphanumeric string. (Range: 1–31 alphanumeric characters.)

•in—Apply the policy on ingress.

•out—Apply the policy on egress.

Default Configuration

No policies are applied by default.

Command Mode

Global Configuration mode (for all system interfaces)

Interface Configuration (Ethernet, Port-channel) mode (for a specific

interface)

User Guidelines

This command applies a DiffServ policy to an interface and enables DiffServ

on the interface. No separate interface administrative mode command for

DiffServ is available. Use the policy-map command to configure the DiffServ

policy. The service-policy direction must match the direction given for the

policy map. DiffServ is enabled globally by default.

Ensure that no attributes within the policy definition exceed the capabilities

of the interface. When a policy is attached to an interface successfully, any

attempt to change the policy definition, such that it would result in a

violation of the interface capabilities, causes the policy change attempt to

fail. ACLs and DiffServ policies may not both exist on the same interface in

Layer 2 Switching Commands 710

the same direction. Applying a policy globally applies the policy to all physical

interfaces. The policy appears in the running-config as part of the individual

interface configuration.

Example

The following example shows how to attach a service policy named “DELL” to

all interfaces for packets ingressing the switch.

console(config)#service-policy in DELL

show class-map

Use the show class-map command to display all configuration information for

the specified class.

NOTE: This command is not available on the N1500 Series switches.

Syntax

show class-map [classname]

• classname — Specifies the valid name of an existing DiffServ class.

(Range: 1–31 characters)

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays all the configuration information for the class

named “Dell”.

console#show class-map

Class L3

Layer 2 Switching Commands 711

Class Name Type Proto Reference Class Name

------------------------------- ----- ----- -----------------------------

ipv4 All ipv4

ipv6 All ipv6

stop_http_class All ipv6

match_icmp6 All ipv6

console#show class-map ipv4

Class Name..................................... ipv4

Class Type..................................... All

Class Layer3 Protocol.......................... ipv4

Match Criteria Values

---------------------------- -------------------------------------

Source IP Address 2.2.2.2 (255.255.255.0)

console#show class-map stop_http_class

Class Name..................................... stop_http_class

Class Type..................................... All

Class Layer3 Protocol.......................... ipv6

Match Criteria Values

---------------------------- -------------------------------------

Source IP Address 2001:DB8::0/32

Source Layer 4 Port 80(http/www)

show classofservice dot1p-mapping

Use the show classofservice dot1p-mapping command to display the current

IEEE 802.1p priority mapping to internal traffic classes for a specific

interface.

Syntax

show classofservice dot1p-mapping [{gigabitethernet unit/slot/port |

port-

channel port-channel-number

| tengigabitethernet unit/slot/port |

fortygigabitethernet unit/slot/port}]

Layer 2 Switching Commands 712

Default Configuration

By default, interfaces are configured to trust the IEEE 802.1p value in

received packets and utilize the dot1p-mapping to assign packets to CoS

queues.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

If the interface is specified, the IEEE 802.1p mapping table of the interface is

displayed. If omitted, the global configuration settings are displayed.

The following table lists the parameters in the example and gives a

description of each.

Example

The following example displays the default 802.1p traffic class mapping and

user priorities.

console#show classofservice dot1p-mapping

User Priority Traffic Class

------------- ---------------

0 1

1 0

2 0

3 1

4 2

5 2

6 3

7 3

Parameter Description

User Priority The 802.1p user priority value.

Traffic Class The traffic class internal queue identifier to which

the user priority value is mapped.

Layer 2 Switching Commands 713

show classofservice ip-dscp-mapping

Use the show classofservice ip-dscp-mapping command to display the

current IP DSCP mapping to internal traffic classes for a specific interface.

Syntax

show classofservice ip-dscp-mapping

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

console#show classofservice ip-dscp-mapping

IP DSCP Traffic Class

------------- -------------

0(be/cs0 1

1 1

2 1

3 1

4 1

5 1

6 1

7 1

8(cs1) 0

9 0

10(af11) 0

11 0

12(af12) 0

13 0

14(af13) 0

15 0

16(cs2) 0

17 0

Layer 2 Switching Commands 714

18(af21) 0

19 0

20(af22) 0

21 0

22(af23) 0

23 0

24(cs3) 1

25 1

26(af31) 1

27 1

28(af32) 1

29 1

30(af33) 1

31 1

32(cs4) 2

33 2

34(af41) 2

35 2

36(af42) 2

37 2

38(af43) 2

39 2

40(cs5) 2

41 2

42 2

43 2

44 2

45 2

46(ef) 2

47 2

48(cs6) 3

49 3

50 3

51 3

52 3

53 3

54 3

55 3

56(cs7) 3

57 3

58 3

59 3

60 3

61 3

62 3

63 3

Layer 2 Switching Commands 715

show classofservice trust

Use the show classofservice trust command to display the current trust mode

setting for a specific interface.

Syntax

show classofservice trust [{gigabitethernet unit/slot/port|

port-channel port-

channel-number

| tengigabitethernet unit/slot/port | fortygigabitethernet

unit/slot/port}]

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

If the interface is specified, the port trust mode of the interface is displayed.

If omitted, the port trust mode for global configuration is shown.

Example

The following example displays the current trust mode settings for the

specified port.

console#show classofservice trust gigabitethernet 1/0/2

Class of Service Trust Mode: Dot1P

show diffserv

Use the show diffserv command to display the DiffServ general information,

which includes the current administrative mode setting as well as the current

and maximum number of DiffServ components.

NOTE: On the N1500 Series switches, enable Simple RED since the

hardware is not capable of Weighted RED.

Layer 2 Switching Commands 716

Syntax

show diffserv

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays the DiffServ information.

console#show diffserv

DiffServ Admin mode.......................... Enable

Class Table Size Current/Max................. 5 / 25

Class Rule Table Size Current/Max............ 6 / 150

Policy Table Size Current/Max................ 2 / 64

Policy Instance Table Size Current/Max....... 2 / 640

Policy Attribute Table Size Current/Max...... 2 / 1920

Service Table Size Current/Max............... 26 / 214

show diffserv service interface

Use this command to display policy service information for the specified

interface.

NOTE: This command is not available on the N1500 Series switches.

Syntax

show diffserv service interface {interface-id} {in|out}

•interface-id—An Ethernet or port-channel identifier.

•in—Show ingress policies.

•out—Show egress policies.

Layer 2 Switching Commands 717

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

This command has no user guidelines.

Example

console#show diffserv service interface gigabitethernet 1/0/1 in

DiffServ Admin Mode........................... Enable

Interface..................................... Gi1/0/1

Direction..................................... In

No policy is attached to this interface in this direction.

show diffserv service brief

Use the show diffserv service brief command to display all interfaces in the

system to which a DiffServ policy has been attached.

NOTE: This command is not available on the N1500 Series switches.

Syntax

show diffserv service brief

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Layer 2 Switching Commands 718

Example

The following example shows how to display all interfaces in the system to

which a DiffServ policy has been attached.

console(config)#show diffserv service brief

DiffServ Admin Mode............................ Enable

Interface Direction OperStatus Policy Name

----------- ----------- ---------- -------------------------------

Po47 In Down DELL

Gi1/0/1 In Down DELL

Po48 In Down DELL

Gi1/0/2 In Down DELL

show interfaces cos-queue

Use the show interfaces cos-queue command to display the class-of-service

queue configuration for the specified interface.

Syntax

show interfaces cos-queue [{gigabitethernet unit/slot/port |

port-channel

port-channel-number

| tengigabitethernet unit/slot/port |

fortygigabitethernet unit/slot/port}]

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

If the interface is specified, the class-of-service queue configuration of the

interface is displayed. If omitted, the most recent global configuration

settings are displayed.

Examples

The following example displays the COS configuration with no unit/slot/port

or port-channel parameter.

Layer 2 Switching Commands 719

console#show interfaces cos-queue

Global Configuration

Interface Shaping Rate......................... 0

Queue Id Min. Bandwidth Scheduler Type Queue Management Type

-------- -------------- -------------- --------------

0 0 Weighted Tail Drop

1 0 Weighted Tail Drop

2 0 Weighted Tail Drop

3 0 Weighted Tail Drop

4 0 Weighted Tail Drop

5 0 Weighted Tail Drop

6 0 Weighted Tail Drop

This example displays the COS configuration for the specified interface

Gi1/0/1.

console#show interfaces cos-queue gigabitethernet 1/0/1

Interface...................................... Gi1/0/1

Interface Shaping Rate......................... 0

Queue Id Min. Bandwidth Scheduler Type Queue Management Type

-------- -------------- -------------- --------------

0 0 Weighted Tail Drop

1 0 Weighted Tail Drop

2 0 Weighted Tail Drop

3 0 Weighted Tail Drop

4 0 Weighted Tail Drop

5 0 Weighted Tail Drop

6 0 Weighted Tail Drop

The following table lists the parameters in the examples and gives a

description of each.

Parameter Description

Interface The port of the interface. If displaying the global

configuration, this output line is replaced with a

global configuration indication.

Intf Shaping Rate The maximum transmission bandwidth limit for

the interface as a whole. It is independent of any

per-queue maximum bandwidth values in effect

for the interface. This value is a configured value.

Layer 2 Switching Commands 720

show interfaces random-detect

Use the show interfaces random-detect command to display the global

WRED policy or for an interface.

Syntax

show interfaces random-detect interface-id

• interface-id—Specify an optional interface type. Valid interfaces include

physical ports and port channels.

Default Configuration

For the N1500, the default drop probability is 8 – 0.781% and the default

minimum thresholds for Red/Yellow/Green colored packets are 40/30/20

percent respectively.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

Queue Mgmt Type The queue depth management technique used for

all queues on this interface.

Queue An interface supports n queues numbered 0 to

(n-1).The specific n value is platform-dependent.

Internal egress queue of the interface; queues 0–6

are available.

Minimum Bandwidth The minimum transmission bandwidth guarantee

for the queue, expressed as a percentage. A value of

0 means bandwidth is not guaranteed and the

queue operates using best-effort scheduling. This

value is a configured value.

Scheduler Type Indicates whether this queue is scheduled for

transmission using a strict priority or a weighted

scheme. This value is a configured value.

Parameter Description

Layer 2 Switching Commands 721

User Guidelines

This command displays the globally configured policy if no interface

parameter is given. If an interface parameter is given, it displays the

configured interface policy. The per CoS queue display for an interface

displays the minimum and maximum thresholds, drop probability, and ECN

capability per TCP packet color in the order: green, yellow, red, and non-TCP.

Absent a metering policy (see police-simple, police-one-rate or police-two-

rate commands), all packets are colored green. Use the

show interfaces cos-

queue

command to show the global or per interface scheduler type and queue

management types.

The N1500 Series switch does not support configuration of the maximum

threshold nor can the threshold or drop probability be configured for non-

TCP traffic.

Example

Example 1

This example shows ECN enabled for green color packets on CoS queues 0

and 1.

console#show interfaces random-detect

Global Configuration

WRED WRED WRED

Queue ID Minimum Threshold Maximum Threshold Drop Probability ECN Enabled

-------- ----------------- ----------------- ----------------- -------------

0 40/ 30/ 20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 1/ 0/ 0/ 0

1 40/ 30/ 20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 1/ 0/ 0/ 0

2 40/ 30/ 20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 0/ 0/ 0/ 0

3 40/ 30/ 20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 0/ 0/ 0/ 0

4 40/ 30/ 20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 0/ 0/ 0/ 0

5 40/ 30/ 20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 0/ 0/ 0/ 0

6 40/ 30/ 20/100 100/ 90/ 80/100 10/ 10/ 10/ 10 0/ 0/ 0/ 0

Example 2

This example show ECN enabled for green color packets on CoS queue 0 and

on an N1500 Series switch:

console#show interfaces random-detect

Global Configuration

SRED SRED Drop

Layer 2 Switching Commands 722

Queue ID Minimum Threshold Probability Scale ECN Enabled

-------- ----------------- ----------------- -------------

0 40/ 30/ 20 8/ 8/ 8 1/ 0/ 0

1 40/ 30/ 20 8/ 8/ 8 1/ 0/ 0

2 40/ 30/ 20 8/ 8/ 8 0/ 0/ 0

3 40/ 30/ 20 8/ 8/ 8 0/ 0/ 0

4 40/ 30/ 20 8/ 8/ 8 0/ 0/ 0

5 40/ 30/ 20 8/ 8/ 8 0/ 0/ 0

6 40/ 30/ 20 8/ 8/ 8 0/ 0/ 0

show policy-map

Use the show policy-map command to display all configuration information

for the specified policy.

NOTE: This command is not available on the N1500 Series switches.

Syntax

show policy-map [policyname]

• policyname — Specifies the name of a valid existing DiffServ policy.

(Range: 1-31)

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays the DiffServ information.

console#show policy-map

Policy Name Policy Type Class Members

----------- ----------- -------------

POLY1 xxx DellClass

DELL xxx DellClass

Layer 2 Switching Commands 723

show policy-map interface

Use the show policy-map interface command to display policy-oriented

statistics information for the specified interface.

NOTE: This command is not available on the N1500 Series switches.

Syntax

show policy-map interface {interface-id} {in|out}

• interface-id—An Ethernet or port-channel identifier.

•in—Show inbound service policies. The offered value indicates the

number of packets received by the classifier.

•out—Show outbound service policies. The discarded value indicates the

number of packets discarded by the policy.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays the statistics information for port te1/0/1.

console#show policy-map interface te1/0/1 in

Interface..................................... Te1/0/1

Operational Status............................ Down

Policy Name................................... DELL

Interface Summary:

Class Name.................................... Dell EMC Networking

In Offered Packets............................ 1003

In Discarded Packets.......................... 11

Layer 2 Switching Commands 724

show service-policy

Use the show service-policy command to display a summary of

policy-oriented statistics information for all interfaces.

Syntax

show service-policy {in | out}

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays a summary of policy-oriented statistics

information.

console#show service-policy in

Oper Policy

Intf Stat Name

------ ----- -------------------------------

Gi1/0/1 Down DELL

Gi1/0/2 Down DELL

Gi1/0/3 Down DELL

Gi1/0/4 Down DELL

Gi1/0/5 Down DELL

Gi1/0/6 Down DELL

Gi1/0/7 Down DELL

Gi1/0/8 Down DELL

Gi1/0/9 Down DELL

Gi1/0/10 Down DELL

Layer 2 Switching Commands 725

traffic-shape

Use the traffic-shape command in Global Configuration mode and Interface

Configuration mode to specify the maximum transmission bandwidth limit

for the interface as a whole. To restore the default interface shaping rate

value, use the no form of this command.

Syntax

traffic-shape bw kbps

no traffic-shape

• bw — Maximum transmission bandwidth value expressed in Kbps.

(Range: 64 - 4294967295)

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode, Interface Configuration (gigabitethernet, port-

channel, tengigabitethernet, fortygigabitethernet) mode

User Guidelines

Traffic shaping, also known as rate shaping, has the effect of smoothing

temporary traffic bursts over time so that the transmitted traffic rate is

bounded. This command implements a true egress shaper where bursts of

traffic are buffered and smoothed. Shaping occurs if the average rate exceeds

the configured limit or a burst exceeds 2% of the configured limit. Effectively,

all CoS queues are configured with the configured rate limit in the scheduler.

Traffic shaping may cause congestion and packet loss if the aggregate ingress

rate for an interface persistently exceeds the egress traffic shape rate.

Example

The following example rate limits interface gi1/0/1 to a maximum bandwidth

of 1024 Kbps.

console(config-if-Gi1/0/1)#traffic-shape 1024 Kbps

Layer 2 Switching Commands 726

vlan priority

Use the vlan priority command to assign a default VLAN priority tag for

untagged frames ingressing an interface.

Syntax

vlan priority cos-value

• cos-value – A value ranging from 0-7.

Default Configuration

By default, untagged frames are processed with VLAN priority 0. The VLAN

priority is mapped to a class of service value which determines the handling of

the frame. Use the show interfaces detail command to display the configured

priority. Use the show classofservice dot1p-mapping command to display the

mapping of VLAN priorities to COS values.

Command Modes

Interface (physical) Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example configures the default VLAN priority to 1 for

untagged frames ingressing interface Te1/0/1.

console(config-if-Te1/0/1)#vlan priority 1

Layer 2 Switching Commands 727

Spanning Tree Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

The Multiple Spanning Tree Protocol (MSTP) component complies with

IEEE 802.1 by efficiently segregating VLAN traffic over separate interfaces for

multiple instances of Spanning Tree. IEEE 802.1D, Spanning Tree and IEEE

w, Rapid Spanning Tree are supported through the IEEE 802.1s

implementation. The difference between the RSTP and STP (IEEE 802.1D)

is the ability to configure and recognize full-duplex connectivity and ports

that are connected to end stations. The difference enables RSTP to rapidly

transition to the Forwarding state and to suppress the Topology Change

Notification PDUs, where possible.

A VLAN ID does not have to be preconfigured before mapping it to an MST

instance.

Management of MSTP is compliant with the requirements of RFC5060.

The following features are supported by Dell EMC Networking MSTP:

STP Loop Guard - The Loop Guard feature is an enhancement of the

Multiple Spanning Tree Protocol. Loop guard protects a network from

forwarding loops induced by BPDU packet loss. It can be configured to

prevent a blocked port from transitioning to the forwarding state when the

port stops receiving BPDUs for some reason (such as a uni-directional link

failure).

STP BPDU Guard - The STP BPDU guard allows the network administrator

to enforce the STP domain borders and keep the active topology consistent

and predictable. The switches behind the edge ports that have STP BPDU

guard enabled are not able to influence the overall STP topology. At the

reception of BPDUs, the BPDU guard operation diagnostically disables a port

that is configured with this option. Use the spanning-tree bpdu-protection

command to enable BPDU guard.

STP Root Guard - The root guard ensures that the port on which root guard

is enabled is the designated port. In a root bridge ports are all designated

ports, unless two or more ports of the root bridge are connected together. If

the bridge receives superior STP BPDUs on a root guard enabled port, root

guard moves this port to a root inconsistent STP state. This root inconsistent

state is effectively equal to a listening state. No traffic is forwarded across this

Layer 2 Switching Commands 728

port. In this way, the root guard enforces the position of the root bridge. In

MSTP scenario the port may be designated in one of the instances while

being alternate in the CIST, and so on. Root guard is a per port (not a per port

per instance command) configuration so all the MSTP instances this port

participates in should not be in root role.

STP BPDU Filtering - STP BPDU filtering applies to all operational edge

ports. An Edge Port is supposed to be connected to hosts that typically do not

generate BPDUs. Ports on which BDPU filtering is enabled will drop both

transmitted and received BPDUs. As a result, loops may be formed on ports

for which BPDU filtering is enabled.

STP BPDU Flooding - STP BPDU flooding feature applies to an STP

disabled switch. To enable BPDU flooding on a port, STP must be disabled

on the switch administratively. When this feature is enabled on the switch, it

floods all the ports which have the BPDU flood feature enabled.

BPDU Storm Protection - If STP BPDUs are received at a rate of 15 pps or

greater for 3 consecutive seconds on a port, the port will be diagnostically

disabled. A message of the following form is logged:

<188> MAY 04 09:45:23 10.10.10.10-1 DOT1S[276072720]: dot1s_ih.c(1587)

15855515 %% Diagnostically disabling interface 2/0/41

Use the no shut command to return the port to service.

Commands in this Section

This section explains the following commands:

clear spanning-tree

detected-protocols

spanning-tree

backbonefast

spanning-tree mode spanning-tree priority

exit (mst) spanning-tree bpdu

flooding

spanning-tree mst

configuration

spanning-tree tcnguard

instance (mst) spanning-tree

bpdu-protection

spanning-tree mst

cost

spanning-tree transmit

hold-count

name (mst) spanning-tree cost spanning-tree mst

port-priority

spanning-tree

uplinkfast

revision (mst) spanning-tree

disable

spanning-tree mst

priority

spanning-tree vlan

Layer 2 Switching Commands 729

clear spanning-tree detected-protocols

Use the clear spanning-tree detected-protocols command to restart the

protocol migration process (force the renegotiation with neighboring

switches) on all interfaces or on the specified interface.

Syntax

clear spanning-tree detected-protocols [ interface-id ]

• interface-id—An Ethernet or port channel interface identifier

Default Configuration

This command has no default setting.

Command Mode

Privileged Exec mode

User Guidelines

This feature is used only when working in RSTP or MSTP mode.

Example

The following example restarts the protocol migration process (forces the

renegotiation with neighboring switches) on Gi1/0/1.

show spanning-tree spanning-tree

forward-time

spanning-tree

portfast

spanning-tree vlan

forward-time

show spanning-tree

summary

spanning-tree guard spanning-tree

portfast bpdufilter

default

spanning-tree vlan

hello-time

show spanning-tree

vlan

spanning-tree

loopguard

spanning-tree

portfast default

spanning-tree vlan

max-age

spanning-tree spanning-tree max-

age

spanning-tree port-

priority (Interface

Configuration)

spanning-tree vlan root

spanning-tree auto-

portfast

spanning-tree max-

hops

–

spanning-tree vlan

priority

Layer 2 Switching Commands 730

console#clear spanning-tree detected-protocols gigabitethernet 1/0/1

exit (mst)

Use the exit command in MST mode to exit the MST configuration mode

and apply all configuration changes.

Syntax

exit

Default Configuration

MST configuration.

Command Mode

MST mode

User Guidelines

This command has no user guidelines.

Example

The following example shows how to exit the MST configuration mode and

save changes.

console(config)#spanning-tree mst configuration

console(config-mst)#exit

instance (mst)

Use the instance command in MST mode to map VLANS to an MST

instance.

Syntax

instance instance-id {add | remove} vlan vlan-list

• instance-ID — ID of the MST instance. (Range: 1-4094)

• vlan-list — VLANs to be added to the existing MST instance. To specify a

range of VLANs, use a hyphen. To specify a series of VLANs, use a comma.

(Range: 1-4094)

Layer 2 Switching Commands 731

Default Configuration

VLANs are mapped to the common and internal spanning tree (CIST)

instance (instance 0).

Command Mode

MST mode

User Guidelines

Before mapping VLANs to an instance use the spanning-tree mst enable

command to enable the instance.

All VLANs that are not explicitly mapped to an MST instance are mapped to

the common and internal spanning tree (CIST) instance (instance 0) and

cannot be unmapped from the CIST.

For two or more switches to be in the same MST region, they must have the

same VLAN mapping, the same configuration revision number, and the same

configuration name.

Dell EMC Networking MSTP supports mapping of VLANs to MST instances,

even though the underlying VLAN may not be defined on the switch. Traffic

received on VLANs not defined on the port received is dropped.

For interoperability purposes, VLAN 4094 may be mapped to an MSTI,

however, VLAN 4094 is reserved internally and may not be used to forward

traffic.

Example

The following example maps the entire range of VLANs to MST instances

(MST instance 0 is mapped to VLAN 1 by default). Additionally, two 10G

ports have some, but not all, of the VLANs mapped to MST instances.

console(config)#spanning-tree mode mst

console(config)#spanning-tree mst 1 priority 8192

console(config)#spanning-tree mst 2 priority 28672

console(config)#spanning-tree mst configuration

console(config-mst)#instance 1 add vlan 2-199

console(config-mst)#instance 1 add vlan 350

console(config-mst)#instance 1 add vlan 400-449

console(config-mst)#instance 1 add vlan 500-1999

console(config-mst)#instance 1 add vlan 2200-2499

console(config-mst)#instance 1 add vlan 2600-2799

Layer 2 Switching Commands 732

console(config-mst)#instance 1 add vlan 3000-4093

console(config-mst)#instance 2 add vlan 200-349

console(config-mst)#instance 2 add vlan 351-399

console(config-mst)#instance 2 add vlan 450-499

console(config-mst)#instance 2 add vlan 2000-2199

console(config-mst)#instance 2 add vlan 2500-2599

console(config-mst)#instance 2 add vlan 2800-2999

console(config-mst)#exit

console(config)#interface te1/1/1

console(config-if-Te1/1/1)#switchport mode trunk

console(config-if-Te1/1/1)#switchport trunk allowed vlan add 2-150

console(config-if-Te1/1/1)#spanning-tree mst 1 port-priority 16

console(config-if-Te1/1/1)#interface te1/1/2

console(config-if-Te1/1/2)#switchport mode trunk

console(config-if-Te1/1/2)#switchport trunk allowed vlan add 200-349

console(config-if-Te1/1/2)#spanning-tree mst 2 port-priority 16

console(config-if-Te1/1/2)#exit

name (mst)

Use the name command in MST mode to define the region name. To return

to the default setting, use the no form of this command.

Syntax

name string

• string — Case sensitive MST configuration name. (Range: 1-32

characters)

Default Configuration

Bridge address.

Command Mode

MST mode

User Guidelines

When configuring the switch in MSTP mode, be sure to configure the MST

region name. For multiple switches to become members of the same region,

the configuration name, the configuration revision and mapping of VLANs to

MSTIs must be identical.

Layer 2 Switching Commands 733

Example

The following example sets the configuration name to “region1”.

console(config)#spanning-tree mst configuration

console(config-mst)#name region1

revision (mst)

Use the revision command in MST mode to identify the configuration

revision number. To return to the default setting, use the no form of this

command.

Syntax

revision

version

no revision

• version — Configuration revision number. (Range: 0-65535)

Default Configuration

Revision number is 0.

Command Mode

MST mode

User Guidelines

When configuring the switch in MSTP mode, be sure to configure the MST

region name. For multiple switches to become members of the same region,

the configuration name, the configuration revision and mapping of VLANs to

MSTIs must be identical.

Example

The following example sets the configuration revision to 1.

console(config)#spanning-tree mst configuration

console(config-mst)#revision 1

Layer 2 Switching Commands 734

show spanning-tree

Use the show spanning-tree command to display the spanning-tree

configuration.

Syntax

show spanning-tree [{gigabitethernet unit/slot/port |

port-channel port-

channel-number

| tengigabitethernet unit/slot/port | fortygigabitethernet

unit/slot/port}] [instance instance-id]

show spanning-tree [detail] [active | blockedports] | [instance instance-id]

show spanning-tree mst-configuration

show spanning-tree {uplinkfast | backbonefast}

•detail—Displays detailed information.

•active—Displays active ports only.

•blockedports—Displays blocked ports only.

•mst-configuration—Displays the MST configuration identifier.

• instance -id —ID of the spanning tree instance.

•uplinkfast—Displays Direct Link Rapid Convergence information.

•backbonefast—Displays Indirect Link Rapid Convergence information.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Examples

The following examples display spanning-tree information. MST information

is shown in this form of the command regardless of the spanning tree mode.

Layer 2 Switching Commands 735

console#show spanning-tree

Spanning Tree: Enabled - BPDU Flooding: Disabled - Portfast BPDU Filtering:

Disabled

Mode: rstp

CST Regional Root: 80:00:00:1E:C9:DE:D4:47

Regional Root Path Cost: 0

ROOT ID

Priority 32768

Address 001E.C9DE.D447

This Switch is the Root.

Hello Time: 2s Max Age: 20s Forward Delay: 15s Transmit Hold

Count: 6s

Bridge Max Hops: 20

Interfaces

Name State Prio.Nbr Cost Sts Role Restricted

--------- -------- --------- --------- ---- ----- ----------

Gi1/0/1 Enabled 128.1 20000 FWD Desg No

Gi1/0/2 Enabled 128.2 20000 FWD Desg No

Gi1/0/3 Enabled 128.3 0 DIS Disb No

Gi1/0/4 Enabled 128.4 0 DIS Disb No

Gi1/0/5 Enabled 128.5 0 DIS Disb No

Gi1/0/6 Enabled 128.6 0 DIS Disb No

console#show spanning-tree gi1/0/1

Port: Gi1/0/1 Enabled

State: Forwarding Role: Designated

Port ID: 128.1 Port Cost: 20000

Port Fast: No Root Protection: No

Designated Bridge Priority: 32768 Address: 001E.C9DE.D447

Designated Port ID: 128.1 Designated Path Cost: 0

CST Regional Root: 80:00:00:1E:C9:DE:D4:47

Root Guard..................................... False

Loop Guard..................................... False

TCN Guard...................................... False

Auto Portfast.................................. True

BPDU Filter Mode............................... Disabled

Time Since Counters Last Cleared............... 0d0h2m46s

BPDUs: Sent: 74, Received: 0

console#show spanning-tree detail

Spanning Tree: Enabled (BPDU Flooding: Disabled)

Mode: rstp Portfast BPDU Filtering: Disabled

CST Regional Root: 80:00:00:1E:C9:DE:D4:47

Regional Root Path Cost: 0

Address 80:00:00:1E:C9:DE:D4:47

Layer 2 Switching Commands 736

This Switch is the Root.

Hello Time: 2s Max Age: 20s Forward Delay: 15s Transmit Hold

Count: 6s

Bridge Max Hops: 20

Number of topology changes: 1 Last Change Occurred: 0d0h3m6s ago

Times: Hold: 6, Hello: 2, Max Age: 20, Forward Delay: 15

Port: Gi1/0/1 Enabled

State: Forwarding Role: Designated

Port ID: 128.1 Port Cost: 20000

Root Protection: No

Designated Bridge Priority: 32768 Address: 001E.C9DE.D447

Designated Port ID: 128.1 Designated Path Cost: 0

CST Regional Root: 80:00:00:1E:C9:DE:D4:47 CST Port Cost: 0

BPDUs: Sent: 83, Received: 0

Port: Gi1/0/2 Enabled

State: Forwarding Role: Designated

Port ID: 128.2 Port Cost: 20000

Root Protection: No

Designated Bridge Priority: 32768 Address: 001E.C9DE.D447

Designated Port ID: 128.2 Designated Path Cost: 0

CST Regional Root: 80:00:00:1E:C9:DE:D4:47 CST Port Cost: 0

BPDUs: Sent: 84, Received: 2

Port: Gi1/0/3 Enabled

State: Disabled Role: Disabled

Port ID: 128.3 Port Cost: 0

Root Protection: No

Designated Bridge Priority: 32768 Address: 001E.C9DE.D447

Designated Port ID: 0.0 Designated Path Cost: 0

CST Regional Root: 80:00:00:1E:C9:DE:D4:47 CST Port Cost: 0

BPDUs: Sent: 0, Received: 0

console#show spanning-tree detail active

Spanning Tree: Enabled (BPDU Flooding: Disabled)

Mode: rstp Portfast BPDU Filtering: Disabled

CST Regional Root: 80:00:00:1E:C9:DE:D4:47

Regional Root Path Cost: 0

ROOT ID

Address 80:00:00:1E:C9:DE:D4:47

This Switch is the Root.

Hello Time: 2s Max Age: 20s Forward Delay: 15s Transmit Hold

Count: 6s

Bridge Max Hops: 20

Number of topology changes: 1 Last Change Occurred: 0d0h4m13s ago

Times: Hold: 6, Hello: 2, Max Age: 20, Forward Delay: 15

Port: Gi1/0/1 Enabled

State: Forwarding Role: Designated

Layer 2 Switching Commands 737

Port ID: 128.1 Port Cost: 20000

Root Protection: No

Designated Bridge Priority: 32768 Address: 001E.C9DE.D447

Designated Port ID: 128.1 Designated Path Cost: 0

CST Regional Root: 80:00:00:1E:C9:DE:D4:47 CST Port Cost: 0

BPDUs: Sent: 112, Received: 0

Port: Gi1/0/2 Enabled

State: Forwarding Role: Designated

Port ID: 128.2 Port Cost: 20000

Root Protection: No

Designated Bridge Priority: 32768 Address: 001E.C9DE.D447

Designated Port ID: 128.2 Designated Path Cost: 0

CST Regional Root: 80:00:00:1E:C9:DE:D4:47 CST Port Cost: 0

BPDUs: Sent: 113, Received: 2

Port: Te1/0/1 Enabled

State: Forwarding Role: Designated

Port ID: 128.49 Port Cost: 2000

Root Protection: No

Designated Bridge Priority: 32768 Address: 001E.C9DE.D447

Designated Port ID: 128.49 Designated Path Cost: 0

CST Regional Root: 80:00:00:1E:C9:DE:D4:47 CST Port Cost: 0

BPDUs: Sent: 113, Received: 1

console#show spanning-tree blockedports

Spanning Tree: Enabled (BPDU Flooding: Disabled) Mode: rstp

CST Regional Root: 80:00:00:1E:C9:DE:D4:47

Regional Root Path Cost: 0

###### MST 0 Vlan Mapped: 1-10

ROOT ID

Priority 32768

Address 001E.C9DE.D447

This Switch is the Root.

Hello Time: 2s Max Age: 20s Forward Delay: 15s

Interfaces

Name State Prio.Nbr Cost Sts Role RestrictedPort

--------- -------- --------- --------- ---- ----- --------------

Te1/0/2 Enabled 128.50 2000 DSC Bkup No

console(config)#show spanning-tree uplinkfast

Directlink rapid convergence is enabled

BPDU update rate : 150 packets/sec

Directlink rapid convergence Statistics

---------------------

Directlink rapid convergence transitions (all VLANs).. 0

Proxy multicast addresses transmitted (all VLANs)..... 0

Layer 2 Switching Commands 738

Name Interface list

--------------- ------------------------------------

VLAN0001 Gi1/0/2(fwd)

VLAN0002

VLAN0003

VLAN0004

VLAN0005

VLAN0006

VLAN0007

VLAN0008

VLAN0009

VLAN0010

console(config)#show spanning-tree backbonefast

Indirectlink rapid convergence is enabled

Indirectlink rapid convergence Statistics

---------------------

Transitions via indirectlink rapid convergenc.. 0

Inferior BPDUs received (all VLANs)............ 7

RLQ request PDUs received (all VLANs).......... 0

RLQ response PDUs received (all VLANs)......... 0

RLQ request PDUs sent (all VLANs).............. 0

RLQ response PDUs sent (all VLANs)............. 0

This example shows spanning-tree configured in mstp mode. Output is

shown for each VLAN that is a member of an MST domain.

console(config-mst)#show spanning-tree active

Spanning Tree: Enabled (BPDU Flooding: Disabled)

Mode: rstp Portfast BPDU Filtering: Disabled

CST Regional Root: 80:00:00:1E:C9:DE:D4:47

Regional Root Path Cost: 0

###### MST 0 Vlan Mapped: 1

ROOT ID

Priority 32768

Address 001E.C9DE.D447

This Switch is the Root.

Hello Time: 2s Max Age: 20s Forward Delay: 15s

Interfaces

Name State Prio.Nbr Cost Sts Role RestrictedPort

Layer 2 Switching Commands 739

--------- -------- --------- --------- ---- ----- --------------

Gi1/0/1 Enabled 128.1 0 FWD Desg No

Gi1/0/2 Enabled 128.2 0 FWD Desg No

Te1/0/1 Enabled 128.49 0 FWD Desg No

Te1/0/2 Enabled 128.50 0 DSC Bkup No

###### MST 1 Vlan Mapped: 2

ROOT ID

Priority 32768

Address 001E.C9DE.D447

This Switch is the Root.

Hello Time: 2s Max Age: 20s Forward Delay: 15s

Interfaces

Name State Prio.Nbr Cost Sts Role RestrictedPort

--------- -------- --------- --------- ---- ----- --------------

Gi1/0/1 Enabled 128.1 20000 FWD Desg No

Gi1/0/2 Enabled 128.2 20000 FWD Desg No

###### MST 2 Vlan Mapped: 3-5

ROOT ID

Priority 4096

Address 001E.C9DE.D447

This Switch is the Root.

Hello Time: 2s Max Age: 20s Forward Delay: 15s

Interfaces

Name State Prio.Nbr Cost Sts Role RestrictedPort

--------- -------- --------- --------- ---- ----- --------------

Gi1/0/1 Enabled 128.1 20000 FWD Desg No

Gi1/0/2 Enabled 128.2 20000 FWD Desg No

###### MST 3 Vlan Mapped: 6-10

ROOT ID

Priority 32768

Address 001E.C9DE.D447

This Switch is the Root.

Hello Time: 2s Max Age: 20s Forward Delay: 15s

Interfaces

Name State Prio.Nbr Cost Sts Role RestrictedPort

--------- -------- --------- --------- ---- ----- --------------

Gi1/0/1 Enabled 128.1 20000 FWD Desg No

Gi1/0/2 Enabled 128.2 20000 FWD Desg No

console(config)#show spanning-tree instance 2

Layer 2 Switching Commands 740

Spanning Tree: Enabled BPDU Flooding: Disabled

Mode: mstp Portfast BPDU Filtering: Disabled

CST Regional Root: 80:00:00:1E:C9:DE:D4:47

Regional Root Path Cost: 0

###### MST 2 Vlan Mapped: 3-5

ROOT ID

Priority 4096

Address 001E.C9DE.D447

Path Cost 0

Root Port

Bridge ID

Priority 4096

Address 001E.C9DE.D447

Hello Time: 2s Max Age: 20s Forward Delay: 15s Transmit Hold

Count: 6s

Name State Prio.Nbr Cost Sts Role RestrictedPort

--------- -------- --------- --------- ---- ----- --------------

Gi1/0/1 Enabled 128.1 0 FWD Desg No

Gi1/0/2 Enabled 128.2 0 FWD Desg No

Gi1/0/3 Enabled 128.3 0 DIS Disb No

Gi1/0/4 Enabled 128.4 0 DIS Disb No

Gi1/0/5 Enabled 128.5 0 DIS Disb No

Gi1/0/6 Enabled 128.6 0 DIS Disb No

Gi1/0/7 Enabled 128.7 0 DIS Disb No

Gi1/0/8 Enabled 128.8 0 DIS Disb No

This example shows spanning-tree configured in rstp mode. Output is shown

for each interface.

console(config)#show spanning-tree active

Spanning Tree: Enabled (BPDU Flooding: Disabled)

Mode: rstp Portfast BPDU Filtering: Disabled

CST Regional Root: 80:00:00:1E:C9:DE:D4:47

Regional Root Path Cost: 0

###### MST 0 Vlan Mapped: 1-10

ROOT ID

Priority 32768

Address 001E.C9DE.D447

This Switch is the Root.

Hello Time: 2s Max Age: 20s Forward Delay: 15s

Interfaces

Name State Prio.Nbr Cost Sts Role RestrictedPort

--------- -------- --------- --------- ---- ----- --------------

Gi1/0/1 Enabled 128.1 20000 FWD Desg No

Layer 2 Switching Commands 741

Gi1/0/2 Enabled 128.2 20000 FWD Desg No

Te1/0/1 Enabled 128.49 2000 FWD Desg No

Te1/0/2 Enabled 128.50 2000 DSC Bkup No

This example shows spanning-tree configured in rapid-pvst mode. Output is

shown for each VLAN that is actively running a spanning tree instance.

console(config)#show spanning-tree active

Spanning-tree enabled protocol rpvst

VLAN 1

RootID Priority 32768

Address F8B1.562B.A1D6

Cost 20000

Port 2(Gi1/0/2)

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

BridgeID Priority 32769 (priority 32768 sys-id-ext 1)

Address 001E.C9DE.D447

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Aging Time 300 sec

Interface State Prio.Nbr Cost Status Role

--------- --------- --------- ------- ------------- -----------

Gi1/0/1 Enabled 128.1 20000 Forwarding Designated

Gi1/0/2 Enabled 128.2 20000 Forwarding Root

Te1/0/1 Enabled 128.49 2000 Forwarding Designated

Te1/0/2 Enabled 128.50 2000 Discarding Backup

VLAN 2

RootID Priority 32770

Address 001E.C9DE.D447

Cost 0

Port This switch is the root

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

BridgeID Priority 32770 (priority 32768 sys-id-ext 2)

Address 001E.C9DE.D447

Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec

Aging Time 300 sec

Interface State Prio.Nbr Cost Status Role

--------- --------- --------- ------- ------------- -----------

Gi1/0/1 Enabled 128.1 20000 Forwarding Designated

Gi1/0/2 Enabled 128.2 20000 Forwarding Designated

Layer 2 Switching Commands 742

show spanning-tree summary

Use the show spanning-tree summary command to display spanning tree

settings and parameters for the switch.

Syntax

show spanning-tree summary

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The following fields are displayed:

Field Description

Spanning Tree Admin

Mode

Enabled or disabled

Spanning Tree Version Version of currently supported (IEEE 802.1s, IEEE

802.1w, or IEEE 802.1d) based upon the mode

parameter.

BPDU Protection Mode Enabled or disabled.

BPDU Filter Mode Enabled or disabled.

BPDU Flooding Mode Enabled or disabled.

IndirectLink Rapid

Convergence

Backbone-fast for RSTP-PV is enabled or disabled.

DirectLink Rapid

Convergence

Enables/Disables DRC by setting switch priority to

49152.

Configuration Name Identifier used to identify the configuration currently

being used.

Layer 2 Switching Commands 743

Example

console#show spanning-tree summary

Spanning Tree Admin Mode.......... Enabled

Spanning Tree Version............. IEEE 802.1w

BPDU Guard Mode................... Disabled

BPDU Flood Mode................... Disabled

IndirectLink Rapid Convergence.... Disabled

DirectLink Rapid Convergence...... Disabled

BPDU Filter Mode.................. Disabled

Configuration Name................ 14-18-77-0C-9D-D8

Configuration Revision Level...... 0

Configuration Digest Key.......... 0xac36177f50283cd4b83821d8ab26de62

Configuration Format Selector..... 0

show spanning-tree vlan

Use the show spanning-tree vlan command to display spanning tree

information per VLAN and also list out the port roles and states as well as

port cost.

Syntax

show spanning-tree vlan { vlan-list | all }

• vlan-list — A list of VLANs or VLAN ranges separated by commas and

with no embedded blank spaces. VLAN ranges are of the form X-Y where X

and Y are valid VLAN identifiers and X < Y.

•

all—Show all VLANs.

Configuration Revision

Level

Identifier used to identify the configuration currently

being used.

Configuration Digest Key A generated Key used in the exchange of the BPDUs.

Configuration Format

Selector

Specifies the version of the configuration format being

used in the exchange of BPDUs. The default value is

zero.

MST Instances List of all multiple spanning tree instances configured

on the switch.

Layer 2 Switching Commands 744

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec and above

User Guidelines

There are no user guidelines for this command.

Example

console(config)#show spanning-tree vlan 2

VLAN 2

Spanning Tree: Enabled Mode: rapid-pvst

RootID Priority 32770

Address 001E.C9DE.D447

Cost 0

Port This switch is the root

Hello Time: 2s Max Age: 20s Forward Delay: 15s

BridgeID Priority 32770 (priority 32768 sys-id-ext 2)

Address 001E.C9DE.D447

Hello Time: 2s Max Age: 20s Forward Delay: 15s

Aging Time 300 sec

Interface Role Sts Cost Prio.Nbr

--------- ---------- ------------- --------- --------

Gi1/0/1 Designated Forwarding 20000 128.1

Gi1/0/2 Designated Forwarding 20000 128.2

spanning-tree

Use the spanning-tree command in Global Configuration mode to enable

spanning-tree functionality. To disable spanning-tree functionality, use the no

form of this command.

Syntax

spanning-tree

no spanning-tree

Default Configuration

Spanning-tree is enabled.

Layer 2 Switching Commands 745

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example enables spanning-tree functionality.

console(config)#spanning-tree

spanning-tree auto-portfast

Use the spanning-tree auto-portfast command to set the port to auto portfast

mode. This enables the port to become a portfast port if it does not see any

BPDUs for 3 seconds after a link up event. Use the no form of this command

to disable auto portfast mode.

Syntax

spanning-tree auto-portfast

no spanning-tree auto-portfast

Default Configuration

Auto portfast mode is enabled by default.

Command Mode

Interface Configuration (Ethernet, Port Channel) mode

User Guidelines

There are no user guidelines for this command.

Example

The following example enables spanning-tree functionality on Gigabit

ethernet interface 4/0/1.

console#config

console(config)#interface gigabitethernet 4/0/1

Layer 2 Switching Commands 746

console(config-if-4/0/1)#spanning-tree auto-portfast

spanning-tree backbonefast

Use the spanning-tree backbonefast command to enable the detection of

indirect link failures and accelerate spanning tree convergence on

STP-PV/RSTP-PV configured switches using Indirect Link Rapid

Convergence (IRC). IRC accelerates finding an alternative path when an

indirect link to the root port goes down. Use the no form of the command to

disable the IRC feature.

Syntax

spanning-tree backbonefast

no spanning-tree backbonefast

Default Configuration

This command has no default configuration.

Command Modes

Global Configuration Mode

User Guidelines

IRC can be configured even if the switch is configured for MST(RSTP) or

RSTP-PV mode. It only has an effect when the switch is configured for

STP-PV mode.

If an IRC-enabled switch receives an inferior BPDU from its designated

switch on a root or blocked port, it sets the maximum aging time on the

interfaces on which it received the inferior BPDU if there are alternative

(blocked) paths to the designated switch. This allows a blocked port to

immediately move to the listening state where the port can be transitioned to

the forwarding state in the normal manner.

Example

console(config)#spanning-tree backbonefast

Layer 2 Switching Commands 747

spanning-tree bpdu flooding

The spanning-tree bpdu flooding command allows flooding of BPDUs

received on non-spanning-tree ports to all other non-spanning-tree ports. Use

the “no” form of the command to disable flooding.

Syntax

spanning-tree bpdu flooding

no spanning-tree bpdu flooding

Default Configuration

This feature is disabled by default.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console#spanning-tree bpdu flooding

spanning-tree bpdu-protection

Use the spanning-tree bpdu-protection command in Global Configuration

mode to enable BPDU guard on a switch. Use the no form of this command

to resume the default status of BPDU guard function.

Syntax

spanning-tree bpdu-protection

no spanning-tree bpdu-protection

Default Configuration

BPDU guard is not enabled.

Layer 2 Switching Commands 748

Command Mode

Global Configuration mode

User Guidelines

The administrator should ensure that interfaces on which BDPU guard is

enabled are configured as edge ports. To configure an interface as an edge

port, use the spanning-tree portfast command.

An edge port is generally connected to a user terminal (such as a desktop

computer) or file server directly and is configured as an edge port to

implement a fast transition to the forwarding state. When the port receives a

BPDU packet, the system sets it to non-edge port and recalculates the

spanning tree topology, which may cause network topology flapping. In

normal cases, edge ports do not receive any BPDU packets. However, an

attacker may forge BPDU packets to maliciously disrupt the switch and cause

network flapping.

Dell spanning-tree provides a BPDU guard function against such attacks. If

an interface enabled for BPDU guard receives a BPDU packet, the interface is

diagnostically disabled and a message is written to the log. The port may be

re-enabled using the no shutdown command after disconnecting the

offending device from the interface.

Example

The following example enables BPDU protection.

console(config)#spanning-tree bpdu-protection

spanning-tree cost

Use the spanning-tree cost command in Interface Configuration mode to

configure the externally advertised spanning-tree path cost for a port. To

return to the default port path cost, use the no form of this command.

The path cost is used in the selection of an interface for the forwarding or

blocking states. Use the no form of the command to automatically select the

path cost based upon the speed of the interface.

Syntax

spanning-tree [vlan vlan-list] cost cost

Layer 2 Switching Commands 749

no spanning-tree cost

• cost — The port path cost.

Default Configuration

The default cost value (0) causes the switch to select the path cost based on

the link speed.

•40G Port path cost — 1400

•10G Port path cost — 2000

•1000 Mbps (giga) — 20,000

•100 Mbps — 200,000

•10 Mbps — 2,000,000

• Port Channel—200,000,000 divided by the sum of the unidirectional link

speed (in Mbps) of each active member multiplied by 10 per section 13.6.1

of IEEE

802.1

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

Dell EMC Networking spanning tree uses long values for spanning tree costs.

The range for path cost for a port is 0-200,000,000. The range for path cost for

a VLAN is 1-200,000,000. Use the no form of the command to calculate the

cost based on the interface speed. A zero path cost causes the switch to

calculate the path cost based upon the speed of the interface.

If the VLAN parameter is given, the path cost is configured only for the

selected VLANs (applies only when pvst or rapid-pvst mode is selected).

Configuration without the VLAN parameter configures the interface path

cost for STP, RSTP, and the MSTP common instance.

If an interface is configured with both the spanning-tree vlan vlan-id cost cost

command and the spanning-tree cost cost command, the spanning-tree vlan

vlan-id cost cost value is used in the spanning tree calculation for RSTP-PV,

STP-PV, and MST.

Layer 2 Switching Commands 750

Example

The following example configures the external path cost to be 8192 for

VLANs 12, 13, 24, 25, and 26.

console(config-if-Gi1/0/1)#spanning-tree vlan 12,13,24-26 cost 8192

spanning-tree disable

Use the spanning-tree disable command in Interface Configuration mode to

disable spanning-tree on a specific port. To enable spanning-tree on a port,

use the no form of this command.

Syntax

spanning-tree disable

no spanning-tree disable

Default Configuration

By default, all ports are enabled for spanning-tree.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

This command has no user guidelines.

Example

The following example disables spanning-tree on Gi1/0/5.

console(config)#interface gigabitethernet 1/0/5

console(config-if-Gi1/0/5)#spanning-tree disable

spanning-tree forward-time

Use the spanning-tree forward-time command in Global Configuration

mode to configure the spanning-tree bridge forward time, which is the

amount of time a port remains in the listening and learning states before

entering the forwarding state.

Layer 2 Switching Commands 751

To reset the default forward time, use the no form of this command.

Syntax

spanning-tree forward-time seconds

no spanning-tree forward-time

• seconds — Time in seconds. (Range: 4–30)

Default Configuration

The default forwarding-time for IEEE Spanning-tree Protocol (STP) is 15

seconds.

Command Mode

Global Configuration mode.

User Guidelines

When configuring the Forward-Time the following relationship should be

satisfied:

2*(Forward-Time - 1) >= Max-Age.

Example

The following example configures spanning-tree bridge forward time to 25

seconds.

console(config)#spanning-tree forward-time 25

spanning-tree guard

The spanning-tree guard command selects whether loop guard or root guard

is enabled on an interface. If neither is enabled, the port operates in

accordance with the multiple spanning tree protocol. Use the “no” form of

this command to disable loop guard or root guard on the interface.

Syntax

spanning-tree guard {root | loop | none}

•root — Enables root guard.

Layer 2 Switching Commands 752

•loop — Enables loop guard

•none — Disables root and loop guard.

Default Configuration

Neither root nor loop guard is enabled.

Command Mode

Interface Configuration (Ethernet, Port Channel) mode.

User Guidelines

There are no user guidelines for this command.

Example

The following example disables spanning-tree guard functionality on Gigabit

ethernet interface 4/0/1.

console#config

console(config)#interface gigabitethernet 4/0/1

console(config-if-4/0/1)#spanning-tree guard none

spanning-tree loopguard

Use the spanning-tree loopguard command to enable loop guard on all ports.

Use the “no” form of this command to disable loop guard on all ports.

Syntax

spanning-tree loopguard default

no spanning-tree loopguard default

Default Configuration

Loop guard is disabled by default.

Command Mode

Global Configuration mode

Layer 2 Switching Commands 753

User Guidelines

There are no user guidelines for this command.

Example

The following example enables spanning-tree loopguard functionality on all

ports.

console(config)#spanning-tree loopguard default

spanning-tree max-age

Use the spanning-tree max-age command in Global Configuration mode to

configure the spanning-tree bridge maximum age. To reset the default

maximum age, use the no form of this command.

Syntax

spanning-tree max-age seconds

no spanning-tree max-age

• seconds -Time in seconds. (Range: 6–40)

Default Configuration

The default max-age for IEEE STP is 20 seconds.

Command Mode

Global Configuration mode

User Guidelines

When configuring the Max-Age the following relationships should be

satisfied:

2*(Forward-Time - 1) >= Max-Age

Max-Age >= 2*(Hello-Time + 1)

Example

The following example configures the spanning-tree bridge maximum-age to

10 seconds.

Layer 2 Switching Commands 754

console(config)#spanning-tree max-age 10

spanning-tree max-hops

Use the spanning-tree max-hops command to set the MSTP Max Hops

parameter to a new value for the common and internal spanning tree. Use the

“no” form of this command to reset the Max Hops to the default.

Syntax

spanning-tree max-hops hops

no spanning-tree max-hops

• hops — The maximum number of hops to use (Range: 6 to 40).

Default Configuration

The maximum number of hops is 20 by default.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console(config)#spanning-tree max-hops 32

spanning-tree mode

Use the spanning-tree mode command in Global Configuration mode to

configure the spanning-tree protocol. To return to the default configuration,

use the no spanning-tree form of this command.

Syntax

spanning-tree mode {stp | rstp | mst | pvst | rapid-pvst}

•stp — Spanning Tree Protocol (STP) is enabled.

•rstp — Rapid Spanning Tree Protocol (RSTP) is enabled.

Layer 2 Switching Commands 755

•mst — Multiple Spanning Tree Protocol (MSTP) is enabled.

•pvst—

Spanning-tree operates in

STP-PV

mode.

•rapid-pvst—

Spanning-tree operates in

RSTP-PV

mode.

Default Configuration

Rapid Spanning Tree Protocol (RSTP) is enabled.

Command Mode

Global Configuration mode

User Guidelines

In RSTP mode, the switch uses STP when the neighbor switch is using STP.

In MSTP mode, the switch uses RSTP when the neighbor switch is using

RSTP and uses STP when the neighbor switch is using STP.

Only one of STP, RSTP, MSTP (RSTP), STP-PV or RSTP-PV can be enabled

on a switch. This command stops all spanning-tree instances in the current

mode and enables spanning-tree per VLAN in the new mode. By default,

RSTP is enabled.

If configuring the switch to MSTP mode, be sure to configure the MST

region name. For multiple switches to become members of the same region,

the configuration name, the configuration revision and mapping of VLANs to

MSTIs must be identical.

In the STP-PV or RSTP-PV modes, BPDUs contain per-VLAN information

instead of the common spanning-tree information (MST/RSTP).

RSTP-PV maintains independent spanning tree information about each

configured VLAN. RSTP-PV uses IEEE 802.1Q trunking and allows a trunked

VLAN to maintain blocked or forwarding state per port on a per VLAN basis.

This allows a trunk port to be forwarding for some VLANs and blocked on

other VLANs.

RSTP-PV extends the IEEE 802.1w standard. It supports faster convergence

than IEEE 802.1D. RSTP-PV is compatible with IEEE 802.1D spanning tree.

RSTP-PV sends BPDUs on all ports instead of only the root bridge sending

BPDUs and supports the discarding, learning, and forwarding states.

Layer 2 Switching Commands 756

When the mode is changed to rapid-pvst, version 0 STP BPDUs are no longer

transmitted and version 2 RSTP-PV BPDUs that carry per-VLAN information

are transmitted on the VLANs enabled for spanning-tree. If a version 0 BPDU

is seen, RSTP-PV reverts to sending version 0 BPDUs.

RSTP-PV embeds support for STP-PV Indirect Link Rapid Convergence and

Direct Link Rapid Convergence. There is no provision to enable or disable

these features in RSTP-PV.

Example

The following example configures the spanning-tree protocol to MSTP.

console(config)#spanning-tree mode mst

spanning-tree mst configuration

Use the spanning-tree mst configuration command in Global Configuration

mode to enable configuring an MST region by entering the multiple

spanning-tree (MST) mode.

Syntax

spanning-tree mst configuration

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

For two or more switches to be in the same MST region, they must have the

same VLAN mapping, the same configuration revision number and the same

name.

Example

The following example configures an MST region.

console (config)#spanning-tree mst configuration

console (config-mst)#instance 1 add vlan 10-20

Layer 2 Switching Commands 757

console (config-mst)#name region1

console (config-mst)#revision 1

spanning-tree mst cost

Use the spanning-tree mst cost command in Interface Configuration mode

to configure the internal path cost for multiple spanning tree (MST)

calculations. If a loop occurs, the spanning tree considers path cost when

selecting an interface to put in the forwarding state. To return to the default

port path cost, use the no form of this command.

Syntax

spanning-tree mst instance-id cost cost

no spanning-tree mst instance-id cost

• instance-ID — ID of the spanning -tree instance. (Range: 1-4094)

• cost — The port path cost. (Range: 0–200,000,000)

Default Configuration

The default cost is 0, which signifies that the cost will be automatically

calculated based on port speed.

The default configuration is:

• Ethernet (10 Mbps) — 2,000,000

• Fast Ethernet (100 Mbps) — 200,000

• Gigabit Ethernet (1000 Mbps) — 20,000

• Port-Channel — 20,000

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

Use the spanning-tree cost command to configure MST instance 0 (the

common spanning tree instance). Use the show spanning-tree active

command to display the spanning tree costs.

Layer 2 Switching Commands 758

Example

The following example configures the MSTP instance 1 path cost for Gigabit

Ethernet interface 1/0/9 to 4.

console(config)#interface gigabitethernet 1/0/9

console(config-if-Gi1/0/9)#spanning-tree mst 1 cost 4

spanning-tree mst port-priority

Use the spanning-tree mst port-priority command in Interface Configuration

mode to configure port priority. To return to the default port priority, use the

no form of this command.

Syntax

spanning-tree mst instance-id port-priority priority

no spanning-tree mst instance-id port-priority

• instance-id—ID of the spanning-tree instance. (Range: 1-4094)

• priority—The port priority. (Range: 0-240 in multiples of 16.)

Default Configuration

The default port-priority for IEEE STP is 128. The default priority for a port-

channel is 96.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

The priority will be set to the nearest multiple of 4096 if not an exact multiple

of 4096.

Example

The following example configures the port priority of Gigabit Ethernet

interface 1/0/5 to 144.

console(config)#interface gigabitethernet 1/0/5

console(config-if)#spanning-tree mst 1 port-priority 144

Layer 2 Switching Commands 759

spanning-tree mst priority

Use the spanning-tree mst priority command in Global Configuration mode

to set the switch priority for the specified spanning-tree instance. To return to

the default setting, use the no form of this command.

Syntax

spanning-tree mst instance-id priority priority

no spanning-tree mst instance-id priority

• instance-id—ID of the spanning-tree instance. (Range: 1-4094)

• priority—Sets the switch priority for the specified spanning-tree instance.

This setting affects the likelihood that the switch is selected as the root

switch. A lower value increases the probability that the switch is selected as

the root switch. (Range: 0-61440)

Default Configuration

The default bridge priority for IEEE STP is 32768.

Command Mode

Global Configuration mode

User Guidelines

The priority value must be a multiple of 4096. The priority will be set to the

nearest multiple of 4096 if not an exact multiple of 4096.

Bridge priority configuration is given preference over the root

primary/secondary configuration. Root primary/secondary configuration is

given preference over the DRC configuration.

The switch with the lowest priority is selected as the root of the spanning tree.

Example

The following example configures the spanning tree priority of instance 1 to

4096.

console(config)#spanning-tree mst 1 priority 4096

Layer 2 Switching Commands 760

spanning-tree portfast

Use the spanning-tree portfast command in Interface Configuration mode to

enable portfast mode. In portfast mode, the interface is immediately put into

the forwarding state upon linkup, without waiting for the timer to expire. To

disable portfast mode, use the no form of this command.

Syntax

spanning-tree portfast

no spanning-tree portfast

Default Configuration

Portfast mode is disabled.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

This command only applies to access ports. The command is to be used only

with interfaces connected to end stations. Otherwise, an accidental topology

loop could cause a data packet loop and disrupt switch and network

operations.

An interface with portfast mode enabled is moved directly to the spanning

tree forwarding state when linkup occurs without waiting the standard

forward-time delay.

Example

The following example enables portfast on Gi1/0/5.

console(config)#interface gigabitethernet 1/0/5

console(config-if-Gi1/0/5)#spanning-tree portfast

Layer 2 Switching Commands 761

spanning-tree portfast bpdufilter default

The spanning-tree portfast bpdufilter default command disables the

transmission and reception of BPDUs on portfast enabled ports. Use the “no”

form of the command to enable the transmission and receipt of BPDUs.

Syntax

spanning-tree portfast bpdufilter default

no spanning-tree portfast bpdufilter default

Default Configuration

This feature is disabled by default.

Command Mode

Global Configuration mode, Interface Configuration mode (physical

interface and port-channels)

User Guidelines

BPDU filtering disables both the sending and receiving of BPDUs on portfast

enabled ports.

A port enabled for BPDU filtering does not receive or send any BPDUs. It is

possible that a network loop may result if BPDU filtering is enabled on a port

connected to anything other than an end system.

BPDU filtering is appropriate for configuration on portfast enabled interfaces

that are connected to end system hosts where it is desired to not send BPDUs

to the host or receive BPDUs from the host. Use the BPDU guard capability if

it is desired to obtain a greater level of protection from rogue hosts or possible

spanning-tree loops.

The administrator must ensure that interfaces enabled for BPDU filtering are

configured as edge ports. Use the spanning-tree portfast command to

configure the interface as an edge port.

Example

The following example discards BPDUs received on spanning-tree ports in

portfast mode.

Layer 2 Switching Commands 762

console(config)#spanning-tree portfast bpdufilter default

spanning-tree portfast default

Use the spanning-tree portfast default command to enable portfast mode on

access ports. Interfaces configured as access mode ports are considered to be

edge ports. Use the no form of this command to disable portfast mode on all

ports.

Syntax

spanning-tree portfast default

no spanning-tree portfast default

Default Configuration

Portfast mode is disabled by default.

Command Mode

Global Configuration mode

User Guidelines

This command only affects access ports.

NOTE: This command should be used with care. An interface with

portfast mode enabled is moved directly to the spanning tree forwarding state

when linkup occurs without waiting for the standard forward-time delay.

Setting a port connected to another switch into portfast mode may cause an

accidental topology loop and disrupt switch and network operations.

Example

The following example enables portfast mode on all access ports.

console(config)#spanning-tree portfast default

Layer 2 Switching Commands 763

spanning-tree port-priority (Interface

Configuration)

Use the spanning-tree port-priority command in Interface Configuration

mode to configure the priority value of an edge-port or point-to-point

interface to allow the operator to select the relative importance of the

interface in the selection process for forwarding. Set this value to a lower

number to prefer an operationally enabled interface for forwarding of frames.

Use the no form of the command to return the priority to the default value.

Syntax

spanning-tree [vlan vlan-id] port-priority priority

no spanning-tree [vlan vlan-id] port-priority

• vlan-id — An optional parameter specifying the VLAN to which the

priority applies when the port is configured as an edge-port. Range 1-4093.

• priority — The priority of the edge-port or point-to-point link in the

forwarding port selection process. Range is 0 to 240 in increments of 16.

Default Configuration

The default port-priority for IEEE STP is 128.

Command Mode

Interface Configuration mode

User Guidelines

If the VLAN parameter is given, the priority is configured only for the

selected VLANs (applies only when pvst or rapid-pvst mode is selected).

Configuration without the VLAN parameter configures the port priority for

RSTP, STP-PV, and RSTP-PV.

If an interface is configured with both the spanning-tree vlan vlan-id port-

priority priority command and the spanning-tree port-priority priority

command, the spanning-tree vlan vlan-id port-priority priority value is used

as the port priority.

If a VLAN parameter is provided, the VLAN must have been previously

configured or an error is thrown.

Layer 2 Switching Commands 764

An edge port is a port with spanning-tree port-fast enabled. A point-to-point

link is a link configured as full-duplex. Edge-ports and point-to-point links

directly transition to the forwarding state and do not delay for the listening

and learning stages of spanning-tree. An edge port that receives a BPDU is no

longer considered an edge-port and will utilize the configured port priority

value.

All interfaces and VLANs have 128 as priority value by default. By default,

spanning-tree puts the lowest numbered operationally enabled interface in

the forwarding state and blocks other interfaces. The priority value is used to

override this default behavior. Interfaces with lower port priorities are

preferred for forwarding over interfaces with numerically higher priority

values. STP-PV/RSTP-PV uses the port priority value when the LAN port is

configured as an edge port and uses the VLAN priority value when the

interface is configured as a point-to-point link. MSTP uses the port priority

regardless of whether the port is an edge port or not.

Example

The following example configures a port connected to a host to be least likely

to be selected for forwarding to the root bridge, even if the host begins to

send BPDUs.

console(config-if-Gi1/0/1)#spanning-tree port-priority 240

console(config-if-Gi1/0/1)#spanning-tree vlan 10 port-priority 240

spanning-tree priority

Use the spanning-tree priority command in Global Configuration mode to

configure the spanning-tree priority. The priority value is used to determine

which bridge is elected as the root bridge. To reset the default spanning-tree

priority use the no form of this command.

Syntax

spanning-tree priority priority

no spanning-tree priority

• priority — Priority of the bridge. (Range: 0–61440)

Default Configuration

The default bridge priority for IEEE STP is 32768.

Layer 2 Switching Commands 765

Command Mode

Global Configuration mode

User Guidelines

The priority value must be a multiple of 4096.

The switch with the lowest priority is the root of the spanning tree.

Bridge priority configuration is given preference over root primary/secondary

configuration. Root primary/secondary configuration is given preference over

DRC configuration.

Example

The following example configures spanning-tree priority to 12288.

console(config)#spanning-tree priority 12288

spanning-tree tcnguard

Use the spanning-tree tcnguard command to prevent a port from propagating

topology change notifications. Use the “no” form of the command to enable

TCN propagation.

Syntax

spanning-tree tcnguard

no spanning-tree tcnguard

Default Configuration

TCN propagation is disabled by default.

Command Mode

Interface Configuration (Ethernet, Port Channel) mode

User Guidelines

There are no user guidelines for this command.

Layer 2 Switching Commands 766

Example

The following example configures spanning-tree tcnguard on 4/0/1.

console(config-if-4/0/1)#spanning-tree tcnguard

spanning-tree transmit hold-count

Use the spanning-tree transmit hold-count command to set the maximum

number of BPDUs that a bridge is allowed to send within a hello time window

(2 seconds). Use the no form of this command to reset the hold count to the

default value.

Syntax

spanning-tree transmit hold-count <value>

no spanning-tree transmit

• value — The maximum number of BPDUs to send (Range: 1–10).

Default Configuration

The default hold count is 6 BPDUs.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

The following example sets the maximum number of BPDUs sent to 6.

console(config)#spanning-tree transmit hold-count 6

spanning-tree uplinkfast

Use the spanning-tree uplinkfast command to configure the rate at which

gratuitous frames are sent (in packets per second) after a switchover to an

alternate port on STP-PV and RSTP-PV configured switches and enable

Layer 2 Switching Commands 767

Direct Link Rapid Convergence on STP-PV switches. This command assists

in accelerating spanning-tree convergence after switchover to an alternate

port.

Use the no form of the command to return the configured rate to the default

value (or disable uplinkfast on STP-PV configured switches).

Syntax

spanning-tree uplinkfast [max-update-rate packets/s ]

no spanning-tree uplinkfast [max-update-rate]

• max-update-rate—The rate at which update packets are sent. (Range: 0-

32000)

Default Configuration

The default rate is 150.

Command Modes

Global Configuration Mode

User Guidelines

DirectLink Rapid Convergence (DRC) can be configured even if the switch is

configured for MST(RSTP) mode. It only has an effect when the switch is

configured for STP-PV or RSTP-PV modes. Enabling DRC sets the switch

priority to 49152. Path costs have an additional 3000 added when DRC is

enabled. This reduces the probability that the switch will become the root

switch.

DRC immediately changes to an alternate root port on detecting a root port

failure and change the new root port directly to the forwarding state. A TCN

is sent for this event.

After a switchover to an alternate port (new root port), DRC multicasts a

gratuitous frame on the new root port on behalf of each attached machine so

that the rest of the network knows to use the secondary link to reach that

machine.

DRC is disabled when the administrator modifies the spanning-tree priority

of a VLAN and is re-enabled only when the default priority is restored.

Layer 2 Switching Commands 768

Configuration of the bridge priority is given preference over configuration of

the root primary or root secondary configuration, which is given preference

over the configuration of DirectLink Rapid Convergence.

RSTP-PV embeds support for IRC and DRC. There is no provision to enable

or disable these features in RSTP-PV configured switches.

DRC is most useful for enterprise wiring-closet topologies with a limited

number of VLANs. Do not enable DRC on backbone or distribution layer

switches as DRC is not capable of completing the reconfiguration of large

networks within the max age time.

Example

console(config)#spanning-tree uplinkfast

spanning-tree vlan

Use the spanning-tree vlan command to enable per VLAN spanning tree on a

VLAN. Use the no form of the command to remove the VLAN as a separate

spanning tree instance.

Syntax

spanning-tree vlan {vlan-list}

no spanning-tree vlan {vlan-list}

• vlan-list–A single VLAN ID or a list of VLAN IDs in comma delineated or

range format with no embedded blanks. Range 1-4093.

Default Configuration

By default, each configured VLAN is automatically associated with a per

VLAN spanning tree instance. If more than eight VLANs are configured, the

excess VLANs do not participate in per VLAN spanning tree.

To change the allocation of spanning-tree instances to VLANs, use the no

spanning-tree vlan command to disassociate a VLAN from a per VLAN

spanning-tree instance and use the spanning-tree vlan command to associate

the spanning-tree instance with the desired VLAN.

Command Modes

Global Configuration mode

Layer 2 Switching Commands 769

User Guidelines

This command can be configured even if the switch is configured for

MST(RSTP) mode. It is only used when the switch is configured for STP-PV

or RSTP-PV modes.

Example

This example configures a switch to use per VLAN spanning tree for VLANS

12, 13 and 24-26

console(config)#spanning-tree vlan 12,13,24-26

spanning-tree vlan forward-time

Use the spanning-tree vlan forward-time command to configure the

spanning tree forward delay time for a specified VLAN or a range of VLANs.

Use the no form of the command to return the forward time to its default

value.

Syntax

spanning-tree vlan vlan-list forward-time 4-30

no spanning-tree vlan vlan-list forward-time

• forward-time — The interval (time spent in listening and learning states)

before transitioning a port to the forwarding state. (Range: 4-30 seconds)

Default Configuration

The default forward delay time is 15.

Command Modes

Global Configuration Mode

User Guidelines

Set this value to a lower number to accelerate the transition to forwarding.

The network operator should take into account the end to end BPDU

propagation delay, the maximum frame lifetime, the maximum transmission

halt delay and the message age overestimate values specific to their network

when configuring this parameter.

Layer 2 Switching Commands 770

Forward delay is only application to STP modes. The forward delay setting is

ignored in MSTP, RSTP and RSTP-PV modes as the designated port is

transitioned to the forwarding state immediately.

Example

console(config)#spanning-tree vlan 3 forward-time 12

spanning-tree vlan hello-time

Use the spanning-tree vlan hello-time command to configure the spanning

tree hello time for a specified VLAN or a range of VLANs.

Syntax

spanning-tree vlan vlan-list hello-time 1-10

no spanning-tree vlan vlan-list hello-time

• Hello-time–The interval between sending successive BDPUs. Default: 2

seconds.

Default Configuration

The default hello time is 2 seconds.

Command Modes

Global Configuration Mode

User Guidelines

This command can be configured even if the switch is configured for

MST(RSTP) mode. It is only used when the switch is configured for STP-PV

or RSTP-PV modes.

Set this value to a lower number to accelerate discovery of topology changes.

Use the no form of the command to return the hello time to its default value.

Example

console(config)#spanning-tree vlan 3 hello-time 1

Layer 2 Switching Commands 771

spanning-tree vlan max-age

Use the spanning-tree vlan max-age command to configure the spanning tree

maximum age time for a set of VLANs. Use the no form of the command to

return the maximum age timer to the default value.

Syntax

spanning-tree vlan vlan-list max-age 6-40

no spanning-tree vlan vlan-list> max-age

• max-age — The maximum age time before a bridge port saves its

configuration information.

Default Configuration

The default maximum aging time is 20 seconds.

Command Modes

Global Configuration Mode

User Guidelines

Set this value to a lower number to accelerate discovery of topology changes.

The network operator must take into account the end to end BPDU

propagation delay and message age overestimate for their specific topology

when configuring this value.

The default setting of 20 seconds is suitable for a network of diameter 7, lost

message value of 3, transit delay of 1, hello interval of 2 seconds, overestimate

per bridge of 1 second, and a BPDU delay of 1 second. For a network of

diameter 4, a setting of 16 seconds is appropriate if all other timers remain at

their default values. IEEE 802.1Q notes that RSTP and MSTP treat the

common spanning tree message age field as a hop count. Section 13.37

Performance discusses appropriate and recommended values and further

refers the network operator to the discussion in IEEE 802.1D section 17.14.

In particular, operators should make themselves of the requirement that

bridges must enforce the following constraint:

2 × (Bridge_Forward_Delay – 1.0 seconds) >= Bridge_Max_Age >= 2 ×

(Bridge_Hello_Time + 1.0 seconds)

Layer 2 Switching Commands 772

Example

console(config)#spanning-tree vlan 3 max-age 18

spanning-tree vlan root

Use the spanning-tree vlan root primary command to configure the switch to

become the root bridge or standby root bridge by modifying the bridge

priority from the default value to a lower value calculated to ensure the bridge

is the root (or standby) bridge. Use the no form of the command to let the

network elect the root bridge.

Syntax

spanning-tree vlan vlan-list root {primary | secondary}

no spanning tree vlan vlan-list root

Default Configuration

The default bridge priority value is 32768.

Command Modes

Global Configuration mode

User Guidelines

This command can be configured even if the switch is configured for MST

(RSTP) mode. It is only used when the switch is configured for STP-PV or

RSTP-PV modes.

The logic sets the bridge priority to a value lower (primary) or next lower

(secondary) than the lowest bridge priority for the specified VLAN or a range

of VLANs. This command only applies when STP-PV or RSTP-PV is enabled.

Configuration of the bridge priority is given preference over configuration of

the root primary or root secondary configuration, which is given preference

over the configuration of DirectLink Rapid Convergence.

Example

console(config)#spanning-tree vlan 3 root primary

Layer 2 Switching Commands 773

spanning-tree vlan priority

Use the spanning-tree vlan priority command to configure the bridge priority

of a VLAN. The bridge priority is combined with the MAC address of the

switch and is used to select the root bridge for the VLAN. Use the no form of

the command to return the priority to the default value.

Syntax

spanning-tree vlan {vlan-list} priority priority

no spanning-tree vlan {vlan-list} priority

• vlan-list–A single VLAN ID or a list of VLAN IDs in comma delineated or

range format with no embedded blanks. Range 1-4093.

• priority –The bridge priority advertised when combined with the switch

MAC address. Range 0-61440.

Default Configuration

The default bridge priority is 32768.

Valid values are 0, 4096, 8192, 12288, 16384, 20480, 24576, 28672, 32768,

36864, 40960, 45056, 49152, 53248, 57344, and 61440. The default value is

32768.

If the value configured is not among the specified values, it will be rounded

off to the nearest valid value.

Command Modes

Global Configuration mode

User Guidelines

This command can be configured even if the switch is configured for

MST(RSTP) mode. It is only used when the switch is configured for STP-PV

or RSTP-PV modes.

The root bridge for a VLAN should be carefully selected to provide optimal

paths for traffic through the network. Generally, this means selecting a switch

that is well-connected with other switches in the network.

Layer 2 Switching Commands 774

Configuration of the bridge priority is given preference over configuration of

the root primary or root secondary configuration, which is given preference

over the configuration of DirectLink Rapid Convergence.

Example

This example configures a switch to be the spanning tree root bridge for

VLANs 12, 13, 24, 25, and 26. This presumes other switches in the network

utilize the default bridge priority configuration.

console(config)#spanning-tree vlan 12,13,24-26 priority 8192

Layer 2 Switching Commands 775

UDLD Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

The UDLD feature detects unidirectional links on physical ports. A

unidirectional link is a forwarding anomaly in a Layer 2 communication

channel in which a bi-directional link stops passing traffic in one direction.

UDLD must be enabled on the both sides of the link in order to detect a

unidirectional link. The UDLD protocol operates by exchanging packets

containing information about neighboring devices.

UDLD enabled devices send announcements to the multicast destination

address 01-00-0c-cc-cc-cc. UDLD packets are transmitted using SNAP

encapsulation, with OUI value 0x00000c (Cisco) and protocol ID 0x0111.

UDLD is supported on individual physical ports that are members of port

channel interface. If any of the aggregated links becomes unidirectional,

UDLD detects it and disables the individual link, but not the entire port

channel. This improves fault tolerance of port-channel.

UDLD PDUs act as network control packets. They are unaffected by

Spanning Tree state. Thus, they are transmitted and received regardless of

Spanning Tree state.

For the successful operation of UDLD, it is required that its neighbors are

UDLD-capable and UDLD is enabled on the corresponding ports. All ports

should also be configured to use the same mode of UDLD, either normal or

aggressive mode.

Detecting Unidirectional Links on a Device Port

A device detects unidirectional links on its port via UDLD. Every UDLD-

capable device distributes service information over the network via a layer 2

broadcast frame. This service frame contains information about sender

(source device) and all discovered neighbors. Every sender expects to receive

an UDLD echo frame. If an echo frame is received, but does not contain

information about the sender itself, it implies that the sender's frames have

not reached the neighbors. This can happen when the link is able to receive

traffic but cannot send traffic. In other words, a UDLD-capable device can

Layer 2 Switching Commands 776

recognize only the sending failures on unidirectional links. If all devices in the

network support UDLD, this functionality is enough to detect all

unidirectional links.

Processing UDLD Traffic from Neighbors

Every UDLD-capable device collects information about all other UDLD-

capable devices. Each device populates UDLD echo packets with collected

neighbor information to help neighbors identify unidirectional links. Every

frame basically contains the device ID of the sender and the collection of

device IDs of its discovered neighbors.

UDLD in Normal-mode

In normal mode, a port’s state is classified as undetermined if an anomaly

exists. These include the absence of its own information in received UDLD

messages or the failure to receive UDLD messages. The state of

undetermined has no effect on the operation of the port. The port is not

disabled and continues operating as it previously did. When in normal mode,

a port is diagnostically disabled for the following cases:

UDLD PDU is received from partner that does not have the port’s

own details (echo).

When there is a loopback, information sent out on a port is received

back as is.

UDLD in Aggressive-mode

Aggressive mode differs from normal UDLD mode – it can diagnostically

disable a port if the port does not receive any UDLD echo packets after a

bidirectional connection was established. It expands the cases when port can

be disabled. There can be several causes for a port not to receive UDLD

echoes. These include:

• A link is up on one side and down on the other. This can occur on fiber

ports if the transmit port is unplugged on one side.

• Loss of connectivity, i.e. the port is neither transmitting nor receiving, but

the port also reports it is up.

Layer 2 Switching Commands 777

UDLD will put the port into the diagnostically disabled state in the following

cases:

When there is a loopback, the device ID and port ID sent out on a

port is received back.

UDLD PDU is received from a partner does not have its own details

(echo).

Bidirectional connection is established and no UDLD packets are

received from the partner device within three times the message

interval.

In aggressive mode, when the partner does not respond to an ECHO

within 7 seconds.

Commands in this Section

This section explains the following commands:

udld enable (Global Configuration)

Use the udld enable command in Global Configuration mode to globally

enable UDLD.

Use the no form of the command to globally disable UDLD.

Syntax

udld enable

no udld enable

Default Configuration

UDLD is disabled by default.

udld enable (Global Configuration) udld enable (Interface Configuration)

udld reset udld port

udld message time show udld

udld timeout interval

–

Layer 2 Switching Commands 778

Command Mode

Global Configuration mode

User Guidelines

This command globally enables UDLD. Interfaces must also be individually

enabled for UDLD.

Example

This command globally enables UDLD.

console(config)#udld enable

udld reset

Use the udld reset command to reset (enable) all interfaces disabled by

UDLD.

Syntax

udld reset

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

The following commands will reset an interface disabled by UDLD:

• Use udld reset to reset all interfaces disabled by UDLD.

• The shutdown command followed by no shutdown interface configuration

command.

• The no udld enable global configuration command followed by the udld

enable command.

• The no udld port interface configuration command followed by the udld

port or udld port aggressive interface configuration command.

Layer 2 Switching Commands 779

Example

This example resets all UDLD disabled interfaces.

console#udld reset

udld message time

Use the udld message time command in Global Configuration mode to

configure the interval between the transmission of UDLD probe messages on

ports that are in the advertisement phase.

Use the no form of the command to return the message transmission interval

to the default value.

Syntax

udld message time message-interval

no udld message time

•

message-interval

—

UDLD message transmit interval in seconds. Range

is 7 to 90 seconds.

Default Configuration

The default message transmit interval is 15 seconds.

Command Mode

Global Configuration mode

User Guidelines

Lower message time values will detect the unidirectional links more quickly

at the cost of higher CPU utilization.

The message interval is also used to age out UDLD entries from the internal

database. UDLD entries are removed after three times the message interval

and the discovery process starts again.

Example

This example sets the UDLD message transmit interval to 10 seconds.

console(config)#udld message time 10

Layer 2 Switching Commands 780

udld timeout interval

Use the udld timeout interval command in Global Configuration mode to

configure the interval for the receipt of ECHO replies.

Use the no form of the command to return the value to the default setting.

Syntax

udld timeout interval timeout-interval

no udld timeout interval

• timeout-interval—UDLD timeout interval. Range is 5 to 60 seconds.

Default Configuration

The default timeout interval is 5 seconds.

Command Mode

Global Configuration mode

User Guidelines

This command sets the time interval used to determine if the link has

bidirectional or unidirectional connectivity. If no ECHO replies are received

within three times the message interval, then the link is considered to have

unidirectional connectivity.

Example

This example sets the UDLD timeout interval to 15 seconds.

console(config)#udld timeout interval 15

udld enable (Interface Configuration)

Use the udld enable command in Interface (physical) Configuration mode to

enable UDLD on a specific interface.

Use the no form of the command to disable UDLD on an interface.

Syntax

udld enable

Layer 2 Switching Commands 781

no udld enable

Default Configuration

UDLD is disabled by default on an interface. UDLD must be enabled

globally and on an interface in order to operate.

Command Mode

Interface (physical) Configuration mode

User Guidelines

UDLD cannot be enabled on a port channel. Instead, enable UDLD on the

physical interfaces of a port channel.

Example

This example enables UDLD on an interface. UDLD must also be enabled

globally.

console(config-if-Te1/0/1)#udld enable

udld port

Use the udld port command in Interface (physical) Configuration mode to

select the UDLD operating mode on a specific interface.

Use the no form of the command to reset the operating mode to the default

(normal).

Syntax

udld port aggressive

no udld port

• aggressive—Sets the port to discover peers in aggressive mode.

Default Configuration

Normal mode is configured by default when UDLD is enabled on an

interface.

Layer 2 Switching Commands 782

Command Mode

Interface (Ethernet) Configuration mode

User Guidelines

In aggressive mode, UDLD will attempt to detect a peer by sending an

ECHO packet every seven seconds until a peer is detected.

Example

This example configure an interface to operate in UDLD aggressive mode.

console(config-if-Te1/0/1)#udld port aggressive

show udld

Use the show udld command in User Exec or Privileged Exec mode to display

the global settings for UDLD.

Syntax

show udld [interface-id|all]

Default Configuration

This command has no default setting.

Command Mode

Privileged Exec or User Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

When no interface is specified, the following fields are shown:

Field Description

Admin Mode The global administrative mode of UDLD.

Message Interval The time period (in seconds) between the transmission of

UDLD probe packets.

Layer 2 Switching Commands 783

When an interface ID is specified, the following fields are shown:

Timeout Interval The time period (in seconds) before making decision that link

is unidirectional.

Field Description

Interface Id The interface identifier in short form, e.g. te1/0/1.

Admin Mode The administrative mode of UDLD configured on this

interface. This is either Enabled or Disabled.

UDLD Mode The UDLD mode configured on this interface. This is either

Normal or Aggressive.

UDLD Status The status of the link as determined by UDLD. The options

are:

•Undetermined – UDLD has not collected enough information

to determine the state of the port.

•Not applicable – UDLD is disabled, either globally or on the

port.

•Shutdown – UDLD has detected a unidirectional link and

shutdown the port. That is, the port is in the D-Disable state.

•Bidirectional - UDLD has detected a bidirectional link.

•Undetermined (Link Down) – The port transitions into this

state when the port link physically goes down due to any

reasons other than the port being put into D-Disable mode by

the UDLD protocol on the switch.

Field Description

Layer 2 Switching Commands 784

VLAN Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Dell EMC Networking 802.1Q VLANs are an implementation of the Virtual

Local Area Network, specification 802.1Q. Operating at Layer 2 of the OSI

model, the VLAN is a means of parsing a single network into logical user

groups or organizations as if they physically resided on a dedicated LAN

segment of their own. In reality, this virtually defined community may have

individual members scattered across a large, extended LAN. The VLAN

identifier is part of the 802.1Q tag, which is added to an Ethernet frame by an

Q-compliant switch or router. Devices recognizing 802.1Q-tagged frames

maintain appropriate tables to track VLANs. The first three bits of the

802.1Q tag are used by 802.1p to establish priority for the packet.

Dell EMC Networking switches supports 802.1Q VLANs. As such, ports may

simultaneously belong to multiple VLANs. VLANs allow a network to be

logically segmented without regard to the physical locations of devices in the

network.

Dell EMC Networking switches supports up to 4093 VLANs for forwarding.

Interfaces can be configured in trunk mode (multiple VLAN support) or

access mode (single VLAN support).

VLANs can be allocated by subnet and netmask pairs, thus allowing

overlapping subnets. For example, subnet 10.10.128.0 with Mask

255.255.128.0 and subnet 10.10.0.0 with Mask 255.255.0.0 can have different

VLAN associations.

Access, trunk and general mode VLAN configurations are maintained

independently by the switch and take affect when the interface is configured

in the relevant mode. In other words, trunk mode VLAN configuration only

affects an interface when it is configured in trunk mode. When the interface

is configured in trunk mode, access and general mode VLAN configuration is

ignored.

Layer 2 Switching Commands 785

Double VLAN Mode

An incoming frame is identified as tagged or untagged based on Tag Protocol

Identifier (TPID) value it contains. The IEEE 802.1Q standard specifies a

TPID value (0x8100) to recognize an incoming frame as tagged or untagged.

Any valid Ethernet frame with a value of 0x8100 in the 12th and 13th bytes is

recognized as a tagged frame.

Dell EMC Networking N-Series switches can be configured to enable the port

in double-VLAN (QinQ) mode. In this mode, the switch looks for 12th, 13th,

16th, and 17th bytes for the tag status in the incoming frame. The outer tag

TPID is identified by the 12th and 13th bytes values. The inner tag TPID is

identified by 16th and 17th bytes values. These two TPID values can be

different or the same. VLAN normalization, source MAC learning, and

forwarding are based on the outer value in a received frame.

NOTE: DVLAN is not available on the N3000 Series switches when utilizing the

AGGREGATION ROUTER image.

Independent VLAN Learning

Independent VLAN Learning (IVL) allows unicast address-to-port mappings

to be created based on a MAC Address in conjunction with a VLAN ID.

This arrangement associates the MAC Address only with the VLAN on which

the frame was received. Therefore, frames are forwarded based on their

unicast destination address as well as their VLAN membership. This

configuration affords multiple occurrences of an address in the forwarding

database. Each address associates with a unique VLAN. Care must be taken

in the administration of networks, as multiple instances of a MAC address,

each on a different VLAN, can quickly eat up address entries.

Each VLAN is associated with its own forwarding database. Hence the

number of forwarding databases equals the number of VLANs supported.

The MAC address stored is supplemented by a 2-byte VLAN ID. The first 2

bytes of a forwarding database entry contain the VLAN ID associated, and the

next 6 bytes contain the MAC address. There is a one-to-one relationship

between VLAN ID and FID (forwarding database ID).

Layer 2 Switching Commands 786

Protocol Based VLANs

The main purpose of Protocol-based VLANs (PBVLANs) is to selectively

process packets based on their upper-layer protocol by setting up protocol-

based filters. Packets are bridged through user-specified ports based on their

protocol.

In PBVLANs, the VLAN classification of a packet is based on its protocol (IP,

IPX, NetBIOS, and so on). PBVLANs help optimize network traffic because

protocol-specific broadcast messages are sent only to end stations using that

protocol. End stations do not receive unnecessary traffic, and bandwidth is

used more efficiently. It is a flexible method that provides a logical grouping

of users. An IP subnet or an IPX network, for example, can each be assigned

its own VLAN. Additionally, protocol-based classification allows an

administrator to assign nonrouting protocols, such as NetBIOS or DECnet, to

larger VLANs than routing protocols like IPX or IP. This maximizes the

efficiency gains that are possible with VLANs.

In port-based VLAN classification, the Port VLAN Identifier (PVID) is

associated with the physical ports. The VLAN ID (VID) for an untagged

packet is equal to the PVID of the port. In port-and protocol-based VLAN

classifications, multiple VIDs are associated with each of the physical ports.

Each VID is also associated with a protocol. The ingress rules used to classify

incoming packets include the use of the packet's protocol, in addition to the

PVID, to determine the VLAN to which the packet belongs. This approach

requires one VID on each port for each protocol for which the filter is desired.

IP Subnet Based VLANs

This feature allows an untagged packet to be placed in a configured VLAN

based upon its IP address.

MAC-Based VLANs

This feature allows an untagged packet to be placed in a configured VLAN

based upon its MAC address.

Layer 2 Switching Commands 787

Private VLAN Commands

The Dell EMC Networking Private VLAN feature separates a regular VLAN

domain into two or more subdomains. Each subdomain is defined

(represented) by a primary VLAN and a secondary VLAN. The primary VLAN

ID is the same for all subdomains that belong to a private VLAN. The

secondary VLAN ID differentiates subdomains from each another and

provides Layer 2 isolation between ports of the same private VLAN. There are

the following types of VLANs within a private VLAN:

• Primary VLAN

Forwards the traffic from the promiscuous ports to isolated ports,

community ports and other promiscuous ports in the same private VLAN.

Only one primary VLAN can be configured per private VLAN. All ports

within a private VLAN share the same primary VLAN.

• Isolated VLAN

Is a secondary VLAN. It carries traffic from isolated ports to promiscuous

ports. Only one isolated VLAN can be configured per private VLAN.

• Community VLAN

Is a secondary VLAN. It forwards traffic between ports which belong to the

same community and to the promiscuous ports. There can be multiple

community VLANs per private VLAN.

Three types of port designations exist within a private VLAN:

• Promiscuous port

Belongs to a primary VLAN and can communicate with all interfaces in

the private VLAN, including other promiscuous ports, community ports

and isolated ports. An endpoint connected to a promiscuous port is

allowed to communicate with any endpoint within the private VLAN.

Multiple promiscuous ports can be defined for a single private VLAN

domain.

• Host port

Belongs to a secondary VLAN and depending upon the type of secondary

VLAN can either communicate with other ports in the same community

(if the secondary VLAN is the community VLAN) and with the

Layer 2 Switching Commands 788

promiscuous ports or can communicate only with the promiscuous ports

(if the secondary VLAN is an isolated VLAN).

The Private VLANs can be extended across multiple switches through inter-

switch/stack links that transport primary, community and isolated VLANs

between devices, as shown in Figure 3-1.

Figure 3-1. Private VLANs

Isolated VLAN

An endpoint connected over an isolated VLAN is allowed to communicate

with endpoints connected to promiscuous ports only. Endpoints connected to

adjacent endpoints over an isolated VLAN cannot communicate with each

other.

Community VLAN

An endpoint connected over a community VLAN is allowed to communicate

with the endpoints within the community and can also communicate with

any configured promiscuous port. The endpoints which belong to one

community cannot communicate with endpoints which belong to a different

community or with endpoints connected over isolated VLANs.

Layer 2 Switching Commands 789

Private VLAN Operation in the Switch Environment

The Private VLAN feature operates in a stacked or single switch environment.

The stack links are transparent to the configured VLAN, thus there is no need

for special private VLAN configuration. Any private VLAN port can reside on

any stack member.

In order to enable Private VLAN operation across multiple switches which are

not stacked, the inter-switch links should carry VLANs which belong to a

private VLAN. The trunk ports which connect neighbor switches have to be

assigned to the primary, isolated, and community VLANs of a private VLAN.

In regular VLANs, ports in the same VLAN switch traffic at L2. However for

private VLAN, the promiscuous port is in the primary VLAN whereas the

isolated or community ports are in the secondary VLAN. Similarly, for

broadcasts, in regular VLANs, ports in the same VLAN receive broadcast

traffic. However, for private VLANs, the ports to which the broadcast traffic is

forwarded depend on the type of port on which the traffic was received. If the

received port is a host port; the traffic is forwarded to all promiscuous and

trunk ports. If the received port is community port the broadcast traffic is

forwarded to promiscuous, trunk and community ports in the same VLAN. A

promiscuous port sends traffic to other promiscuous ports, isolated and

community ports.

Commands in this Section

This section explains the following commands:

interface vlan show port protocol switchport general

acceptable-frame-

type tagged-only

switchport trunk

encapsulation dot1q

interface range vlan show switchport

ethertype

switchport general

allowed vlan

vlan

name (VLAN

Configuration)

show vlan switchport general

ingress-filtering

disable

vlan association mac

private-vlan show vlan

association mac

switchport general

pvid

vlan association subnet

Layer 2 Switching Commands 790

interface vlan

Use the interface vlan command in Global Configuration mode to enable L3

on a VLAN and enter VLAN Interface Configuration mode. Use the no form

of the command to disable routing on the VLAN.

Syntax

interface vlan {vlan-id}

no interface vlan { vlan-id }

• vlan-id—The ID of a valid VLAN (Range 1–4093).

Default Configuration

By default, Layer 3 is enabled on VLAN 1 on the N1100-

ON/N1500/N2000/N2100-ON Series switches. However, VLAN routing

interfaces do not route packets until an IP address is assigned to the VLAN

and IP routing is globally enabled. DHCP and Layer 3 are not enabled on

VLAN 1 by default for the N3000, N3100-ON, and N4000 Series switches.

DHCP is enabled on VLAN 1 by default for the N1100-

ON/N1500/N2000/N2100-ON switches. The N1100-ON does not support

routing.

Command Mode

VLAN Configuration or Global Configuration modes

protocol group show vlan

association subnet

switchport mode vlan makestatic

protocol vlan group show vlan private-

vlan

switchport mode

dot1q-tunnel

vlan protocol group

protocol vlan group

all

switchport access

vlan

switchport mode

private-vlan

vlan protocol group add

protocol

show dot1q-tunnel switchport dot1q

ethertype (Global

Configuration)

switchport private-

vlan

vlan protocol group

name

show interfaces

switchport

switchport general

forbidden vlan

switchport trunk vlan protocol group

remove

Layer 2 Switching Commands 791

User Guidelines

Assigning an IP address to a VLAN interface enables Layer 3 on the VLAN

interface. If IP routing is globally enabled and an IP address is assigned, the

router will route packets to and from the VLAN. When an interface is

enabled for routing using the interface vlan command, the port will no longer

be operationally enabled as a protected port on the interface.

Use the no form of the command to remove empty interface vlan entries from

the running config.

Dell EMC N1100-ON switches support configuration of a single IP address in

interface vlan configuration mode. That IP address is used as the L3 address

of the switch. Packets received over the configured VLAN which are addressed

to the L3 address are processed by the switch CPU. This includes

SNMP/HTTP/Telnet/SNMP and any other configured management

protocols. If a subsequent VLAN is configured with an IP address, the prior

VLAN configuration is removed. Dell EMC N1100-ON switches do not

support routing.

Examples

console(config-vlan10)# interface vlan 10

console(config-if-vlan10)#

interface range vlan

Use the interface range vlan command in Global Configuration mode to

enable routing on a range of VLANs and to execute a command on multiple

VLANs at the same time.

Syntax

interface range vlan {vlan-id | all}

• vlan-id — A list of valid VLAN IDs to add. Separate nonconsecutive VLAN

IDs with a comma and no spaces; use a hyphen to designate a range of IDs.

(Range: 1–4093)

•all — All existing static VLANs.

Default Configuration

This command has no default configuration.

Layer 2 Switching Commands 792

Command Mode

Global Configuration mode

User Guidelines

The VLANs in the interface range must by configured and enabled for

routing prior to use in the vlan range command. Commands used in the

interface range context are executed independently on each interface in the

range. If the command returns an error on one of the interfaces, an error

message is displayed and execution continues on other interfaces.

Example

The following example groups VLAN 221 through 228 and VLAN 889 to

execute the commands entered in interface range mode.

dellswitch(config)#vlan 2-5

dellswitch(config-vlan2-5)#exit

dellswitch(config)#interface vlan 2

dellswitch(config-if-vlan2)#interface vlan 3

dellswitch(config-if-vlan3)#interface vlan 4

dellswitch(config-if-vlan4)#interface vlan 5

dellswitch(config-if-vlan5)#interface range vlan 2-5

dellswitch(config-if)#

name (VLAN Configuration)

Use the name command in VLAN Configuration mode to configure the

VLAN name. To return to the default configuration, use the no form of this

command.

NOTE: This command cannot be configured for a range of interfaces (range

context).

Syntax

name vlan–name

no name

• vlan–name—The name of the VLAN. Must be 1–32 characters in length.

Default Configuration

The default VLAN name is default.

Layer 2 Switching Commands 793

Command Mode

VLAN Configuration mode

User Guidelines

The VLAN name may include any alphanumeric characters including a space,

underscore, or dash. Enclose the string in double quotes to include spaces

within the name. The surrounding quotes are not used as part of the name.

The CLI does not filter illegal characters and may truncate entries at the first

illegal character or reject the entry entirely. The name of VLAN 1 cannot be

changed.

Example

The following example configures a VLAN name of office2 for VLAN 2.

console(config)#vlan 2

console(config-vlan2)#name “RDU-NOC Management VLAN”

private-vlan

Use the private-vlan command in VLAN Configuration mode to define a

private VLAN association between the primary and secondary VLANs.

Use the no form of the command to remove the private VLAN association.

Syntax

private-vlan {primary|isolated|community|association [add|remove] vlan-

list}

no private-vlan [association]

•association—Defines an association between the primary VLAN and

secondary VLANs.

•primary—Specify that the selected VLAN is the primary VLAN.

•community—Specify that the selected VLAN is the community VLAN.

•isolated—Specify that the selected VLAN is the isolated VLAN.

•add—Associates a secondary VLAN with the primary VLAN.

•remove—Deletes the secondary VLAN association with the primary

VLAN.

Layer 2 Switching Commands 794

• vlan-list—A list of secondary VLAN ids to be mapped to a primary VLAN.

The VLAN list can contain multiple entries separated by commas and

containing no spaces. Each entry can be a single VLAN id or a hyphenated

range of VLANs.

Default Configuration

This command has no default setting.

Command Mode

VLAN Configuration mode

User Guidelines

A community VLAN carries traffic among community ports and from

community ports to the promiscuous ports on the corresponding primary

VLAN.

An isolated VLAN is used by isolated ports to communicate with

promiscuous ports. It does not carry traffic to other community ports or other

isolated ports with the same primary VLAN.

The primary VLAN is the VLAN that carries traffic from a promiscuous port

to the private ports.

VLAN 1 cannot be configured in a private VLAN configuration.

Examples

console# configure terminal

console(config)# vlan 10

console(config-vlan)# private-vlan primary

console(config-vlan)# exit

console(config)# vlan 1001

console(config-vlan)# private-vlan isolated

console(config-vlan)# exit

console(config)# vlan 1002

console(config-vlan)# private-vlan community

console(config-vlan)# exit

console(config)# vlan 1003

console(config-vlan)# private-vlan community

console(config-vlan)# exit

console(config)# vlan 20

console(config-vlan)# private-vlan association 1001-1003

console(config-vlan)# end

Layer 2 Switching Commands 795

protocol group

Use the protocol group command in VLAN Configuration mode to attach a

VLAN ID to the protocol-based group identified by groupid. A group may

only be associated with one VLAN at a time. However, the VLAN association

can be changed. The referenced VLAN should be created prior to the creation

of the protocol-based group except when GVRP is expected to create the

VLAN.

To detach the VLAN from this protocol-based group identified by this

groupid, use the no form of this command.

Syntax

protocol group group-id vlan-id

no protocol group group-id vlan-id

• group-id — The protocol-based VLAN group ID, which is automatically

generated when you create a protocol-based VLAN group with the vlan

protocol group command. To see the group ID associated with the name

of a protocol group, use the show port protocol all command.

• vlan-id — A valid VLAN ID.

Default Configuration

This command has no default configuration.

Command Mode

VLAN Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example displays how to attach the VLAN ID “100” to the

protocol-based VLAN group “3.”

console(config-vlan)#protocol group 3 100

Layer 2 Switching Commands 796

protocol vlan group

Use the protocol vlan group command in Interface Configuration mode to

add the physical unit/slot/port interface to the protocol-based group

identified by groupid. A group may have more than one interface associated

with it. Each interface and protocol combination can be associated with one

group only. If adding an interface to a group causes any conflicts with

protocols currently associated with the group, this command fails and the

interface(s) are not added to the group. Ensure that the referenced VLAN is

created prior to the creation of the protocol-based group except when GVRP

is expected to create the VLAN.

To remove the interface from this protocol-based VLAN group that is

identified by this groupid, use the no form of this command.

If you select all, all ports are removed from this protocol group.

Syntax

protocol vlan group group-id

no protocol vlan group group-id

• group-id — The protocol-based VLAN group ID, which is automatically

generated when you create a protocol-based VLAN group with the vlan

protocol group command. To see the group ID associated with the name

of a protocol group, use the show port protocol all command.

Default Configuration

This command has no default configuration.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

This command has no user guidelines.

Example

The following example displays how to add an Ethernet interface to the group

ID of “2.”

Layer 2 Switching Commands 797

console(config-if-Gi1/0/1)#protocol vlan group 2

protocol vlan group all

Use the protocol vlan group all command in Global Configuration mode to

add all physical interfaces to the protocol-based group identified by groupid.

A group may have more than one interface associated with it. Each interface

and protocol combination can be associated with one group only. If adding an

interface to a group causes any conflicts with protocols currently associated

with the group, this command fails and the interface(s) are not added to the

group. Ensure that the referenced VLAN is created prior to the creation of the

protocol-based group except when GVRP is expected to create the VLAN.

To remove all interfaces from this protocol-based group that is identified by

this groupid, use the no form of the command

Syntax

protocol vlan group all group-id

no protocol vlan group all group-id

• group-id — The protocol-based VLAN group ID, which is automatically

generated when you create a protocol-based VLAN group with the vlan

protocol group command. To see the group ID associated with the name

of a protocol group, use the show port protocol all command.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example displays how to add all physical interfaces to the

protocol-based group identified by group ID “2.”

console(config)#protocol vlan group all 2

Layer 2 Switching Commands 798

show dot1q-tunnel

Use the show dot1q-tunnel command to display the QinQ status for each

interface.

Syntax

show dot1q-tunnel [ interface interface-id ]

Default Configuration

If no interfaces are specified, information is shown for all interfaces.

Command Mode

Privileged Exec mode and all show modes

User Guidelines

Up to three additional TPIDs can be configured. The 802.1Q tag is pre-

defined in the system and cannot be removed.

It is not possible to configure an inner TPID value other than 0x8100.

The primary TPID is shown in the EtherType column. The primary TPID is

placed in the outer tag for traffic egressing the interface. The interface will

process incoming traffic as double tagged if any of the configured TPIDs is

present in the frames outer VLAN tag. Traffic with a TPID other than the

configured TPID is processed normally, i.e. as if it is not double tagged.

Example

console(config)#show dot1q-tunnel interface all

Interface Mode EtherType

--------- ------- --------------

Gi1/0/1 Disable 802.1

Gi1/0/2 Disable 802.1

Gi1/0/3 Disable 802.1

Gi1/0/4 Disable 802.1

Gi1/0/5 Disable 802.1

Gi1/0/6 Disable 802.1

Layer 2 Switching Commands 799

show interfaces switchport

Use the show interfaces switchport command to display the complete

switchport VLAN configuration for all possible switch mode configurations:

access, dot1q-tunnel, general, trunk, and (private VLAN) host or (private

VLAN) promiscuous.

Syntax

show interfaces switchport {{gigabitethernet unit/slot/port |

port-channel

port-channel-number

| tengigabitethernet unit/slot/port|

fortygigabitethernet unit/slot/port}}

Default Configuration

If no interface parameter is given, all interfaces are shown.

Command Mode

Privileged Exec mode, Interface Configuration mode and all Configuration

submodes

User Guidelines

Each of the switchport modes can be configured independently for a port or

port channel. The configurations are retained even when the port is

configured in a different mode.

It is recommended that the private VLAN host ports be configured as

spanning-tree portfast.

Examples

The following example displays switchport configuration individually for

gi1/0/1.

switch-top(config-if-Gi1/0/1)#show interfaces switchport gi1/0/1

Port: Gi1/0/1

VLAN Membership Mode: Trunk Mode

Access Mode VLAN: 1 (default)

General Mode PVID: 1 (default)

General Mode Ingress Filtering: Enabled

General Mode Acceptable Frame Type: Admit All

General Mode Dynamically Added VLANs:

Layer 2 Switching Commands 800

General Mode Untagged VLANs: 1

General Mode Tagged VLANs:

General Mode Forbidden VLANs:

Trunking Mode Native VLAN: 1 (default)

Trunking Mode Native VLAN Tagging: Disabled

Trunking Mode VLANs Enabled: 1-99,101-4093

Private VLAN Host Association: none

Private VLAN Mapping:

Private VLAN Operational Bindings:

Default Priority: 0

Protected: Disabled

Forbidden VLANS:

VLAN Name

---- ---------

73 Out

show port protocol

Use the show port protocol command to display the Protocol-Based VLAN

information for either the entire system or for the indicated group.

Syntax

show port protocol {group-id | all}

• group-id — The protocol-based VLAN group ID, which is automatically

generated when you create a protocol-based VLAN group with the vlan

protocol group command.

•all — Enter all to show all interfaces.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Layer 2 Switching Commands 801

Example

The following example displays the Protocol-Based VLAN information for

either the entire system.

console#show port protocol all

Group

Group Name ID Protocol(s) VLAN Interface(s)

--------------- ----- ---------- ---- ------------

test 1 IP 1 gi1/0/1

show switchport ethertype

Use the show switchport ethertype to display the configured Ethertype for

each interface.

Syntax

show switchport ethertype [ interface interface-id | all ]

• interface-id—A physical interface or port channel.

•all—All interfaces.

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode and all Show modes

User Guidelines

Up to three additional TPIDs can be configured. The 802.1Q TPID is pre-

configured in the system and may not be removed.

It is not possible to configure an inner VLAN TPID value other than 0x8100.

The primary TPID is shown in the EtherType column. The primary TPID is

placed in the outer tag for traffic egressing the interface. The interface will

process traffic as double tagged if any of the configured TPIDs is present in

the frames outer VLAN tag. Traffic with a TPID other than the configured

TPID is processed normally, i.e. as if it is not double tagged.

Layer 2 Switching Commands 802

Example

This example shows the various invocations of the command.

console(config)#show switchport ethertype

Default TPID................................... 802.1

Configured TPIDs............................... vMAN Custom (1010)

console(config)#show switchport ethertype interface gi1/0/1

Interface EtherType Secondary TPIDs

--------- --------- ---------------

Gi1/0/1 802.1

console(config-vlan10)#show switchport ethertype interface all

console(config)#show switchport ethertype interface gi1/0/1

Interface EtherType Secondary TPIDs

--------- --------- ---------------

Gi1/0/1 802.1

Gi1/0/2 802.1 VMAN

Gi1/0/3 802.1

Gi1/0/4 802.1

Gi1/0/5 802.1

show vlan

Use the show vlan command to display detailed information, including

interface information and dynamic VLAN type, for a specific VLAN or

RSPAN VLAN. The ID is a valid VLAN identification number.

Syntax

show vlan [id

vlan-id

name vlan-name

]

• vlan-id—A VLAN identifier

• vlan-name—A valid VLAN name (Range 1-32 characters)

Default Configuration

This command has no default configuration.

Layer 2 Switching Commands 803

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

• VLAN—The VLAN identifier

• Name—The VLAN name

• Ports—The port membership for the VLAN

• Type—The type of VLAN (default, static, dynamic)

Example

This shows all VLANs and RSPAN VLANs.

console#show vlan

VLAN Name Ports Type

----- --------------- ------------- --------------

1 default Po1-128, Default

Gi1/0/1-48

10 Static

RSPAN Vlan

------------------------------------------------------------------

This example shows information for a specific VLAN ID.

console#show vlan id 10

VLAN Name Ports Type

----- --------------- ------------- --------------

10 Te1/0/1 Static

RSPAN Vlan

------------------------------------------------------------------

Enabled

This example shows information for a specific VLAN name.

console#show vlan name myspan

VLAN Name Ports Type

----- --------------- ------------- --------------

Layer 2 Switching Commands 804

10 myspan Te1/0/1 Static

RSPAN Vlan

------------------------------------------------------------------

Enabled

show vlan association mac

Use the show vlan association mac command to display the VLAN associated

with a specific configured MAC address. If no MAC address is specified, the

VLAN associations of all the configured MAC addresses are displayed.

Syntax

show vlan association mac [mac-address]

• mac-address — Specifies the MAC address to be entered in the list.

(Range: Any valid MAC address)

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

• MAC Address—The configured MAC address

• VLAN —The associated VLAN identifier

Example

The following example shows no entry in MAC address to VLAN cross-

reference.

console#show vlan association mac

MAC Address VLAN ID

----------------------- -------

0001.0001.0001.0001 1

Layer 2 Switching Commands 805

show vlan association subnet

Use the show vlan association subnet command to display the VLAN

associated with a specific configured IP-Address and netmask. If no IP

Address and net mask are specified, the VLAN associations of all the

configured IP-subnets are displayed.

Syntax

show vlan association subnet [ip-address ip-mask]

• ip-address — Specifies IP address to be shown

• ip-mask — Specifies IP mask to be shown

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

• IP Address—The configured IP address

• IP Mask—The configured IP subnet mask

• VLAN ID—The associated VLAN identifier

Example

The following example shows the case if no IP Subnet to VLAN association

exists.

console#show vlan association subnet

IP Address IP Mask VLAN ID

---------------- ---------------- -------

The IP Subnet to VLAN association does not exist.

Layer 2 Switching Commands 806

show vlan private-vlan

Use the show vlan private-vlan command to display information about the

configured private VLANs including primary and secondary VLAN IDs, type

(community, isolated, or primary), and the ports which belong to a private

VLAN.

Syntax

show vlan private-vlan [type]

Default Configuration

This command has no default setting.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

Do not configure private VLANs on ports configured with any of these

features:

• Link Aggregation Control Protocol (LACP)

• Multicast VLAN Registration (MVR)

• Voice VLAN

It is recommended that the private VLAN host ports be configured as

spanning-tree portfast.

The command displays the following information.

Parameter Description

Primary Primary VLAN ID.

Secondary Secondary VLAN ID.

Type Secondary VLAN type. Use the type parameter to display only

private VLAN ID and its type.

Ports Ports that are associated with a private VLAN.

Layer 2 Switching Commands 807

switchport access vlan

Use the switchport access vlan command in Interface Configuration mode to

configure the VLAN ID when the interface is in access mode. To reconfigure

the interface to use the default VLAN, use the no form of this command.

Syntax

switchport access vlan vlan-id

no switchport access vlan

• vlan-id — The identifier of the VLAN associated with the access port.

Default Configuration

This command has no default values.

Command Mode

Interface Configuration (Ethernet and port channel) mode

User Guidelines

This command configures the interface access mode VLAN membership. The

no form of the command sets the access mode VLAN membership to VLAN

1. It is possible to configure the access mode VLAN identifier when the port is

in general or trunk mode. Doing so does not change the VLAN membership

of the interface until the interface is configured into access mode.

If the VLAN identified in the command has not been previously created, the

system creates the VLAN, issues a message, and associates the VLAN with the

interface.

Examples

The following example configures interface gi1/0/8 to operate in access mode

with a VLAN membership of 23. Received untagged packets are processed on

VLAN 23. Received packets tagged with VLAN 23 are also accepted. Other

received tagged packets are discarded.

console(config)#interface gigabitethernet 1/0/8

console(config-if-Gi1/0/8)#switchport access vlan 23

The following example sets the PVID for interface Gi1/0/12 to VLAN ID 33.

Since VLAN 33 does not exist, it is automatically created.

Layer 2 Switching Commands 808

console(config)# interface gi1/0/12

console(config-if-Gi1/0/12)# switchport access vlan 33

Access VLAN does not exist. Creating VLAN 33

switchport dot1q ethertype (Global Configuration)

Use the switchport dot1q ethertype command to define additional QinQ

tunneling TPIDs for matching in the outer VLAN tag of received frames. Use

the no form of the command to remove the configured TPIDs.

Syntax

switchport dot1q ethertype { vman | custom 1-65535 }

no switchport dot1q ethertype { vman | custom 1-65535 }

•vman—Define the Ethertype as 0x88A8.

•custom—Define the Ethertype as a 16 bit user defined value (in decimal).

Default Configuration

802.1Q is the default Ethertype for both inner and outer VLAN TPIDs. The

802.1Q TPID cannot be removed from the configuration.

By default QinQ processing of frames is disabled.

Command Mode

Global Configuration

User Guidelines

This command globally defines additional TPIDs for use by the system for

matching of ingress packets in the outer tag. The switch uses the default

primary TPID 0x8100 and any of the additional TPIDs to match packets in

the outer tag on ingress. A TPID must be configured globally before it can be

applied to an interface. Up to three additional TPIDs can be configured for

acceptance in the outer VLAN tag on the SP port. Packets received on the SP

port which do not contain one of the configured TPIDs or which do not

contain the SP VLAN ID in the outermost VLAN tag are processed by the

port as if they are not part of the QinQ tunnel.

Layer 2 Switching Commands 809

Use the no form of the command to remove an additional TPID. Doing so

removes the TPID from all interfaces. If the removed TPID is the primary

TPID for an interface, the interface is configured to use the default primary

TPID 0x8100.

Packets are always transmitted by the system using the primary TPID value in

the outer VLAN tag.

It is not possible to configure an inner VLAN TPID value. The inner VLAN

TPID value is always 802.1Q (0x8100).

Use the switchport dot1q ethertype Interface Configuration mode command

to apply a configured TPID value to an interface.

NOTE: This feature is not available on the N3000 when loaded with the

AGGREGATION ROUTER enabled firmware (e.g., N3000_BGPvA.B.C.D.stk).

Example

This example defines the VMAN (0x88A8) TPID for use on a service provider

(SP) port and configures a service provider port (Te1/0/1) in general mode

after creating the common SP/CE VLAN. The port is configured in general

mode and to only allow tagged packets on ingress using the outer VLAN ID

10. Then, the port is configured to accept the VMAN TPID in the outer

VLAN on ingress and further configured to tag packets with the VMAN TPID

and VLAN ID 10 in the outer VLAN tag on egress.

This example configures an SP port using general mode.

console(config)#switchport dot1q ethertype vman

console(config)#vlan 10

console(config-vlan10)#exit

console(config)#interface te1/0/1

console(config-if-Te1/0/1)#switchport mode general

console(config-if-Te1/0/1)#switchport general allowed vlan add 10 tagged

console(config-if-Te1/0/1)#switchport dot1q ethertype vman primary-tpid

This example configures an SP port using trunk mode.

console(config)#switchport dot1q ethertype vman

console(config)#vlan 10

console(config-vlan10)#exit

console(config)#interface te1/0/1

console(config-if-Te1/0/1)#switchport mode trunk

console(config-if-Te1/0/1)#switchport trunk allowed vlan 10

Layer 2 Switching Commands 810

console(config-if-Te1/0/1)#switchport trunk native vlan 10

console(config-if-Te1/0/1)#switchport dot1q ethertype vman primary-tpid

switchport dot1q ethertype (Interface

Configuration)

Use the switchport dot1q ethertype command to apply previously defined

QinQ tunneling TPIDs to a service provider interface. Use the no form of the

command to remove the configured TPIDs.

Syntax

switchport dot1q ethertype { 802.1Q | vman | custom 0-65535 } [primary-

tpid]

no switchport dot1q ethertype { 802.1Q |vman | custom 0-65535 }

[primary-tpid]

•

802.1

Q—Allow ingress frames with Ethertype 0x8100.

•vman—Define the Ethertype as 0x88A8.

•custom—Define the Ethertype as a 16 bit user defined value (in decimal).

•primary-tpid—Set the outer VLAN tag TPID to be inserted in frames

transmitted on an SP port. Also processes ingress frames with the

configured Ethertype as double tagged.

Default Configuration

802.1Q is the default Ethertype for both inner and outer VLAN TPIDs.

By default QinQ processing of frames is disabled.

Command Mode

Interface Configuration mode (physical and port channel), Interface range

mode (physical and port channel)

User Guidelines

This command applies a previously defined TPID to an interface. The TPID

must be configured using the global configuration mode command before it

can be applied to an interface. Up to 3 additional TPIDs for use in the outer

VLAN tag may be configured.

Layer 2 Switching Commands 811

The outer VLAN tag in tagged packets received on the interface is compared

against the configured list of TPIDs. Frames that do not match any of the

configured TPIDs are forwarded normally, i.e. without QinQ processing.

Frames transmitted on the interface are always transmitted with the primary

TPID inserted in the outer VLAN tag.

Use the no form of the command to remove the TPID from an interface.

Defining a new primary TPID command overwrites the existing primary

TPID for an interface.

The no form of the command with the optional primary TPID specified sets

the primary TPID value to 802.1Q (0x8100).

If the TPID value was not configured as a primary TPID and the no form the

command includes the optional primary-tpid argument, the command will

fail.

If the TPID value was configured as the primary TPID, and the no form of

the command does not include the optional primary-tpid argument, the

command will fail.

If a TPID value is configured as the primary TPID, and it is added again

without the primary-tpid optional argument, the TPID will be treated as the

primary TPID (the primary TPID includes the behavior of secondary TPIDs).

It is not possible to configure an inner VLAN TPID value. The inner VLAN

TPID value is always 802.1Q (0x8100).

Example

This example defines the VMAN (0x88A8) TPID for use on a service provider

port and configures a service provider port (Te1/0/1) in general mode. The

general mode port is configured to only allow tagged packets on ingress using

VLAN ID 10. Then, in the last command, the port is configured to accept the

VMAN TPID in the outer VLAN on ingress and further configured to tag

packets with the VMAN TPID in the outer VLAN tag on egress.

console(config)#switchport dot1q ethertype vman

console(config)#vlan 10

console(config-vlan10)#exit

console(config)#interface te1/0/1

console(config-if-Te1/0/1)#switchport mode general

console(config-if-Te1/0/1)#switchport general allowed vlan add 10 tagged

console(config-if-Te1/0/1)#switchport dot1q ethertype vman primary-tpid

Layer 2 Switching Commands 812

switchport general forbidden vlan

Use the switchport general forbidden vlan command in Interface

Configuration mode to forbid adding specific VLANs to a general mode port.

To revert to allowing the addition of specific VLANs to the port, use the

remove parameter of this command.

Syntax

switchport general forbidden vlan {add vlan-list | remove vlan-list}

•add vlan-list — List of valid VLAN IDs to add to the forbidden list.

Separate nonconsecutive VLAN IDs with a comma and no spaces. Use a

hyphen to designate a range of IDs.

•remove vlan-list — List of valid VLAN IDs to remove from the forbidden

list. Separate nonconsecutive VLAN IDs with a comma and no spaces. Use

a hyphen to designate a range of IDs.

Default Configuration

All VLANs allowed.

Command Mode

Interface Configuration (Ethernet and port channel) mode

User Guidelines

This configuration only applies to ports configured in general mode. It is

possible to configure the general mode VLAN membership of a port while the

port is in access or trunk mode. Doing so does not change the VLAN

membership of the port until it is configured to be in general mode.

Example

The following example forbids adding VLAN numbers 234 through 256 to

port 1/0/8.

console(config)#interface gigabitethernet 1/0/8

console(config-if-Gi1/0/8)#switchport general forbidden vlan add 234-256

Layer 2 Switching Commands 813

switchport general acceptable-frame-type

tagged-only

Use the switchport general acceptable-frame-type tagged-only command in

Interface Configuration mode to discard untagged frames at ingress. To

enable untagged frames at ingress, use the no form of this command.

Syntax

switchport general acceptable-frame-type tagged-only

no switchport general acceptable-frame-type tagged-only

Default Configuration

All frame types are accepted at ingress.

Command Mode

Interface Configuration (Ethernet and port channel) mode

User Guidelines

It is possible to configure the general mode acceptable frame types of a port

while the port is in access or trunk mode. Doing so does not change the

configuration of the port until it is configured to be in general mode.

Example

The following example configures 1/0/8 to discard untagged frames at ingress.

console(config)#interface gigabitethernet 1/0/8

console(config-if-Gi1/0/8)#switchport general acceptable-frame-type tagged-

only

switchport general allowed vlan

Use the switchport general allowed vlan command in Interface

Configuration mode to add VLANs to or remove VLANs from a general port.

Syntax

switchport general allowed vlan add vlan-list [tagged | untagged]

switchport general allowed vlan remove vlan-list

Layer 2 Switching Commands 814

•add vlan-list — List of VLAN IDs to add. Separate nonconsecutive VLAN

IDs with a comma and no spaces. Use a hyphen to designate a range of

IDs.

•remove vlan-list — List of VLAN IDs to remove. Separate nonconsecutive

VLAN IDs with a comma and no spaces. Use a hyphen to designate a range

of IDs.

•tagged — Sets the port to transmit tagged packets for the VLANs. If the

port is added to a VLAN without specifying tagged or untagged, the

default is untagged.

•untagged — Sets the port to transmit untagged packets for the VLANs.

Default Configuration

Untagged.

Command Mode

Interface Configuration (Ethernet and port channel) mode

User Guidelines

Use this command to change the egress rule (for example, from tagged to

untagged) without first removing the VLAN from the list.

It is possible to configure the general mode VLAN membership of a port

while the port is in access or trunk mode. Doing so does not change the

VLAN membership of the port until it is configured to be in general mode.

Example

The following example shows how to add VLANs 1, 2, 5, and 8 to the allowed

list.

console(config)#interface gigabitethernet 1/0/8

console(config-if-Gi1/0/8)#switchport general allowed vlan add 1,2,5,8

tagged

switchport general ingress-filtering disable

Use the switchport general ingress-filtering disable command in Interface

Configuration mode to disable port ingress filtering. To enable ingress

filtering on a port, use the no form of this command.

Layer 2 Switching Commands 815

Syntax

switchport general ingress-filtering disable

no switchport general ingress-filtering disable

Default Configuration

Ingress filtering is enabled.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

Ingress filtering, when enabled, discards received frames that are not tagged

with a VLAN for which the port is a member. If ingress filtering is disabled,

tagged frames from all VLANs are processed by the switch.

Example

The following example shows how to enables port ingress filtering on Gigabit

Ethernet interface 1/0/8.

console(config)#interface gigabitethernet 1/0/8

console(config-if-Gi1/0/8)#switchport general ingress-filtering enable

switchport general pvid

Use the switchport general pvid command in Interface Configuration mode

to configure the Port VLAN ID (PVID) when the interface is in general mode.

Use the switchport mode general command to set the VLAN membership

mode of a port to “general.” To configure the default value, use the no form

of this command.

Syntax

switchport general pvid vlan-id

no switchport general pvid

• vlan-id — PVID. The VLAN ID may belong to a non-existent VLAN.

Layer 2 Switching Commands 816

Default Configuration

The default value for the vlan-id parameter is 1 when the VLAN is enabled.

Otherwise, the value is 4093.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

Setting a new PVID does NOT remove the previously configured PVID VLAN

from the port membership.

Example

The following example shows how to configure the PVID for 1/0/8, when the

interface is in general mode.

console(config)#interface gigabitethernet 1/0/8

console(config-if-Gi1/0/8)#switchport general pvid 234

switchport mode

Use the switchport mode command in Interface Configuration mode to

configure the VLAN membership mode of a port. To reset the mode to the

appropriate default for the switch, use the no form of this command.

Syntax

switchport mode {access | trunk | general}

no switchport mode

•access—An access port connects to a single end station belonging to a

single VLAN. An access port is configured with ingress filtering enabled

and will accept either an untagged frame or a packet tagged with the access

port VLAN. Tagged packets received with a VLAN other than the access

port VLAN are discarded. An access port transmits only untagged packets.

•trunk—A trunk port connects two switches. A trunk port may belong to

multiple VLANs. A trunk port accepts only packets tagged with the VLAN

IDs of the VLANs to which the trunk is a member or untagged packets if

Layer 2 Switching Commands 817

configured with a native VLAN. A trunk port only transmits tagged packets

for member VLANs other than the native VLAN and untagged packets for

the native VLAN.

•general—Full 802.1Q support VLAN interface. A general mode port is a

combination of both trunk and access ports capabilities. It is possible to

fully configure all VLAN features on a general mode port. Both tagged and

untagged packets may be accepted and transmitted.

Default Configuration

The default switchport mode is access.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

User Guidelines

This command has no user guidelines.

Example

The following example configures Gi1/0/5 to access mode.

console(config)#interface gigabitethernet 1/0/5

console(config-if-Gi1/0/5)#switchport mode access

switchport mode dot1q-tunnel

Use the switchport mode dot1q-tunnel command to enable QinQ tunneling

on customer edge (CE) interfaces. Use the no form of the command to return

the interface to the default switchport mode (access).

Syntax

switchport mode dot1q-tunnel

no switchport mode dot1q-tunnel

Default Configuration

By default, QinQ processing of frames is disabled.

Layer 2 Switching Commands 818

Command Mode

Interface mode (physical and port channel), Interface range mode (physical

and port channel)

User Guidelines

This command configures a customer edge (CE) port for QinQ tunneling.

The dot1q-tunnel mode is an overlay on switchport access mode. In

particular, configuring the access mode PVID sets the outer dot1q-tunnel

VLAN ID. Changing the switchport mode to access, general, or trunk,

effectively disables tunneling on the interface.

Customer edge ports can be physical ports or port channels. Untagged frames

received on the CE interface will be processed as if they belong to the PVID

and will be transmitted out the SP interface with a single VLAN tag. Tagged

frames received on the CE interface will be transmitted out the service

provider (SP) interface with an outer tag containing the native VLAN ID and

the inner tag as received on the CE interface.

CE interfaces must be configured in dot1q-tunnel mode with the PVID

configured with the outer tag (native) VLAN ID for the associated service

provider (SP) interface. Configure the outer VLAN ID using the switchport

access vlan command. All MAC address learning and forwarding occurs on

the outer VLAN tag. The VLAN ID must be common to both the SP port and

the CE ports.

The service provider interface must be configured for egress tagging (trunk or

general mode) with a native VLAN identical to the PVID of the associated

CE ports. SP interfaces should be configured with a single VLAN ID. A trunk

mode port will accept untagged packets on the native VLAN and be a

member of any newly created VLANs by default. In general mode, it is

possible to directly configure the port to only accept tagged packets with a

single VLAN ID.

It is not possible to configure an inner VLAN TPID value. The inner VLAN

TPID value is always Ethernet (0x8100).

Multiple groups of associated CE and SP ports can be defined by configuring

the groups with unique VLAN IDs.

The port mirroring logic stage occurs after the after the tag processing stage

on ingress and before the tag processing stage on egress. When mirroring

packets associated with SP or CE ports, the outer VLAN tag may or may not

Layer 2 Switching Commands 819

appear in the frame. Due to the internal processing of QinQ tagging, the

TPID of ingress frames mirrored from the SP port will always be 0x8100. In

addition, packets forwarded internally across a stacking link may have

different tags applied than packets forwarded on a local egress port. This is

due to the processing required for forwarding across a stack.

Example

This example configures ports Gi1/0/10 through Gi1/0/24 as CE ports using

VLAN 10 as the service provider VLAN ID. See the example for the

switchport dot1q ethertype command to configure an associated SP port.

console(config)#vlan 10

console(config-vlan10)#exit

console(config)#interface range gi1/0/10-24

console(config-if)#switchport access vlan 10

console(config-if)#switchport mode dot1q-tunnel

console(config-if)#exit

switchport mode private-vlan

Use the switchport mode private-vlan command in Interface Configuration

mode to define a private VLAN association for an isolated or community

interface or a mapping for a promiscuous interface.

Use the no form of the command to remove the private VLAN association or

mapping from the interface.

Syntax

switchport mode private-vlan {host|promiscuous}

no switchport mode

•host—Configure the interface as a private VLAN host port. Host ports are

community or isolated ports, depending on the VLAN to which they

belong.

•promiscuous—Configure the interface as a private VLAN promiscuous

port. Promiscuous ports are members of the primary VLAN.

Default Configuration

This command has no default configuration. By default, a port is neither

configured as promiscuous or host.

Layer 2 Switching Commands 820

Command Mode

Interface Configuration (physical or port-channel)

User Guidelines

Do not configure private VLANs on ports configured with any of these

features:

• Link Aggregation Control Protocol (LACP)

• Multicast VLAN Registration (MVR)

• Voice VLAN

It is recommended that the private VLAN host ports be configured as

spanning-tree portfast.

Example

console(config)#interface gigabitethernet 1/0/8

console(config-if-Gi1/0/8)#switchport mode private-vlan host

switchport private-vlan

Use the switchport private-vlan command in Interface Configuration mode

to define a private VLAN association for an isolated or community port or a

mapping for a promiscuous port.

Use the no form of the command to remove the private VLAN association or

mapping from the interface.

Syntax

switchport private-vlan {host-association primary-vlan-id secondary-vlan-id

| mapping primary-vlan-id [add|remove] secondary-vlan-list}

no switchport private-vlan {host-association|mapping}

•host-association—Defines VLAN associations for community or host

ports.

•mapping—Defines the private VLAN mapping for promiscuous ports.

•primary-vlan-id—Primary VLAN ID of a private VLAN.

•secondary-vlan-id—Secondary (isolated or community) VLAN ID of a

private VLAN.

Layer 2 Switching Commands 821

•add—Associates the secondary VLAN with the primary one.

•remove—Deletes the secondary VLANs from the primary VLAN

association.

•secondary-vlan-list—A list of secondary VLANs to be mapped to a primary

VLAN.

Default Configuration

This command has no default association or mapping configuration.

Command Mode

Interface Configuration (physical or port-channel)

User Guidelines

This command has no user guidelines.

Example

console(config)#vlan 10,20

console(config-vlan10,20)#exit

console(config)#interface gigabitethernet 1/0/8

console(config-if-Gi1/0/8)#switchport private-vlan host-association 10 20

switchport trunk

Use the switchport trunk command in Interface Configuration mode to

configure VLAN membership for a trunk port or to set the native VLAN for

an interface in Trunk Mode.

Syntax

switchport trunk {allowed vlan vlan–list | native vlan vlan–id}

no switchport trunk { allowed | native } vlan

•

vlan–list

—Set the list of allowed VLANs that can receive and send traffic

on this interface in tagged format when in trunking mode. The default is

all. The vlan–list format is as follows:

The vlan-list format is all | [add | remove | except] vlan–atom [, vlan–

atom...] where:

Layer 2 Switching Commands 822

–all specifies all VLANs from 1 to 4093. This keyword is not allowed on

commands that do not permit all VLANs in the list to be set at the

same time.

–add adds the defined list of VLANs to those currently set instead of

replacing the list.

–remove removes the defined list of VLANs from those currently set

instead of replacing the list. Valid IDs are from 1 to 4093; extended-

range VLAN IDs of the form X-Y or X,Y,Z are valid in this command.

–except lists the VLANs that should be calculated by inverting the

defined list of VLANs. (VLANs are added except the ones specified.)

–vlan-atom is either a single VLAN number from 1 to 4093 or a

continuous range of VLANs described by two VLAN numbers, the

lesser one first, separated by a hyphen.

• valid–id—A valid VLAN id in the range 1–4093. This is the native VLAN

for the trunk port and will accept and send traffic on this VLAN in

untagged format.

Default Configuration

A trunk port is a member of all VLANs by default.

VLAN 1 is the default native VLAN on a trunk port. The default allowed

VLAN membership on a trunk port is all VLANs.

Command Mode

Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,

fortygigabitethernet) mode

Interface Range mode

Port-Channel Range mode

User Guidelines

Untagged traffic received on a trunk port is forwarded on the native VLAN, if

configured.

To drop untagged traffic on a trunk port, remove the native VLAN from the

trunk port. (Ex. switchport trunk allowed vlan remove 1.) Management

traffic is still allowed on the trunk port in this configuration.

Layer 2 Switching Commands 823

The no form of the command sets the allowed or native VLAN membership

back to the defaults.

It is possible to exclude VLANs that have not yet been created from trunk

port membership. For example, it is possible to exclude VLANs learned

dynamically via GVRP from being configured on a trunk port using this

command.

Example

console(config)#interface gigabitethernet 1/0/1

console(config-if-Gi1/0/1)#switchport trunk allowed vlan 1-1024

console(config-if-Gi1/0/1)#switchport trunk allowed vlan except

1,2,3,5,7,11,13

switchport trunk encapsulation dot1q

Use this command for compatibility. This command performs no action.

Syntax

switchport trunk encapsulation dot1q

Default Configuration

Dell EMC Networking switches use dot1q encapsulation on trunk ports by

default.

Command Mode

Interface config mode, Interface range mode (including port-channels)

User Guidelines

This command performs no action. Dell EMC Networking switches always

use dot1q encapsulation on trunk mode ports.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example demonstrates compatibility.

console(config-if-Gi1/0/1)#switchport trunk encapsulation dot1q

Layer 2 Switching Commands 824

vlan

Use the vlan command in Global Configuration mode to configure a VLAN.

To delete a VLAN, use the no form of this command.

Syntax

vlan {vlan–list}

no vlan {vlan–list}

• vlan–list—A list of one or more valid VLAN IDs. List separate, non-

consecutive VLAN IDs separated by commas (without spaces). Use a

hyphen to designate a range of IDs. (Range: 1–4093)

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration (Config)

User Guidelines

Deleting the VLAN assigned as the PVID on an access port will cause VLAN 1

to be assigned as the PVID for the access port. Deleting the VLAN assigned as

the native VLAN for a trunk port will cause the trunk port to discard

untagged frames received on the port. Creating a VLAN adds it to the allowed

list for all trunk ports except those where it is specifically excluded. Ports and

port channels can be configured with VLANs that do not exist. They will not

forward traffic on nonexisting VLANs.

Example

The following example shows how to create (add) VLAN IDs 22, 23, and 56.

console(config)#vlan 22,23,56

console(config-vlan)#

Layer 2 Switching Commands 825

vlan association mac

Use the vlan association mac command in VLAN Configuration mode to

associate a MAC address to a VLAN. The maximum number of MAC-based

VLANs is 256. Only packets with a matching source MAC address are placed

in the VLAN.

Syntax

vlan association mac mac-address

no vlan association mac mac-address

• mac-address — MAC address to associate to the VLAN. (Range: Any MAC

address in the format xxxx.xxxx.xxxx or xx:xx:xx:xx:xx:xx)

Default Configuration

No assigned MAC address.

Command Mode

VLAN Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example associates MAC address with VLAN ID 1.

console(config)# vlan 1

console(config-vlan-1)#vlan association mac 0001.0001.0001

vlan association subnet

Use the vlan association subnet command in VLAN Configuration mode to

associate a VLAN to a specific IP-subnet. Only packets with a matching

source IP address are placed into the VLAN.

Syntax

vlan association subnet ip-address subnet-mask

Layer 2 Switching Commands 826

no vlan association subnet ip-address subnet-mask

• ip-address — Source IP address. (Range: Any valid IP address)

• subnet-mask — Subnet mask. (Range: Any valid subnet mask)

Default Configuration

No assigned ip-subnet.

Command Mode

VLAN Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example associates the 192.168.0.xxx IP address with VLAN ID

console(config)# vlan 1

console(config-vlan-1)#vlan association subnet 192.168.0.0 255.255.255.0

vlan makestatic

This command changes a dynamically created VLAN (one that is created by

GVRP registration) to a static VLAN (one that is permanently configured and

defined). The ID is a valid VLAN identification number. VLAN range is 2-

4093.

Syntax

vlan makestatic vlan-id

• vlan-id — Valid VLAN ID. Range is 2–4093.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration Mode

Layer 2 Switching Commands 827

User Guidelines

The dynamic VLAN (created via GRVP) should exist prior to executing this

command. See the Type column in output from the

show vlan

command to

determine that the VLAN is dynamic.

Example

The following changes vlan 3 to a static VLAN.

console(config-vlan)#vlan makestatic 3

vlan protocol group

Use the vlan protocol group command in Global Configuration mode to add

protocol-based groups to the system. When a protocol group is created, it is

assigned a unique group ID number. The group ID is used to identify the

group in subsequent commands. Use the no form of the command to remove

the specified VLAN protocol group name from the system.

Syntax

vlan protocol group

group-id

no vlan protocol group

group-id

• group-id — The protocol-based VLAN group ID, to create a protocol-

based VLAN group. To see the created protocol groups, use the show port

protocol all command.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

console(config)# vlan protocol group 1

Layer 2 Switching Commands 828

vlan protocol group add protocol

Use the vlan protocol group add protocol command in Global Configuration

mode to add a protocol to the protocol-based VLAN groups identified by

groupid. A group may have more than one protocol associated with it. Each

interface and protocol combination can be associated with one group only. If

adding a protocol to a group causes any conflicts with interfaces currently

associated with the group, this command fails and the protocol is not added

to the group.

To remove the protocol from the protocol-based VLAN group identified by

groupid, use the no form of this command.

Syntax

vlan protocol group add protocol

group-id

ethertype

value

no vlan protocol group add protocol

group-id

ethertype

value

• group-id — The protocol-based VLAN group ID, which is automatically

generated when you create a protocol-based VLAN group with the vlan

protocol group command. To see the group ID associated with the name

of a protocol group, use the show port protocol all command.

•ethertype value — The protocol you want to add. The ethertype value can

be any valid hexadecimal number in the range 0x0600 to 0xffff.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example displays how to add the “ip” protocol to the protocol

based VLAN group identified as “2.”

console(config)#vlan protocol group add protocol 2 ethertype 0xXXXX

Layer 2 Switching Commands 829

vlan protocol group name

This is a new command for assigning a group name to

vlan protocol group id

Syntax

vlan protocol group name

group-id

groupName

no vlan protocol group name

group-id

• groupid—The protocol-based VLAN group ID, which is automatically

generated when you create a protocol-based VLAN group with the vlan

protocol group command. To see the group ID associated with the name

of a protocol group, use the show port protocol all command

• groupName—The group name you want to add. The group name can be

up to 16 characters length. It can be any valid alpha numeric characters.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

console(config)# vlan protocol group name 1 usergroup

vlan protocol group remove

Use the vlan protocol group remove command in Global Configuration

mode to remove the protocol-based VLAN group identified by groupid.

Syntax

vlan protocol group remove group-id

Layer 2 Switching Commands 830

• group-id — The protocol-based VLAN group ID, which is automatically

generated when you create a protocol-based VLAN group with the vlan

protocol group command. To see the group ID associated with the name

of a protocol group, use the show port protocol all command.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example displays the removal of the protocol-based VLAN

group identified as “2.”

console(config)#vlan protocol group remove 2

Layer 2 Switching Commands 831

Voice VLAN Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

The Voice VLAN feature enables switch ports to carry voice traffic with an

administrator-defined priority so as to enable prioritization of voice traffic

over data traffic. Using Voice VLAN helps to ensure that the sound quality of

an IP phone is protected from deterioration when the data traffic utilization

on the port is high.

Voice VLAN is the preferred solution for applying QoS to voice traffic in an

enterprise environment. Voice VLAN scales with the number of ports and

does not make significant demands on the switch CPU for classification of

voice traffic. However, Voice VLAN does require the administrator to perform

the additional configuration step of defining the QoS policy to be applied to

voice traffic.

The switch can be configured to support voice VLAN on a port connecting to

the VoIP phone. When a VLAN is associated with the voice VLAN port, then

the VLAN ID information is passed onto the VoIP phone using LLDP-MED.

Voice data coming from the VoIP phone is tagged by the phone with the

transmitted VLAN ID; regular data arriving on the switch is given the default

PVID of the port.

When an IEEE 802.1p priority is associated with the voice VLAN port, then

the priority information is passed to the VoIP phone using LLDP-MED. It is

expected that the voice data coming from the VoIP phone is tagged with

VLAN 0 or the voice VLAN and with the transmitted priority. Configure the

voice vlan data priority on the port to enable the switch to transmit the IEEE

802.1p or DSCP values to the phone in the LLDP-MED Network Policy TLV.

Regular data arriving on the switch is given the default priority of the port

(default 0) and the voice traffic is received with the priority assigned by the

phone, allowing the switch to provide distinguished service to the voice

traffic.

The switch can be configured to override the voice traffic CoS by entering an

internal ACL associated with the MAC address of the IP phone. Alternatively,

a diffserv policy can be configured for the voice VLAN which assigns voice

traffic to a queue and also remarks the CoS or DSCP values in the voice

Layer 2 Switching Commands 832

traffic. See the User Configuration Guide for more information. Voice VLAN

is recommended for enterprise-wide deployment of voice services on the IP

network.

Commands in this Section

This section explains the following commands:

voice vlan

This command is used to enable the voice VLAN capability on the switch.

Syntax

voice vlan

no voice vlan

Command Mode

Global Configuration

User Guidelines

Voice VLAN must be configured on access or general mode ports. It is not

supported on trunk mode ports.

Default Value

This feature is disabled by default.

Example

console(config)#voice vlan

console(config)#no voice vlan

voice vlan (Interface)

This command is used to enable the voice VLAN capability on the interface.

voice vlan voice vlan data priority

voice vlan (Interface) show voice vlan

Layer 2 Switching Commands 833

Syntax

voice vlan {vlan-id | dot1p priority | none | untagged | data priority {trust |

untrust} | auth { enable | disable} | dscp dscp}

no voice vlan

•auth

{ enable | disable}

—Enables/disables authentication on the voice

VLAN port.

•data priority

{trust | untrust}

—Respect (ignore) the priority of received

voice VLAN traffic (trusted mode). The interface may be configured to

trust the IEEE 802.1p priority tagged packets as assigned by the phone.

•dot1p—Configure the Voice VLAN 802.1p priority transmitted to the

phone via LLDP-MED. In this configuration, it is expected that data

traffic is received untagged on the native VLAN, and voice traffic is

received tagged with the assigned priority. Set the port to trust the received

data priority. The valid priority range is 0-7.

•dscp—Configure the DSCP value for voice traffic on the voice VLAN port.

(Range: 0–64). Data traffic is expected to use the default or native VLAN

on the port.

•none—Allow the IP phone to use its own configuration to send untagged

voice traffic.

•untagged—Configure the phone to send untagged voice traffic.

• vlan-id—The voice VLAN ID.

Default Configuration

The default DSCP value is 46. The default is tagged voice VLAN traffic. The

default data priority is to trust the received CoS value. The default auth value

is Enabled. No voice VLAN ID is configured by default. The default 802.1p

value is none.

Command Mode

Interface Configuration (Ethernet) mode.

User Guidelines

Voice VLAN must be configured on general or access mode ports. It is not

supported on trunk mode ports.

Layer 2 Switching Commands 834

Example

This example configures an interface to use VLAN 100 as the voice VLAN

and sends LLDP configuration in the Network Policy TLV to the phone to

assign VLAN 100 to 802.1p priority 5. The data priority is trusted by default.

console(config)#vlan 100

console(config-vlan100)#interface gi1/0/1

console(config-if-Gi1/0/1)#voice vlan 100

console(config-if-Gi1/0/1)#voice vlan dot1p 5

In this example, the IP phone will use its own configuration (no policy is sent

via LLDP).

console(config-if-Gi1/0/1)#voice vlan none

console(config-if-Gi1/0/1)#voice vlan untagged

Command History

Description updated in 6.3.0.5 release.

voice vlan data priority

This command is to either trust or not trust (untrust) the data traffic arriving

on the voice VLAN port.

Syntax

voice vlan data priority {trust | untrust}

•

trust —

Trust the IEEE 802.1p user priority contained in packets arriving

on the voice VLAN port.

•

untrust —

Do not trust the IEEE 802.1p user priority contained in packets

arriving on the voice VLAN port. This overrides the received value with the

configured 801.2p value. If a distinguished service for voice traffic is

required, an ACL or diffserv policy must be configured.

Command Mode

Interface Configuration

Default Value

trust

Layer 2 Switching Commands 835

Example

console(config)#interface gigabitethernet 1/0/1

console(config-if-Gi1/0/1)#voice vlan data priority untrust

console(config-if-Gi1/0/1)#voice vlan data priority trust

show voice vlan

This command displays information about the voice VLAN.

Syntax

show voice vlan [interface {gigabitethernet unit/slot/port |

tengigabitethernet unit/slot/port | fortygigabitethernet unit/slot/port}|all]

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

• When the interface parameter is not specified, only the global mode of the

voice VLAN is displayed.

• When the interface parameter is specified, the following is displayed:

When the all parameter is used for the interface, all interfaces are displayed.

Output Description

Interface The interface ID.

Voice VLAN

Interface Mode

The admin mode of the voice VLAN on the interface.

Voice VLAN ID The voice VLAN ID.

Voice VLAN Priority The 802.1p priority for the voice VLAN on the port. This is only

displayed if configured.

Voice VLAN

Untagged

The tagging option for the voice VLAN traffic.

Voice VLAN COS

Override

The Override option for the voice traffic arriving on the port.

Voice VLAN Status The operational status of voice VLAN on the port.

Layer 2 Switching Commands 836

Example

(console)#show voice vlan interface gi1/0/1

Interface...................................... Gi1/0/1

Voice VLAN Interface Mode...................... Enabled

Voice VLAN Priority............................ 2

Voice VLAN COS Override........................ True

Voice VLAN DSCP Value.......................... 46

Voice VLAN Port Status......................... Disabled

Voice VLAN Authentication...................... Disabled

Security Commands 837

Security Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Security commands enable network operators to administer security for

administrator access to the switch management console or web interface as

well as to configure restrictions of network access for network attached

devices.

This section of the document contains the following security commands:

AAA Commands Captive Portal Commands

Administrative Profiles Commands Denial of Service Commands

E-mail Alerting Commands Management ACL Commands

RADIUS Commands Password Management Commands

TACACS+ Commands SSH Commands

802.1x Commands

–

Security Commands 838

AAA Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Dell EMC Networking switches support authentication of network users and

switch administrators via a number of methods. Management access to the

switch is via telnet, HTTP, SSH, or the serial console (SNMP access is

discussed in the SNMP Commands section). To ensure that only authorized

users can access or change the configuration of the switch, the administrator

can require that administrative access be authenticated.

Administrative Authentication

Switch administrators can be authenticated based on:

• Login mode

• Switch access method

• Access to Privileged Exec mode

• Two levels of access:

– 1 = Read-only

– 15 = Read-Write

The supported authentication methods for switch management access are:

• Local: The user's locally stored ID and password are used for

authentication.

• RADIUS: The user's ID and password are authenticated using the

RADIUS server.

• TACACS+: The user's ID and password are authenticated using the

TACACS+ server.

• None: No authentication is used.

• Enable: Uses the enable password for authentication.

• Line: Uses the line password for authentication.

• Authentication Preference Lists (APLs): An Authentication Preference List

is an ordered list of authentication methods.

Security Commands 839

To authenticate a switch administrator, the authentication methods in the

APL for the access line are attempted in order until an authentication

attempt returns a success or failure return code. If a method times out, the

next method in the list is attempted. The component requesting

authentication is unaware of the ultimate authentication source. If a method

in the preference list does not support the concept of time-out, subsequent

entries in the list are never attempted. For example, the local authentication

method implementation does not supply a time-out value. If a list contains

the local method, followed by the RADIUS authentication method, the

RADIUS method is not attempted.

Once an APL is created, a reference to that APL can be stored in the access

line configuration to determine how specific components should

authenticate users. The APL and associated component ID are stored

together. A single APL can be referenced by multiple methods.

The administrator can enable/disable/reorder authentication methods on a

per method basis (see above).

Administrative Accounting

The administrator may choose to account administrative activity on the

switch. The following accounting types are supported:

• User exec sessions: User login and logout times are noted and conveyed to

an external AAA server.

• User executed commands: Commands executed by the user and the time

of execution are accounted and conveyed to an external AAA server.

Administrator activity can be accounted for at the end and/or at the

beginning of the activity. For this purpose, the following record-types are

defined:

• Start-stop

Accounting notifications are sent when the administrator logs into the

switch and when the administrator exits exec mode. Accounting

notifications are also sent at the beginning and at the end of each

administrator executed command. Command execution does not wait for

the accounting notification to be recorded at the AAA server.

• Stop-only

Security Commands 840

Accounting notification is sent when the administrator exits exec mode.

The duration of the exec session is logged in the accounting notice.

Accounting notifications are sent at the end of each administrator

executed command. In the case of commands like reload, and clear config,

an exception is made and the stop accounting notice is sent at the

beginning of the command.

Accounting Method Lists

An Accounting Method List (AML) is an ordered list of accounting methods

that can be applied to the accounting types (exec or commands). Accounting

Method Lists are identified by the default keyword or by a user-defined name.

TACACS+ and RADIUS are supported as accounting methods.

TACACS+ accounts all accounting types (exec and commands). RADIUS

only accounts exec sessions.

Access Line Modes

AMLs can be applied to the following access line modes for accounting

purposes:

• Console: This mode is used when user logs in to the switch using serial

console.

• Telnet: This mode is used when user logs in through Telnet.

• SSH: This mode is used when user logs in through SSH.

By default, no accounting is enabled for any line Configuration modes.

The following default Accounting Methods List are available.

The default lists are not applied to any line-configuration modes by default.

See

Line Commands

for information on associating an accounting method

list (AML) to a login session (console, SSH, Telnet).

Default List Name Accounting Type Record Type Accounting Method

Default Exec List exec Start-stop TACACS+

Default Command List commands Stop-only TACACS+

Security Commands 841

Command Authorization

Dell EMC Networking switches support per command or enable

authorization using a TACACS server. See the authorization command in

this section for further information. Additionally, the RADIUS or TACACS

server can be configured to assign an administrative profile to a switch

administrator. The administrative profile identifies groups of commands

which may be executed by the administrator. See the Administrative Profiles

Commands section for further information on this capability.

Network Authentication

The network administrator can require that devices attached to the network

be authenticated prior to gaining access to network resources. This is most

often performed by the use of IEEE 802.1x in conjunction with a RADIUS or

TACACS authentication server. Dell EMC Networking switches support use

of RADIUS or TACACS authentication servers as well as a local, switch based,

authentication server. Refer to the RADIUS Commands section for

information on configuring a RADIUS server for authentication of network

devices. See the 802.1x Commands section for information on configuring

device access to network resources.

Dell EMC Networking switches support an internal authentication capability

that allows configuration of authentication preference lists for network

connected devices. The authentication preference lists support

authentication methods such as IEEE 802.1x, internal authentication, and no

authentication. MAC Authentication Bypass may be configured to allow

IEEE 802.1x unaware devices access to the network. Refer to the section

below for information on configuring authentication preference lists for

network device access.

Local 802.1x Authentication Server

The Dell EMC Networking switch supports a dedicated database for local

authentication of users for network access through the 802.1x feature. This

functionality is distinct from management access for the switch. See the

802.1x Commands section for information on configuring IEEE 802.1x access

to the network using an external authentication server.

Security Commands 842

The Internal Authentication Server feature provides support for the creation

of users for IEEE 802.1x access only, i.e. without switch management access.

This feature maintains a separate database of users allowed for 802.1x access.

The authentication method internal is available in the list of methods

supported by authentication to support user database lookup. The internal

method cannot be added in the same authentication list that has other

methods like local, radius and reject.

Whenever an operator configures a port in 802.1x authentication mode and

selects the authentication method as internal, then the user credentials

received from the 802.1x supplicant are validated against the user database by

the 802.1x component. The 802.1x application accesses the 802.1x user

database to check whether the user credentials present in the authentication

message corresponds to a valid user or not. If so then an event is generated

which triggers the 802.1x state machine to send a challenge to the supplicant.

Otherwise a failure is returned to the 802.1x state machine and the user is not

granted access to the port.

If user(s) credentials are changed, the existing user connection(s) are not

disturbed and the changed user(s) credentials are only used when a new EAP

request arises.

A CLI configuration mode is added in order to configure 802.1x users and

their attributes. The 802.1x maintained user database can also be exported

(uploaded) or imported (downloaded) to/from a central location using a

TFTP server. Use the aaa ias-user username command to add users to the

internal database.

MAC Authentication Bypass

Today, IEEE 802.1x has become the recommended port-based authentication

method at the access layer in enterprise networks. However, there may be

802.1x unaware devices such as printers, fax-machines, etc., that would

require access to the network without 802.1x authentication. MAC

Authentication Bypass (MAB) is a supplemental authentication mechanism

to allow 802.1x unaware clients to authenticate to the network. It uses the

802.1x infrastructure. MAB cannot be supported independently of the 802.1x

component.

Security Commands 843

MAC Authentication Bypass (MAB) provides 802.1x unaware clients

controlled access to the network using the devices’ MAC address as an

identifier. This requires that the known and allowable MAC address and

corresponding access rights be prepopulated in the authentication server.

MAB only works when the port control mode of the port is MAC-based.

Port access by MAB clients is allowed via local authentication if the user

database has corresponding entries added for the MAB clients with user name

and password attributes set to the MAC address of MAB clients. Alternatively,

a RADIUS authentication server can be configured with the MAC addresses

of the MAB clients. In this configuration, the switch uses EAP-MD5

authentication to communicate with the authentication server. No other

authentication or privacy protocol is supported for server side authentication.

Guest VLAN

The Guest VLAN feature allows a Dell EMC Networking switch to provide a

distinguished service to unauthenticated network devices (not rogue devices

that fail authentication). This feature provides a mechanism to allow network

devices to have network access to reach an external network while restricting

their ability to access the internal LAN.

When a client that does not support 802.1x is connected to an unauthorized

port that is 802.1x-enabled, the client does not respond to the 802.1x requests

from the switch. The port remains in the unauthorized state and the client is

not granted access to the network. If a guest VLAN is configured for that port,

then the port is placed in the configured guest VLAN, and the port is moved

to the authorized state, allowing network access to the client over the guest

VLAN.

Unauthenticated VLAN

The Unauthenticated VLAN feature allows a Dell EMC Networking switch to

provide a distinguished service to unauthorized network devices that attempt

and fail authentication. This feature provides a mechanism to allow network

devices to have network access to an external network while restricting their

ability to access the internal LAN.

When a client network device that supports 802.1x is connected to an

unauthorized port that is 802.1x enabled with no unauthenticated VLAN

configured and the client attempts and fails to authenticate, the port remains

Security Commands 844

in the unauthorized state and the client is not granted access to the network.

If an unauthenticated VLAN is configured for the port and the 802.1x client

fails to authenticate for the configured number of attempts, the port is placed

in the authorized state on the unauthenticated VLAN and the client is

granted access to the network. The default number of authentication

attempts is three.

Commands in this Section

This section explains the following commands:

aaa accounting

Use this command to create an accounting method list for User Exec

sessions, user-executed commands or 802.1X. The no version of the

command deletes the accounting method list.

aaa accounting authentication priority show aaa statistics

aaa authentication dot1x

default

authentication restart show accounting methods

aaa authentication enable clear (IAS) show authentication

aaa authentication login clear authentication

statistics

show authentication

authentication-history

aaa authorization clear authentication

authentication-history

show authentication

methods

aaa authorization network

default radius

enable password show authentication

statistics

aaa ias-user username ip http authentication show authorization methods

aaa new-model ip https authentication show users accounts

aaa server radius dynamic-

author

password (AAA IAS User

Configuration)

show users login-history

authentication enable password (User Exec) username

authentication order show aaa ias-users username unlock

Security Commands 845

Use the no form of the command to delete a list. A list may be identified by

the default keyword or a user-specified listname.

Use either the aaa accounting dot1x default none or no aaa accounting

dot1x default command to disable dot1x accounting.

Use the no aaa accounting exec or no aaa accounting commands to disable

aaa accounting and optionally delete an accounting method list.

Syntax

aaa accounting {exec | commands | dot1x} {default | list-name} {start-stop

| stop-only |none} [method1 [method2…]] {radius|tacacs|radius

tacacs|tacacs radius}

• exec—Provides accounting for a User Exec terminal sessions.

• commands—Provides accounting for all user executed commands.

• dot1x—Provides accounting for DOT1X user commands. Only the default

method is available for dot1x.

• default—The default list of methods for accounting services.

• list-name—Character string used to name the list of accounting methods.

• start-stop—Sends a start accounting notice at the beginning of a process,

and a stop accounting notice at the end of a process.

• stop-only—Sends a stop accounting notice at the end of the requested

user process.

• none—Disables accounting services on this line or for 802.1X.

• method—Use either TACACS or RADIUS server for accounting purposes.

Default Configuration

Accounting is not enabled by default.

Command Mode

Global Configuration

Security Commands 846

User Guidelines

This list is identified by default or a user-specified list_name. Accounting

records, when enabled for a line-mode, can be sent at both the beginning and

at the end (start-stop) or only at the end (stop-only). If none is specified,

accounting is disabled for the specified list. If tacacs is specified as the

accounting method, accounting records are notified to a TACACS+ server. If

radius is the specified accounting method, accounting records are notified to

a RADIUS server.

Please note the following:

• A maximum of five Accounting Method lists can be created for each exec

and commands type.

• Only the default Accounting Method list can be created for RADIUS.

There is no provision to create more.

• The same list-name can be used for both exec and commands accounting

type

• AAA Accounting for commands with RADIUS as the accounting method

is not supported.

• Start-stop or None are the only supported record types for RADIUS

accounting. Start-stop enables accounting and None disables accounting.

• RADIUS is the only accounting method type supported for RADIUS

accounting.

• For the same set of accounting type and list name, the administrator can

change the record type, or the methods list, without having to first delete

the previous configuration.

Example

The following shows an example of the command.

(console)#configure

(console-config)#aaa accounting commands default stop-only tacacs

(console-config)#aaa accounting exec default start-stop radius

(console-config)#aaa accounting dot1x default start-stop radius

(console-config)#aaa accounting dot1x default none

(console-config)#exit

For the same set of accounting type and list name, the administrator can

change the record type, or the methods list, without having to first delete the

previous configuration.

Security Commands 847

(console)#configure

(console-config)#aaa accounting exec ExecList stop-only tacacs

(console-config)#aaa accounting exec ExecList start-stop tacacs

(console-config)#aaa accounting exec ExecList start-stop tacacs radius

(console-config)#exit

The first aaa command creates a method list for exec sessions with the name

ExecList, with record-type as stop-only and the method as TACACS+. The

second command changes the record type to start-stop from stop-only for the

same method list. The third command, for the same list changes the methods

list to {tacacs,radius} from {tacacs}.

The following shows an example of the no version of the command.

(console)#configure

(console-config)#aaa accounting commands userCmdAudit stop-only tacacs

(console-config)#no aaa accounting commands userCmdAudit

(console-config)#exit

aaa authentication dot1x default

Use the aaa authentication dot1x default command in Global Configuration

mode to specify an authentication method for 802.1x clients to access

network resources. Use the no form of the command to return the

authentication method to its default settings.

Syntax

aaa authentication dot1x default {radius| ias|none}

no aaa authentication dot1x default

•radius—

Uses the RADIUS server(s) for authentication.

•ias—

Uses the internal authentication server. Only EAP-MD5 authentication is

supported for the internal authentication server.

•none—

Uses no authentication.

Default Configuration

No default authentication method is defined.

Command Mode

Global Configuration mode

Security Commands 848

User Guidelines

Only one authentication method may be specified in the command. For the

RADIUS authentication method, if the RADIUS server cannot be contacted,

the supplicant fails authentication. The none method always allows access.

the ias method utilizes the internal authentication server. The internal

authentication server only supports the EAP-MD5 method.

Example

The following example configures 802.1x authentication to use no

authentication. Absent any other configuration, this command allows all

802.1x users to pass traffic through the switch.

console(config)# aaa authentication dot1x default none

The following example configures 802.1x authentication to use a RADIUS

server. A RADIUS server must be configured previously using the radius-

server host auth command for the radius method to succeed.

console(config)#aaa authentication dot1x default radius

aaa authentication enable

Use the aaa authentication enable command in Global Configuration mode

to set authentication for accessing higher administrator privilege levels when

logged in to the switch console. To return to the default configuration, use

the no form of this command.

Syntax

aaa authentication enable {default | list-name} method1 [method2...]

no aaa authentication enable {default | list-name}

•default — Uses the listed authentication methods that follow this

argument as the default list of methods, when using higher privilege levels.

• list-name — Character string used to name the list of authentication

methods activated, when using access higher privilege levels. (Range: 1-15

characters)

• method1

[

method2...

]

— Specify at least one from the following table:

Security Commands 849

Default Configuration

The default enable list is enableList. It is used by console, telnet, and SSH

and only contains the method enable and none.

Command Mode

Global Configuration mode

User Guidelines

The default and optional list names created with the aaa authentication

enable command are used with the enable authentication command.

Create a list by entering the aaa authentication enable list-name method

command where list-name is any character string used to name this list. The

method argument identifies the list of methods that the authentication

algorithm tries in the given sequence.

The additional methods of authentication are used only if the previous

method returns an error, not if it fails to authenticate the administrator. Only

the RADIUS or TACACS methods can return an error. For example, if none is

specified as an authentication method after radius, no authentication is used

if the RADIUS server is down.

To ensure that the authentication succeeds even if all methods return an

error, specify none as the final method in the command line. Note that enable

will not succeed for a privilege level one administrator if no authentication

method is defined. A privilege level one administrator must authenticate to

get to Privileged Exec mode.

Keyword Source or destination

enable Uses the enable password for authentication.

line Uses the line password for authentication.

none Uses no authentication.

radius Uses the list of all RADIUS servers for authentication.

tacacs Uses the list of all TACACS+ servers for authentication.

Security Commands 850

NOTE: Requests sent by the switch to a RADIUS server include the username

“$enabx$”, where x is the requested privilege level in decimal. For enable to be

authenticated on Radius servers, add “$enabx$” users to them. The login user ID is

also sent to TACACS+ servers for enable authentication.

Example

The following example configures enable authentication to use the enable

method for accessing higher privilege levels.

console(config)#authentication enable

console(config)# aaa authentication enable default enable

aaa authentication login

Use the aaa authentication login command in Global Configuration mode to

create and enable the authentication method required for administrative

access to the switch. To return to the default configuration and optionally

delete an authentication list, use the no form of this command.

Syntax

aaa authentication login {default | list-name} method1 [method2...]

no aaa authentication login {default | list-name}

•default — Uses the listed authentication methods that follow this

argument as the default list of methods when an administrator logs in.

• list-name — Character string used to name the list of authentication

methods activated when an administrator logs in to the switch. (Range: 1-

15 characters)

• method1

[

method2...

]

— Specify at least one from the following table:

Keyword Source or destination

enable Use the enable password for authentication.

line Use the line password for authentication.

local Use the local username database for authentication.

none Use no authentication.

radius Use the list of all RADIUS servers for authentication.

Security Commands 851

Default Configuration

The default login lists are defaultList and networkList. defaultList is used by

the console and only contains the method none. networkList is used by telnet

and SSH and only contains the method local.

Command Mode

Global Configuration mode

User Guidelines

The default and optional list names created with the aaa authentication

list by entering the aaa authentication login list-name method command for

a particular protocol, where list-name is any character string used to name

this list. The method argument identifies the list of methods that the

authentication algorithm tries, in the given sequence.

The additional methods of authentication are attempted only if the previous

method returns an error, not if there is an authentication failure. Only the

RADIUS, TACACS+, local and enable methods can return an error. To

ensure that authentication succeeds even if all methods return an error,

specify none as the final method in the command line. For example, if none is

specified as an authentication method after radius, no authentication is used

if the RADIUS server is down. If specified, none must be the last method in

the list.

NOTE: Auth-Type:=Local does not work for recent versions of FreeRadius.

FreeRadius ignores the configuration if Local is used. Administrators should remove

Auth-Type=Local and use the PAP or CHAP modules instead.

Example

The following example configures the default authentication login to attempt

RADIUS authentication, then local authentication, then enable

authentication, and then, if all the previous methods returned an error, allows

the administrator access to the switch console (via the none method).

console(config)# aaa authentication login default radius local enable none

tacacs Use the list of all TACACS+ servers for authentication.

Keyword Source or destination

Security Commands 852

aaa authorization

Use the aaa authorization command to enable authorization and optionally

create an authorization method list. A list may be identified by a user-

specified list-name or the keyword default.

Use the no form of the command to disable authorization and optionally

delete an authorization list.

Syntax

aaa authorization {commands|exec|network}{default|list-name} method1

[method2]

no aaa authorization {commands|exec|network} {default|list-name}

•exec—

Provides Exec authorization. All methods are supported.

•commands—

Performs authorization of user commands. Only none and

TACACs methods are supported.

•network—

Performs RADIUS authorization. Only the default list is

supported.

• default—

The default list of methods for authorization services

. The list

dfltCmdAuthList is the default list for command authorization and the

list dfltExecAuthList is the default list for Exec authorization.

• list-name—

Character string used to name the list of authorization

methods. The list name can consist of any alphanumeric character up to

15 characters in length. Use quotes around the list name if embedded

blanks are contained in the list name.

•method—The following authorization methods are supported:

– local—Perform local authorization.

– none—Do not perform authorization. All functions are authorized.

– radius—Request authorization from the configured RADIUS servers.

– tacacs—Request authorization from the configured TACACS+

servers.

Default Configuration

When authorization is enabled, the switch attempts to authorize the listed

function using the configured method.

Security Commands 853

Authorization is not enabled by default. Authorization supports Exec

authorization and network authorization for RADIUS. Only TACACS is

supported for command authorization. Setting a none or local method for

authorization authorizes Exec access for all functions.

The following default Authorization Methods List is present by default:

Command Mode

Global Configuration mode

User Guidelines

A maximum of five authorization method lists may be created for exec and

command types. The default methods may not be deleted.

When command authorization is configured for a line mode, the switch

sends information about the entered command to the AAA server. The AAA

server validates the received command and responds with a PASS or FAIL. If a

PASS response is received, the command is executed. If a FAIL response is

received, the command is not executed and a message is displayed to the user.

Command authorization attempts authorization for all Exec mode

commands associated with a privilege level, including global configuration

commands. Exec authorization attempts authorization when a user attempts

to enter Privileged Exec mode.

When exec authorization is configured for a line mode, the use may not be

required to use the enable command to enter Privileged Exec mode. If the

authorization response indicates the user has privileges for Privileged Exec

mode, then the switch bypasses User Exec mode entirely.

If multiple authorization methods are listed, the switch will attempt

communication with each method in order, until successful communication

is established or all methods in the list have been tried. If authorization fails,

then the command is denied and no further attempts at authorization are

made for the user request.

Default List Name Description Authorization Method

dfltCmdAuthList Default Command List None

dfltExecAuthList Default Exec list None

Security Commands 854

If no authorization server is available or configured, the function is denied

unless the none method is configured in the list. If authorization is

configured on the console, this can lead to situations where the console

denies administrative access. Therefore, it is recommended that the console

authorization only be enabled with due regard to the risks involved. If none is

configured as the last method after radius or tacacs, no authorization is

performed if the RADIUS/TACACS servers are down.

The various utility commands like tftp, ping, outbound telnet also must pass

command authorization. Applying a script is treated as a single command

apply script which also must pass authorization. Startup-config commands

applied on device boot-up are not subject to the authorization process.

Refer to the Line Commands section for information on configured an

authorization method for a particular type of line access.

Example

Per command authorization example for telnet access using TACACS:

Configure the Authorization Method list.

console(config)#aaa authorization commands telnet-list tacacs

Apply the AML to an access line mode (telnet):

console(config)#line telnet

console(config-telnet)#authorization commands telnet-list

Exec authorization example for SSH using RADIUS with a fallback to the

none method:

Configure the Authorization Method list.

Method Notes

Local The local method is not supported for command authorization.

This method is equivalent to selecting the none method when

used for Exec authorization.

TACACS Selects TACACS for command or exec authorization.

None Selecting the none method authorizes all commands. This

option is valid for both command and Exec authorization.

RADIUS The radius method is valid for Exec authorization and Network

authorization. Network and Exec authorization with RADIUS

will work only if the applied authentication method is radius.

Security Commands 855

console(config)#aaa authorization exec exec-list radius none

Apply the AML to an access line mode (SSH):

console(config)#line ssh

console(config-ssh)#authorization exec exec-list

Display the authorization methods:

console#show authorization methods

Exec Authorization List Methods

---------------------------- ------------------------------

dfltExecAuthList none

exec-list radius none

Command Authorization List Methods

---------------------------- ------------------------------

dfltCmdAuthList none

telnet-list tacacs

Line Exec Method Lists Command Method Lists

--------- --------------------- ---------------------

Console dfltExecAuthList dfltCmdAuthList

Telnet dfltExecAuthList telnet-list

SSH exec-list dfltCmdAuthList

Network Authorization Methods

---------------------- -------

Dot1x none

aaa authorization network default radius

Use the aaa authorization network default radius command in Global

Configuration mode to enable the switch to accept VLAN assignment by the

RADIUS server.

Syntax

aaa authorization network default radius

no aaa authorization network default radius

Default Configuration

By default, the switch does not accept VLAN assignments by the RADIUS

server.

Security Commands 856

Command Mode

Global Configuration mode

User Guidelines

The RADIUS server can place a port in a particular VLAN based on the result

of the authentication. VLAN assignment must be configured on the external

RADIUS server using the RADIUS TUNNEL-TYPE attribute and others. See

RADIUS Commands

and

Security Commands

for further information.

Example

The following example enables RADIUS-assigned VLANs.

console(config)#aaa authorization network default radius

aaa ias-user username

Use the aaa ias-user username command in Global Configuration mode to

configure IAS users and their attributes. Username and password attributes

are supported. The ias-user name is composed of up to 64 alphanumeric

characters. This command also changes the mode to a user Configuration

mode. Use the no form of this command to remove the user from the internal

user database.

Syntax

aaa ias-user username user

no aaa ias-user username user

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration

User Guidelines

This command has no user guidelines.

Security Commands 857

Examples

console#configure

console(config)#aaa ias-user username client-1

console(config-ias-user)#exit

console(config)#no aaa ias-user username client-1

aaa new-model

The aaa new-model command in Global Configuration mode is a no-op

command. It is present only for compatibility purposes. Dell EMC

Networking switches only support the new model command set.

Syntax

aaa new-model

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

The following example configures the switch to use the new model command

set.

(config)# aaa new-model

aaa server radius dynamic-author

Use this command to enter dynamic RADIUS server configuration mode.

Syntax

aaa server radius dynamic-author

Security Commands 858

Default Configuration

By default, no dynamic RADIUS servers are configured.

Command Mode

Global Configuration

User Guidelines

Configuring a dynamic RADIUS server causes the system to begin listening

on the default port 3799 for RADIUS CoA requests. The switch ensures that a

unique Acct-Session-Id and the Calling-Station-Id is sent to the RADIUS

server in all Access-Request packets. The Acct-Session-Id and Calling-

Station-Id identifiers are maintained in the switch. CoA-Request requests

must use the Acct-Session-Id or Calling-Station-Id or both for presentation to

the NAS for subsequent CoA requests.

A valid authenticated RFC 3575 Disconnect-Request terminates the session

without disabling the port. The termination may cause the host to attempt to

re-authenticate on the port. If an ACL was applied for the session (i.e., for

MAB), the ACL is removed when the session is terminated.

If a valid authenticated RFC 3575 Disconnect-Request request is received

from a configured server and the session cannot be found, the switch returns a

CoA-NAK message with the 503 Session Context Not Found response code.

If it expected that more than one session will authenticate over a port, use of

MAC based authentication is recommended. If MAC based authentication is

enabled, the user is denied access to the port even if a previous authentication

has occurred on the port.

Command History

Introduced in version 6.2.0.1 firmware.

Example

The following example configures RADIUS servers at 1.1.1.1, 2.2.2.2, and

3.3.3.3 and CoA clients at 4.4.4.4 and 5.5.5.5. It sets the front panel ports to

use 802.1x MAC-based authentication. CoA is configured for two dynamic

RADIUS servers located at 1.1.1.1 and 2.2.2.2 using a global shared secret and

a third server using a server specific shared secret. CoA and disconnect

requests are accepted from the CoA clients at 4.4.4.4 and 5.5.5.5. Any

Security Commands 859

authentication type is allowed for CoA and disconnect requests. In this

example, the NAS-IP-Address is optionally configured at the fixed IPv4

address of 3.3.3.3. CoA client 5.5.5.5 uses the global server key while client

4.4.4.4 uses a client-specific server key.

console#configure terminal

console(config)# aaa new-model

console(config)# aaa authentication dot1x default radius

console(config)# dot1x system-auth-control

console(config)# interface range gi1/0/1-24

console(config-if)# dot1x port-control mac-based

console(config-if)# exit

console(config)# radius-server host 1.1.1.1

console(Config-radius)#primary

console(Config-radius)#exit

console(config)# radius-server host 2.2.2.2

console(Config-radius)#exit

console(config)# radius-server host 3.3.3.3

console(Config-radius)#key “That’s your secret.”

console(Config-radius)#exit

console(config)# radius-server key “Keep it. Keep it.”

console(config)# aaa server radius dynamic-author

console(config-radius-da)# client 4.4.4.4 server-key 0 “That’s your secret.”

console(config-radius-da)# client 5.5.5.5

console(config-radius-da)# server-key 0 “Keep it. Keep it.”

console(config-radius-da)# port 3799

console(config-radius-da)# auth-type any

console(config-radius-da)# exit

console(config)#radius-server attribute 4 3.3.3.3

console(config)#dot1x system-auth-control

console(config)#exit

console#dot1x initialize

authentication enable

Use this command to globally enable the Authentication Manager. Interface

configuration set with the authentication order command takes effect only if

the Authentication Manager is enabled.

Use the no form of this command to disable the Authentication Manager.

Syntax

authentication enable

no authentication enable

Security Commands 860

Default Configuration

The default value is Disabled.

Command Mode

Global Configuration mode

User Guidelines

The administrator must ensure that any methods configured by the

Authentication Manager are enabled (e.g. enable IEEE 802.1x using the

dot1x system-auth-control command). Enable MAB using the dot1x mac-

auth-bypass command.

Example

console(config)# authentication enable

authentication order

This command sets the order of authentication methods used on a port. The

available authentication methods are Dot1x, MAB, and captive portal.

Ordering sets the order of methods that the switch attempts when trying to

authenticate a new device connected to a port. If one method is unsuccessful

or timed out, the next method is attempted.

Use the no form of this command to return the port to the default

authentication order.

Syntax

authentication order {dot1x [mab][captive-portal] | mab [dot1x] [captive-

portal] | captive-portal}

no authentication order

Default Configuration

There is no default configuration for this command.

Command Modes

Interface Configuration (Ethernet) mode

Security Commands 861

User Guidelines

Each method can only be entered once. Ordering is only possible between

802.1x and MAB. Captive portal can be configured either as a stand-alone

method or as the last method in the order.

Example

console(config-if-Gi1/0/1)# authentication order dot1x mab captive-portal

console(config-if-Gi1/0/1)# no authentication order

authentication priority

Use this command to set the priority for the authentication methods used on

a port. The available authentication methods are Dot1x, MAB, and captive

portal. The authentication priority decides if a previously authenticated client

is re-authenticated with a higher-priority method when the same is received.

Captive portal is always the last method in the list.

Use the no form of this command to return the port to the default order of

priority for the authentication methods.

Syntax

authentication priority {[dot1x|mab|captive-portal] [mab|dot1x|captive-

portal] [mab|dot1x|captive-portal]}

no authentication priority

Default Configuration

There is no default configuration for this command.

Command Modes

Interface Configuration (Ethernet) mode.

User Guidelines

Each method can only be entered once. There are no restrictions on the

priority ordering of methods.

Security Commands 862

Example

console(config-if-Gi1/0/1)# authentication priority mab dot1x captive-portal

console(config-if-Gi1/0/1)# no authentication priority

authentication restart

Use this command to set the interval after which reauthentication starts. This

timer starts only if all the authentication methods fail.

Use the no form of this command to set the authentication restart timer to

factory default value.

Syntax

authentication restart time

no authentication restart

•

time

—The time, in seconds, after which reauthentication starts, if all the

authentication methods have failed. Range: 300-65535.

Default Configuration

The default timer value is 300 seconds.

Command Modes

Interface Configuration (Ethernet) mode

User Guidelines

None

Example

console(config-if-Gi1/0/1)# authentication restart 1800

console(config-if-Gi1/0/1)# no authentication restart

clear (IAS)

Use the clear aaa ias-users command to delete all IAS users.

Security Commands 863

Syntax

clear aaa ias-users

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

There are no user guidelines for this command.

Example

console#clear aaa ias-users

clear authentication statistics

Use this command to clear the authentication statistics.

Syntax

clear authentication statistics {interface-id | all}

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec mode

User Guidelines

There are no user guidelines for this command.

Example

console(config)# clear authentication statistics Gi1/0/1

Are you sure you want to clear authentication manager port stats? (y/n)

Security Commands 864

clear authentication authentication-history

Use this command to clear the authentication history logs.

Syntax

clear authentication authentication-history {interface-id | all}

• interface-id—The interface.

•all—All interfaces.

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec mode

User Guidelines

None

Example

console(config)# clear authentication authentication-history Gi1/0/1

enable password

Use the enable password command in Global Configuration mode to set a

local password to control access to the privileged Exec mode. To remove the

password requirement, use the no form of this command.

Syntax

enable password password [encrypted]

no enable password

• password — Password for this level (Range: 8- 64 characters). The special

characters allowed in the password include ! # $ % & ‘ " ( ) * + , - .

/ : ; < = > @ [ \ ] ^ _ ` { | } ~. User names can contain blanks

if the name is surrounded by double quotes. To use the ! character as part

of the username or password string, it should be enclosed within quotation

marks. For example, username “test!xyz” password “test!xyz”.

Security Commands 865

•encrypted — Encrypted password entered, copied from another switch

configuration.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

The Dell EMC Networking firmware emulates industry standard behavior for

enable mode authentication over SSH and telnet. The default enable

authentication method for telnet and SSH uses the enableNetList method,

which requires an enable password. If users are unable to enter privileged

mode when accessing the switch via telnet or SSH, the administrator will

need to either change the enable authentication method, e.g. to enableList,

or set an enable password. If the encrypted parameter is specified, the

password parameter is stored as entered in the running-config. No attempt is

made to decode the encrypted password. To use the ! character as part of the

username or password string, it should be enclosed within quotation marks.

For example, username “test!xyz” password “test!xyz”.

Example

The following example defines password “xxxyyyzzz” to control access to user

and privilege levels.

console(config)# enable password xxxyyyzzz

ip http authentication

Use the ip http authentication command in Global Configuration mode to

specify authentication methods for http server users. To return to the default,

use the no form of this command.

Syntax

ip http authentication method1 [method2...]

no ip http authentication

Security Commands 866

• method1

[

method2...

]

— Specify at least one from the following table:

Default Configuration

The local user database is checked. This action has the same effect as the

command ip http authentication local.

Command Mode

Global Configuration mode

User Guidelines

The additional methods of authentication are used only if the previous

method returns an error, not if it fails. To ensure that the authentication

succeeds even if all methods return an error, specify none as the final method

in the command line. For example, if none is specified as an authentication

method after radius, no authentication is used if the RADIUS server is down.

Example

The following example configures the http authentication.

console(config)# ip http authentication radius local

ip https authentication

Use the ip https authentication command in Global Configuration mode to

specify authentication methods for users authenticating over HTTPS. To

return to the default configuration, use the no form of this command.

Syntax

ip https authentication method1 [method2...]

no ip https authentication

Keyword Source or destination

local Uses the local username database for authentication.

none Uses no authentication.

radius Uses the list of all RADIUS servers for authentication.

tacacs Uses the list of all TACACS+ servers for authentication.

Security Commands 867

• method1 [method2...] — Specify at least one from the following table:

Default Configuration

The local user database is checked. This action has the same effect as the

command ip https authentication local.

Command Mode

Global Configuration mode

User Guidelines

The additional methods of authentication are used only if the previous

method returns an error, not if it fails. To ensure that the authentication

succeeds even if all methods return an error, specify none as the final method

in the command line. If none is specified as an authentication method after

radius, no authentication is used if the RADIUS server is down.

When using a Cisco ACS with TACACS+ as the authentication method for

HTTPS, the Cisco ACS must be configured to allow the shell service. In

addition, for admin privileges, the privilege level attribute must be set to 15.

Example

The following example configures HTTPS authentication.

console(config)# ip https authentication radius local

Keyword Source or destination

local Uses the local username database for authentication.

none Uses no authentication.

radius Uses the list of all RADIUS servers for authentication.

tacacs Uses the list of all TACACS+ servers for authentication.

Security Commands 868

password (AAA IAS User Configuration)

Use the password command in aaa IAS User Configuration mode to configure

a password for an IAS user. The password is composed of up to 64

alphanumeric characters. An optional parameter [encrypted] is provided to

indicate that the password given to the command is already pre-encrypted. To

clear the user’s password, use the no form of this command.

Syntax

password password [encrypted]

no password

• password — Password for this level. (Range: 1- 64 characters)

•encrypted — Encrypted password to be entered, copied from another

switch configuration.

Default Configuration

This command has no default configuration.

Command Mode

AAA IAS User Configuration

User Guidelines

IAS user accounts are distinct from user (administrator) accounts. IAS

accounts give access to network resources (via 802.1X or MAB), whereas user

accounts give administrative access to the switch.

Example

console#configure

console(config)#aaa ias-user username client-1

console(config-ias-user)#password client123

console(config-ias-user)#no password

The following is an example of adding a MAB Client to the IAS user database

with MAC address f81f.3ccc.b157. Be sure to enter the password in upper case

letters or authentication will fail with an “MD5 Validation Failure” as the

password hash does not match.

console#configure

console(config)#aaa ias-user username f81f3cccb157

Security Commands 869

console(config-ias-user)#password F81F3CCCB157

console(config-ias-user)#exit

console(config)#

password (User Exec)

Use the password command in User Exec mode to allow a currently logged in

user to change the user password without having read/write privileges. This

command should be used after the password has aged. The user is prompted

to enter the old password and the new password.

The special characters

allowed in the password include ! # $ % & ‘ ( ) * + , - . / : ; < = > @

[ \ ] ^ _ ` { | } ~. User names can contain blanks if the name is

surrounded by double quotes.

NOTE: For commands that configure password properties, see

Password

Management Commands

Syntax

password

Default Configuration

There is no default configuration for this command.

Command Mode

User Exec mode

User Guidelines

This command configures the password for a switch administrative user.

Example

The following example shows the prompt sequence for executing the

password command.

console>password

Enter old password:********

Enter new password:********

Confirm new password:********

Security Commands 870

show aaa ias-users

Use the show aaa ias-users command to display configured IAS users and

their attributes. Passwords configured are not shown in the show command

output.

Syntax

show aaa ias-users

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

IAS users are distinct from switch administrative users. IAS users are allowed

access to network resources.

Example

console#show aaa ias-users

UserName

-------------------

Client-1

Client-2

show aaa statistics

Use the show aaa statistics command to display accounting statistics.

Syntax

show aaa statistics

Default Configuration

This command has no default setting.

Security Commands 871

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Examples

console#show aaa statistics

Number of Accounting Notifications sent at beginning of an Exec session: 0

Errors when sending Accounting Notifications beginning of an Exec session: 0

Number of Accounting Notifications sent at end of an Exec session: 0

Errors when sending Accounting Notifications at end of an Exec session: 0

Number of Accounting Notifications sent at beginning of a command execution: 0

Errors when sending Accounting Notifications at beginning of a command execution: 0

Number of Accounting Notifications sent at end of a command execution: 0

Errors when sending Accounting Notifications at end of a command execution: 0

show accounting methods

Use the show accounting methods command to display the configured

accounting method lists.

Syntax

show accounting methods

Default Configuration

This command has no default setting.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Examples

console#show accounting methods

AcctType MethodName MethodType Method1 Method2

Security Commands 872

------------------------------------------------------------------

Exec dfltExecList start-stop tacacs

Commands dfltCmdList stop-only tacacs

Dot1x dfltDot1xList start-stop

Line EXEC Method List Command Method List

-------------------------------------------------

Console none none

Telnet none none

SSH none none

Command History

Example updated in the 6.4 release.

show authentication

Use this command to list the authentication methods configured on the

interface and display if the Tiered Authentication feature is enabled.

Syntax

show authentication [interface {interface-id | all}]

• interface-id—The physical interface.

•all—All interfaces.

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

console# show authentication

Tiered Authentication.......................... Enabled

Security Commands 873

console# show authentication interface gi1/0/1

Port........................................... Gi1/0/1

Authentication Restart timer................... 300

Configured method order........................ dot1x mab captive-portal

Enabled method order........................... dot1x mab undefined

Configured method priority..................... undefined undefined

undefined

Enabled method priority........................ undefined undefined

undefined

Number of authenticated clients................ 1

Logical Interface.............................. 0

client mac addr:............................... 00:00:00:00:00:01

Authenticated Method:.......................... dot1x

Auth State..................................... success

Auth Status.................................... Authenticated

show authentication authentication-history

Use this command to display the authentication history on one or more

interfaces.

Syntax

show authentication authentication-history {interface-id | all}

• interface-id—Any physical interface.

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

console#show authentication authentication-history gi1/0/1

Time Stamp Interface MAC-Address Auth Status Method

Security Commands 874

--------------------- --------- ----------------- ------------ ------

Jul 21 1919 15:06:15 Gi1/0/1 00:00:00:00:00:01 Authorized 802.1x

show authentication methods

Use the show authentication methods command to display information

about the authentication methods.

Syntax

show authentication methods

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays the authentication configuration.

console#show authentication methods

---------------------------------

defaultList : none

networkList : local

Enable Authentication Method Lists

----------------------------------

enableList : enable none

enableNetList : enable

Line Login Method List Enable Method List

------- ----------------- ------------------

Console defaultList enableList

Telnet networkList enableNetList

Security Commands 875

SSH networkList enableNetList

HTTPS :local

HTTP :local

DOT1X :

show authentication statistics

Use this command to display the Authentication Manager statistics on one or

more interfaces.

Syntax

show authentication statistics interface-id

• interface-id—The physical interface.

Default Configuration

There is no default configuration for this command.

Command Modes

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

config# show authentication statistics gi1/0/1

Port........................................... Gi1/0/1

802.1x attempts................................ 1

802.1x failed attempts......................... 0

Mab attempts................................... 0

Mab failed attempts............................ 0

Captive-portal attempts........................ 0

Captive-Portal failed attempts................. 0

Security Commands 876

show authorization methods

Use the show authorization methods command to display the configured

authorization method lists.

Syntax

show authorization methods

Default Configuration

This command has no default setting.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

Command authorization is supported only for the line, telnet, and SSH

access methods.

Example

console#show authorization methods

Exec Authorization List Methods

---------------------------- ------------------------------

dfltExecAuthList none

Command Authorization List Methods

---------------------------- ------------------------------

dfltCmdAuthList none

Line Exec Method Lists Command Method Lists

--------- --------------------- ---------------------

Console dfltExecAuthList dfltCmdAuthList

Telnet dfltExecAuthList dfltCmdAuthList

SSH dfltExecAuthList dfltCmdAuthList

Network Authorization Methods

---------------------- -------

Dot1x radius

Security Commands 877

show users accounts

Use the show users accounts command to display the local user status with

respect to user account lockout and password aging.

Syntax

show users accounts

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

User accounts are distinct from the IAS user accounts. IAS users are allowed

access to network resources when authenticating via AAA. User accounts are

switch administrators allowed access to the switch administrator console.

The following fields are displayed by this command.

Example

The following example displays information about the local user database.

Parameter Description

UserName Local user account’s user name.

Privilege User’s access level (read only-1 or

read/write-15). Use level 0 to block a

user’s access.

Password Aging Indicates whether password aging is

enabled and the password aging period.

Password Expiry Date Current password expiration date in date

format.

Lockout Displays the user’s lockout status (True or

False).

Security Commands 878

console(config)#show users accounts

UserName Privilege Password Password Lockout

Aging Expiry date

------------------------ --------- -------- -------------------- --------

admin 15 200 Jan 13 1915 00:32:12 False

Administrative Profile(s):

show users login-history

Use the show users login-history command in Global Configuration mode to

display information about the login history of users.

Syntax

show users login-history [username|long]

• username — name of user. (Range: 1-64 characters)

• long — display only the user login name

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command displays switch administrative user information.

Example

The following example shows user login history outputs.

console#show users login-history

-------------------- --------- --------- -----------

Jan 19 2005 08:23:48 Bob Serial

Jan 19 2005 08:29:29 Robert HTTP 172.16.0.8

Jan 19 2005 08:42:31 John SSH 172.16.0.1

Jan 19 2005 08:49:52 Betty Telnet 172.16.1.7

Security Commands 879

Command History

Syntax updated in 6.4 release.

username

Use the username command in Global Configuration mode to add a new user

to the local user (switch administrator) database. The default privilege level is

1. The command optionally allows the specification of an Administrative

Profile for a local user.

Use the no form of this command to remove the username from the local user

database.

Syntax

username name {nopassword|password password} [privilege level|admin-

profile profile] [encrypted]

no username name

• name—The name of the user. Range: 1-64 printable characters. The

special characters allowed in the username include ! # $ % & ‘ ( ) * +

, - . / : ; < = > @ [ \ ] ^ _ ` { | } ~. Question marks are

disallowed.User names can contain blanks if the name is surrounded by

double quotes.

•

password

—The authentication password for the user. Range: 8-64

characters. This value can be 0 [zero] if the no passwords min-length

command has been executed. The special characters allowed in the

password include ! # $ % & ‘ ( ) * + , - . / : ; < = > @ [ \ ] ^

_ ` { | } ~. Question marks are disallowed.

•

level

—The user’s privilege level. Level 0 can be assigned by a level 15 user

to another user to restrict that user’s access to configuration commands.

Supported access levels are 0, 1, or 15. Enter access level 0 to restrict the

user’s access, 1 for Read Access, or 15 for Read/Write Access.

•

nopassword—

Configure a switch administrator with no password. Note

that the SSH is configured to require a password to access the switch. Use

of a password for administrative access is highly recommended.

•

profile

—

The name of the administrative profile(s) to apply to this user.

An administrative profile is mutually exclusive with a privilege level.

Security Commands 880

•encrypted—

Encrypted password entered, copied from another switch

configuration. Password strength checking is not applied to the encrypted

string.

Default Configuration

The default privilege level is 1.

Command Mode

Global Configuration mode

User Guidelines

To use the ! character as part of the username or password string, it should be

enclosed within quotation marks. For example, username “test!xyz” password

“test!xyz” includes an exclamation point in both the username and password.

Up to 8 users may be created. If the password strength feature is enabled, it

checks for password strength and returns an appropriate error if it fails to

meet the password strength criteria. If the encrypted keyword is entered, no

password strength checking is performed as the password is encrypted and the

system does not have the capability of decrypting the password. Privilege level

0 is restricted from using Privileged Exec or any Configuration level

commands. There is effectively no difference between Privilege level

1 and 15.

The following table lists the completion messages.

Message Type Message Description

Successful Completion Message No message is displayed.

Error Completion Message Could not set user password!

Security Commands 881

Example

The following example configures user bob with password xxxyymmmm and

user level 15.

console(config)# username bob password ?

<password> Enter the password. The special characters allowed in the

password include ~ ` ! @ # $ % ^ & * ( ) _ - + = [ ] { } \ | : ; ' < > . , /.

console(config)# username bob password xxxyyymmm privilege 15

username unlock

Use the username unlock command in Global Configuration mode to unlock

a locked user account. Only a user with read/write access can reactivate a

locked user account.

Syntax

username username unlock

Reason behind the failure 1

Exceeds Minimum Length of a Password.

Password should be in the range of 8-64

characters in length. Set minimum password

length to 0 by using the passwords min-length

0 command.

Password should contain Minimum

<number> uppercase-letters,

<number> lowercase-letters, <number>

numeric numbers,

<number> special characters and

<number> character classes and

Maximum limit of <number> consecutive

alphabetic and numeric

characters.

Maximum repetition of <number>

alphabetic and number characters.

Password should not contain the

keywords <keyword1>, <keyword2>

and <keyword3> in any form (reversed,

substring or case-insensitive).

Message Type Message Description

Security Commands 882

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

This command applies to switch administrator accounts.

Privilege level 0 is restricted from using Privileged Exec or any Configuration-

level commands. There is effectively no difference between privilege level 1

and 15.

Security Commands 883

Administrative Profiles Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

The administrative profiles capability provides the network administrator

control over which commands a user (switch administrator) is allowed to

execute. The administrator is able to group commands into a “profile” and

assign a profile to a user upon authentication. This provides more granularity

than simply allowing read-only and read-write users. It may be, for example,

that a particular user is only allowed to manage the Captive Portal feature but

not allowed to manage any other of the switch features.

This capability is similar to the industry standard “User Roles” feature. The

main difference is that the Administrative Profile is obtained via

authentication rather than via authorization. This was necessary because Dell

EMC Networking does not support AAA authorization of users.

Functionally, the Administrative Profiles feature allows the network

administrator to define a list of rules which control the commands which may

be executed by a user. These rules are collected in a “profile.” A rule defines a

set of commands to which a user is permitted or denied access. Alternatively,

a rule may define a CLI command mode to which the user is permitted or

denied access. The rule numbers determine the order in which the rules are

applied: Rules are applied in descending numerical order until there is a

match. Rules may use regular expressions for command matching. All profiles

have an implicit “deny all” rule such that any command which does not

match any rules in the profile is considered to have been denied by that

profile.

It is possible to assign a user more than one profile. If there are conflicting

rules in profiles, the “permit” rule always takes precedence over the “deny”

rule, i.e., if any profile assigned to a user permits a command, then the user is

permitted access to that command. A user may be assigned up to 16 profiles.

A number of profiles are provided by default. These profiles may not be

altered by the switch administrator.

If the successful authentication method does not provide an Administrative

Profile for a user, then the user is permitted access based upon the user’s

privilege level (as in previous releases). This means that if a user successfully

Security Commands 884

passes enable authentication, the user is permitted access to all commands.

This is also true if none of the Administrative Profiles provided are configured

on the switch.

RADIUS and TACACS+

The network administrator may configure a custom attribute to be provided

by the server during authentication. The RADIUS and TACACS+

applications process this custom attribute and provide this data to the User

Manager for configuring the user profile.

The custom attribute is defined as:

cisco-av-pair=shell:roles=”roleA roleB …”

Commands in this Section

This section explains the following commands:

admin-profile

Use the admin-profile command in Global Configuration mode to create an

administrative profile. The system-defined administrative profiles cannot be

deleted. When creating a profile, the user is placed into Administrative

Profile Configuration mode.

Use the no form of the command to delete an administrative profile and all

its rules.

Syntax

admin-profile profile-name

no admin-profile profile-name

• profile-name—The name of the profile to create or delete. Range: 1 to 16

alphanumeric characters – may also include a hyphen.

admin-profile show admin-profiles

description (Administrative Profile

Configuration)

show admin-profiles brief

rule show cli modes

Security Commands 885

Default Configuration

The administrative profiles are defined by default.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

console(config)#admin-profile qos

console(admin-profile)#

description (Administrative Profile Configuration)

Use the description command in Administrative Profile Configuration mode

to add a description to an administrative profile.

Use the no form of this command to delete the description.

Syntax

description text

no description

• text—A description of, or comment about, the administrative profile. To

include white space, enclose the description in quotes. Range: 1 to 128

printable characters.

Default Configuration

This command has no default configuration.

Command Mode

Administrative Profile Configuration mode

User Guidelines

The description string is required to be enclosed in quotes if it contains

embedded white space. Question marks are disallowed.

Security Commands 886

Example

console(admin-profile)#description “This profile allows access to QoS

commands.”

rule

Use the rule command to add a rule to an administrative profile.

Use the no form of this command to delete a rule.

Syntax

rule number {deny|permit} {command command-string|mode mode-

name}

no rule number

• number—The sequence number of the rule. Rules are applied from the

highest sequence number to the lowest. Range: 1 to 256.

• command-string—Specifies which commands to permit or deny. The

command-string may contain spaces and regular expressions. The

command string is required to be enclosed in quotes if it contains

embedded white space. Range: 1 to 128 characters). Regular expressions

should conform to Henry Spencer’s implementation of the POSIX 1003.2

specification.

NOTE: Note: In this usage, the beginning and end of line meta-characters have no

meaning.

• mode-name—The name of the CLI mode to which the profile will permit

or deny access.

Default Configuration

This command has no default configuration.

Command Mode

Administrative Profile Configuration mode

User Guidelines

This command has no user guidelines.

Security Commands 887

Example

console(admin-profile)#rule 1 permit command “access-list *”

console(admin-profile)#

show admin-profiles

Use the show admin-profiles command to show the administrative profiles. If

the optional profile name parameter is used, only that profile will be shown.

Syntax

show admin-profiles [name profile-name]

•

profile-name

—The name of the administrative profile to display.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The following admin profiles are predefined and may not be deleted or

changed by the administrator:

• Profile: network-admin

• Profile: network-security

• Profile: router-admin

• Profile: multicast-admin

• Profile: dhcp-admin

• Profile: CP-admin

• Profile: network-operator.

Example

console#show admin-profiles name qos

Profile: qos

Security Commands 888

Description: This profile allows access to QoS commands.

Rule Perm Type Entity

---- ------ ------- ----------------------------------------

1 permit command access-list *

2 permit command access-group *

3 permit mode class-map

show admin-profiles brief

Use the show admin-profiles brief command to list the names of the

administrative profiles defined on the switch.

Syntax

show admin-profiles brief

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

console#show admin-profiles brief

Profile: network-admin

Profile: network-security

Profile: router-admin

Profile: multicast-admin

Profile: dhcp-admin

Profile: CP-admin

Profile: network-operator

Security Commands 889

show cli modes

Use the show cli modes command to list the names of all the CLI modes.

Syntax

show cli modes

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

These are the generic mode names to be used in the

rule

command above.

These are not the same as the prompt which is displayed in a particular mode.

Example

console#show cli modes

user-exec

privileged-exec

global-config

ethernet-config

port-channel-config

Security Commands 890

E-mail Alerting Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

E-mail Alerting is an extension of the logging system. The Dell EMC

Networking logging system allows the user to configure a variety of

destinations for log messages. This feature adds e-mail configuration

capabilities, by which the log messages are sent to a configured SMTP server

such that an operator may receive the log in an e-mail account of their choice.

Figure 1: Log Messages Severity Level

The network operator can adjust the urgent and non-urgent severity levels.

These levels are global and apply to all destination e-mail addresses. Log

messages in the urgent group are sent immediately to SMTP server with each

log message in a separate mail. Log messages in the non-urgent group are

batched into a single e-mail message and after a configurable delay.

Only the minimum part (MUA functionality of RFC 4409) required by the

switch or router to send the messages to the SMTP server is supported. Some

SMTP servers insist on authentication before the messages may be received

by them. The minimum part (MUA functionality of RFC 4954) required by

the switch or router to become authenticated by the SMTP server is

supported. Only plain text authentication is supported.

Commands in this Section

This section explains the following commands:

Security Commands 891

logging email

Use the logging email command in Global Configuration mode to enable e-

mail alerting and set the lowest severity level for which log messages are e-

mailed. Use the no form of the command to disable e-mail alerting.

Syntax

logging email [severity]

no logging email

• severity—If you specify a severity level, log messages at or above the

severity level are e-mailed. The severity level may either be specified by

keyword or as an integer from 0 to 7. The accepted keywords, and the

numeric severity level each represents, are as follows.

– emergency (0)

– alert (1)

– critical (2)

– error (3)

– warning (4)

– notice (5)

– info (6)

– debug (7)

logging email show logging email statistics

logging email urgent clear logging email statistics

logging email message-type to-addr security

logging email from-addr mail-server ip-address | hostname

logging email message-type subject port (Mail Server Configuration Mode)

logging email logtime username (Mail Server Configuration

Mode)

logging email test message-type password (Mail Server Configuration

Mode)

–

show mail-server

Security Commands 892

Default Configuration

E-mail alerting is disabled by default. When e-mail alerting is enabled, log

messages at or above severity Warning are e-mailed.

Command Mode

Global Configuration mode

User Guidelines

The logging email command with no arguments enables e-mail alerting.

Specify a severity to set the severity level of log messages that are e-mailed in

a non-urgent manner. Log messages at or above this severity level, but below

the urgent severity level, are collected together until the log time expires (the

time specified in the

logging email logtime

command) and then e-mailed in a

single e-mail message. If you set the non-urgent severity level to the same

value as the urgent severity level, then no log messages are e-mailed non-

urgently. See the

logging email urgent

command to specify the urgent severity

level. The command no logging email disables all e-mail alerting.

logging email urgent

Use the logging email urgent command in Global Configuration mode to set

the lowest severity level at which log messages are e-mailed in an urgent

manner. To revert the urgent severity level to its default value, use the no

form of this command.

Syntax

logging email urgent {severity | none}

no logging email urgent

• severity—If you specify a severity level, log messages at or above the

severity level are e-mailed. The severity level may either be specified by

keyword or as an integer from 0 to 7. The accepted keywords, and the

numeric severity level each represents, are as follows.

– emergency (0)

– alert (1)

– critical (2)

Security Commands 893

– error (3)

– warning (4)

– notice (5)

– info (6)

– debug (7)

•none—

If you specify this keyword, no log messages are e-mailed urgently. All log

messages at or above the non-urgent level (configured with the logging email

command) are e-mailed in batch.

Default Configuration

The default severity level is alert.

Command Mode

Global Configuration mode

User Guidelines

Log messages at or above this severity level are considered urgent. By default,

Emergency and Alert log messages are considered urgent. Urgent log

messages are e-mailed immediately, one log message per e-mail message, and

do not wait for the log time to expire. Urgent log messages are not e-mailed

unless you enable e-mail alerting with the logging email command.

logging email message-type to-addr

Use the logging email message-type to-addr command in Global

Configuration mode to configure the To address field of the e-mail. The

message types supported are urgent, non-urgent, and both. For each

supported severity level, multiple e-mail addresses can be configured. For

example, for urgent type of messages, there could be multiple addresses

configured.

Syntax

logging email message-type {urgent | non-urgent | both} to-addr to-email-

addr

no logging email to-addr to-addr message-type

Security Commands 894

no logging email message-type {urgent | non-urgent | both} to-addr

to-

email-addr

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration

User Guidelines

The to-email-addr is the address to which the email is sent.

Urgent | non-urgent | both—The priority with which the email is queued.

Urgent email is sent immediately. Non-urgent email is queued and sent

periodically.

Example

console(config)#logging email message-type urgent to-addr admin123@dell.com

Command History

Example added in the 6.4 release.

logging email from-addr

Use the logging email from-addr command in Global Configuration mode to

configure the From address of the e-mail. Use the no form of this command

to remove the e-mail source address.

Syntax

logging email from-addr

from-email-addr

no logging email from-addr

Default Configuration

This command has no default configuration.

Security Commands 895

Command Mode

Global Configuration

User Guidelines

The from-addr in this command is the email address of the email sender.

Many mail servers will validate the from address of an email to ensure that

abuse of the email server does not occur.

Example

console(config)#logging email from-addr dell@gmail.com

Command History

Example added in the 6.4 release.

logging email message-type subject

Use the logging email message-type subject command in Global

Configuration mode to configures subject of the e-mail. Use the no form of

this command to remove the existing subject and return to the default

subject.

Syntax

logging email message-type message-type subject subject

no logging email message-type message-type subject

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration

User Guidelines

The user must enter the message-type parameter manually as tab and space

bar completion do not work for this parameter.

Security Commands 896

Example

console(config)#logging email message-type urgent subject UrgentLog

Command History

Example added in the 6.4 release.

logging email logtime

Use the logging email logtime command in Global Configuration mode to

configure the value of how frequently the queued messages are sent.

Syntax

logging email logtime time duration

no logging email logtime

• time duration—

Time in minutes. Range: 30 – 1440.

Default Configuration

The default value is 30 minutes.

Command Mode

Global Configuration

User Guidelines

This command has no user guidelines.

Example

console(config)#logging email logtime 50

Command History

Example added in the 6.4 release.

Security Commands 897

logging email test message-type

Use the logging email test message-type command in Global Configuration

mode to test whether or not an e-mail is being sent to an SMTP server.

Syntax

logging email test message-type message-type message-body message-body

• message-type—Urgent, non-urgent, or both

•

message-body

—

The message to log. Enclose the message in double quotes if it

contains any spaces.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration

User Guidelines

This command has no user guidelines.

Example

console(config)#logging email test message-type urgent message-body

urgentlog

Command History

Example added in the 6.4 release.

show logging email statistics

Use the show logging email statistics command to show the statistics about

the e-mails. The command displays information on how many e-mails are

sent, how many e-mails failed, how long it has been since the last e-mail was

sent.

Syntax

show logging email statistics

Security Commands 898

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec

User Guidelines

This command has no user guidelines.

Example

console#show logging email statistics

No of email Failures so far.................... 0

No of email sent so far......................... 0

Time since last email Sent.................... 00 days 00 hours 00 mins 00

secs

clear logging email statistics

Use the clear logging email statistics command to clear the e-mail alerting

statistics.

Syntax

clear logging email statistics

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec

User Guidelines

This command has no user guidelines.

Example

console#clear logging email statistics

Security Commands 899

Command History

Example added in the 6.4 release.

security

Use the security command in Mail Server Configuration mode to set the e-

mail alerting security protocol. This enables and disables the switch to use

TLS authentication with the SMTP Server. If the administrator sets the TLS

mode and, if the SMTP sever does not support TLS mode, then no e-mail

goes to the SMTP server.

Syntax

security {tlsv1 | none}

Default Configuration

The default value is disabled.

Command Mode

Mail Server Configuration

User Guidelines

This command has no user guidelines.

Example

console(config)#mail-server 10.131.1.11

console(mail-server)#security tlsv1

Command History

Example added in the 6.4 release.

mail-server ip-address | hostname

Use the mail-server ip-address | hostname command in Global

Configuration mode to configure the SMTP server IP address and change the

mode to Mail Server Configuration mode. Use the no form of this command

to remove the configured SMTP server address.

Security Commands 900

Syntax

mail-server {ip-address |

hostname

}

no mail-server {ip-address | hostname}

• ip-address—An IPv4 or IPv6 address.

• hostname—

The DNS name of an SMTP server.

Default Configuration

The default configuration for a mail server is shown in the table below.

Command Mode

Global Configuration

User Guidelines

The server address can be in the IPv4, IPv6, or DNS FQDN name format.

port (Mail Server Configuration Mode)

Use the port command in Mail Server Configuration mode to configure the

TCP port to use for communication with the SMTP server. The default for no

security is 25 (SMTP). The port for TLSv1 is port 465. The range is 1025 to

65535. Use the no form of the command to revert the SMTP port to the

default port.

Syntax

port port

no port

Field Default

Email Alert Mail Server Port 25

Email Alert Security Protocol none

Email Alert Username admin

Email Alert Password admin

Security Commands 901

Default Configuration

The default value is 25 (SMTP).

Command Mode

Mail Server Configuration

User Guidelines

Port 25 is the standard SMTP port for cleartext messages. Port 465 is the

standard port for messages sent using TLSv1.

Example

console(config)#mail-server 10.131.1.11

console(mail-server)#port 1024

Command History

Example added in the 6.4 release.

Description updated in the 6.4 release.

username (Mail Server Configuration Mode)

Use the username command in Mail Server Configuration mode to configure

the username required by the authentication. Use the no form of the

command to revert the username to the default value.

Syntax

username

no username

Default Configuration

The default value for username is admin.

Command Mode

Mail Server Configuration

Security Commands 902

User Guidelines

This command has no user guidelines.

Example

console(config)#mail-server 10.131.1.11

console(mail-server)#username admin

Command History

Example added in the 6.4 release.

password (Mail Server Configuration Mode)

Use the password command in Mail Server Configuration mode to configure

the password required to authenticate to the e-mail server. Use the no form of

the command to revert the password to the default value.

Syntax

password

no password

Default Configuration

The default value for password is admin.

Command Mode

Mail Server Configuration

User Guidelines

This command has no user guidelines.

Example

console(config)#mail-server 10.131.1.11

console(mail-server)#password admin123

Command History

Example added in the 6.4 release.

Security Commands 903

show mail-server

Use the show mail-server command to display the configuration of all the

mail servers or a particular mail server.

Syntax

show mail-server {ip-address | hostname | all}

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

This command has no user guidelines.

Example

console#show mail-server all

Mail Servers Configuration:

No of mail servers configured......................1

Email Alert Mail Server Address.................. 10.131.1.11

Email Alert Mail Server Port........................ 465

Email Alert SecurityProtocol........................ tlsv1

Email Alert Username................................ admin

Email Alert Password................................ password

console#show mail-server all

Mail Servers Configuration:

No of mail servers configured......................1

Email Alert Mail Server Address.................. 10.131.1.11

Email Alert Mail Server Port........................ 465

Email Alert SecurityProtocol........................ tlsv1

Email Alert Username................................ admin

Email Alert Password................................ password

console#show mail-server 10.131.1.11

Security Commands 904

Email Alert Mail Server Address................ 10.131.1.11

Email Alert Mail Server Port................... 465

Email Alert SecurityProtocol................... tlsv1

Email Alert Username........................... admin

Email Alert Password........................... password

Command History

Example added in the 6.4 release.

Security Commands 905

RADIUS Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Authentication of users in a large network can be significantly simplified by

making use of a single database of accessible information supplied by an

Authentication Server. These servers commonly use the Remote

Authentication Dial In User Service (RADIUS) protocol as defined by RFC

2865.

RADIUS permits access to a user’s authentication and configuration

information contained on the server only when requests are received from a

client that shares an encrypted secret with the server. This secret is never

transmitted over the network in an attempt to maintain a secure

environment. Any requests from clients that are not appropriately configured

with the secret or access from unauthorized devices are silently discarded by

the server.

RADIUS conforms to a client/server model with secure communications

using UDP as a transport protocol. It is extremely flexible, supporting a

variety of methods to authenticate and statistically track users. It is very

extensible allowing for new methods of authentication to be added without

disrupting existing network functionality.

Dell EMC Networking supports a RADIUS client in conformance with RFC

2865 and accounting functions in conformance with RFC2866. The RADIUS

client will apply user policies under control of the RADIUS server, e.g.

password lockout or login time of day restrictions. The RADIUS client

supports up to 32 named authentication and accounting servers.

For the N1100-ON and N1500 Series switches, the number of supported

authentication and accounting servers is 8.

RADIUS-based Dynamic VLAN Assignment

If a VLAN assignment is enabled in the RADIUS server, then as part of the

response message, the RADIUS server sends the VLAN ID that the client is

requested to use in the 802.1x tunnel attributes. If dynamic VLAN creation is

enabled on the switch and the RADIUS assigned VLAN does not exist on the

supplicant connected interface, the assigned VLAN is dynamically created.

Security Commands 906

This implies that the client can connect from any port and be assigned to the

appropriate VLAN, which may be already configured on an uplink interface.

This gives flexibility for clients to move around the network with out

requiring the operator to perform additional provisioning for each network

interface.

RADIUS Change of Authorization

Dell EMC Networking supports the Change of Authorization Disconnect -

Request per RFC 3575. The Dell EMC Networking switch listens for the

Disconnect-Request on UDP port 3799. The Disconnect-Request identifies

the user session to be terminated using the following attributes:

• State (IETF attribute #24)

• Acct-Session-Id (IETF attribute #44)

• Calling-Station-Id (IETF attribute #31, which contains the host MAC

address)

The following messages from RFC 3575 are supported:

• 40 - Disconnect-Request

• 41 - Disconnect-ACK

• 42 - Disconnect-NAK

A CoA Disconnect-Request terminates the session without disabling the

switch port. Instead, CoA Disconnect-Request termination causes re-

initialization of the authenticator state machine for the specified host. MAC

port control can be enabled for 802.1x sessions. In this case, if the RADIUS

server issues a disconnect request and subsequently does not authorize the

MAC address to access network resources, the host is effectively denied

network access.

If the session cannot be located, the device returns a Disconnect-NAK

message with the “Session Context Not Found” error-code attribute. If the

session is located, the device terminates the session. After the session has

been completely removed, the device returns a Disconnect-ACK message.

The attributes returned within a CoA ACK can vary based on the CoA

Request.

Security Commands 907

The administrator can configure whether all or any of the session attributes

are used to identify a client session. If all is configured, all session

identification attributes included in the CoA Disconnect-Request must

match a session or the device returns a Disconnect-NAK or CoA-NAK with

the “Invalid Attribute Value” error-code attribute.

Dell EMC Networking supports the following attributes in responses:

• State (IETF attribute #24)

• Calling-Station-ID (IETF attribute #31)

• Acct-Session-ID (IETF attribute #44)

• Message-Authenticator (IETF attribute #80)

• Error-Cause (IETF attribute #101)

A CoA NAK message is not sent for all CoA requests with a key mismatch.

The message is sent only for the first three requests for a client. After that, all

the packets from that client are dropped. When there is a key mismatch, the

response authenticator sent with the CoA NAK message is calculated from a

dummy key value.

The Dell EMC Networking switch starts listening to the client again based on

re-authentication timer.

Refer to the RADIUS Change of Authorization section in the Users

Configuration Guide for examples of configuring RADIUS CoA.

Commands in this Section

This section explains the following commands:

acct-port primary radius-server source-ip

attribute 6 priority radius-server source-

interface

attribute 8 radius-server attribute 4 radius-server timeout

attribute 25 radius-server attribute 6 retransmit

attribute 31 radius-server attribute 8 show aaa servers

authentication event fail

retry

radius-server attribute 25 show radius statistics

Security Commands 908

acct-port

Use the acct-port command to set the port on which the RADIUS accounting

server listens for connections. Use the no form of this command to reset the

port to the default.

Syntax

acct-port port

no acct-port

• port — The layer 4 port number of the accounting server (Range: 1 -

65535).

Default Configuration

The default value of the port number is 1813.

Command Mode

RADIUS Server Accounting mode

User Guidelines

There are no user guidelines for this command.

Example

The following example sets port number 56 for accounting requests.

console(config)#radius-server host acct 3.2.3.2

console(Config-acct-radius)#acct-port 56

auth-port radius-server attribute 31 source-ip

deadtime radius-server deadtime timeout

key radius-server host usage

msgauth radius-server key

–

name (RADIUS server) radius-server retransmit

–

Security Commands 909

attribute 6

Use the attribute 6 command to configure processing of the RADIUS

Service-Type attribute.

Syntax

attribute 6 [on-for-login-auth|mandatory]

no attribute 6 [on-for-login-auth|mandatory]

Default Configuration

By default, the Service-Type is not included in the Access-Request message

sent to the authentication server.

Command Mode

RADIUS Server Configuration

User Guidelines

on-for-login

—If the on-for-login parameter is enabled, the Service-Type TLV is

send in the Access-Request message.

mandatory—If the mandatory parameter is enabled, the Service-Type

attribute is required and validated in the Access-Accept packet received from

the RADIUS server. Dell EMC Networking N-Series switches accept the

message returned from the RADIUS server. If the mandatory parameter is not

configured, the Service-Type TLV received in an Access-Accept packet is

ignored.

Command History

Introduced in version 6.3.0.1 firmware. Updated in 6.3.5.0 firmware.

Example

This example configures the switch to send the Service-Type attribute to the

RADIUS server in the Access-Request message.

console#conf

console(config)#radius-server host 4.3.2.1

console(config-auth-radius)#attribute 6 on-for-login-auth

Security Commands 910

This example configures the switch to process and validate the Service-Type

received in the Access-Accept message from the RADIUS server.

console#conf

console(config)#radius-server host 4.3.2.1

console(config-auth-radius)#attribute 6 mandatory

attribute 8

Use the attribute 8 command to configure the switch to send the RADIUS

Framed-IP-Address attribute in the Access-Request message sent to a specific

RADIUS authentication server. The switch sends the IP address of the host

attempting to authenticate in the Framed-IP-Address attribute in the Access-

Request sent to the authentication server.

Syntax

attribute 8 include-in-access-req

no attribute 8 include-in-access-req

Default Configuration

By default, the Service-Type is not included in the Access-Request message

sent to the authentication server.

Command Mode

RADIUS Server Configuration

User Guidelines

There are no user guidelines for this command.

Command History

Introduced in version 6.3.0.1 firmware.

Example

console#conf

console(config)#radius-server host 4.3.2.1

console(config-auth-radius)#attribute 8 include-in-access-req

Security Commands 911

attribute 25

Use the attribute 25 command to enable the switch to send the RADIUS

Class attribute as supplied by the RADIUS server in accounting messages

sent to the specific accounting server.

Syntax

attribute 25 include-in-access-req

no attribute 25 include-in-access-req

Default Configuration

By default, the Service-Type is included in the accounting messages sent to

the accounting server.

Command Mode

RADIUS Server Configuration

User Guidelines

The switch sends the value supplied by the RADIUS server in the Class

attribute. The Class attribute may be up to 16 octets in length

Command History

Introduced in version 6.3.0.1 firmware.

Example

console#conf

console(config)#radius-server host 4.3.2.1

console(config-auth-radius)#attribute 25 include-in-access-req

attribute 31

Use the attribute 31 command to alter the format of the MAC address sent to

the RADIUS server in the Calling-Station-Id attribute and the USER-NAME

attribute when authenticating using 802.1X MAC based authentication for

an interface. Use the no form of the command to return the MAC address

format to the default.

Security Commands 912

Syntax

attribute 31 mac format { ietf | unformatted | legacy } [lower-case | upper-

case]

no attribute 31 mac format

• ietf—Format the MAC address as aa-aa-bb-bb-cc-cc. The default is upper

case.

• unformatted—Format the MAC address as aaaabbbbcccc. The default is

lower case.

• legacy—Format the MAC address as aa:aa:bb:bb:cc:cc. The default is lower

case.

• lower-case—Format hexadecimal characters using the character set [0-9a-

f].

• upper-case—Format hexadecimal characters using the character set [0-9A-

F].

Default Configuration

There is no default configuration.

Command Mode

RADIUS Server Configuration

User Guidelines

Use this command to override the formats of MAC addresses sent in

authentication requests for ports configured for MAC based 802.1x

authentication for a specific interface.

This command is only valid for 802.1X authentication.

This command overrides the global configuration for attribute 31 (Calling-

Station-ID) and attribute 1 (User-Name) on a specific interface.

Command History

Introduced in version 6.3.0.1 firmware.

Security Commands 913

Example

This example configures the format of the MAC address sent in MAC based

authentication to IETF lower case for the RADIUS server at address 1.2.3.4.

MAB must be configured on the switch in an active authentication list, IEEE

802.1X must be configured, and a RADIUS server must also be configured.

console(config)#radius-server host 1.2.3.4

console(config-auth-radius)# attribute 31 mac format ietf lower-case

authentication event fail retry

Use the authentication event fail retry command to select the number of

times authentication is reattempted by the user for an IEEE 802.1X

supplicant. Use the no form of the command to return the number of

maximum attempts to the default value.

Syntax

authentication event fail retry max-attempts

no authentication event fail retry

• max-attempts — The number of times RADIUS authentication is allowed

to fail before failing the authentication and moving to the next

authentication method. Default 1. Range 1–5.

Default Configuration

By default, the number of failed authentication attempts is 1. An

authentication failure is declared failed after a single authentication attempt

and the next authentication method is attempted.

Command Mode

Interface Configuration mode, Interface Range mode

User Guidelines

The authentication manager must be enabled for this command to have

effect.

This command is only applicable to IEEE 802.1X authentication with a

RADIUS server. It has no effect on any other authentication method.

Security Commands 914

This parameter is independent of, and does not control, the number of times

the authenticator will attempt to contact the RADIUS servers. For example, if

the max-retries for a single configured RADIUS server is set to 3 and the max-

attempts is set to 2, on a supplicant login attempt, the authenticator will send

up to three access requests to the RADIUS server before returning failure.

The authenticator will then re-invoke supplicant authentication method

which allows the RADIUS back end to again send up to three requests to the

RADIUS server before the authenticator allows IEEE 802.1x to stop

supplicant authentication and to invoke the quiet period for the supplicant.

This command sets the limit for retring failed authentications for RADIUS.

The switch attempts authentication based on the selected method and if

authentication returns an error (as opposed to a failure), the next

authentication method is attempted regardless of this setting.

For example, if one or multiple RADIUS servers are configured and no

RADIUS server responds to the authentication message, RADIUS returns an

error and the next authentication method is attempted even when the retry

parameter is configured to a value larger than 1.

Example

The following example configures the switch to allow IEEE 802.1X

supplicants to fail authentication (e.g., enter incorrect passwords) three times

before invoking the quiet timer on the interface.

console#conf

console(config)#authentication enable

console(config)#interface gi1/0/3

console(config-if-Gi1/0/3)#authentication order dot1x

console(config-if-Gi1/0/3)#authentication event fail retry 3

Command History

Introduced in version 6.3.0.1 firmware.

auth-port

Use the auth-port command in RADIUS Server Configuration mode to set

the port number on which the RADIUS server listens for authentication

requests.

Security Commands 915

Syntax

auth-port auth-port-number

• auth-port-number — Port number for authentication requests. (Range: 1 -

65535)

Default Configuration

The default value of the port number is 1812.

Command Mode

RADIUS Server Configuration mode

User Guidelines

User must enter the mode corresponding to a specific RADIUS Server

Configuration before executing this command.

Example

The following example sets the port number 2412 for authentication

requests.

console(config)#radius-server host 192.143.120.123

console(config-auth-radius)#auth-port 2412

deadtime

Use the deadtime command in RADIUS Server Configuration mode to

configure the minimum amount of time to wait before attempting to

recontact an unresponsive RADIUS server. If a RADIUS server is currently

active and responsive, that server will be used until it no longer responds.

RADIUS servers whose deadtime interval has not expired are skipped when

searching for a new RADIUS server to contact.

Syntax

deadtime deadtime

• deadtime — The amount of time that the unavailable server is skipped

over. (Range: 0-2000 minutes)

Security Commands 916

Default Configuration

The default deadtime interval is 0 minutes.

Command Mode

RADIUS Server Configuration mode

User Guidelines

If only one RADIUS server is configured, it is recommended to use a

deadtime interval of 0.

Example

The following example specifies a deadtime interval of 60 minutes.

console(config)#radius-server host 192.143.120.123

console(config-auth-radius)#deadtime 60

key

Use the key command to specify the encryption key which is shared with the

RADIUS server. Use the no form of this command to remove the key.

Syntax

key [ 0|7] key-string

no key

• 0—The key string that follows is the unencrypted shared secret. The

length is 1–128 characters.

• 7—The key string that follows is the encrypted shared secret. The length is

exactly 256 characters.

• key-string — The key string in encrypted or unencrypted form. In

encrypted form, it must be 256 characters in length. In unencrypted form,

it may be up to 128 characters in length.

Default Configuration

There is no key configured by default.

Security Commands 917

Command Mode

RADIUS Server Configuration mode

User Guidelines

There are no user guidelines for this command.

In an Access-Request, encrypted passwords are sent using the RSA Message

Digest algorithm (MD5).

If no encryption parameter (7) is present, the key string is interpreted as an

unencrypted shared secret.

Keys are always displayed in their encrypted form in the running

configuration.

The encryption algorithm is the same across switches. Encrypted passwords

may be copied from one switch and pasted into another switch.

Command History

Updated in version 6.3.0.1 firmware.

Example

The following two examples globally configure the RADIUS server key for all

configured servers. The two examples are identical in effect.

console(config)#radius-server host 1.2.3.4

console(config-auth-radius)#key "This is a key string"

console(config-auth-radius)#key 0 "This is a key string"

msgauth

Use the msgauth command to enable the message authenticator attribute to

be used for the RADIUS Authenticating server being configured. Use the

“no” form of this command to disable the message authenticator attribute.

Syntax

msgauth

no msgauth

Security Commands 918

Default Configuration

The message authenticator attribute is enabled by default.

Command Mode

RADIUS Server Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console(Config-auth-radius)#msgauth

name (RADIUS server)

Use the name command to assign a name to a RADIUS server. Use the no

form of the command to return the name to the default (Default-RADIUS-

Server). The no form of the command does not require the user to enter the

configured name.

Syntax

name servername

no name

• servername—The name for the RADIUS server (Range: 1 - 32 characters).

Default Configuration

The default RADIUS server name is Default-RADIUS-Server.

Command Mode

RADIUS Server Configuration mode

User Guidelines

Names may only be set for authentication servers, not for accounting servers.

Names may consist of alphanumeric characters and the underscore, dash and

blanks.Embed the name in double quotes to use a name with blanks.

Security Commands 919

Note that, when multiple RADIUS servers are configured with different

names (for example, ServerName is name1 and address is 1.1.1.1 and

ServerName is name2 and address is 1.1.1.2):

The RADIUS request is always sent to the first ordered name server list, i.e.

name1 server list would be tried before moving on to name2. Even if the

priority value of servers in name2 is lower (lower value indicates high priority)

the request would be sent to the name1 servers. If for name1 list, the

configured servers fail to respond, the request is sent to the second configured

name list.

Within the same server list, the first primary server would be tried. You can

have multiple secondary servers in the same name list. From the multiple

secondary servers, the one with the lowest priority value would be tried. For a

different named server list, the server name would be based on lexicographic

order. For example, if name9, name1, name6 are configured in this order,

name1, then name6, then name9 would be tried.

Example

console(config)#radius-server host 44.44.44.44

console(config-auth-radius)#name NAME

console(config-auth-radius)#no name

primary

Use the primary command to specify that a configured server should be the

primary server in the group of authentication servers which have the same

server name. Multiple primary servers can be configured for each group of

servers which have the same name. When the RADIUS client has to perform

transactions with an authenticating RADIUS server of the specified name, it

uses the primary server that has the specified server name by default. If it fails

to communicate with the primary server for any reason, it uses the backup

servers configured with the same server name. These backup servers are

identified as the “Secondary” type.

Syntax

primary

Default Configuration

There is no primary authentication server by default.

Security Commands 920

Command Mode

RADIUS Server Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console(Config-auth-radius)#primary

priority

Use the priority command in RADIUS Server Configuration mode to specify

the order in which the servers are to be used, with 0 being the highest priority.

Syntax

priority priority

• priority — Sets server priority level. (Range 0-65535)

Default Configuration

The default priority is 0.

Command Mode

RADIUS Server Configuration mode

User Guidelines

User must enter the mode corresponding to a specific RADIUS server before

executing this command.

Example

The following example specifies a priority of 10 for the designated server.

console(config)#radius-server host 192.143.120.123

console(config-auth-radius)#priority 10

Security Commands 921

radius-server attribute 4

Use the radius-server attribute 4 command to set the network access server

(NAS) IPv4 address for the RADIUS server. The NAS-IP-Address is RADIUS

attribute number 4. Use the no version of the command to set the value to

the default.

Syntax

radius-server attribute 4 ip-address

no radius-server attribute 4

• ip-address — Specifies the IPv4 address to be used as the RADIUS

attribute 4, the NAS-IP-Address.

Default Configuration

If a RADIUS server has been configured on the switch, the default NAS-IP-

Address sent to the RADIUS server is the address of the switch or the address

of the interface over which the Access-Request is sent.

Command Mode

Global Configuration mode

User Guidelines

This command does not alter the address in the IP header in Access-Requests

transmitted to the RADIUS server. It only configures the NAS-IP-Address

attribute sent to the RADIUS server inside the RADIUS Access-Request

packet. This capability is useful when configuring multiple RADIUS clients

(switches) to simulate a single RADIUS client for scalability. The RADIUS

Acct-Session-Id may overlap if multiple switches are configured with the

same NAS-IP-Address.

The configured NAS-IP-Address need not be the same as the IPv4 source

address transmitted in the IP header. Use the radius-server source-ip

command to configure the IPv4 source address transmitted in the IP header.

Example

The following example sets the NAS IP address RADIUS attribute 4 to

192.168.10.22.

Security Commands 922

console(config)#radius-server attribute 4 192.168.10.22

radius-server attribute 6

Use the radius-server attribute 6 command to configure the use of the

RADIUS Service-Type attribute.

Syntax

radius-server attribute 6 [on-for-login-auth|mandatory]

no radius-server attribute 6 [on-for-login-auth|mandatory]

Default Configuration

By default, the switch does not send the Service-Type attribute to the

RADIUS server in the Access-Request packets. By default, the switch ignores

the Service-Type received in Access-Accept packets.

Command Mode

Global Configuration

User Guidelines

on-for-login—This parameter globally configures the switch to send the

RADIUS Service-Type attribute in the Access-Request message sent to all

RADIUS authentication servers. The switch sends the Service-Type value

Administrative (6) for administrators attempting to access the switch console

and sends Service-Type value Login (1) for users attempting to access the

network.

mandatory—This parameter enables processing and validation of the Service-

Type parameter received from the RADIUS server in Access-Accept messages.

Dell EMC Networking N-Series switches accept the Login-User (1) or

Administrative-User (6) values in the Access-Accept message returned from

the RADIUS server. Access-Accept messages without one of those values are

treated as if an Access-Reject message has been received.

Command History

Introduced in version 6.3.0.1 firmware. Updated in 6.3.0.5 firmware.

Security Commands 923

Example

This command configures the switch to send the Service-Type attribute in the

Access-Request message sent to the RADIUS server.

console#conf

console(config)#radius-server attribute 6 on-for-login-auth

radius-server attribute 8

Use the radius-server attribute 8 command to enable the switch to send the

RADIUS Framed-IP-Address attribute in authentication messages sent to the

authentication server.

Syntax

radius-server attribute 8 include-in-access-req

no rradius-server attribute 8 include-in-access-req

Default Configuration

By default, the switch does not send the Framed-IP-Address attribute to the

authentication server.

Command Mode

Global Configuration

User Guidelines

The switch sends the IP address of the host attempting to access the network

in the Framed-IP-Address attribute.

Command History

Introduced in version 6.3.0.1 firmware.

Example

console#conf

console(config)#radius-server attribute 8 include-in-access-req

Security Commands 924

radius-server attribute 25

Use the radius-server attribute 25 command to globally enable the switch to

send the RADIUS Class attribute as supplied by the RADIUS server in

accounting messages sent to the accounting server.

Syntax

radius-server attribute 25 include-in-access-req

no radius-server attribute 25 include-in-access-req

Default Configuration

By default, the switch sends the Class attribute to the accounting server.

Command Mode

Global Configuration

User Guidelines

The switch sends the value supplied by the RADIUS server in the Class

attribute. The Class attribute may be up to 16 octets in length

Command History

Introduced in version 6.3.0.1 firmware.

Example

console#conf

console(config)#radius-server attribute 25 include-in-access-req

radius-server attribute 31

Use the radius-server attribute 31 command to alter the format of the MAC

address sent to the RADIUS server when authenticating using 802.1X MAC

based authentication. Use the no form of the command to return the MAC

address format to the default.

Security Commands 925

Syntax

radius-server attribute 31 mac format { ietf | unformatted | legacy } [lower-

case | upper-case]

no radius-server attribute 31 mac format

•ietf—Format the MAC address as aa-aa-bb-bb-cc-cc. The default is upper

case.

•unformatted—Format the MAC address as aaaabbbbcccc. The default is

lower case.

•legacy—Format the MAC address as aa:aa:bb:bb:cc:cc. The default is

lower case.

•lower-case—Format hexadecimal characters using the character set [0-9a-

f].

•upper-case—Format hexadecimal characters using the character set [0-9A-

F].

Default Configuration

By default, the switch sends the Calling-Station-Id MAC address in lower

case legacy format and the User-Name (Attribute 1) is sent in legacy upper

case format.

Command Mode

Global Configuration

User Guidelines

Use this command to override the format of MAC addresses sent in the

Calling-Station-Id (attribute 31) and the User-Name (attribute 1) for

authentication requests for ports configured for MAC based 802.1x

authentication (MAB).

This command is only valid for 802.1X authentication.

This command does not override interface configuration for attribute 31 or

attribute 1.

Command History

Introduced in version 6.3.0.1 firmware.

Security Commands 926

Example

This example globally configures the format of the MAC address sent in the

Calling-Station-Id attribute and the User-Name attribute when using MAC

based authentication to IETF lower case. It also configures interface Gi1/0/1

to use MAB. MAB must be configured on the switch in an active

authentication list, IEEE 802.1X must be configured, and a RADIUS server

must also be configured.

console(config)#radius-server attribute 31 mac format ietf lower-case

console(config)#interface gi1/0/1

console(config-if-Gi1/0/1)#dot1x port-control mac-based

"console(config-if-Gi1/0/1)#dot1x mac-auth-bypass"

radius-server deadtime

Use the radius-server deadtime command to configure the minimum amount

of time to wait before attempting to recontact an unresponsive RADIUS

server. To set the deadtime to 0, use the no form of this command.

Syntax

radius-server deadtime deadtime

no radius-server deadtime

• deadtime — Length of time in minutes, for which a RADIUS server is

skipped over by transaction requests. (Range: 0–2000 minutes). Deadtime

is used to mark an unavailable RADIUS server as dead until this user-

configured time expires. Deadtime is configurable on a RADIUS server

basis.

Default Configuration

The default dead time is 0 minutes.

Command Mode

Global Configuration mode

Security Commands 927

User Guidelines

If only one RADIUS server is configured, it is recommended that the

deadtime interval be left at 0. If a RADIUS server is currently active and

responsive, that server will be used until it no longer responds. RADIUS

servers whose deadtime interval has not expired are skipped when searching

for a new RADIUS server to contact.

Example

The following example sets the minimum interval for a RADIUS server will

not be contacted after becoming unresponsive.

console(config)#radius-server deadtime 10

radius-server host

Use the radius-server host command to specify a RADIUS server host and

enter RADIUS Server Configuration mode. To delete the specified RADIUS

host, use the no form of this command.

Syntax

radius-server host [acct | auth] {ip–address | hostname}

no radius-server host [acct | auth] {ip–address | hostname}

•acct | auth—The type of server (accounting or authentication).

• ip–address—The RADIUS server host IP address.

• hostname —Host name of the RADIUS server host. (Range: 1–255

characters).

Default Configuration

The default server type is authentication. The default server name is Default

RADIUS Server. The default port number is 1812 for an authentication

server and 1813 for an accounting server.

Command Mode

Global Configuration mode

Security Commands 928

User Guidelines

RADIUS servers are keyed by the host name, therefore it is advisable to use

unique server host names.

Example

The following example specifies a RADIUS server host with the following

characteristics:

Server host IP address — 192.168.10.1

console(config)#radius-server host 192.168.10.1

radius-server key

Use the radius-server key command to set the authentication and encryption

key for all RADIUS communications between the switch and the RADIUS

server. Use the no form of the command to disable the key.

Syntax

radius-server key [ 0 | 7 ]key-string

no radius-server key

• 0—The key string that follows is the unencrypted shared secret. The

length is 1–128 characters.

• 7—The key string that follows is the encrypted shared secret. The length is

exactly 256 characters.

• key-string — The key string in encrypted or unencrypted form. In

encrypted form, it must be 256 characters in length. In unencrypted form,

it may be up to 128 characters in length.

Default Configuration

The default is an empty string.

Command Mode

Global Configuration

Security Commands 929

User Guidelines

In an Access-Request, encrypted passwords are sent using the RSA Message

Digest algorithm (MD5).

If no encryption parameter (7) is present, the key string is interpreted as an

unencrypted shared secret.

Keys are always displayed in their encrypted form in the running

configuration.

The encryption algorithm is the same across switches. Encrypted passwords

may be copied from one switch and pasted into another switch configuration.

Command History

Updated in version 6.3.0.1 firmware.

Example

The following two examples globally configure the RADIUS server key for all

configured servers. The two examples are identical in effect.

console(config)#radius-server key “This is a key string”

console(config)#radius-server key 0 “This is a key string”

radius-server retransmit

Use the radius-server retransmit command to specify the number of times

the RADIUS client will retransmit requests to the RADIUS server. To reset

the default configuration, use the no form of this command.

Syntax

radius-server retransmit retries

no radius-server retransmit

• retries — Specifies the retransmit value. (Range: 1–10)

Default Configuration

The default is 3 attempts.

Command Mode

Global Configuration mode

Security Commands 930

User Guidelines

This command has no user guidelines.

Example

The following example configures the number of times the RADIUS client

attempts to retransmit requests to the RADIUS server to five attempts.

console(config)#radius-server retransmit 5

radius-server source-ip

Use the radius-server source-ip command to specify the source IPv4 address

used in the IP header for communication with RADIUS servers. To return to

the default, use the no form of this command. 0.0.0.0 is interpreted as a

request to use the IPv4 address of the outgoing IP interface.

Syntax

radius-server source-ip source

no radius-server source-ip

• source — Specifies the source IPv4 address.

Default Configuration

The default IPv4 address is the outgoing interface IPv4 address.

Command Mode

Global Configuration mode

User Guidelines

The command configures the source IP address present in the IPv4 header. It

is not the optional NAS-IP-Address in the RADIUS message. Use the radius-

server attribute 4 command to configure the NAS-IP-Address attribute sent in

the RADIUS Access-Request message.

Example

The following example configures the source IP address used for

communication with RADIUS servers to 10.1.1.1.

Security Commands 931

console(config)#radius-server source-ip 10.1.1.1

radius-server source-interface

Use the radius-server source-interface command to select the interface from

which to use the IP address in the source IP address field of transmitted

RADIUS packets. Use the no form of the command to revert to the default IP

address.

Syntax

radius-server source-interface {loopback loopback-id | vlan vlan-id}

no radius-server source-interface

• loopback-id — A loopback interface identifier.

• vlan-id—A VLAN identifier.

Default Configuration

By default, the switch uses the assigned switch IP address as the source IP

address for RADIUS packets. This is either the IP address assigned to the

VLAN from which the RADIUS packet originates or the out-of-band interface

IP address.

Command Mode

Global Configuration

User Guidelines

The source IP address of RADIUS packets sent to a server should match the

NAS IP address configured on the RADIUS server. A mismatch may lead to a

RADIUS packet timeout.

Loopback interfaces are not supported on the Dell EMC N1100-ON Series

switches.

Command History

Introduced in version 6.3.0.1 firmware.

Example

console#conf

Security Commands 932

console(config)#interface vlan 1

console(config-if-vlan1)#ip address dhcp

console(config-if-vlan1)#exit

console(config)#radius-server source-interface vlan 1

radius-server timeout

Use the radius-server timeout command in Global Configuration mode to set

the interval for which a switch waits for a server to reply. To restore the

default, use the no form of this command.

Syntax

radius-server timeout timeout

no radius-server timeout

• timeout — Specifies the timeout value in seconds. (Range: 1–30)

Default Configuration

The default value is 15 seconds.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example sets the interval for which a switch waits for a server to

reply to 5 seconds.

console(config)#radius-server timeout 5

retransmit

Use the retransmit command in RADIUS Server Configuration mode to

specify the number of times the RADIUS client retransmits requests to the

RADIUS server.

Security Commands 933

Syntax

retransmit retries

• retries — Specifies the retransmit value. (Range: 1-10 attempts)

Default Configuration

The default number for attempts is 3.

Command Mode

RADIUS mode

User Guidelines

User must enter the mode corresponding to a specific RADIUS server before

executing this command.

Example

The following example of the retransmit command specifies five retries.

console(config)#radius-server host 192.143.120.123

console(config-auth-radius)#retransmit 5

show aaa servers

Use the show aaa servers command to display the list of configured RADIUS

servers and the values configured for the global parameters of the RADIUS

servers.

Syntax

show aaa servers [accounting | authentication] [name [servername]]

•accounting—This optional parameter will cause accounting servers to be

displayed.

•authentication—This optional parameter will cause authentication servers

to be displayed.

•name—This optional parameter will cause the server names to be

displayed instead of the server configuration parameters.

Security Commands 934

• servername—Will cause only the server(s) with server-name name to be

displayed. There are no global parameters displayed when this parameter is

specified.

Default Configuration

All authentication servers are displayed by default.

Command Mode

User Exec, Privileged Exec, Global Configuration mode and all Configuration

submodes

User Guidelines

The following fields are displayed:

Field Description

Configured

Authentication Servers

The number of RADIUS Authentication servers that have

been configured.

Configured Accounting

Servers

The number of RADIUS Accounting servers that have

been configured.

Named Authentication

Server Groups

The number of configured named RADIUS server groups.

Named Accounting

Server Groups

The number of configured named RADIUS server groups.

Timeout The configured timeout value, in seconds, for request

retransmissions.

Retransmit The configured value of the maximum number of times a

request packet is retransmitted.

Deadtime The length of time an unavailable RADIUS server is

skipped.

RADIUS Accounting

Mode

A Global parameter to indicate whether the accounting

mode for all the servers is enabled or not.

RADIUS Attribute 4

Mode

A Global parameter to indicate whether the NAS-IP-

Address attribute has been enabled to use in RADIUS

requests.

Security Commands 935

Command History

Introduced in version 6.2.0.1 firmware.

Example

console#show aaa servers

IP address Type Port TimeOut Retran. DeadTime Source IP Prio.Usage

---------------- ----- ----- ------- ------- -------- ---------- ----- ------

6.6.6.6 Auth 1812 Global Global Global Default 0 all

5.5.5.5 Auth 1812 Global Global Global 2.2.2.2 0 all

4.4.4.4 Auth 1812 Global Global Global Default 0 all

3.3.3.3 Auth 1812 Global Global Global Default 0 all

2.2.2.2 Auth 1812 Global Global Global Default 0 all

1.1.1.1 Acct 1813 N/A N/A N/A N/A N/A N/A

Global values

--------------------------------------------

Number of Configured Authentication Servers.... 5

Number of Configured Accounting Servers........ 1

Number of Named Authentication Server Groups... 2

Number of Named Accounting Server Groups....... 1

Number of Retransmits.......................... 3

Timeout Duration............................... 15

Deadtime....................................... 0

Source IP...................................... Default

RADIUS Accounting Mode......................... Disable

RADIUS Attribute 4 Mode........................ Disable

RADIUS Attribute 4 Value....................... 0.0.0.0

console#show aaa servers name

Server Name Host Address Port Secret

Configured

-------------------------------- ------------------------ ------ ----------

Default-RADIUS-Server 4.4.4.4 1812 No

RADIUS Attribute 4

Value

A Global parameter that specifies the IP address to be

used in NAS-IP-Address attribute to be used in RADIUS

requests.

Source Interface The source interface from which the source IP address is

obtained.

Field Description

Security Commands 936

test 6.6.6.6 1812 No

switch-top#show aaa servers authentication name CoA-Server-1

RADIUS Server Name............................. CoA-Server-1

Current Server IP Address...................... 1.1.1.1

Number of Retransmits.......................... 3

Timeout Duration............................... 15

Deadtime....................................... 0

Port........................................... 3799

Source IP...................................... Default

RADIUS Accounting Mode......................... Disabled

Secret Configured.............................. Yes

Message Authenticator.......................... Enable

Number of CoA Requests Received...................... 203

Number of CoA ACK Responses Sent..................... 111

Number of CoA NAK Responses Sent...................... 37

Number of Coa Requests Ignored.........................55

Number of CoA Missing/Unsupported Attribute Requests...18

Number of CoA Session Context Not Found Requests.......5

Number of CoA Invalid Attribute Value Requests.........11

Number of Administratively Prohibited Requests.........3

show radius statistics

Use the show radius statistics command to show the statistics for an

authentication or accounting server.

Syntax

show radius statistics [accounting | authentication] [{ipaddress | hostname

| name servername}]

•accounting | authentication—The type of server (accounting or

authentication).

• ipaddress—The RADIUS server host IP address.

• hostname—Host name of the RADIUS server host. (Range: 1–158

characters). The command allows spaces in the host name when specified

in double quotes. For example, console(config)#snmp-server host “host

name”

• servername—The alias used to identify the server.

Security Commands 937

Default Configuration

There is no default configuration for this command.

Command Mode

User Exec, Privileged Exec mode, Global Configuration mode and all

Configuration submodes

User Guidelines

The following fields are displayed for accounting servers:

Field Description

RADIUS

Accounting Server

Name

Name of the accounting server.

Server Host

Address

IP address of the host.

Round Trip Time The time interval, in hundredths of a second, between the most

recent Accounting Response and the Accounting Request that

matched it from this RADIUS accounting server.

Requests The number of RADIUS Accounting Request packets sent to this

server not including the retransmissions.

Retransmissions The number of RADIUS Accounting Request packets

retransmitted to this RADIUS accounting server.

Responses The number of RADIUS packets received on the accounting port

from this server.

Malformed

Responses

The number of malformed RADIUS Accounting Response

packets received from this server. Malformed packets include

packets with an invalid length. Bad authenticators or signature

attributes or unknown types are not included as malformed

accounting responses.

Bad

Authenticators

The number of RADIUS Accounting Response packets

containing invalid authenticators received from this accounting

server.

Pending Requests The number of RADIUS Accounting Request packets destined

for this server that have not yet timed out or received a response.

Security Commands 938

The following fields are displayed for authentication servers:

Timeouts The number of accounting timeouts on this server.

Unknown Types The number of packets unknown type which were received from

this server on accounting port.

Packets Dropped The number of RADIUS packets received from this server on

accounting port and dropped for some other reason.

Field Description

RADIUS Server

Name

Name of the authenticating server.

Server Host

Address

IP address of the host.

Access Requests The number of RADIUS Access Request packets sent to this

server. This number does not include retransmissions.

Access

Retransmissions

The number of RADIUS Access Request packets retransmitted

to this RADIUS authentication server.

Access Accepts The number of RADIUS Access Accept packets, including both

valid and invalid packets, that were received from this server.

Access Rejects The number of RADIUS Access Reject packets, including both

valid and invalid packets, that were received from this server.

Access Challenges The number of RADIUS Access Challenge packets, including

both valid and invalid packets, that were received from this

server.

Malformed Access

Responses

The number of malformed RADIUS Access Response packets

received from this server. Malformed packets include packets

with an invalid length. Bad authenticators or signature attributes

or unknown types are not included as malformed access

responses.

Bad

Authenticators

The number of RADIUS Access Response packets containing

invalid authenticators or signature attributes received from this

server.

Pending Requests The number of RADIUS Access Request packets destined for

this server that have not yet timed out or received a response.

Field Description

Security Commands 939

Example

console#show radius statistics accounting 192.168.37.200

RADIUS Accounting Server Name................. Default_RADIUS_Server

Host Address.................................. 192.168.37.200

Round Trip Time............................... 0.00

Requests...................................... 0

Retransmissions............................... 0

Responses..................................... 0

Malformed Responses........................... 0

Bad Authenticators............................ 0

Pending Requests.............................. 0

Timeouts...................................... 0

Unknown Types................................. 0

Packets Dropped............................... 0

console#show radius statistics name Default_RADIUS_Server

RADIUS Server Name............................ Default_RADIUS_Server

Server Host Address........................... 192.168.37.200

Access Requests............................... 0.00

Access Retransmissions........................ 0

Access Accepts................................ 0

Access Rejects................................ 0

Access Challenges............................. 0

Malformed Access Responses.................... 0

Bad Authenticators............................ 0

Pending Requests.............................. 0

Timeouts...................................... 0

Unknown Types................................. 0

Packets Dropped............................... 0

Timeouts The number of authentication timeouts to this server.

Unknown Types The number of packets unknown type which were received from

this server on the authentication port.

Packets Dropped The number of RADIUS packets received from this server on

authentication port and dropped for some other reason.

Field Description

Security Commands 940

source-ip

Use the source-ip command in RADIUS Server Configuration mode to

specify the source IP address to be used for communication with RADIUS

servers. 0.0.0.0 is interpreted as a request to use the IP address of the outgoing

IP interface.

Syntax

source-ip source

• source — A valid source IP address.

Default Configuration

The IP address is of the outgoing IP interface.

Command Mode

RADIUS Server Configuration mode

User Guidelines

The administrator must enter the mode corresponding to a specific RADIUS

server before executing this command.

Example

The following example specifies 10.240.1.23 as the source IP address.

console(config)#radius-server host 192.143.120.123

console(config-auth-radius)#source-ip 10.240.1.23

timeout

Use the timeout command in RADIUS mode to set the timeout value in

seconds for the designated RADIUS server.

Syntax

timeout timeout

• timeout — Timeout value in seconds for the specified server. (Range: 1-30

seconds.)

Security Commands 941

Default Configuration

The default value is 15 seconds.

Command Mode

RADIUS mode

User Guidelines

User must enter the mode corresponding to a specific RADIUS server before

executing this command.

Example

The following example specifies the timeout setting for the designated

RADIUS Server.

console(config)#radius-server host 192.143.120.123

console(config-radius)#timeout 20

usage

Use the usage command in RADIUS mode to specify the usage type of the

server.

Syntax

usage type

• type — Variable can be one of the following values: login, dot1x or all.

Default Configuration

The default variable setting is all.

Command Mode

RADIUS mode

User Guidelines

User must enter the mode corresponding to a specific RADIUS server before

executing this command.

Security Commands 942

Example

The following example specifies usage type login.

console(config)#radius-server host 192.143.120.123

console(config-auth-radius)#usage login

Security Commands 943

TACACS+ Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

TACACS+ provides access control for networked devices via one or more

centralized servers, similar to RADIUS this protocol simplifies authentication

by making use of a single database that can be shared by many clients on a

large network. TACACS+ is based on the TACACS protocol (described in

RFC1492) but additionally provides for separate authentication,

authorization and accounting services. The original protocol was UDP based

with messages passed in clear text over the network; TACACS+ uses TCP to

ensure reliable delivery and a shared key configured on the client and daemon

server to encrypt all messages.

Dell EMC Networking supports authentication of a user using a TACACS+

server. When TACACS+ is configured as the authentication method for a

user login type (CLI/HTTP/HTTPS), the NAS will prompt for the user login

credentials and request services from the TACACS+ client; the client will

then use the configured list of servers for authentication and provide results

back to the NAS. The TACACS+ server list is configured with one or more

hosts defined via their network IP address; each can be assigned a priority to

determine the order in which the TACACS+ client will contact them, a

server is contacted when a connection attempt fails or times out for a higher

priority server. Each server host can be separately configured with a specific

connection type, port, time-out, and shared key, or the global configuration

may be used for the key and time-out. Like RADIUS, the TACACS+ server

may do the authentication itself, or redirect the request to another back-end

device, all sensitive information is encrypted and the shared secret is never

passed over the network.

Commands in this Section

This section explains the following commands:

key tacacs-server host

port tacacs-server key

priority tacacs-server source-interface

Security Commands 944

key

Use the key command in TACACS Configuration mode to specify the

authentication and encryption key for all TACACS communications between

the device and the TACACS server. This key must match the key used on the

TACACS daemon.

Syntax

key [0|7] key-string

no key

• 0—The key string that follows is the unencrypted shared secret. The

length is 1–128 characters.

• 7—The key string that follows is the encrypted shared secret. The length is

256 characters.

• key-string — Specifies the key string in encrypted or unencrypted form. It

may be up to 128 characters in length in unencrypted format and 256

characters in length in encrypted format.

Default Configuration

If left unspecified, the key-string parameter defaults to the global value.

Command Mode

TACACS Configuration mode

User Guidelines

The key command accepts any printable characters for the key except a

question mark. Enclose the string in double quotes to include spaces within

the key. The surrounding quotes are not used as part of the name. The CLI

does not filter illegal characters and may accept entries up to the first illegal

character or reject the entry entirely.

If no encryption parameter is present, the key string is interpreted as an un-

encrypted shared secret.

show tacacs tacacs-server timeout

–

timeout

Security Commands 945

Keys are always displayed in their encrypted form in the running

configuration.

In an Access-Request, encrypted passwords are sent using the RSA Message

Digest algorithm (MD5).

The encryption algorithm is the same across switches. Encrypted passwords

may be copied from one switch and pasted into another switch configuration.

Command History

Updated in version 6.3.0.1 firmware.

Example

The following example sets the authentication encryption key.

console(config-tacacs)#key “This is a key string”

console(config-tacacs)#key 0 “This is a key string”

port

Use the port command in TACACS Configuration mode to specify a port

number on which a TACACS server listens for connections.

Syntax

port [port-number]

• port-number — The server port number. If left unspecified, the default

port number is 49. (Range: 0–65535)

Default Configuration

The default port number is 49.

Command Mode

TACACS Configuration mode

User Guidelines

This command has no user guidelines.

Security Commands 946

Example

The following example displays how to specify TACACS server port number

1200.

console(config-tacacs)#port 1200

priority

Use the priority command in TACACS Configuration mode to specify the

order in which servers are used, where 0 (zero) is the highest priority.

Syntax

priority [priority]

• priority — Specifies the priority for servers. 0 (zero) is the highest priority.

(Range: 0–65535).

Default Configuration

If left unspecified, this parameter defaults to 0 (zero).

Command Mode

TACACS Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example shows how to specify a server priority of 10000.

console(config-tacacs)#priority 10000

show tacacs

Use the show tacacs command to display the configuration and statistics of a

TACACS+ server.

Syntax

show tacacs [ip-address]

Security Commands 947

•

ip-address

— The name or IP address of the host.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Examples

The following example displays TACACS+ server settings.

console#show tacacs

Global Timeout: 5

Server Address Port Timeout Priority Source Interface

--------------- ----- ------- -------- -----------------

10.254.24.162 49 Global 0 Loopback 0

tacacs-server host

Use the tacacs-server host command in Global Configuration mode to

configure a TACACS+ server. This command enters into the TACACS+

configuration mode. To delete the specified hostname or IP address, use the

no form of this command.

Syntax

tacacs-server host {ip-address | hostname}

no tacacs-server host {ip-address | hostname}

•

ip-address

— The IP address of the TACACS+ server.

• hostname — The hostname of the TACACS+ server. (Range: 1-255

characters).

Security Commands 948

Default Configuration

No TACACS+ host is specified.

Command Mode

Global Configuration mode

User Guidelines

To specify multiple hosts, multiple tacacs-server host commands can be used.

TACACS servers are keyed by the host name, therefore it is advisable to use

unique host names.

Example

The following example specifies a TACACS+ host.

console(config)#tacacs-server host 172.16.1.1

console(config-tacacs)#

tacacs-server key

Use the tacacs-server key command in Global Configuration mode to set the

authentication and encryption key for all TACACS+ communications

between the switch and the TACACS+ daemon. To disable the key, use the

no form of this command.

Syntax

tacacs-server key [ 0 | 7 ][key-string]

no tacacs-server key

• 0—The key string that follows is the unencrypted shared secret. The

length is 1–128 characters.

• 7—The key string that follows is the encrypted shared secret. The length is

fixed at 256 characters.

• key-string — Specifies the key string in encrypted or unencrypted form. It

may be up to 128 characters in length in unencrypted format and is exactly

256 characters in length in encrypted format.

Security Commands 949

Default Configuration

The default is an empty string.

Command Mode

Global Configuration mode

User Guidelines

The tacacs-server key command accepts any printable characters for the key

except a question mark. Enclose the string in double quotes to include spaces

within the key. The surrounding quotes are not used as part of the name. The

CLI does not filter illegal characters and may accept entries up to the first

illegal character or reject the entry entirely.

If no encryption parameter is present, the key string is interpreted as an un-

encrypted shared secret.

Keys are always displayed in their encrypted form in the running

configuration.

In an Access-Request, encrypted passwords are sent using the RSA Message

Digest algorithm (MD5).

The encryption algorithm is the same across switches. Encrypted passwords

may be copied from one switch and pasted into another switch.

Command History

Updated in version 6.3.0.1 firmware.

Example

The following example sets the authentication encryption key.

console(config)#tacacs-server key “This is a key string”

console(config)#tacacs-server key 0 “This is a key string”

tacacs-server source-interface

Use the tacacs-server source-interface command to select the interface from

which to use the IP address in the source IP address field of transmitted

TACACS packets. Use the no form of the command to revert to the default

IP address.

Security Commands 950

Syntax

tacacs-server source-interface { loopback loopback-id | vlan vlan-id }

no tacacs-server source-interface

• loopback-id — Identifies the loopback interface.

• vlan-id — Identifies the VLAN.

Default Configuration

By default, the switch uses the assigned switch IP address as the source IP

address for TACACS packets. This is either the IP address assigned to the

VLAN from which the TACACS packet originates or a loopback interface IP

address.

Command Mode

Global Configuration

User Guidelines

The source interface must have an assigned IP address (either manually or via

another method such as DHCP). Loopback interfaces are not suppported on

the Dell EMC N1100-ON Series switches.

Command History

Introduced in version 6.3.0.1 firmware.

Example

console#conf

console(config)#interface vlan 1

console(config-if-vlan1)#ip address dhcp

console(config-if-vlan1)#exit

console(config)#tacacs-server source-interface vlan 1

tacacs-server timeout

Use the tacacs-server timeout command in Global Configuration mode to set

the interval during which a switch waits for a server host to reply. To restore

the default, use the no form of this command.

Security Commands 951

Syntax

tacacs-server timeout [timeout]

no tacacs-server timeout

• timeout — The timeout value in seconds. (Range: 1–30)

Default Configuration

The default value is 5 seconds.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example sets the timeout value as 30.

console(config)#tacacs-server timeout 30

timeout

Use the timeout command in TACACS Configuration mode to specify the

timeout value in seconds. If no timeout value is specified, the global value is

used.

Syntax

timeout [timeout]

• timeout — The timeout value in seconds. (Range: 1–30)

Default Configuration

If left unspecified, the timeout defaults to the global value.

Command Mode

TACACS Configuration mode

Security Commands 952

User Guidelines

This command has no user guidelines.

Example

This example shows how to specify the timeout value.

console(config-tacacs)#timeout 23

Security Commands 953

802.1x Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Local Area Networks (LANs) are often deployed in environments that permit

the attachment of unauthorized devices. The networks also permit

unauthorized users to attempt to access the LAN through existing

equipment. In such environments, the administrator may desire to restrict

access to the services offered by the LAN.

Port-based network access control makes use of the physical characteristics of

LAN infrastructures to provide a means of authenticating and authorizing

devices attached to a LAN port. Port-based network access control prevents

access to the port in cases in which the authentication and authorization

process fails. A port is defined as a single point of attachment to the LAN.

The Dell EMC Networking switches support an 802.1x Authenticator service

with a local authentication server or authentication using remote RADIUS or

TACACS servers. Refer to "AAA Commands" on page 838 for information on

configuring connectivity to a RADIUS or TACACS authentication server or

to configure the local authentication service.

Dell EMC Networking switches also support 802.1X accounting to RADIUS

or TACACS servers. Refer to the “AAA Commands” section to configure

802.1X accounting.

MD5 or none is the supported authentication method for communication

with an authentication server. Dell EMC Networking does not support

encryption of switch initiated authenticator/authentication server

communication. However, Dell EMC Networking switches are capable of

transporting end-to-end encrypted traffic such as EAP-TLS between a

supplicant and an authenticator.

802.1x Monitor Mode

Monitor mode is a special mode that can be enabled in conjunction with

Dot1x authentication. It allows network access even in case where there is a

failure to authenticate but logs the results of the authentication process for

diagnostic purposes. The exact details are described in the below sections.

The main aim of the monitor mode is to provide a mechanism to the operator

Security Commands 954

to be able to identify the short-comings in the configuration of a 802.1x

authentication on the switch without affecting the network access to the

users of the switch.

There are three important aspects to this feature after activation:

To allow successful authentications using the returned information from

authentication server.

To provide a mechanism to report unsuccessful authentications without

negative repercussions to the user due to operator errors or failure cases

from the Authentication server or supplicants.

To accurately report the data received from the successful and

unsuccessful operations so that the operator can make the appropriate

changes or learn where the problem areas are.

The monitor mode can be configured globally on a switch. If the switch fails

to authenticate the user for any reason (say RADIUS access reject from

RADIUS server, RADIUS time-out, or the client itself is 802.1x unaware), the

client is authenticated and is undisturbed by the failure condition(s). The

reasons for failure are logged and buffered into the local logging database such

that the operator can track the failure conditions. Clients authenticated when

monitor mode is enabled are always assigned to the default VLAN, regardless

of the RADIUS assignment.

Commands in this Section

This section explains the following commands:

dot1x dynamic-vlan enable dot1x system-auth-control

monitor

server-key

dot1x eapolflood dot1x timeout quiet-period show dot1x

dot1x initialize dot1x timeout re-

authperiod

show dot1x authentication-

history

dot1x mac-auth-bypass dot1x timeout server-

timeout

show dot1x clients

dot1x max-req dot1x timeout supp-

timeout

show dot1x interface

Security Commands 955

802.1x Advanced Features

dot1x dynamic-vlan enable

Use the dot1x dynamic-vlan enable command in Global Configuration mode

to enable the capability of creating VLANs dynamically when a RADIUS–

assigned VLAN does not exist in the switch. Use the no form of the command

to disable this capability.

Syntax

dot1x dynamic-vlan enable

no dot1x dynamic-vlan enable

Default Configuration

The default value is Disabled.

Command Mode

Global Configuration

User Guidelines

This command has no user guidelines.

dot1x max-users dot1x timeout tx-period show dot1x interface

statistics

dot1x port-control auth-type show dot1x users

dot1x re-authenticate client clear dot1x authentication–

history

dot1x reauthentication ignore dot1x guest-vlan

dot1x system-auth-control port dot1x unauth-vlan

––

show dot1x advanced

dot1x guest-vlan dot1x unauth-vlan show dot1x advanced

dot1x timeout guest-vlan-

period

––

Security Commands 956

dot1x eapolflood

This command enables the flooding of received IEEE 802.1x frames in the

VLAN. Use the no form of the command to return the processing of EAPOL

frames to the default.

Syntax

dot1x eapolflood

no dot1x eapolflood

Default Configuration

By default, the switch does not forward received IEEE 802.1x frames, even if

802.1x is not enabled on the switch. This is the default behavior required by

IEEE 802.1x-2010.

Command Mode

Global Configuration mode

User Guidelines

Local processing of IEEE 802.1x frames must be disabled (no dot1x system-

auth-control) for this capability to be enabled. This capability is useful in

situations where the authenticator device is placed one or more hops away

from the authenticating host. The intervening switch will flood all received

IEEE 802.1x frames in the VLAN.

Flooding of IEEE 802.1x frames makes end stations vulnerable to a denial of

service attack should another end station record and play back certain flooded

EAPOL frames at a high rate.

dot1x initialize

This command begins the initialization sequence on the specified port. This

command is only valid if the control mode for the specified port is auto or

mac-based. If the control mode is not auto or mac-based, an error will be

returned.

Security Commands 957

Syntax

dot1x initialize [interface interface-id]

• interface-id—The port to be initialized.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

There are no user guidelines for this command.

dot1x mac-auth-bypass

Use the dot1x mac-auth-bypass command to enable MAB on an interface.

Use the no form of this command to disable MAB on an interface.

Syntax

dot1x mac-auth-bypass

no dot1x mac-auth-bypass

Default Configuration

MAC Authentication Bypass is disabled by default.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

Authentication of a user via mac-auth-bypass will not occur until the “dot1x

time-out guest-vlan-period” timer expires.

When using MAB, configure the user name and password attributes with the

supplicant MAC address using the form XXXXXXXXXXXX where X is an

upper case hexadecimal digit.

Security Commands 958

Example

The following example sets MAC Authentication Bypass on interface

gigabitethernet 1/0/2:

console(config-if-Gi1/0/2)#dot1x port-control mac-based

console(config-if-Gi1/0/2)#dot1x mac-auth-bypass

dot1x max-req

Use the dot1x max-req command in Interface Configuration mode to set the

maximum number of times that the switch sends an Extensible

Authentication Protocol (EAP)-request frame (assuming that no response is

received) to the client before restarting the authentication process. To return

to the default setting, use the no form of this command.

Syntax

dot1x max-req count

no dot1x max-req

• count — Number of times that the switch sends an EAP-request/identity

frame before restarting the authentication process. (Range: 1–10)

Default Configuration

The default value for the count parameter is 2.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

Change the default value of this command only to adjust for unusual

circumstances, such as unreliable links or specific behavioral problems with

certain clients and authentication servers.

Example

The following example sets the number of times that the switch sends an

EAP-request/identity frame to 6.

console(config)# interface gigabitethernet 1/0/16

console(config-if-Gi1/0/16)# dot1x max-req 6

Security Commands 959

dot1x max-users

Use the dot1x max-users command in Interface Configuration mode to set

the maximum number of clients supported on the port when MAC-based

802.1x authentication is enabled on the port. Use the no version of the

command to reset the maximum number of clients supported on the port

when MAC-based 802.1x authentication is enabled on the port.

Syntax

dot1x max-users users

no dot1x max-users

• users — The number of users the port supports for MAC-based 802.1x

authentication (Range: 1–64)

Default Configuration

The default number of clients supported on a port with MAC-based 802.1x

authentication is 64. The N1100-ON Series switches, the range is 1–32.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

The N1100-ON Series switches support up to 32 users per interface.

Example

The following command limits the number of devices that can authenticate

on port gigabitethernet 1/0/2 to 3.

console(config-if-Gi1/0/2)#dot1x max-users 3

dot1x port-control

Use the dot1x port-control command in Interface Configuration mode to

configure the 802.1x mode of authentication on the port. Use the no form of

the command to return the mode to the default.

Security Commands 960

Syntax

dot1x port-control {force-authorized | force-unauthorized | auto | mac-

based}

no dot1x port-control

•auto — Enables 802.1x authentication on the interface and causes the

port to transition to the authorized or unauthorized state based on the

802.1x authentication exchange between the switch and the client. VLAN

assignment is allowed on the port if it is not configured in trunk mode.

This is the default port-control mode.

•force-authorized — Disables 802.1x authentication on the interface and

causes the port to transition to the authorized state without any

authentication exchange required. The port sends and receives normal

traffic without 802.1x-based authentication of the client. VLAN

assignment is not supported in this mode.

•force-unauthorized — Denies all access through this interface by forcing

the port to transition to the unauthorized state, ignoring all attempts by

the client to authenticate. The switch cannot provide authentication

services to the client through the interface. VLAN assignment is not

supported in this mode.

•mac-based — Enables 802.1x authentication on the interface and allows

multiple hosts to authenticate on a single port. The hosts are distinguished

by their MAC addresses. VLAN assignment is allowed on the port if it is

configured in General mode.

Default Configuration

The default port-control mode is auto.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

It is recommended that you disable spanning tree or enable spanning-tree

portfast mode on 802.1x edge ports (ports in auto state that are connected to

end stations) in order to go immediately to the forwarding state after

successful authentication.

Security Commands 961

When configuring a port to use MAC-based authentication, the port must be

in switchport general mode.

Example

The following command enables MAC-based authentication on port 1/0/2

console(config)# interface gigabitethernet 1/0/2

console(config-if-Gi1/0/2)# dot1x port-control mac-based

dot1x re-authenticate

Use the dot1x re-authenticate command to manually initiate a

re-authentication of all 802.1x-enabled ports or the specified 802.1x-enabled

port.

Syntax

dot1x re-authenticate [gigabitethernet unit/slot/port | tengigabitethernet

unit/slot/port | fortygigabitethernet unit/slot/port]

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

Interfaces that are not running the 802.1x protocol (e.g. MAB configured

ports) are not re-authenticated. Only ports that have an authentication dot1x

port-control mode of auto are re-authenticated.

Example

The following command manually initiates a reauthentication of the 802.1x-

enabled port.

console# dot1x re-authenticate gigabitethernet 1/0/16

Security Commands 962

dot1x reauthentication

Use the dot1x reauthentication command in Interface Configuration mode

to enable periodic re-authentication of the client. To return to the default

setting, use the no form of this command.

Syntax

dot1x reauthentication

no dot1x reauthentication

Default Configuration

Periodic reauthentication is disabled.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

This command has no user guidelines.

Example

The following example enables periodic reauthentication of the client.

console(config)# interface gigabitethernet 1/0/16

console(config-if-Gi1/0/16)# dot1x reauthentication

dot1x system-auth-control

Use the dot1x system-auth-control command in Global Configuration mode

to enable 802.1x globally. To disable 802.1x globally, use the no form of this

command.

Syntax

dot1x system-auth-control

no dot1x system-auth-control

Security Commands 963

Default Configuration

The default for this command is disabled.

Command Mode

Global Configuration mode

User Guidelines

Devices connected to interfaces on which IEEE 802.1X authentication is

enabled will be required to authenticate before accessing network resources.

This command enables local processing of IEEE 802.1x frames on the switch.

Dot1x eapolflood mode must be disabled for local processing to occur.

If 802.1x is used in combination with the authentication manager, be sure to

enable the authentication manager with the authentication enable

command.

Example

The following example enables 802.1x globally.

console(config)# dot1x system-auth-control

dot1x system-auth-control monitor

Use the dot1x system-auth-control monitor command in Global

Configuration mode to enable 802.1x monitor mode globally. To disable this

function, use the no form of this command.

Syntax

dot1x system-auth-control monitor

no dot1x system-auth-control monitor

Default Configuration

Dot1x monitor mode is disabled.

Command Mode

Global Configuration mode

Security Commands 964

User Guidelines

Monitor mode always allows access to network resources, even if

authentication fails.

Example

The following command enables monitor mode. Clients are always

authenticated in monitor mode.

console(config)# dot1x system-auth-control monitor

dot1x timeout quiet-period

Use the dot1x timeout quiet-period command in Interface Configuration

mode to set the number of seconds that the switch remains in the quiet state

following a failed authentication exchange (for example, the client provided

an invalid password). To return to the default setting, use the no form of this

command.

Syntax

dot1x timeout quiet-period seconds

no dot1x timeout quiet-period

• seconds — Time in seconds that the switch remains in the quiet state

following a failed authentication exchange with the client. (Range: 0–

65535 seconds)

Default Configuration

The switch remains in the quiet state for 60 seconds.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

During the quiet period, the switch does not accept or initiate any

authentication requests.

Security Commands 965

Change the default value of this command only to adjust for unusual

circumstances, such as unreliable links or specific behavioral problems with

certain clients and authentication servers.

To provide a faster response time to the user, enter a smaller number than the

default.

Example

The following example sets the number of seconds that the switch remains in

the quiet state following a failed authentication exchange to 3600.

console(config)# interface gigabitethernet 1/0/16

console(config-if-Gi1/0/16)# dot1x timeout quiet-period 3600

dot1x timeout re-authperiod

Use the dot1x timeout re-authperiod command in Interface Configuration

mode to set the number of seconds between reauthentication attempts. To

return to the default setting, use the no form of this command.

Syntax

dot1x timeout re-authperiod seconds

no dot1x timeout re-authperiod

• seconds — Number of seconds between re-authentication attempts.

(Range: 300–4294967295)

Default Configuration

The default re-authentication period is 3600 seconds.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

The re-authentication process sends an authentication message (EAP-

Request/Identity)to authenticated supplicants asking them to re-

authenticate themselves. If a supplicant fails re-authentication, it is denied

access to switch resources.

Security Commands 966

Example

The following example sets the number of seconds between re-authentication

attempts to 300.

console(config)# interface gigabitethernet 1/0/16

console(config-if-Gi1/0/16)# dot1x timeout re-authperiod 300

dot1x timeout server-timeout

Use the dot1x timeout server-timeout command in Interface Configuration

mode to set the time that the switch waits for a response from the

authentication server. To return to the default setting, use the no form of this

command.

Syntax

dot1x timeout server-timeout seconds

no dot1x timeout server-timeout

• seconds — Time in seconds that the switch waits for a response from the

authentication server. (Range: 1–65535)

Default Configuration

The period of time is set to 30 seconds.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

The actual timeout is this parameter or the product of the RADIUS

transmission times the RADIUS timeout, whichever is smaller.

Example

The following example sets the time for the retransmission to the

authentication server to 3600 seconds.

console(config-if-gi1/0/1)# dot1x timeout server-timeout 3600

Security Commands 967

dot1x timeout supp-timeout

Use the dot1x timeout supp-timeout command to set the time that the

switch waits for a response before retransmitting an Extensible

Authentication Protocol (EAP-Request/Identity) frame to the client. To

return to the default setting, use the no form of this command.

Syntax

dot1x timeout supp-timeout seconds

no dot1x timeout supp-timeout

• seconds—The time in seconds that the switch should wait for a response

to an EAP-request frame from the client before resending the request.

(Range: 1–65535)

Default Configuration

The default supplicant timeout is 30 seconds.

Command Mode

Interface Configuration mode

User Guidelines

Change the value of the supplicant timeout only to adjust for unusual

circumstances, such as unreliable links or specific behavioral problems with

certain clients and authentication servers. The default timeout value is set

per IEEE 802.1x.

This value is used in conjunction with the dot1x timeout server-timeout

command to limit the amount of time a supplicant can remain in a pending

authentication state.

Example

console(config-if-Gi1/0/1)#dot1x timeout supp-timeout 60

Security Commands 968

dot1x timeout tx-period

Use the dot1x timeout tx-period command in Interface Configuration mode

to set the number of seconds that the switch waits for a response to an

Extensible Authentication Protocol

EAP-Request/Identity

frame from the

client before resending the request. To return to the default setting, use the

no form of this command.

Syntax

dot1x timeout tx-period seconds

no dot1x timeout tx-period

• seconds — Time in seconds that the switch should wait for a response to

an EAP-Request/Identity frame from the client before resending the

request. (Range: 1–65535)

Default Configuration

The period of time is set to 30 seconds.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

Change the default value of this command only to adjust for unusual

circumstances, such as unreliable links or specific behavioral problems with

certain clients and authentication servers.

Example

The following command sets the number of seconds that the switch waits for

a response to an EAP-request/identity frame to 3600 seconds.

console(config)# interface gigabitethernet 1/0/16

console(config-if-Gi1/0/16)# dot1x timeout tx-period 3600

Security Commands 969

auth-type

Use this command to set the accepted authorization types for dynamic

RADIUS clients. Use the no form of the command to set the authorization

type to the default.

Syntax

auth-type { all | any |session-key}

no auth-type

•all—Selects all COA client authentication types. All authentication

attributes must match for the authentication to succeed.

•any—Selects any COA client authentication type. Any authentication

attribute may match for the authentication to succeed.

•session-key—Indicates that the session-key must match for authentication

to succeed.

Default Configuration

The default is to authenticate with all parameters.

Command Modes

Dynamic Radius Configuration

User Guidelines

This command specifies the attributes to validate before acting on a CoA or

disconnect request. If session-key is specified and the session ID is valid,

authentication succeeds even if the session-key does not match.

This command works in concert with the ignore command. The ignore

command refines the all parameter to limit the attribute matching.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config-radius-da)# auth-type all

Security Commands 970

client

Use this command to enter the CoA client parameters.

Syntax

client {ip-address | hostname } [ server-key [0 | 7] key-string ]

no client {ip-address | hostname }

• ip-address—The IPv4 address of a CoA client. The IPv4 address is entered

in dotted-quad notation.

•

host

name—The fully qualified domain name (FQDN) of a CoA client.

Maximum length of a host FQDN is 255 characters.

• server-key —Sets the shared secret to verify client COA requests for this

server.

•0—An unencrypted key is to be entered.

•7—An encrypted key is to be entered.

•

key-

string—The key string in encrypted or unencrypted form. In encrypted

form, it must be 256 characters in length. In unencrypted form, it may be

up to 128 characters in length. Enclose in key string in quotes to use

special characters or embedded blanks.

Default Configuration

By default, no dynamic CoA clients are configured.

Command Modes

Dynamic Radius Configuration

User Guidelines

Up to 8 dynamic CoA clients can be configured.

The server-key, if configured, overrides the global shared secret for this client

only.

Messages received from a dynamic RADIUS client are validated against the

configured servers. Messages received from unconfigured dynamic RADIUS

clients are silently discarded.

Security Commands 971

Command History

Introduced in version 6.2.0.1 firmware.

Example

The following example configures RADIUS servers at 1.1.1.1, 2.2.2.2, and

3.3.3.3 and CoA clients at 3.3.3.3, 4.4.4.4, and 5.5.5.5. It sets the front panel

ports to use 802.1x MAC-based authentication. CoA is configured for two

RADIUS servers located at 1.1.1.1 and 2.2.2.2 using a global shared secret and

a third server using a server specific shared secret. CoA and disconnect

requests are accepted from these servers. Any authentication type is allowed

for CoA and disconnect requests.

console#configure terminal

console(config)# aaa new-model

console(config)# aaa authentication dot1x default radius

console(config)# dot1x system-auth-control

console(config)# interface range gi1/0/1-24

console(config-if)# dot1x port-control mac-based

console(config-if)# exit

console(config)# radius-server host 1.1.1.1

console(config-auth-radius)#primary

console(config-auth-radius)#exit

console(config)# radius-server host 2.2.2.2

console(config-auth-radius)#exit

console(config)# radius-server host 3.3.3.3

console(config-auth-radius)#key “That’s your secret.”

console(config-auth-radius)#exit

console(config)# radius-server key “Keep it. Keep it.”

console(config)# aaa server radius dynamic-author

console(config-radius-da)# client 3.3.3.3 server-key 0 “That’s your secret.”

console(config-radius-da)# client 4.4.4.4

console(config-radius-da)# client 5.5.5.5

console(config-radius-da)# server-key 0 “Keep it. Keep it.”

console(config-radius-da)# port 3799

console(config-radius-da)# auth-type any

console(config-radius-da)# exit

console(config)#dot1x system-auth-control

console(config)#dot1x initialize

Security Commands 972

ignore

Use this command to set the switch to ignore certain authentication

parameters from dynamic RADIUS clients. Use the no form of the command

to restore checking of the specific authentication parameters as configured by

the auth-type command.

Syntax

ignore {session-key | server-key}

no ignore {session-key | server-key}

• Session-key—Do not attempt to authenticate with the session key.

• Server-key—Do not attempt to authenticate with the server key.

Default Configuration

The default is to authenticate using the parameters as specified by the

configured auth-type.

Command Modes

Dynamic Radius Configuration

User Guidelines

This command specifies the attributes to validate before acting on a CoA or

disconnect request. If session-key is specified and the session ID is valid,

authentication succeeds even if the session-key does not match.

The ignore command refines the all parameter to limit the attribute

matching.

Setting the auth-type to session-key in conjunction with setting the ignore

session-key is invalid and causes all configured servers to authenticate with no

warnings.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config-radius-da)# ignore session-key

Security Commands 973

port

Use this command to set the port on which to listen for CoA and disconnect

requests from authorized dynamic RADIUS clients.

Syntax

port port–number

no port

• port-number—An integer in the range of 1025–65535

Default Configuration

The default is port 3799.

Command Modes

Dynamic Radius Configuration

User Guidelines

Only one port may be defined and it is used to all RADIUS clients. Do not use

a port number reserved for use by the switch. UDP, TCP and RAW Ports

reserved by the switch and unavailable for use or configuration are:

Ports 1, 17, 58, 255, 546, 547, 2222, 4567, 6343, 49160

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config-radius-da)# port 1700

server-key

Use this command to configure a global shared secret that is used for all

dynamic RADIUS clients that do not have an individual shared secret

configured. Use the no form of the command to remove the global shared

secret configuration.

Security Commands 974

Syntax

server-key [0 | 7] key-string

no server-key

•0—An unencrypted key is to be entered.

•7—An encrypted key is to be entered.

• key-string—The key string in encrypted or unencrypted form. In encrypted

form, it must be 256 characters in length. In unencrypted form, it may be

up to 128 characters in length. Enclose the key string in quotes to use

special characters or embedded blanks.

Default Configuration

By default, no global server key is configured.

Command Modes

Dynamic Radius Configuration

User Guidelines

Only one global server key may be defined. Use the server-key parameter in

the client command to configure a unique server key for each client.

Command History

Introduced in version 6.2.0.1 firmware.

Example

The following example configures RADIUS servers at 1.1.1.1, 2.2.2.2, and

3.3.3.3. It sets the front panel ports to use 802.1x MAC-based authentication.

CoA is configured for two RADIUS servers located at 1.1.1.1 and 2.2.2.2 using

a global shared secret and a third server 3.3.3.3 using a server specific shared

secret. CoA and disconnect requests are accepted from these servers. Any

authentication type is allowed for CoA and disconnect requests.

console#configure terminal

console(config)# aaa new-model

console(config)# aaa authentication dot1x default radius

console(config)# dot1x system-auth-control

console(config)# interface range gi1/0/1-24

console(config-if)# dot1x port-control mac-based

Security Commands 975

console(config-if)# exit

console(config)# radius-server host 1.1.1.1

console(config-auth-radius)#primary

console(config-auth-radius)#exit

console(config)# radius-server host 2.2.2.2

console(config-auth-radius)#exit

console(config)# radius-server host 3.3.3.3

console(config-auth-radius)#key “That’s your secret.”

console(config-auth-radius)#exit

console(config)# radius-server key “Keep it. Keep it.”

console(config)# aaa server radius dynamic-author

console(config-radius-da)# client 3.3.3.3 server-key 0 “That’s your secret.”

console(config-radius-da)# client 1.1.1.1

console(config-radius-da)# client 2.2.2.2

console(config-radius-da)# server-key 0 “Keep it. Keep it.”

console(config-radius-da)# port 3799

console(config-radius-da)# auth-type any

console(config-radius-da)# exit

console(config)#dot1x system-auth-control

console(config)#dot1x initialize

show dot1x

Use the show dot1x command to display:

•

A summary of

the global dot1x configuration.

• Summary information of the dot1x configuration for a specified port or all

ports.

• Detailed dot1x configuration for a specified port

• Dot1x statistics for a specified port, depending on the tokens used.

Syntax

show dot1x [interface interface-id [statistics]]

• interface-id—Any valid interface. See Interface Naming Conventions for

interface representation.

Default Configuration

This command has no default configuration.

Security Commands 976

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

If you do not use the optional parameters, the command displays the global

dot1x mode, Dynamic VLAN Creation Mode, Monitor Mode, EAPOL Flood

Mode, and the VLAN Assignment mode.

Example

console(config-if-Gi1/0/1)#show dot1x

Administrative Mode............... Disabled

Dynamic VLAN Creation Mode........ Disabled

VLAN Assignment Mode.............. Disabled

Monitor Mode...................... Disabled

EAPOL Flood Mode.................. Disabled

Port Admin Mode Oper Mode Reauth Reauth

Control Period

--------- ------------------ ------------ -------- ----------

Gi1/0/1 auto N/A FALSE 3600

Gi1/0/2 auto N/A FALSE 3600

Gi1/0/3 auto N/A FALSE 3600

Field Description

Administrative

Mode

Indicates whether authentication control on the switch is

enabled or disabled.

VLAN Assignment

Mode

Indicates whether assignment of an authorized port to a

RADIUS assigned VLAN is allowed (enabled) or not (disabled).

Monitor Mode Indicates whether the Dot1x Monitor mode on the switch is

enabled or disabled.

Dynamic VLAN

Creation Mode

Indicates if VLANs assigned by the RADIUS server are

dynamically created by the dot1x client.

EAPOL flood mode Indicates whether EAPOL frames are flooded on the interface

or are processed locally by the switch.

Security Commands 977

show dot1x authentication-history

Use the show dot1x authentication-history command to display the dot1x

authentication events and information during successful and unsuccessful

dot1x authentication processes. The command is available to display all

events, or events per interface, or only failure authentication events in

summary or in detail.

Syntax

show dot1x authentication-history {interface-id | all} [failed-auth-only]

[detail]

• interface-id— Any valid interface. See Interface Naming Conventions for

interface representation.

• all—All interfaces.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The following table explains the output parameters.

Parameter Description

Time Stamp Exact time at which the event occurs.

Interface Physical Port on which the event occurs.

MAC-Address Supplicant/Client MAC Address

VLAN assigned VLAN assigned to the client/port on authentication.

VLAN assigned

Reason

Type of VLAN ID assigned i.e Guest VLAN, Unauth,

Default, Radius Assigned or Monitor Mode VLAN ID.

Auth Status Authentication Status

Security Commands 978

Example

console#show dot1x authentication-history all detail

Time Stamp.......................... Mar 22 2010 01:16:31

Result Age.......................... 0 days, 1 hours, 17 minutes, 38 seconds

Interface........................... Gi1/0/2

MAC-Address......................... 00:01:02:03:04:05

VLAN Assigned....................... 111

VLAN Assigned Reason................ Guest VLAN

Filter Name.........................

Auth Status......................... Authorized

Reason.............................. Dot1x Authentication due to Guest VLAN

Timer Expiry.

......

console#show dot1x authentication-history all

Time Stamp Interface MAC-Address VLANID Auth Status

--------------------- --------- ----------------- ------ ----------

Mar 22 2010 01:16:31 Gi1/0/2 00:01:02:03:04:05 111 Authorized

Mar 22 2010 01:20:33 Gi1/0/7 00:00:0D:00:00:00 222 Authorized

console#show dot1x authentication-history gi1/0/1

Time Stamp Interface MAC-Address VLANID Auth Status

--------------------- --------- ----------------- ------ ----------

Mar 22 2010 01:16:31 Gi1/0/1 00:01:02:03:04:05 111 Authorized

Mar 22 2010 01:18:22 Gi1/0/1 00:00:00:03:04:05 0 Unauthorized

console#show dot1x authentication-history gi1/0/1 failed-auth-only

Time Stamp Interface MAC-Address VLANID Auth Status

--------------------- --------- ----------------- ------ ----------

Mar 22 2010 01:18:22 Gi1/0/2 00:00:00:03:04:05 0 Unauthorized

Reason Actual reason behind the successful or failure authentication.

Result Age Time since last result.

Filter Name The name of the assigned filter (policy map).

Parameter Description

Security Commands 979

show dot1x clients

Use the show dot1x clients command to display 802.1x client information.

The client information is displayed in summary or in detail. The command

also displays the statistics of the number of clients that are authenticated

using Monitor Mode and using 802.1x.

Syntax

show dot1x clients {interface–id | all}

• interface–id—Any valid interface. See Interface Naming Conventions for

interface representation.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The following fields are displayed by this command.

The following table describes the significant fields shown in the display.

Field Description

Clients

Authenticated using

Monitor Mode

Indicates the number of Dot1x clients authenticated using

Monitor mode.

Clients

Authenticated using

Dot1x

Indicates the number of Dot1x clients authenticated using

802.1x authentication process.

Field Description

Interface The port number.

Security Commands 980

Example

The following example displays information about the 802.1x clients.

console#show dot1x clients all

Clients Authenticated using Monitor Mode....... 1

Clients Authenticated using Dot1x.............. 1

Interface...................................... Gi1/0/2

User Name...................................... 000102030405

Supp MAC Address............................... 00:01:02:03:04:05

Session Time................................... 518

Filter Id......................................

VLAN Assigned.................................. 1

Interface...................................... Gi1/0/7

User Name...................................... dell

Supp MAC Address............................... 00:08:A1:7E:45:1A

Session Time................................... 67

VLAN Assigned.................................. Monitor Mode

show dot1x interface

This command shows the status and configuration of an IEEE 802.1x

configured interface.

Username The username representing the identity of the Supplicant.

This field shows the username when the port control is

auto or mac-based. If the port is Authorized, it shows the

username of the current user. If the port is unauthorized it

shows the last user that was authenticated successfully.

Supp MAC Address The MAC-address of the supplicant

Session Time The amount of time, in seconds, since the client was

authenticated on the port.

Filter ID The Filter ID assigned to the client by the RADIUS server.

This field is not applicable when the Filter-ID feature is

disabled on the RADIUS server and client.

VLAN Assigned The VLAN assigned to the client by the radius server.

When VLAN assignments are disabled, RADIUS server

does not assign any VLAN to the port, and this field is set

to 0.

Field Description

Security Commands 981

Syntax

show dot1x interface interface-id

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The command accepts Ethernet interface identifiers.

Example

console#show dot1x interface gigabitethernet 1/0/10

Administrative Mode............... Disabled

Dynamic VLAN Creation Mode........ Disabled

Monitor Mode...................... Disabled

Port Admin Oper Reauth Reauth

Mode Mode Control Period

------- ------------------ ------------ -------- ----------

Gi1/0/10 auto N/A FALSE 3600

Quiet Period................................... 60

Transmit Period................................ 30

Maximum Requests............................... 2

Max Users...................................... 16

VLAN Assigned..................................

Supplicant Timeout............................. 30

Guest-vlan Timeout............................. 30

Server Timeout (secs).......................... 30

MAB mode (configured).......................... Disabled

MAB mode (operational)......................... Disabled

Authenticator PAE State........................ Initialize

Backend Authentication State................... Initialize

Security Commands 982

show dot1x interface statistics

Use the show dot1x interface statistics command to display 802.1x statistics

for the specified interface.

Syntax

show dot1x interface {gigabitethernet unit/slot/port| tengigabitethernet

unit/slot/port | fortygigabitethernet unit/slot/port} statistics

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The following table describes the significant fields shown in the display.

Field Description

Port The interface for which counters are displayed.

EAPOL Frames Received The number of valid EAPOL frames of any type that

have been received by this Authenticator.

EAPOL Frames

Transmitted

The number of EAPOL frames of any type that have

been transmitted by this Authenticator.

EAPOL Start Frames

Received

The number of EAPOL Start frames that have been

received by this Authenticator.

EAPOL Logoff Frames

Received

The number of EAPOL Logoff frames that have been

received by this Authenticator.

EAP Response/ID Frames

Received

The number of EAP Resp/Id frames that have been

received by this Authenticator.

EAP Response Frames

Received

The number of valid EAP Response frames (other than

Resp/Id frames) that have been received by this

Authenticator.

Security Commands 983

Example

The following example displays 802.1x statistics for the specified interface.

console#show dot1x interface gigabitethernet 1/0/2 statistics

Port......................................... Gi1/0/2

EAPOL Frames Received.......................... 0

EAPOL Frames Transmitted....................... 0

EAPOL Start Frames Received.................... 0

EAPOL Logoff Frames Received................... 0

Last EAPOL Frame Version....................... 0

Last EAPOL Frame Source........................ 0000.0000.0000

EAP Response/Id Frames Received................ 0

EAP Response Frames Received................... 0

EAP Request/Id Frames Transmitted.............. 0

EAP Request Frames Transmitted................. 0

Invalid EAPOL Frames Received.................. 0

EAPOL Length Error Frames Received............. 0

show dot1x users

Use the show dot1x users command to display 802.1x authenticated users for

the switch.

EAP Request/ID Frames

Transmitted

The number of EAP Req/Id frames that have been

transmitted by this Authenticator.

EAP Request Frames

Transmitted

The number of EAP Request frames (other than Rq/Id

frames) that have been transmitted by this

Authenticator.

Invalid EAPOL Frames

Received

The number of EAPOL frames that have been received

by this Authenticator in which the frame type is not

recognized.

EAPOL Length Error

Frames Received

The number of EAPOL frames that have been received

by this Authenticator in which the Packet Body Length

field is invalid.

Last EAPOL Frame

Version

The protocol version number carried in the most recently

received EAPOL frame.

Last EAPOL Frame

Source

The source MAC address carried in the most recently

received EAPOL frame.

Field Description

Security Commands 984

Syntax

show dot1x users [username username]

• username — Supplicant username (Range: 1–160 characters)

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays 802.1x users.

console#show dot1x users

Port Username

--------- ---------

Gi1/0/1 Bob

Gi1/0/2 John

Switch# show dot1x users username Bob

Port Username

--------- ---------

Gi1/0/1 Bob

The following table describes the significant fields shown in the display:

clear dot1x authentication–history

Use the clear dot1x authentication–history command to clear the

authentication history table captured during successful and unsuccessful

authentication.

Field Description

Username The username representing the identity of the Supplicant.

Port The port over which the user authenticated.

Security Commands 985

Syntax

clear dot1x authentication–history [interface–id]

• interface–id—Any valid interface. See Interface Naming Conventions for

interface representation.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

This command has no user guidelines.

Example

This examples clears all entries from the authentication log.

console#clear dot1x authentication-history

This example purges all entries for the specified interface from the

authention log.

console#clear dot1x authentication-history gi1/0/1

802.1x Advanced Features

dot1x guest-vlan

Use the dot1x guest-vlan command in Interface Configuration mode to set

the guest VLAN on a port. The VLAN must be defined prior to use. The no

form of this command sets the guest VLAN id to zero, which disables the

guest VLAN on a port.

Syntax

dot1x guest-vlan vlan-id

no dot1x guest-vlan

Security Commands 986

• vlan-id — The ID of a valid VLAN to use as the guest VLAN (Range: 0-

4093).

Default Configuration

The guest VLAN is disabled on the interface by default.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

If configured, the guest VLAN is the VLAN to which 802.1X unaware clients

are assigned. Configure the guest VLAN before using this command.

The switch attempts authentication three times before assigning a supplicant

to the guest VLAN.

Example

The following example sets the guest VLAN on port 1/0/2 to VLAN 10.

console(config-if-Gi1/0/2)#dot1x guest-vlan 10

dot1x timeout guest-vlan-period

Use the dot1x timeout guest-vlan-period command in Interface

Configuration mode to set the number of seconds that the switch waits

before authorizing the client if the client is an 802.1X unaware client. Use the

no form of the command to return the timeout to the default value.

Syntax

dot1x timeout guest-vlan-period seconds

no dot1x timeout guest-vlan-period

• seconds — Time in seconds that the switch waits before authorizing the

client if the client is a

802.1X

unaware client. Range 1-300.

Default Configuration

The switch remains in the quiet state for 90 seconds.

Security Commands 987

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

It is recommended that the user set the dot1x timeout guest-vlan-period to at

least three times the while timer so that at least three EAP Requests are sent,

before assuming that the client is an 802.1X unaware client. An 802.1X

unaware client is one that does not respond to EAP-Request/Identity frames

and does not send EAPOL-Start or EAP-Response/Identity frames.

Example

The following example sets the 802.1X timeout guest vlan period to 100

seconds.

console(config)# dot1x timeout guest-vlan-period 100

dot1x unauth-vlan

Use the dot1x unauth-vlan command in Interface Configuration mode to

specify the unauthenticated VLAN on a port. The unauthenticated VLAN is

the VLAN to which supplicants that fail 802.1x authentication are assigned.

Syntax

dot1x unauth-vlan vlan-id

no dot1x unauth-vlan

• vlan-id — The ID of a valid VLAN to use for unauthenticated clients

(Range: 0-4093).

Default Configuration

The unauthenticated VLAN is disabled on the interface by default.

Command Mode

Interface Configuration (Ethernet) mode

Security Commands 988

User Guidelines

The switch attempts authentication three times before assigning a user to the

unauthenticated VLAN. Configure the unauthenticated VLAN before using

this command.

Example

The following example set the unauthenticated VLAN on port 1/0/2 to VLAN

20.

console(config-if-Gi1/0/2)#dot1x unauth-vlan 20

show dot1x advanced

Use the show dot1x advanced command to display 802.1x advanced features

for the switch or for the specified interface. The output of this command has

been updated in release 2.1 to remove the Multiple Hosts column and add an

Unauthenticated VLAN column, which indicates whether an

unauthenticated VLAN is configured on a port. The command has also been

updated to show the Guest VLAN ID (instead of the status) since it is now

configurable per port.

Syntax

show dot1x advanced [{gigabitethernet unit/slot/port| tengigabitethernet

unit/slot/port | fortygigabitethernet unit/slot/port}]

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays 802.1x advanced features for the switch.

Security Commands 989

console#show dot1x advanced

Port Guest Unauthenticated

VLAN Vlan

--------- --------- ---------------

Gi1/0/1 Disabled Disabled

Gi1/0/2 10 20

Gi1/0/3 Disabled Disabled

Gi1/0/4 Disabled Disabled

Gi1/0/5 Disabled Disabled

Gi1/0/6 Disabled Disabled

console#show dot1x advanced gigabitethernet 1/0/2

Port Guest Unauthenticated

VLAN Vlan

--------- --------- ---------------

Gi1/0/2 10 20

Security Commands 990

Captive Portal Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

The Captive Portal feature is a software implementation that blocks both

wired and wireless clients from accessing the network until user verification

has been established. Verification can be configured to allow access for both

guest and authenticated users. Authenticated users must be validated against

a database of authorized Captive Portal users before access is granted.

The Authentication server supports both HTTP and HTTPS web

connections. In addition, Captive Portal can be configured to use an optional

HTTP port (in support of HTTP Proxy networks) or an optional HTTPS port.

If configured, this additional port or ports are then used exclusively by

Captive Portal.

NOTE: This optional HTTP port is in addition to the standard HTTP port 80 which is

currently being used for all other web traffic, and the optional HTTPS port is in

addition to the standard HTTPS port 443 used for secure web traffic.

Commands in this Section

This section explains the following commands:

Administrative Profiles Commands

Captive Portal Configuration Commands

authentication timeout https port

captive-portal show captive-portal

enable show captive-portal status

http port

–

block name (Captive Portal)

configuration protocol

enable redirect

group redirect-url

Security Commands 991

Captive Portal Client Connection Commands

Captive Portal Local User Commands

Captive Portal Status Commands

Captive Portal User Group Commands

interface session-timeout

locale verification

captive-portal client deauthenticate show captive-portal interface client status

show captive-portal client status show captive-portal interface configuration

status

show captive-portal configuration client

status

–

clear captive-portal users user-logout

no user user name

show captive-portal user user password

user group user session-timeout

show captive-portal configuration show captive-portal configuration locales

show captive-portal configuration interface show captive-portal configuration status

user group user group name

user group moveusers

–

Security Commands 992

Captive Portal Global Commands

authentication timeout

Use the authentication timeout command to configure the authentication

timeout. If the user does not enter valid credentials within this time limit, the

authentication page needs to be served again in order for the client to gain

access to the network. Use the “no” form of this command to reset the

authentication timeout to the default.

Syntax

authentication timeout timeout

no authentication timeout

• timeout — The authentication timeout (Range: 60–600 seconds).

Default Configuration

The default authentication timeout is 300 seconds.

Command Mode

Captive Portal Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp)#authentication timeout 600

console(config-cp)#no authentication timeout

captive-portal

Use the captive-portal command to enter the captive portal configuration

mode.

Syntax

captive-portal

Security Commands 993

Default Configuration

There is no default configuration for this command.

Command Mode

Global Configuration mode

User Guidelines

There are no user guidelines for this command.

Example

console(config)#captive-portal

console(config-cp)#

enable

Use the enable command to globally enable captive portal. Use the “no” form

of this command to globally disable captive portal.

Syntax

enable

no enable

Default Configuration

Captive Portal is disabled by default.

Command Mode

Captive Portal Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp)#enable

Security Commands 994

http port

Use the http port command to configure an additional HTTP port for captive

portal to listen for connections. Use the “no” form of this command to

remove the additional HTTP port from monitoring.

Syntax

http port port-num

no http port

• port-num — The port number on which the HTTP server listens for

connections

(

Range: 1025–65535).

Default Configuration

Captive portal only monitors port 80 by default.

Command Mode

Captive Portal Configuration mode

User Guidelines

The port number should not be set to a value that might conflict with other well-

known protocol port numbers used on this switch.

Example

console(config-cp)#http port 32768

console(config-cp)#no http port

https port

Use the https port command to configure an additional HTTPS port for

captive portal to monitor. Use the “no” form of this command to remove the

additional HTTPS port.

Syntax

https port port-num

no https port

Security Commands 995

• port-num — The port number on which the HTTPS server listens for

connections (Range: 1025–65535).

Default Configuration

Captive portal listens on port 443 by default.

Command Mode

Captive Portal Configuration mode.

User Guidelines

The port number should not be set to a value that might conflict with other well-

known protocol port numbers used on this switch.

Example

console(config-cp)#https port 1443

console(config-cp)#no https port

show captive-portal

Use the show captive-portal command to display the status of the captive

portal feature.

Syntax

show captive-portal

Default Configuration

There is no default configuration for this command

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Security Commands 996

Example

console#show captive-portal

Administrative Mode....................... Disabled

Operational Status........................ Disabled

Disable Reason............................ Administrator Disabled

CP IP Address............................. 1.2.3.4

show captive-portal status

Use the show captive-portal status command to report the status of all

captive portal instances in the system.

Syntax

show captive-portal status

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show captive-portal status

Additional HTTP Port........................... 81

Additional HTTP Secure Port.................... 1443

Authentication Timeout......................... 300

Supported Captive Portals...................... 10

Configured Captive Portals..................... 1

Active Captive Portals......................... 0

Local Supported Users.......................... 128

Configured Local Users......................... 3

System Supported Users......................... 1024

Authenticated Users............................ 0

Security Commands 997

Captive Portal Configuration Commands

The commands in this section are related to captive portal configurations.

block

Use the block command to block all traffic for a captive portal configuration.

Use the “no” form of this command to unblock traffic.

Syntax

block

no block

Default Configuration

Traffic is not blocked by default.

Command Mode

Captive Portal Instance mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp 2)#block

configuration

Use the configuration command to enter the captive portal instance mode.

The captive portal configuration identified by CP ID 1 is the default CP

configuration. The system supports a total of ten CP configurations. Use the

“no” form of this command to delete a configuration. The default

configuration (1) cannot be deleted.

Syntax

configuration cp-id

no configuration cp-id

Security Commands 998

• cp-id — Captive Portal ID (Range: 1–10).

Default Configuration

Configuration 1 is enabled by default.

Command Mode

Captive Portal Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp)#configuration 2

console(config-cp 2)#

enable

Use the enable command to enable a captive portal configuration. Use the no

form of this command to disable a configuration.

Syntax

enable

no enable

Default Configuration

Configurations are enabled by default

Command Mode

Captive Portal Instance mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp 2)#no enable

Security Commands 999

group

Use the group command to configure the group number for a captive portal

configuration. If a group number is configured, the user entry (Local or

RADIUS) must be configured with the same name and the group to

authenticate to this captive portal instance. Use the no form of this

command to reset the group number to the default.

Syntax

group group-number

no group

• group-number — The number of the group to associate with this

configuration (Range: 1–10).

Default Configuration

The default group number is 1.

Command Mode

Captive Portal Instance mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp 2)#group 2

interface

Use the interface command to associate an interface with a captive portal

configuration. Use the no form of this command to remove an association.

Syntax

interface interface

no interface interface

• interface — An interface or range of interfaces.

Security Commands 1000

Default Configuration

No interfaces are associated with a configuration by default.

Command Mode

Captive Portal Instance Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp 2)#interface gi1/0/2

locale

The locale command is not intended to be a user command. The

administrator must use the Web UI to create and customize captive portal

web content. This command is primarily used by the show running-config

command and process as it provides the ability to save and restore

configurations using a text based format.

Syntax

locale web-id

• web-id — The locale number (Range: 1–3)

Default Configuration

Locale 1 is configured by default.

Command Mode

Captive Portal Instance mode.

User Guidelines

Captive Portal supports 3 locales per configuration.

Security Commands 1001

name (Captive Portal)

Use the name command to configure the name for a captive portal

configuration. Use the no form of this command to remove a configuration

name.

Syntax

name cp-name

no name

• cp-name — CP configuration name (Range: 1–32 characters).

Default Configuration

Configuration 1 has the name “Default” by default. All other configurations

have no name by default.

Command Mode

Captive Portal Instance mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp 2)#name cp2

protocol

Use the protocol command to configure the protocol mode for a captive

portal configuration.

Syntax

protocol {http | https}

Default Configuration

The default protocol mode is http.

Security Commands 1002

Command Mode

Captive Portal Instance mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp 2)#protocol http

redirect

Use the redirect command to enable the redirect mode for a captive portal

configuration. Use the “no” form of this command to disable redirect mode.

Syntax

redirect

no redirect

Default Configuration

Redirect mode is disabled by default.

Command Mode

Captive Portal Instance mode.

User Guidelines

Enabling redirect mode will configure the redirect-url with an empty URL.

Example

console(config-cp 2)#redirect

redirect-url

Use the redirect-url command to configure the redirect URL for a captive

portal configuration.

Security Commands 1003

Syntax

redirect-url url

• url — The URL for redirection (Range: 1–512 characters).

Default Configuration

There is no redirect URL configured by default.

Command Mode

Captive Portal Instance mode.

User Guidelines

The administrator must enable redirect mode before executing this

command.

Example

console(config-cp 2)#redirect-url www.dell.com

session-timeout

Use the session-timeout command to configure the session timeout for a

captive portal configuration. Use the no form of this command to reset the

session timeout to the default.

Syntax

session-timeout timeout

no session-timeout

• timeout — Session timeout. 0 indicates timeout not enforced (Range: 0–

86400 seconds).

Default Configuration

There is no session timeout by default.

Command Mode

Captive Portal Instance mode.

Security Commands 1004

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp 2)#session-timeout 86400

console(config-cp 2)#no session-timeout

verification

Use the verification command to configure the verification mode for a

captive portal configuration.

Syntax

verification { guest | local | radius }

• guest — Allows access for unauthenticated users (users that do not have

assigned user names and passwords).

• local — Authenticates users against a local user database.

• radius — Authenticates users against a remote RADIUS database.

Default Configuration

The default verification mode is guest.

Command Mode

Captive Portal Instance mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp 2)#verification local

Security Commands 1005

Captive Portal Client Connection Commands

captive-portal client deauthenticate

Use the captive-portal client deauthenticate command to deauthenticate a

specific captive portal client.

Syntax

captive-portal client deauthenticate macaddr

• macaddr — Client MAC address.

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode.

User Guidelines

There are no user guidelines for this command.

Example

console#captive-portal client deauthenticate 0002.BC00.1290

show captive-portal client status

Use the show captive-portal client status command to display client

connection details or a connection summary for connected captive portal

users.

Syntax

show captive-portal client [macaddr] status

• macaddr — Client MAC address.

Default Configuration

There is no default configuration for this command.

Security Commands 1006

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show captive-portal client status

Client MAC Address Client IP Address Protocol Verification Session Time

------------------ ----------------- -------- ------------ ------------

0002.BC00.1290 10.254.96.47 https Local 0d:00:01:20

0002.BC00.1291 10.254.96.48 https Local 0d:00:05:20

0002.BC00.1292 10.254.96.49 https Radius 0d:00:00:20

console#show captive-portal client 0002.BC00.1290 status

Client MAC Address........................ 0002.BC00.1290

Client IP Address......................... 10.254.96.47

Protocol Mode............................. https

Verification Mode......................... Local

CP ID..................................... 1

CP Name................................... cp1

Interface................................. Gi1/0/1

Interface Description..................... Unit: 1 Slot: 0 Port: 1 Gigabit -

Level

User Name................................. user123

Session Time.............................. 0d:00:00:13

show captive-portal configuration client status

Use the show captive-portal configuration client status command to display

the clients authenticated to all captive portal configurations or a to specific

configuration.

Syntax

show captive-portal configuration [ cp-id ] client status

• cp-id — Captive Portal ID.

Default Configuration

There is no default configuration for this command.

Security Commands 1007

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show captive-portal configuration client status

CP ID CP Name Client MAC Address Client IP Address Interface

----- --------------- ------------------ ----------------- ---------

1 cp1 0002.BC00.1290 10.254.96.47 Gi1/0/1

0002.BC00.1291 10.254.96.48 Gi1/0/2

2 cp2 0002.BC00.1292 10.254.96.49 Gi1/0/3

3 cp3 0002.BC00.1293 10.254.96.50 Gi1/0/4

console#show captive-portal configuration 1 client status

CP ID..................................... 1

CP Name................................... cp1

Client Client

MAC Address IP Address Interface Interface Description

-------------- --------------- --------- --------------------------------

0002.BC00.1290 10.254.96.47 Gi1/0/1 Unit: 1 Slot: 0 Port: 1 Gigabit

0002.BC00.1291 10.254.96.48 Gi1/0/2 Unit: 1 Slot: 0 Port: 2 Gigabit

show captive-portal interface client status

Use the show captive-portal interface client status command to display

information about clients authenticated on all interfaces or a specific

interface.

Syntax

show captive-portal interface {gigabitethernet unit/slot/port|

tengigabitethernet unit/slot/port | fortygigabitethernet unit/slot/port} client

status

Default Configuration

There is no default configuration for this command.

Security Commands 1008

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show captive-portal interface client status

Client Client

Intf Intf Description MAC Address IP Address

------ ----------------------------------- ----------------- ---------------

Gi1/0/1 Unit: 1 Slot: 0 Port: 1 Gigabit 0002.BC00.1290 10.254.96.47

0002.BC00.1291 10.254.96.48

Gi1/0/2 Unit: 1 Slot: 0 Port: 2 Gigabit 0002.BC00.1292 10.254.96.49

Gi1/0/3 Unit: 1 Slot: 0 Port: 3 Gigabit 0002.BC00.1293 10.254.96.50

console#show captive-portal interface gi1/0/1 client status

Interface................................. Gi1/0/1

Interface Description..................... Unit: 1 Slot: 0 Port: 1 Gigabit

Client Client

MAC Address IP Address CP ID CP Name Protocol Verification

----------------- --------------- ----- ----------------- -------- ---------

0002.BC00.1290 10.254.96.47 1 cp1 http local

0002.BC00.1291 10.254.96.48 2 cp2 http local

Captive Portal Interface Commands

show captive-portal interface configuration

status

Use the show captive-portal interface configuration status command to

display the interface to configuration assignments for all captive portal

configurations or for a specific configuration.

Syntax

show captive-portal interface configuration [cp-id] status

• cp-id — Captive Portal ID.

Security Commands 1009

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show captive-portal interface configuration status

CP ID CP Name Interface Interface Description Type

----- -------- --------- ------------------------------------ ---------

1 Default Gi1/0/1 Unit:1 Slot: 0 Port: 1 Gigabit . Physical

console#show captive-portal interface configuration 1 status

CP ID..................................... 1

CP Name................................... cp1

Interface Interface Description Type

--------- ----------------------------------- --------

Gi1/0/1 Unit: 1 Slot: 0 Port: 1 Gigabit ... Physical

Captive Portal Local User Commands

clear captive-portal users

Use the clear captive-portal users command to delete all captive portal user

entries.

Syntax

clear captive-portal users

Default Configuration

There is no default configuration for this command.

Security Commands 1010

Command Mode

Privileged Exec mode.

User Guidelines

There are no user guidelines for this command.

Example

console#clear captive-portal users

no user

Use the no user command to delete a user from the local user database. If the

user has an existing session, it is disconnected.

Syntax

no user user-id

• user-id — User ID (Range: 1–128).

Default Configuration

There is no default configuration for this command.

Command Mode

Captive Portal Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp)#no user 1

show captive-portal user

Use the show captive-portal user command to display all configured users or a

specific user in the captive portal local user database.

Security Commands 1011

Syntax

show captive-portal user [user-id]

• user-id — User ID (Range: 1–128).

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show captive-portal user

Session

User ID User Name Timeout Group ID Group Name

------- --------------------- ------- ------------ ------------

1 user123 14400 1 Default

2 user234 0 1 Default

2 group2

console#show captive-portal user 1

User ID........................................ 1

User Name...................................... user123

Password Configured............................ Yes

Session Timeout................................ 0

Group ID Group Name

-------- --------------------------------

1 Default

2 group2

user group

Use the user group command to associate a group with a captive portal user.

Use the “no” form of this command to disassociate a group and user. A user

must be associated with at least one group so the last group cannot be

disassociated.

Security Commands 1012

Syntax

user user-id group group-id

• user-id — User ID (Range: 1–128).

• group-id — Group ID (Range: 1–10).

Default Configuration

A user is associated with group 1 by default.

Command Mode

Captive Portal Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp)#user 1 group 3

user-logout

Use the user-logout command in Captive Portal Instance mode to enable

captive portal users to log out of the portal (versus having the session time

out). Use the no form of the command to return the user logout

configuration to the default.

Syntax

user-logout

no user-logout

Default Configuration

User-logout is disabled by default.

Command Mode

Captive-portal Instance mode

Security Commands 1013

User Guidelines

There are no user guidelines for this command.

Example

In this example, all classes of entries in the mac address-table are displayed.

console(config)#captive-portal

console(config-cp)#user 1 name asd

console(config-cp)#configuration 1

console(config-cp 1)#user-logout

console(config-cp 1)#no user-logout

user name

Use the user name command to modify the user name for a local captive

portal user.

Syntax

user user-id name name

• user-id — User ID (Range: 1–128).

• name — user name (Range: 1–32 characters).

Default Configuration

There is no name for a user by default.

Command Mode

Captive Portal Configuration mode.

User Guidelines

There are no user guidelines.

Example

console(config-cp)#user 1 name johnsmith

Security Commands 1014

user password

Use the user password command to create a local user or change the password

for an existing user.

Syntax

user user-id password {password | encrypted enc-password}

• user-id — User ID (Range: 1–128).

• password — User password (Range: 8–64 characters).

• enc-password — User password in encrypted form.

Default Configuration

There are no users configured by default.

Command Mode

Captive Portal Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp)#user 1 password

Enter password (8 to 64 characters): ********

Re-enter password: ********

user session-timeout

Use the user session-timeout command to set the session timeout value for a

captive portal user. Use the no form of this command to reset the session

timeout to the default.

Syntax

user user-id session-timeout timeout

no user user-id session-timeout

• user-id — User ID (Range: 1–128).

Security Commands 1015

• timeout — Session timeout. 0 indicates use global configuration (Range:

0–86400 seconds).

Default Configuration

The global session timeout is used by default.

Command Mode

Captive Portal Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp)#user 1 session-timeout 86400

console(config-cp)#no user 1 session-timeout

Captive Portal Status Commands

show captive-portal configuration

Use the show captive-portal configuration command to display the

operational status of each captive portal configuration.

Syntax

show captive-portal configuration cp-id

• cp-id — Captive Portal ID.

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

Security Commands 1016

User Guidelines

There are no user guidelines for this command.

Example

console#show captive-portal configuration 1

CP ID..................................... 1

CP Name................................... cp1

Operational Status........................ Disabled

Disable Reason............................ Administrator Disabled

Blocked Status............................ Not Blocked

Configured Locales........................ 1

Authenticated Users....................... 0

show captive-portal configuration interface

Use the show captive-portal configuration interface command to display

information about all interfaces assigned to a captive portal configuration or

about a specific interface assigned to a captive portal configuration.

Syntax

show captive-portal configuration cp-id interface [{gigabitethernet

unit/slot/port| tengigabitethernet unit/slot/port | fortygigabitethernet

unit/slot/port}]

• cp-id — Captive Portal ID.

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show captive-portal configuration 1 interface

CP ID..................................... 1

Security Commands 1017

CP Name................................... cp1

Operational Block

Interface Interface Description Status Status

--------- ---------------------------------------- ------------ ---------

Gi1/0/1 Unit: 1 Slot: 0 Port: 1 Gigabit - Level Disabled Blocked

console#show captive-portal configuration 1 interface gi1/0/1

CP ID..................................... 1

CP Name................................... cp1

Interface................................. Gi1/0/1

Interface Description..................... Unit: 1 Slot: 0 Port: 1 Gigab...

Operational Status........................ Disabled

Disable Reason............................ Interface Not Attached

Block Status.............................. Not Blocked

Authenticated Users....................... 0

show captive-portal configuration locales

Use the show captive-portal configuration locales command to display

locales associated with a specific captive portal configuration.

Syntax

show captive-portal configuration cp-id locales

• cp-id — Captive Portal Configuration ID.

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show captive-portal configuration 1 locales

Locale Code

---------------

Security Commands 1018

show captive-portal configuration status

Use the show captive-portal configuration status command to display

information about all configured captive portal configurations or about a

specific captive portal configuration.

Syntax

show captive-portal configuration [ cp-id ] status

• cp-id — Captive Portal ID.

Default Configuration

There is no default configuration for this command.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

There are no user guidelines for this command.

Example

console#show captive-portal configuration status

CP ID CP Name Mode Protocol Verification

----- --------------- -------- -------- ------------

1 cp1 Enable https Guest

2 cp2 Enable http Local

3 cp3 Disable https Guest

console#show captive-portal configuration 1 status

CP ID.......................................... 1

CP Name........................................ cp1

Mode........................................... Enabled

Protocol Mode.................................. https

Verification Mode.............................. Guest

Group Name..................................... group123

Redirect URL Mode.............................. Enabled

Redirect URL................................... www.cnn.com

Session Timeout (seconds)...................... 86400

Security Commands 1019

Captive Portal User Group Commands

user group

Use the user group command to create a user group. Use the no form of this

command to delete a user group. The default user group (1) cannot be

deleted.

Syntax

user group group-id

no user group group-id

group-id

—

Group ID (Range: 1–10).

Default Configuration

User group 1 is created by default and cannot be deleted.

Command Mode

Captive Portal Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp)#user group 2

console(config-cp)#no user group 2

user group moveusers

Use the user group moveusers command to move a group's users to a different

group.

Syntax

user group group-id moveusers new-group-id

• group-id — Group ID (Range: 1–10).

• new-group-id — Group ID (Range: 1–10).

Security Commands 1020

Default Configuration

There is no default configuration for this command.

Command Mode

Captive Portal Configuration mode

User Guidelines

The new group-id must already exist.

Example

console(config-cp)#user group 2

console(config-cp)#user 1 group 2

console(config-cp)#user group 2 moveusers 3

user group name

Use the user group name command to configure a group name.

Syntax

user group group-id name name

• group-id — Group ID (Range: 1–10).

• name — Group name (Range: 1–32 alphanumeric characters).

Default Configuration

User groups have no names by default.

Command Mode

Captive Portal Configuration mode.

User Guidelines

There are no user guidelines for this command.

Example

console(config-cp)#user group 2 name group2

Security Commands 1021

Denial of Service Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

The Dell EMC Networking DoS capability supports a package of filters

intended to provide network administrators the ability to reduce network

exposure to common attack vectors. The following list shows the DoS attack

detection Dell EMC Networking supports.

• SIP=DIP:

– Source IP address = Destination IP address.

• First Fragment:

– TCP Header size smaller then configured value.

• TCP Fragment:

– IP Fragment Offset = 1.

• TCP Flag:

– TCP Flag SYN set and Source Port < 1024 or TCP Control Flags = 0

and

– TCP Sequence Number = 0 or TCP Flags FIN, URG, and PSH set

and

– TCP Sequence Number = 0 or TCP Flags SYN and FIN set.

• L4 Port:

– Source TCP/UDP Port = Destination TCP/UDP Port.

• ICMP:

– Limiting the size of ICMP Ping packets.

• SMAC=DMAC:

– Source MAC address = Destination MAC address.

• TCP Port:

– Source TCP Port = Destination TCP Port.

• UDP Port:

– Source UDP Port = Destination UDP Port.

• TCP Flag & Sequence:

Security Commands 1022

– TCP Flag SYN set and Source Port < 1024 or TCP Control Flags = 0

and

– TCP Sequence Number = 0 or TCP Flags FIN, URG, and PSH set

and

– TCP Sequence Number = 0 or TCP Flags SYN and FIN set.

• TCP Offset:

– Checks for TCP header offset =1.

• TCP SYN:

– TCP Flag SYN set.

• TCP SYN & FIN:

– TCP Flags SYN and FIN set.

• TCP FIN & URG & PSH:

– TCP Flags FIN and URG and PSH set and TCP Sequence Number =

• ICMP V6:

– Limiting the size of ICMPv6 Ping packets.

• ICMP Fragment:

– Checks for fragmented ICMP packets.

Commands in this Section

This section explains the following commands:

dos-control firstfrag rate-limit cpu

dos-control icmp show dos-control

dos-control l4port show system internal pktmgr

dos-control sipdip storm-control broadcast

dos-control tcpflag storm-control multicast

dos-control tcpfrag storm-control unicast

Security Commands 1023

dos-control firstfrag

Use the dos-control firstfrag command in Global Configuration mode to

enable Minimum TCP Header Size Denial of Service protection. If the mode

is enabled, Denial of Service prevention is active for this type of attack. If

packets ingress having a TCP Header Size smaller than the configured value,

the packets are dropped.

Syntax

dos-control firstfrag [size]

no dos-control firstfrag

• size —TCP header size. (Range: 0-255). The default TCP header size is 20.

ICMP packet size is 512.

Default Configuration

Denial of Service is disabled.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example defines a minimum TCP header size of 20. Packets

entering with a smaller header size are dropped.

console(config)#dos-control firstfrag 20

dos-control icmp

Use the dos-control icmp command in Global Configuration mode to enable

Maximum ICMP Packet Size Denial of Service protections. If the mode is

enabled, Denial of Service prevention is active for this type of attack. If ICMP

Echo Request (PING) packets ingress having a size greater than the

configured value, the packets are dropped.

Security Commands 1024

Syntax

dos-control icmp [size ]

no dos-control icmp

• size — Maximum ICMP packet size. (Range: 0-16376). If size is

unspecified, the value is 512.

Default Configuration

Denial of Service is disabled.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example activates the Maximum ICMP Packet Denial of

Service protection with a maximum packet size of 1023.

console(config)#dos-control icmp 1023

dos-control l4port

Use the dos-control l4port command in Global Configuration mode to

enable L4 Port Denial of Service protection. If the mode is enabled, Denial of

Service prevention is active for this type of attack. If packets ingress having

Source TCP/UDP Port Number equal to Destination TCP/UDP Port

Number, the packets are dropped.

Syntax

dos-control l4port

no dos-control l4port

Default Configuration

Denial of Service is disabled.

Security Commands 1025

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example activates L4 Port Denial of Service protection.

console(config)#dos-control l4port

dos-control sipdip

Use the dos-control sipdip command in Global Configuration mode to

enable Source IP Address = Destination IP Address (SIP=DIP) Denial of

Service protection. If the mode is enabled, Denial of Service prevention is

active for this type of attack. If packets ingress with SIP=DIP, the packets is

dropped if the mode is enabled.

Syntax

dos-control sipdip

no dos-control sipdip

Default Configuration

Denial of Service is disabled.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example activates SIP=DIP Denial of Service protection.

console(config)#dos-control sipdip

Security Commands 1026

dos-control tcpflag

Use the dos-control tcpflag command in Global Configuration mode to

enable TCP Flag Denial of Service protections. If the mode is enabled, Denial

of Service prevention is active for this type of attack. If packets ingress having

TCP Flag SYN set and a source port less than 1024, having TCP Control

Flags set to 0 and TCP Sequence Number set to 0, having TCP Flags FIN,

URG, and PSH set and TCP Sequence Number set to 0, or having TCP Flags

SYN and FIN both set, the packets are dropped.

Syntax

dos-control tcpflag

no dos-control tcpflag

Default Configuration

Denial of Service is disabled.

Command Mode

Global Configuration mode.

User Guidelines

This command has no user guidelines.

Example

The following example activates TCP Flag Denial of Service protections.

console(config)#dos-control tcpflag

dos-control tcpfrag

Use the dos-control tcpfrag command in Global Configuration mode to

enable TCP Fragment Denial of Service protection. If the mode is enabled,

Denial of Service prevention is active for this type of attack. If packets ingress

having IP Fragment Offset equal to one (1), the packets are dropped.

Syntax

dos-control tcpfrag

Security Commands 1027

no dos-control tcpfrag

Default Configuration

Denial of Service is disabled.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example activates TCP Fragment Denial of Service protection.

console(config)#dos-control tcpfrag

rate-limit cpu

Use the rate-limit cpu command to reduce the amount of unknown

unicast/multicast packets forwarded to the CPU on CoS queues 0 and 1.

This command also configures the rate in packets-per-second for the number

of IPv4 and IPv6 data packets trapped to CPU when the packet fails to be

forwarded in the hardware due to unresolved MAC address of the destination

IPv6 node. Packets exceeding the rate limit are silently discarded.

Use the no form of the command to return the rate limit to the default value.

Syntax

rate-limit cpu direction input pps pps-value

no rate-limit cpu direction input pps

• pps-value—Range of 100-1024 packets per second (100-3000 for N4000

switches)

Default Configuration

The default is 1024 packets per second

(3000 for N4000 switches)

Security Commands 1028

Command Modes

Global Configuration mode

User Guidelines

Unknown multicast and IPv4/IPv6 data packets destined to hosts in the

connected networks on the router for which the MAC address is not resolved

are trapped to CPU to trigger the ARP/neighbor discovery resolution of those

hosts.

When the ARP or neighbor table is filled, the switch cannot accommodate

new entries. In this case, there is no value in receiving the unresolved

IPv4/IPv6 packets. Likewise, in cases of a L2 network re-convergence, a large

number of neighbors may not be discovered but may be transmitting traffic.

In the case of multicast data, certain multicast topologies using multi-access

VLANs may result in packets being forwarded to the CPU with no associated

PIM or MFDB state.

Receiving large numbers unresolved packets spikes the CPU usage to high

levels at no benefit. For Ipv6, it also results in delayed processing of the NUD

packets (NS/NA) for the existing neighbor entries leading to NUD anomalies

and deletions of existing neighbor entries.

To avoid such an unnecessary CPU load leading to NUD anomalies when the

ARP or IPV6 neighbor table is close to full (crossing 95% of table size) or

other failures, the switch automatically reduces the rate limit to an empirical

value of 50 pps irrespective of the configured rate limit. When the table size

falls below 95% of the table size, it is restored to the configured rate limit

value.

Use this command to limit the CPU load in situations where large numbers of

unknown multicast or IPv4/IPv6 packets with an unknown multicast or

unicast IPv4/IPv6 destination are being handled in software. The symptom

can be diagnosed by high CPU usage of the ipMapForwardingTask.

Example

An example output is showing higher than normal CPU usage due to packets

copied to the software forwarding task below:

console#show process cpu

Memory Utilization Report

Security Commands 1029

status bytes

------ ----------

free 1055653888

alloc 672153600

CPU Utilization:

PID Name 5 Secs 60 Secs 300 Secs

---------- ------------------- -------- -------- --------

1129 osapiTimer 0.09% 0.02% 0.01%

1137 bcmCNTR.0 0.19% 0.28% 0.30%

1142 bcmRX 18.00% 12.04% 11.10%

1155 bcmLINK.0 0.39% 0.37% 0.36%

1156 cpuUtilMonitorTask 0.09% 0.04% 0.04%

1170 nim_t 0.09% 0.07% 0.07%

1222 snoopTask 0.09% 0.02% 0.02%

1243 ipMapForwardingTask 27.30% 24.19% 29.06%

1257 tRtrDiscProcessingT 0.09% 0.01% 0.00%

1291 RMONTask 0.00% 0.02% 0.03%

1293 boxs Req 0.00% 0.01% 0.01%

------------------------------ -------- -------- --------

Total CPU Utilization 55.91% 45.40% 48.02%

show dos-control

Use the show dos-control command to display Denial of Service

configuration information.

Syntax

show dos-control

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Security Commands 1030

Example

The following example displays Denial of Service configuration information.

console#show dos-control

SIPDIP Mode...............................Disable

First Fragment Mode.......................Disable

Min TCP Hdr Size..........................20

TCP Fragment Mode........................ Disable

TCP Flag Mode.............................Disable

L4 Port Mode..............................Disable

ICMP Mode.................................Disable

Max ICMP Pkt Size.........................512

show system internal pktmgr

Use the show system internal pktmgr command to display the configured

CPU rate limit for unknown packets in packets per second.

Syntax

show system internal pktmgr internal control sw-rate-limit

Default Configuration

This command has no default configuration.

Command Modes

Privileged Exec mode

User Guidelines

See the rate-limit cpu command for further information on the output of this

command.

Example

console# show system internal pktmgr internal control sw-rate-limit

Inband pps global threshold 1024

Security Commands 1031

storm-control broadcast

Use the storm-control broadcast command to enable broadcast storm

recovery mode for a specific interface. Use the no form of the command to

disable storm control or to return the configuration to the default.

Syntax

storm-control broadcast [{level level| rate rate | action {shutdown | trap}]

no storm-control broadcast [level| rate | action]

• level— The configured rate as a percentage of link bandwidth (Range: 0-

100)

• rate — The configured rate in packets per second. (Range: 0-14880000)

•action shutdown—Places the interface in the D-disable state if the

threshold is exceeded.

•action trap—Logs a message and issue a trap if the threshold is exceeded.

Default Configuration

By default, broadcast storm control is disabled on all physical interfaces.

The default threshold for broadcast traffic is 5% of link bandwidth.

The default behavior is to rate limit (drop) traffic exceeding the configured

threshold.

There is no default action.

Command Mode

Interface Configuration (Ethernet) mode, Interface Range mode

User Guidelines

Broadcast storm control can only be enabled on physical interfaces. It cannot

be configured on port channels.

Setting the level, rate or action enables broadcast storm control. When

enabled, broadcast storm control can issue a trap and drop traffic in excess of

the configured rate (level) or shut down the port if the rate is exceeded.

Either the level or the rate threshold may be configured, but not both.

Security Commands 1032

Either the trap action or the shutdown action may be specified, but not both.

The trap action issues a log message and a trap when the configured threshold

is exceeded. Traffic exceeding the threshold is dropped.

The shutdown action shuts down the interface, puts the interface into the D-

disable state, issues a log message (WARNING) and a trap. The operator may

bring the port back into service using the no shutdown command.

Use the show storm-control action and show storm-control all commands to

display the storm control settings.

Example

The following example configures any port to drop excess broadcast traffic

and issue a log and trap if the received broadcast traffic exceeds 10% of link

bandwidth:

console(config)#interface range gi1/0/1-24

console(config-if)#storm-control broadcast level 10

console(config-if)#storm-control broadcast action trap

console(config-if)#exit

storm-control multicast

Use the storm-control multicast command in Interface Configuration mode

to enable multicast storm storm control for an interface.

Use the no form of the command to disable storm-control in order to return

the configuration to the default.

Syntax

storm-control multicast [level level | rate rate | action {shutdown | trap}]

no storm-control multicast [level | rate | action]

• level— The configured rate as a percentage of link-speed.

• rate — The configured rate in packets per second. (Range: 0-14880000)

•action shutdown—Places the interface in the D-disable state if the

threshold is exceeded.

•action trap—Logs a message and issue a trap if the threshold is exceeded.

Security Commands 1033

Default Configuration

By default, multicast storm control is not enabled on any interfaces.

The default threshold for multicast traffic is 5% of link bandwidth.

The default behavior is to rate limit (drop) traffic exceeding the configured

threshold.

The default action is no action.

Command Mode

Interface Configuration (Ethernet) mode, Interface Range mode

User Guidelines

Multicast storm control applies to unknown multicast (i.e., multicast groups

that are not control plane traffic and are not currently active on any

interface). This is multicast traffic that normally is flooded in the VLAN.

Multicast storm control can issue a trap and drop traffic in excess of the

configured rate (level), or shut down the ingress port if the rate is exceeded.

Multicast storm control can only be enabled on physical interfaces. It cannot

be configured on port channels.

Setting the level, rate or action does not enable multicast storm control. Issue

the storm-control multicast command separately to enable multicast storm

control.

Either the level or the rate threshold may be configured, but not both.

Either the trap action or the shutdown action may be specified, but not both.

The trap action issues a log message (WARNING) and a trap when the

configured threshold is exceeded. Traffic exceeding the threshold is dropped.

The shutdown action shuts down the interface, puts the interface into the D-

disable state, issues a log message and a trap. The operator may bring the port

back into service using the no shutdown command.

Use the show storm-control action and show storm-control all commands to

display the storm control settings.

Example

The following example configures any port to shut down if the received

multicast traffic rate exceeds 20% of link bandwidth:

Security Commands 1034

console(config)#interface range gi1/0/1-24

console(config-if)#storm-control multicast level 20

console(config-if)#storm-control multicast action shutdown

console(config-if)#exit

storm-control unicast

Use the storm-control unicast command in Interface Configuration mode to

enable storm control for an interface. Unicast storm control limits the

number of unicast destination lookup failures (DLFs). Use the no form of the

command to disable unicast storm control or to return the configuration to

the default.

Syntax

storm-control unicast [level level |rate rate|action{shutdown|trap}]

no storm-control unicast [level | rate]

• level— The configured rate as a percentage of link bandwidth (Range: 0-

100)

• rate—The configured rate in packets per second. (Range: 0-14880000)

• action—The configured action: shutdown or trap.

Default Configuration

By default, unicast storm control is not enabled on any interfaces.

The default threshold for unicast traffic is 5% of link bandwidth.

Command Mode

Interface Configuration (Ethernet) mode, Interface Range mode

User Guidelines

A destination lookup failure (DLF) is when a L2 unicast packet is unable to

resolve the destination MAC address to an egress interface (no MAC

forwarding address entry exists). The standard behavior for L2 DLFs is to

flood the packet on all ports in the VLAN other than the port on which the

packet was received. This flooding behavior can cause significant amounts of

bandwidth to be consumed, potentially disrupting the forwarding of other

traffic.

Security Commands 1035

Unicast storm control can issue a trap and drop packets in excess of the

configured rate (level) or shut down the port when the rate is exceeded.

Setting the level, rate or action enables storm control. The shutdown action

disables the interface when a packet storm is detected. The trap action issues

an SNMP trap to configured SNMP agents.

Unicast storm control can only be enabled on physical interfaces. It cannot be

configured on port channels.

Either the level or the rate threshold may be configured, but not both.

Use the show storm-control action and show storm-control all commands to

display the storm control settings.

Example

The following example configures any port to rate limit DLF traffic rate to 5%

of link bandwidth:

console(config)#interface range gi1/0/1-24

console(config-if)#storm-control unicast level 5

console(config-if)#exit

Security Commands 1036

Management ACL Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

In order to ensure the security of the switch management features, the

administrator may elect to configure a management access control list. The

Management Access Control and Administration List (ACAL) component is

used to ensure that only known and trusted devices are allowed to remotely

manage the switch via TCP/IP. Management ACLs are only configurable on

IP (in-band) interfaces, not on the out-of-band interface or the serial port,

and only filter packets sent to the switch CPU. Packets that are forwarded by

the switch are not filtered by Management ACLs. Management ACLs filter

packets in firmware after all hardware based ACLs (ip access-list and ipv6

access-list) have been applied. This allows the administrator to configure

hardware based filtering criteria for in-band management access and then

further refine that criteria with firmware based filtering supplied by the

management ACL capability.

When a Management ACAL is enabled, incoming TCP packets initiating a

connection (TCP SYN) and UDP packets will be filtered based on their

source IP address and destination port. Additionally, other attributes such as

incoming port (or port-channel) and VLAN ID can be used to determine if

the traffic should be allowed access to the management interface. When the

Management Access Control component is disabled, incoming TCP/UDP

packets are not filtered in firmware and are processed normally. TCP SYN

packets or UDP packets addressed to the following destination port numbers

are not processed by the management ACL list: DNS(53), DHCP Server(67),

DHCP Client (68), TFTP(69), telnet(23), HTTP(80), HTTPS(443),

SNMP(161), SSH(22), and JAVA(4242).

There is also an option to restrict all the above packets from the network

interface. This is done by specifying “console only” in the MACAL

component. If this option is enabled, the system management interface is

only accessible via the serial port. All TCP SYN packets and UDP packets are

dropped except UDP packets sent to the ports listed above.

Commands in this Section

This section explains the following commands:

Security Commands 1037

deny (management)

Use the deny command in Management Access-List Configuration mode to

set conditions for disallowing packets to flow to the switch management

function.

Syntax

deny [gigabitethernet unit/slot/port | vlan vlan-id |

port-channel port-

channel-number

| tengigabitethernet unit/slot/port | fortygigabitethernet

unit/slot/port] [service service] [priority priority]

deny ip-source ip-address [mask mask | prefix-length] [gigabitethernet

unit/slot/port | vlan vlan-id |

port-channel port-channel-number

tengigabitethernet unit/slot/port | fortygigabitethernet unit/slot/port]

[service service] [priority priority]

•gigabitethernet unit/slot/port — A valid 1-Gigabit Ethernet-routed port

number.

•vlan vlan-id — A valid VLAN number.

•port-channel port-channel-number — A valid routed port-channel

number.

•tengigabitethernet unit/slot/port — A valid 10-Gigabit Ethernet-routed

port number.

•

fortygigabitethernet

unit/slot/port

–

A valid 40-Gigabit Ethernet-routed

port number.

• ip-address — Source IP address.

•mask mask — Specifies the network mask of the source IP address.

•mask prefix-length — Specifies the number of bits that comprise the

source IP address prefix. The prefix length must be preceded by a forward

slash (/). (Range: 0–32)

deny (management) permit (management)

management access-class show management access-class

management access-list show management access-list

Security Commands 1038

•service service — Indicates service type. Can be one of the following:

telnet, ssh, http, https, tftp, snmp, sntp, or any. The any keyword indicates

that the service match for the ACL is effectively “don’t care”.

•priority priority — Priority for the rule. (Range: 1–64)

Default Configuration

This command has no default configuration.

Command Mode

Management Access-list Configuration mode

User Guidelines

Rules with gigabitethernet, tengigabitethernet, fortygigabitethernet, vlan,

and port-channel parameters are valid only if an IP address is defined on the

appropriate interface. Ensure that each rule has a unique priority.

Example

The following example shows how all ports are denied in the access-list called

mlist.

console(config)# management access-list mlist

console(config-macal)# deny

management access-class

Use the management access-class command in Global Configuration mode

to restrict switch management connections. To disable any restrictions, use

the no form of this command.

Syntax

management access-class {console-only | name}

no management access-class

• name — A valid access-list name. (Range: 1–32 characters)

•console-only — The switch can be managed only from the console.

Security Commands 1039

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

The active management access-list processes IPv4 TCP/UDP packets only.

Packets for certain management protocols are allowed to pass to the CPU

without processing by the management ACL list. Specifically, TCP or UDP

packets addressed to the following destination port numbers are not

processed by the management ACL list: DNS(53), DHCP Server(67), DHCP

Client (68), TFTP(69), telnet(23), HTTP(80), HTTPS(443), SNMP(161),

SSH(22), and JAVA(4242). A rate-limiting egress CPU ACL would be ideal to

mitigate smurf style attacks on these ports.

Only a single management access list can be active at a time. However, it can

have multiple permit/deny conditions.

Example

The following example configures an access-list called mlist as the

management access-list.

console(config)# management access-class mlist

management access-list

Use the management access-list command in Global Configuration mode to

define an access list for management, and enter the access-list configuration

mode for editing the access list conditions. Once in access-list configuration

mode, access conditions are configured with the deny and permit commands.

To remove an access list, use the no form of this command.

Syntax

management access-list name

no management access-list name

• name — The access list name. (Range: 1–32 printable characters)

Security Commands 1040

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

A management access list is only supported on the switched interfaces. It is

not supported on the out-of-band interface.

This command enters the access-list configuration mode, where access

conditions may be defined with deny and permit commands.

If no match criteria are defined the default is to deny the packet (i.e., the

packet is dropped).

If editing an access-list context, new rules are appended to the end of the

access-list.

Use the management access-class command to select the active access-list.

The active management list cannot be updated or removed.

Management access list names can consist of any printable character,

including blanks. Enclose the name in quotes to embed blanks in the name.

Question marks are disallowed.

Examples

The following example shows how to permit access to switch management via

two physical interfaces, Gigabit Ethernet 1/0/1 and Gigabit Ethernet 1/0/9.

console(config)#management access-list mlist

console(config-macal)# permit gigabitethernet 1/0/1 priority 1

console(config-macal)# permit gigabitethernet 1/0/9 priority 1

console(config-macal)# exit

console(config)#management access-class mlist

The following example shows how to configure all the interfaces to be

management interfaces except for two interfaces, Gigabit Ethernet 1/0/1 and

Gigabit Ethernet 1/0/9.

console(config)# management access-list mlist

console(config-macal)# deny gigabitethernet 1/0/1 priority 1

console(config-macal)# deny gigabitethernet 1/0/9 priority 2

console(config-macal)# permit priority 2

Security Commands 1041

console(config-macal)# exit

console(config) # management access-class mlist

permit (management)

Use the permit command in Management Access-List configuration mode to

set conditions for allowing packets to flow to the switch management

function.

Syntax

permit ip-source ip-address [mask mask | prefix-length] [gigabitethernet

unit/slot/port | vlan vlan-id |

port-channel port-channel-number

tengigabitethernet unit/slot/port |fortygigabitethernet unit/slot/port][

service service ] [ priority priority-value ]

permit {gigabitethernet unit/slot/port | vlan vlan-id |

port-channel port-

channel-number

| tengigabitethernet unit/slot/port |fortygigabitethernet

unit/slot/port} [service service] [priority priority-value]

permit service service [priority priority-value]

permit priority priority-value

•gigabitethernet unit/slot/port — A valid Gigabit Ethernet routed port

number.

•vlan vlan-id — A valid VLAN number.

•port-channel port-channel-number — A valid port channel number.

•tengigabitethernet unit/slot/port — A valid 10-Gigabit Ethernet routed

port number.

•

fortygigabitethernet

unit/slot/port

–

A valid 40-Gigabit Ethernet routed

port number.

• ip-address — Source IP address.

•mask mask — Specifies the network mask of the source IP address.

•mask prefix-length — Specifies the number of bits that comprise the

source IP address prefix. The prefix length must be preceded by a forward

slash (/). (Range: 0–32)

•service service — Indicates service type. It can be one of the following:

telnet, ssh, http, https, tftp, snmp, sntp, or any. The any keyword indicates

that the service match for the ACL is effectively “don’t care”.

Security Commands 1042

•priority priority-value — Priority for the rule. (Range: 1 – 64)

Default Configuration

This command has no default configuration.

Command Mode

Management Access-list Configuration mode

User Guidelines

Rules with gigabitethernet, tengigabitethernet, fortygigabitethernet, vlan,

and port-channel parameters are valid only if an IP address is defined on the

appropriate interface.

Examples

The following example shows how to configure two management interfaces,

Gigabit Ethernet 1/0/1 and Gigabit Ethernet 1/0/9.

console(config)#management access-list mlist

console(config-macal)# permit gigabitethernet 1/0/1 priority 1

console(config-macal)# permit gigabitethernet 1/0/9 priority 1

console(config-macal)# exit

console(config)# management access-class mlist

The following example shows how to configure all the interfaces to be

management interfaces except for two interfaces, Gigabit Ethernet 1/0/1 and

1/0/9.

console(config)# management access-list mlist

console(config-macal)# deny gigabitethernet 1/0/1 priority 1

console(config-macal)# deny gigabitethernet 1/0/9 priority 2

console(config-macal)# permit priority 2

console(config-macal)# exit

console(config)# management access-class mlist

show management access-class

Use the show management access-class command to display information

about the active management access list.

Syntax

show management access-class

Security Commands 1043

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays the management access-list information.

console# show management access-class

Management access-class is enabled, using access list mlist

show management access-list

Use the show management access-list command to display management

access-lists.

Syntax

show management access-list [name]

• name — A valid access list name. (Range: 1–32 characters)

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Security Commands 1044

Example

The following example displays the active management access-list.

console# show management access-list

mlist

-----

permit priority 1 gigabitethernet 1/0/1

permit priority 2 gigabitethernet 2/0/1

! (Note: all other access implicitly denied)

Security Commands 1045

Password Management Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

The Password Management component supports configuration of strength

checks intended to ensure that network operators utilize passwords that are

difficult to crack. In addition, the administrator can age passwords, ensure

that operators do not reuse passwords, and lock out operator accounts when

multiple attempts to enter incorrect passwords are detected. Passwords are

masked from view when entered by the user and in the running config.

Configurable Minimum Password Length

The administrator has the option of requiring user passwords to be a

minimum length. The administrator can choose to have the switch enforce a

minimum length between 8 and 64 characters. The default minimum length

is 8 although there is no default password (zero length string).

Password History

Keeping a history of previous passwords ensures that users cannot reuse

passwords often. The administrator can configure the switch to store up to 10

of the last passwords for each user. The default operation is that no history is

stored.

Password Aging

The switch can implement an aging process on passwords and require users to

change them when they expire. The administrator can configure the switch to

force a password change between 1 and 365 days. By default, password aging

is disabled. When a password expires, the user must enter a new password

before continuing.

User Lockout

The administrator may choose to strengthen the security of the switch by

enabling the user lockout feature. A lockout count between 1 and 5 attempts

can be configured. When a lockout count is configured, then a user that is

Security Commands 1046

logging in must enter the correct password within that count. Otherwise, that

user is locked out form further remote switch access. Only an administrator

with read/write access can reactivate that user. The user lockout feature is

disabled by default. The user lockout feature applies to all users on all ports.

The administrator can access the serial port even if he/she is locked out and

reset the password or clear the config to regain control of the switch. This

ensures that if a hacker tries to log in as admin and causes the account to be

locked out, then the administrator with physical access to the switch can still

Password Strength

Password Strength is a measure of the effectiveness of a password in resisting

guessing and brute-force attacks. The strength of a password is a function of

length, complexity and randomness. Using strong passwords lowers overall

risk of a security breach. The scope of this feature is to enforce a baseline

Password Strength for all locally administered users.

The feature doesn’t affect users with an existing password until their

password ages out. Password Strength is only enforced when a user is

configuring a new password or changing their existing password. The default

action is Disabled in FP and is independent of any platform. The network

operator has to take care that the Password Strength check is Disabled before

downloading scripts containing old users to avoid password configuration

failure for such users.

Password Strength Definition:

The feature ensures that any password configured on the switch for local

administration purpose is a strong password and conforms to each of the

following characteristics when configured:

• Minimum number of uppercase letters.

• Minimum number of lowercase letters.

• Minimum number of numeric characters.

• Minimum number of special characters from the set: `! " ? $ ? % ^ & * ( )

_ - + = { [ } ] : ; @ ' ~ # | \ < , > . ? / .

• Does not contain the associated login name.

• Maximum number of consecutive characters (such as abcd).

Security Commands 1047

• Maximum number of consecutive numbers (such as 1234).

• Maximum number of repetition of characters or numbers (such as 1111 or

aaaa).

Configuring minimum value of 0 for the above parameters means no

restriction on that set of characters and configuring maximum of 0 means

disabling the restriction (or no limit on the maximum number of course

limited by minimum password length). Implicitly, configuring a minimum

value of 0 means a user may enter a valid password consisting entirely of those

characters unless minimum character class checking is also enabled with

some non-zero minimum strength check values.

The Password strength feature applies to all login passwords (user, line and

enable).

Commands in this Section

This section explains the following commands for viewing and configuring

properties of passwords:

NOTE: To change a password, use the passwords command, which is described in

AAA Commands

passwords aging passwords strength minimum special-

characters

passwords history passwords strength max-limit consecutive-

characters

passwords lock-out passwords strength max-limit repeated-

characters

passwords min-length passwords strength minimum character-

classes

passwords strength-check passwords strength exclude-keyword

passwords strength minimum uppercase-

letters

enable password encrypted

passwords strength minimum lowercase-

letters

show passwords configuration

passwords strength minimum numeric-

characters

show passwords result

Security Commands 1048

passwords aging

Use the passwords aging command in Global Configuration mode to

implement aging on passwords for local users. When a user’s password

expires, the user is prompted to change it before logging in again. Use the no

form of this command to set the password aging to the default value.

Syntax

passwords aging 1-365

no passwords aging

Default Configuration

The default value is 0.

Command Mode

Global Configuration mode

User Guidelines

A value of 0 days disables password aging. Password aging uses the time-of-day

clock, therefore having an accurate clock source is required. The use on SNTP

is strongly recommended.

Example

The following example sets the password age limit to 100 days.

console(config)#passwords aging 100

passwords history

As administrator, use the passwords history command in Global

Configuration mode to set the number of previous passwords that are stored

for each user account. When a local user changes his or her password, the user

is not able to reuse any password stored in password history. This setting

ensures that users do not reuse their passwords often. The default is 0. Use

the no form of this command to set the password history to the default value

of 0.

Security Commands 1049

Syntax

passwords history

0-10

no passwords history

Default Configuration

The default value is 0.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example sets the number of previous passwords remembered by

the system at 10.

console(config)#passwords history 10

passwords lock-out

Use the passwords lock-out command in Global Configuration mode to

strengthen the security of the switch by locking user accounts that have failed

who is logging in must enter the correct password within that count.

Otherwise that user is locked out from further switch access. Only a user with

read/write access can reactivate a locked user account. Password lockout does

not apply to logins from the serial console. Use the no form of this command

to set the password lockout count to the default value.

Syntax

passwords lock-out

1-5

no passwords lock-out

Default Configuration

The default value is 0 or no lockout count is enforced.

Security Commands 1050

Command Mode

Global Configuration mode.

User Guidelines

Password lockout only applies to users with authentication configured to

local. RADIUS or TACACS authenticated users will use policies configured

on the respective RADIUS/TACACS servers.

Example

The following example sets the number of user attempts before lockout at 2.

console(config)#passwords lock-out 2

passwords min-length

Use the passwords min-length command in Global Configuration mode to

enforce a minimum length password length for local users. The value also

applies to the enable password. The valid range is 8–64. The default is 8. Use

the no version of this command to set the minimum password length to 8.

Syntax

passwords min-length length

no passwords min-length

• length — The minimum length of the password (Range: 8–64 characters)

Default Configuration

By default, the minimum password length is 8 characters.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Security Commands 1051

Example

The following example configures user bob with password xxxyymmmm and

user level 15.

(config)# username bob password xxxyyymmm privilege 15

passwords strength-check

Use the passwords strength-check command in Global Configuration mode

to enable the Password Strength feature. The command is used to enable the

checking of password strength during user configuration. Use the no form of

the command to disable the Password Strength feature.

Syntax

passwords strength-check

no passwords strength-check

Default Configuration

The password strength feature is disabled by default.

Command Mode

Global Configuration

User Guidelines

This command enables/disables enforcement of password strength checking

policy as configured by the following commands:

passwords strength minimum uppercase-letters

passwords strength minimum lowercase-letters

passwords strength minimum special-characters

passwords strength minimum numeric-characters

passwords strength max-limit consecutive-characters

passwords strength max-limit repeated-characters

passwords strength minimum character-classes

Minimum strength validation validates a password containing a character in

the corresponding character class. If a character class is configured with a

strength check minimum of 0 (the default), a user may enter a valid password

containing only characters from that class and pass the strength check.

Therefore, it is recommended that the administrator configure all four

Security Commands 1052

minimum strength check character classes if password strength checking is

desired. Use the minimum character class check to require the user to enter a

password that passes the minimum strength check for more than one

minimum strength check character class.

Minimum character class checking validates passwords that contain a

character matching a configured character class. If minimum character class

checking is enabled, a password must pass at least the minimum number of

configured minimum strength class checks to be valid. Non-configured

minimum character classes are not counted towards the minimum matching

character classes.

If minimum character class checking is disabled and if a password contains a

character matching a configured character class, it must meet the specific

minimum strength check limit for the matching character class. If the

password only contains characters that are in non-configured (0 limit)

minimum strength check character class, the password is considered valid.

If the maximum consecutive characters or maximum repeated characters

limits, or other validation checks are configured, passwords must pass these

tests regardless of the minimum character class checking setting.

passwords strength minimum uppercase-letters

Use this command to enforce a minimum number of uppercase letters that a

password must contain. The valid range is 0–16. The default is 1. A minimum

of 0 means no restriction on that set of characters. Use the no form of the

command to reset the minimum uppercase letters to the default value.

Syntax

passwords strength minimum uppercase-letters 0–16

no passwords strength minimum uppercase-letters

Default Configuration

The default value is 1.

Command Mode

Global Configuration

Security Commands 1053

User Guidelines

This limit is not enforced unless the passwords strength minimum

uppercase-letters command is configured with a value greater than 0. In other

words, with a configuration of 0, a password consisting entirely of upper case

letters will pass the minimum strength check criteria.

Example

console(config)#passwords strength minimum uppercase-letters 6

passwords strength minimum lowercase-letters

Use this command to enforce a minimum number of lowercase letters that a

password must contain. The valid range is 0–16. The default is 1. A setting of

0 means no restriction. Use the no form of this command to reset the

minimum lowercase letters to the default value.

Syntax

passwords strength minimum lowercase-letters 0–16

no passwords strength minimum lowercase-letters

Default Configuration

The default value is 1.

Command Mode

Global Configuration

User Guidelines

This limit is not enforced unless the passwords strength minimum lowercase-

letters command is configured with a value greater than 0. In other words, a

password consisting entirely of lower case letters will pass the minimum

strength check criteria.

Example

console(config)#passwords strength minimum lowercase-letters 6

Security Commands 1054

passwords strength minimum numeric-

characters

Use this command to enforce a minimum number of numeric numbers that a

password should contain. The valid range is 0–16. The default is 1. A

minimum of 0 means no restriction on that set of characters. Use the no form

of this command to reset the minimum numeric characters to the default

value.

Syntax

passwords strength minimum numeric–characters 0–16

no passwords strength minimum numeric–characters

Default Configuration

The default value is 1.

Command Mode

Global Configuration

User Guidelines

This limit is not enforced unless the passwords strength minimum numeric-

characters command is configured with a value greater than 0. In other words,

a configuration of 0 allows a password consisting entirely of numeric

characters to pass strength check validation.

Example

console(config)#passwords strength minimum numeric–characters 6

passwords strength minimum special-characters

Use this command to enforce a minimum number of special characters that a

password may contain. The valid range is 0–16. The default is 1. A setting of 0

means no restriction. Special characters are one of the following characters (`!

$ % ^ & * ( ) _ - + = { [ } ] : ; @ ' ~ # | \ < , > . / ) Use the no form of this

command to reset the minimum special characters to the default value.

Security Commands 1055

Syntax

passwords strength minimum special–characters 0–16

no passwords strength minimum special–characters

Default Configuration

The default value is 1.

Command Mode

Global Configuration

User Guidelines

This limit is not enforced unless the passwords strength minimum special-

characters command is configured with a value greater than 0. In other words,

a configuration of 0 allows a password consisting entirely of special characters

to pass strength check validation.

Example

console(config)#passwords strength minimum special–characters 6

passwords strength max-limit consecutive-

characters

Use this command to enforce a maximum number of consecutive characters

that a password can contain. If a user enters a password that has more

consecutive characters than the configured limit, the system rejects the

password. The valid range of consecutive characters is 0–15. The default is 0.

A maximum of 0 means there is no restriction on consecutive characters.

Examples of consecutive characters are ABCDEF or 123456 or !”#$%&’().

Use the no form of this command to reset the maximum consecutive

characters accepted to the default value.

Syntax

passwords strength max-limit consecutive–characters 0–15

no passwords strength max-limit consecutive-characters

Security Commands 1056

Default Configuration

The default value is 0.

Command Mode

Global Configuration

User Guidelines

This command has no user guidelines.

Example

console(config)#passwords strength max-limit consecutive-characters 3

passwords strength max-limit repeated-

characters

Use this command to enforce a maximum repeated characters that a

password should contain. If password has repetition of characters more than

the configured max-limit, it fails to configure. The valid range is 0-15. The

default is 0. A maximum of 0 means again disabling the restriction. Use the

no form of this command to reset the maximum repeated characters to the

default value.

Syntax

passwords strength max-limit repeated-characters 0-15

no passwords strength max-limit repeated-characters

Default Configuration

The default value is 0.

Command Mode

Global Configuration

User Guidelines

This command has no user guidelines.

Security Commands 1057

Example

console(config)# passwords strength max-limit repeated-characters 3

passwords strength minimum character-classes

Use this command to enforce a minimum number of character classes that a

password must contain. Character classes are uppercase letters, lowercase

letters, numeric characters and special characters. The valid range is 0-4. The

default is 0. If a value of 0 is configured then no character class checking is

performed, i.e. the password need not contain characters from more than one

character class. Configured minimum strength and maximum strength

checking is still performed for each individual character class, if configured.

Use the no form of this command to reset the minimum character-classes to

the default value.

Syntax

passwords strength minimum character-classes 0-4

no passwords strength minimum character–classes

Default Configuration

The default value is 0. This character class limit is not enforced unless the

passwords strength minimum character-classes

command is configured with a

value greater than 0.

Command Mode

Global Configuration

User Guidelines

This command is used to enable password character class checking using the

parameters set by the following commands:

• passwords strength minimum uppercase-letters

• passwords strength minimum lowercase-letters

• passwords strength minimum special-characters

• passwords strength minimum numeric-characters

Security Commands 1058

A value greater than 0 specifies the minimum number of character class tests

a password must contain. A value of 0 disables checking that the password

contains characters from the requisite number of character classes. Minimum

character class checking validates passwords that contain at lease one

character matching a character class. If minimum character class checking is

enabled, a password must contain at least one character from a minimum

number of character classes to be valid.

Even if the minimum character class checking is disabled, passwords

containing characters from a class must still meet the specific minimum

strength limit for the matching class. If the password only contains characters

from non-configured character classes, the password is considered valid.

If the maximum consecutive characters or maximum repeated characters

limits are configured, passwords must pass these tests regardless of the

minimum character class checking setting.

Example

console(config)#passwords strength minimum character-classes 4

passwords strength exclude-keyword

Use this command to exclude the keyword while configuring the password.

The password does not accept the keyword in any form (inbetween the string,

case insensitive and reverse) as a substring. You can configure up to a

maximum of three keywords. Use the no form of this command to reset the

restriction for a given string or all the strings configured.

Syntax

passwords strength exclude–keyword

string

no passwords strength exclude–keyword [

string

]

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration

Security Commands 1059

User Guidelines

This command has no user guidelines.

Example

console(config)#passwords strength exclude-keyword dell

enable password encrypted

This command is used by an Administrator to transfer the enable password

between devices without having to know the password.

Syntax

enable password password encrypted

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

The password parameter must be exactly 128 hexadecimal characters.

show passwords configuration

Use the show passwords configuration command to display the configured

password management settings.

Syntax

show passwords configuration

Default Configuration

This command has no default configuration.

Security Commands 1060

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The following fields are displayed by this command.

Parameter Description

Minimum Password Length Minimum number of characters required

when changing passwords.

Password History Number of passwords to store for reuse

prevention.

Password Aging Length in days that a password is valid.

Lockout Attempts Number of failed password login attempts

before lockout.

Minimum Password Uppercase Letters Minimum number of uppercase

characters required when configuring

passwords.

Minimum Password Lowercase Letters Minimum number of uppercase

characters required when configuring

passwords.

Minimum Password Numeric Characters Minimum number of numeric characters

required when configuring passwords.

Minimum Password Special Characters Minimum number of special characters

required when configuring passwords.

Maximum Password Consecutive

Characters

Maximum number of consecutive

characters required that the password

should contain when configuring

passwords.

Maximum Password Repeated Characters Maximum number of repetition of

characters that the password should

contain when configuring passwords.

Security Commands 1061

Example

The following example displays the command output.

console#show passwords configuration

Passwords Configuration

-----------------------

Minimum Password Length........................ 8

Password History............................... 0

Password Aging (days).......................... 0

Lockout Attempts............................... 0

Password Strength Check........................ Enable

Minimum Password Uppercase Letters............. 4

Minimum Password Lowercase Letters............. 4

Minimum Password Numeric Characters............ 3

Minimum Password Special Characters............ 3

Maximum Password Consecutive Characters........ 3

Maximum Password Repeated Characters........... 3

Minimum Password Character Classes............. 4

Password Exclude Keywords...................... dell, dell1, dell2

show passwords result

Use the show passwords result command to display the last password set

result information.

Syntax

show passwords result

Default Configuration

This command has no default configuration.

Minimum Password Character Classes Minimum number of character classes

(uppercase, lowercase, numeric and

special) required when configuring

passwords.

Password Exclude-Keywords Minimum number of character classes

(uppercase, lowercase, numeric and

special) required when configuring

passwords.

Parameter Description

Security Commands 1062

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays the command output.

console#show passwords result

Last User whose password is set....................... dell

Password strength check............................ Enable

Last Password Set Result:

Reason for failure: Could not set user password! Password should contain at

least 4 uppercase letters.

Security Commands 1063

SSH Commands

Dell EMC Networking N1100-ON/N1500/N2000/N2100-

ON/N3000/N3100-ON/N4000 Series Switches

Management access to the switch is supported via telnet, SSH, or the serial

console. The Dell EMC Networking supports secure shell (SSH) and secure

sockets layer (SSL) to help ensure the security of network transactions.

Keys and certificates can be generated externally (that is, offline) and

downloaded to the target or generated directly by the Dell EMC Networking

switch.

Commands in this Section

This section explains the following commands:

crypto key generate dsa

Use the crypto key generate dsa command in Global Configuration mode to

generate DSA key pairs for the SSH server. A key pair is one public DSA key

and one private DSA key. Use the crypto key zeroize command to remove the

generated private key from the local file system. The public and private keys

will be overwritten if the command is subsequently executed.

Syntax

crypto key generate dsa

Default Configuration

DSA key pairs do not exist.

crypto key generate dsa ip ssh pubkey-auth

crypto key generate rsa ip ssh server

crypto key pubkey-chain ssh key-string

crypto key zeroize pubkey-chain show crypto key mypubkey

crypto key zeroize {rsa|dsa} show crypto key pubkey-chain ssh

ip ssh port show ip ssh

Security Commands 1064

Command Mode

Global Configuration mode

User Guidelines

DSA keys are generated in pairs: one public DSA key and one private DSA

key. These keys are used the encrypt communication with the switch when

using SSH or HTTPS. If your switch already has DSA keys when you issue this

command, you are warned and prompted to replace the existing keys. Existing

certificates generated from the previous keys will be invalidated.The keys are

not saved in the switch configuration; they are saved in the file system and

the private key is never displayed to the user. DSA keys, along with other

switch credentials, are distributed to all units in a stack on a configuration

save.

Use the crypto key zeroize dsa command to remove the DSA key pair from

the system.

Private keys should never be shared with unauthorized users. This command

generates the following private/public key pair in the ssh_host_dsa_key and

ssh_host_dsa_key.pub files. Both the RSA and DSA keys must be generated to

enable the SSH server.

Example

The following example generates DSA key pairs.

console(config)#crypto key generate dsa

crypto key generate rsa

Use the crypto key generate rsa command in Global Configuration mode to

generate RSA key pairs for use by the SSH or HTTPS server. Use the crypto

key zeroize form of the command to delete the private key from the local file

system.

Syntax

crypto key generate rsa

Default Configuration

RSA key pairs do not exist.

Security Commands 1065

Command Mode

Global Configuration mode

User Guidelines

RSA keys are generated in pairs: one public RSA key and one private RSA key.

These keys are used to encrypt communication with the switch when using

SSH. If your switch already has RSA keys when you issue this command, you

are warned and prompted to replace the existing keys. The keys are not saved

in the switch configuration; they are saved in the file system and the private

key is never displayed to the user. RSA keys, along with other switch

credentials, are distributed to all units in a stack on a configuration save.

Use the crypto key zeroize rsa command to remove RSA key pair from the

system.

Private keys should never be shared with unauthorized users. This command

generates the private public key pairs in the following files:

ssh_host_rsa_key and ssh_host_rsa_key.pub, ssh_host_key and

ssh_host_key.pub files. Both the RSA and DSA keys must be generated to

enable the SSH server.

Example

The following example generates RSA key pairs.

console(config)#crypto key generate rsa

crypto key pubkey-chain ssh

Use the crypto key pubkey-chain ssh command in Global Configuration

mode to enter public key configuration mode in order to manually specify

public keys for SSH clients or an individual user.

Syntax

crypto key pubkey-chain ssh user-key username rsa/dsa

Default Configuration

By default, this command has no public keys configured.

Security Commands 1066

Command Mode

Global Configuration mode

User Guidelines

This public key is used to authenticate an administrator to the switch when

using SSH. This avoids the need for the administrator to enter a password on

every login.

Enclose the key string is quotes. The Key String is the contents of the public

key in uu-encoded format.

Example

The following example configures a public key for administrator bob, enables

the SSH server, and enables public key authentication over SSH.

console#configure

console(config)#crypto key generate rsa

console(config)#crypto key generate dsa

console(config)#crypto key pubkey-chain ssh user-key bob rsa

Key-string row AAAAB3NzaC1yc2EAAAABIwAAAQEAu7WHtjQDUygjSQXHVgyqdUby

Key-string row dxUXEAiDHXcWHVr0R/ak1HDQitBzeEv1vVEToEn5ddLmRhtIgRdKUJHgBHJV

Key-string row R2VaSN/WC0IK53j9re4B11AE+O3qAxwJs0KD7cTkvF9I+YdiXeOM8VE4skkw

Key-string row AiyLDNVWXgNQ6iat8+8Mjth+PIo5t3HykYUCkD8B1v93nzi/sr4hHHJCdx7w

Key-string row wRW3QtgXaGwYt2rdlr3x8ViAF6B7AKYd8xGVVjyJTD6TjrCRRwQHgB/BHsFr

Key-string row z/Rl1SYa0vFjel/7/0qaIDSHfHqWhajYkMa4xPOtIye7oqzAOm1b76l28uTB

Key-string row luBEoLQ+PKOKMiK8sQ==

console(config-pubkey-key)#exit

console(config)#ip ssh server

console(config)#ip ssh pubkey-auth

crypto key zeroize pubkey-chain

Use the crypto key zeroize pubkey-chain command in Global Configuration

mode to erase all SSH server public key chains or the public key chain for a

user.

Syntax

crypto key zeroize pubkey-chain ssh [user-key username]

Security Commands 1067

Default Configuration

There is no default configuration for this command.

Command Mode

Global Configuration mode.

User Guidelines

The SSH server requires the public and private keys RSA/DSA keys to

operate.

Example

console(config)#crypto key zeroize pubkey-chain ssh user-key bob

crypto key zeroize {rsa|dsa}

Use the crypto key zeroize {rsa|dsa} command in Global Configuration

mode to delete the RSA or DSA public and private keys from the switch.

Syntax

crypto key zeroize {rsa|dsa}

Default Configuration

There is no default configuration for this command.

Command Mode

Global Configuration mode.

User Guidelines

The crypto key zeroize rsa command removes the following files:

ssh_host_key

ssh_host_rsa_key

ssh_host_key.pub

ssh_host_rsa_key.pub

Security Commands 1068

The crypto key zeroize dsa command removes the following files:

ssh_host_dsa_key

ssh_host_dsa_key.pub

Removing the keys does not terminate existing SSH sessions.

Example

console(config)#crypto key zeroize rsa

ip ssh port

Use the ip ssh port command in Global Configuration mode to specify the

TCP port to be used by the SSH server. To use the default port, use the no

form of this command.

Syntax

ip ssh port port-number

no ip ssh port

• port-number — Port number for use by the SSH server. (Range: 1025–

65535)

Default Configuration

The default value is 22.

Command Mode

Global Configuration mode

User Guidelines

The SSH TCP port should not be set to a value that might conflict with other

well-known protocol port numbers used on this switch. The following non-

exhaustive list of ports are reserved to the system and may not be able to be

configured for another purpose: 23 (telnet), 80 (HTTP), 161,162 (SNMP),

514, (SYSLOG), 546,547 (DHCPv6), 2222 (SSH).

Security Commands 1069

Example

The following example specifies the port to be used by the SSH server as

8080.

console(config)#ip ssh port 8080

ip ssh pubkey-auth

Use the ip ssh pubkey-auth command in Global Configuration mode to

enable public key authentication for incoming SSH sessions. To disable this

function, use the no form of this command.

Syntax

ip ssh pubkey-auth

no ip ssh pubkey-auth

Default Configuration

The function is disabled.

Command Mode

Global Configuration mode

User Guidelines

Public key authentication allow administrators with an SSH client access to

the switch without requiring a password. Use the crypto key pubkey-chain ssh

user-key command to configure the administrators public key for use by the

SSH server. AAA authentication is independent from this configuration.

Example

The following example enables public key authentication for incoming SSH

sessions.

console(config)#ip ssh pubkey-auth

Security Commands 1070

ip ssh server

Use the ip ssh server command in Global Configuration mode to enable the

switch to be configured using SSH. To disable this function, use the no form

of this command.

Syntax

ip ssh server

no ip ssh server

Default Configuration

The SSH server is disabled by default.

Command Mode

Global Configuration mode

User Guidelines

To generate SSH server keys, use the commands crypto key generate rsa and

crypto key generate dsa commands. These keys are required to allow the SSH

server to operate.

Dell EMC Networking N-Series switches support the SSH service over IPv4

or IPv6. SSH is configured to require a password on accounts that attempt to

log into the switch.

Example

The following example enables the switch to be configured using SSH.

console(config)#crypto key generate rsa

Do you want to overwrite the existing RSA keys? (y/n):y

RSA key generation started, this may take a few minutes...

RSA key generation complete.

console(config)#crypto key generate dsa

Do you want to overwrite the existing DSA keys? (y/n):y

DSA key generation started, this may take a few minutes...

DSA key generation complete.

console(config)#ip ssh server

Security Commands 1071

key-string

Use the key-string SSH Public Key Configuration mode to specify an SSH

public key manually.

Syntax

key-string key-string

key-string row key-string

•row — To specify the SSH public key row by row.

• key-string — The UU-encoded DER format is the same format as the

authorized keys file used by OpenSSH.

Default Configuration

By default, the key-string is empty.

Command Mode

SSH Public Key Configuration mode

User Guidelines

The key string is the public key of the specified type (RSA or DSA) generated

by the administrator. The administrator will need access to both the public

and private key on the host to log in without authenticating via password.

Enclose the key string in quotes.

DSA is considered less secure than RSA. Use of RSA is recommended.

Use the key-string row command to enter the key-string one row at a time.

The row may be enclosed in quotes. This command may be used to enter the

key one line at a time should the key-string be greater than 234 characters in

length.

Use the key-string command without the row parameter to enter the entire

key at once if the key-string does not exceed 234 characters.

Examples

The following example shows how to enter a single public key string for a user

called “bob.”

Security Commands 1072

console(config)#crypto key pubkey-chain ssh user-key bob rsa

Key-string row AAAAB3NzaC1yc2EAAAABIwAAAQEAu7WHtjQDUygjSQXHVgyqdUby

Key-string row dxUXEAiDHXcWHVr0R/ak1HDQitBzeEv1vVEToEn5ddLmRhtIgRdKUJHgBHJV

Key-string row R2VaSN/WC0IK53j9re4B11AE+O3qAxwJs0KD7cTkvF9I+YdiXeOM8VE4skkw

Key-string row AiyLDNVWXgNQ6iat8+8Mjth+PIo5t3HykYUCkD8B1v93nzi/sr4hHHJCdx7w

Key-string row wRW3QtgXaGwYt2rdlr3x8ViAF6B7AKYd8xGVVjyJTD6TjrCRRwQHgB/BHsFr

Key-string row z/Rl1SYa0vFjel/7/0qaIDSHfHqWhajYkMa4xPOtIye7oqzAOm1b76l28uTB

Key-string row luBEoLQ+PKOKMiK8sQ==

show crypto key mypubkey

Use the show crypto key mypubkey command to display the SSH public keys

of the switch.

Syntax

show crypto key mypubkey [rsa | dsa]

•rsa — RSA key.

•dsa — DSA key.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays the SSH public keys on the switch.

console#show crypto key mypubkey rsa

rsa key data:

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAu7WHtjQDUygjSQXHVgyqdUby

dxUXEAiDHXcWHVr0R/ak1HDQitBzeEv1vVEToEn5ddLmRhtIgRdKUJHgBHJV

R2VaSN/WC0IK53j9re4B11AE+O3qAxwJs0KD7cTkvF9I+YdiXeOM8VE4skkw

AiyLDNVWXgNQ6iat8+8Mjth+PIo5t3HykYUCkD8B1v93nzi/sr4hHHJCdx7w

wRW3QtgXaGwYt2rdlr3x8ViAF6B7AKYd8xGVVjyJTD6TjrCRRwQHgB/BHsFr

Security Commands 1073

z/Rl1SYa0vFjel/7/0qaIDSHfHqWhajYkMa4xPOtIye7oqzAOm1b76l28uTB

luBEoLQ+PKOKMiK8sQ==

Fingerprint(hex): 58:7f:5c:af:ba:d3:60:88:42:00:b0:2f:f1:5a:a8:fc

Fingerprint(bubbleBabble): xodob-liboh-heret-tiver-dyrib-godac-pynah-muzyt-

mofim-bihog-cuxyx

show crypto key pubkey-chain ssh

Use the show crypto key pubkey-chain ssh command to display SSH public

keys stored on the switch.

Syntax

show crypto key pubkey-chain ssh [username username] [fingerprint bubble-

babble | hex]

• username — Specifies the remote SSH client username. (Range: 1–48

characters)

•bubble-babble — Fingerprints in Bubble Babble format.

•hex — Fingerprint in Hex format. If fingerprint is unspecified, it defaults

to Hex format.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays all SSH public keys stored on the switch.

console#show crypto key pubkey-chain ssh

Username Fingerprint

-------- -------------------------------------------------

bob 9A:CC:01:C5:78:39:27:86:79:CC:23:C5:98:59:F1:86

john 98:F7:6E:28:F2:79:87:C8:18:F8:88:CC:F8:89:87:C8

Security Commands 1074

The following example displays the SSH public called “dana.”

console#show crypto key pubkey-chain ssh username dana

Username: dana

rsa key data:

ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAIEAywqRKTRnexccxVUVTeMl+Gkh

imyUDhcTkgEfssLPMsgoXlTwzCE5+97UIIsSRKQQWR+pBNl45tCYd75LUofV

4LP6Lj1Q5Q0w5lBgiqC2MZ/iBHGSsHMAE0lpYtelZprDu4uiZHMuWezmdQp9

a1PU4jwQ22TlcfaUq3sqC3FMUoU=

Fingerprint: 2f:09:e7:6f:c9:bf:ab:04:d4:6f:a0:eb:e8:df:7a:11

show ip ssh

Use the show ip ssh command to display the SSH server configuration.

Syntax

show ip ssh

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

This command has no user guidelines.

Example

The following example displays the SSH server configuration.

console#show ip ssh

SSH server enabled. Port: 22

RSA key was generated.

DSA key was generated.

SSH Public Key Authentication is enabled.

Active incoming sessions:

IP Address User Name Idle Time SessionTime

------------- -------------------- -------------- --------------

10.240.1.122 John 00:00:00 00:00:08

Audio Visual Bridging Commands 1075

Audio Visual Bridging Commands

Dell EMC Networking N4000 Series Switches

This section of the document contains the following audio visual bridging

commands:

Multiple MAC Registration

Protocol Commands

Multiple Stream Reservation

Protocol Commands

Multiple VLAN Registration

Protocol Commands

802.1AS Timesync Commands

Audio Visual Bridging Commands 1076

Multiple MAC Registration Protocol

Commands

Dell EMC Networking N4000 Series Switches

This section covers commands related to Multiple MAC Registration

Protocol (MMRP). MMRP is an implementation of IEEE 802.1ak. MMRP

supports registration of MAC address/VLAN pairs in support of Audio-Visual

Bridging.

Commands in this Section

This section explains the following commands:

clear mmrp statistics

This command clears the MMRP statistics for an interface or all interfaces.

Syntax

clear mmrp statistics [ interface-id | all ]

• All—Clear MMRP statistics for all interfaces

• interface-id—Clear statistics for the specified interface.

Default Configuration

This command has no defaults.

Command Mode

Privileged Exec

clear mmrp statistics mmrp periodic state machine

mmrp show mmrp

mmrp global show mmrp statistics

Audio Visual Bridging Commands 1077

User Guidelines

MMRP is not compatible the GMRP. Do NOT enable GMRP/GVRP on

MMRP enabled switches.

The clear counters command also clears all MMRP statistics for all interfaces

in addition to clearing other counters.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example clears the MMRP counters on port channel 1

console#clear mmrp statistics po1

mmrp

This command enables MMRP on a specific interface. Use the no form of the

command to disable MMRP on an interface.

Syntax

mmrp

no mmrp

Default Configuration

By default, MMRP is disabled globally and on all interfaces.

Command Mode

Interface Configuration (physical and port channel) and Interface Range

(physical and port channel)

User Guidelines

MMRP is not compatible with GVRP/GMRP. Do not enable MMRP on

switches enabled for GVRP/GMRP.

Enabling MMRP on an interface automatically disables dynamic MFDB

entry creation. MFDB entries are only configured via MMRP when MMRP is

enabled.

Audio Visual Bridging Commands 1078

Enabling MMRP on a port channel associated Ethernet interface has no

effect as long as the interface is a member of the port channel.

MMRP must also be enabled globally in order to become operational.

This command is only available on the Dell EMC Networking N4000 Series

switches.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example enables MMRP on port channel 1.

console(config)#interface po1

console(config-if-Po1)#mmrp

mmrp global

Use the mmrp global command to globally enable MMRP. Use the no form of

the command to globally disable MMRP.

Syntax

mmrp global

no mmrp global

Default Configuration

By default, MMRP is disabled globally and on all interfaces.

Command Mode

Global Configuration

User Guidelines

MMRP is not compatible with GVRP/GMRP. Do not enable MMRP on

switches enabled for GVRP/GMRP.

IGMP snooping can interfere with MMRP/MVRP. Disable IGMP snooping if

using MMRP/MVRP.

Audio Visual Bridging Commands 1079

IGMP snooping can interfere with MMRP/MVRP. Disable IGMP snooping if

using MMRP/MVRP.

MMRP propagates VLAN registration information to allow switches in the

network to dynamically learn and configure VLANs. Refer to IEEE Std.

802.1Q-2005 and IEEE Std. 802.1Qbe-2010 for further information. In

particular, MMRP must also be enabled on the individual interfaces to

become operational.

MMRP does not support configuration of default group filtering behavior.

MMRP does not support the optional Registrar Administrative Control for

MAC addresses.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example enables MMRP globally.

console(config)#mmrp global

mmrp periodic state machine

Use this command to globally enable the MMRP periodic state machine. Use

the no form of the command to globally disable the MMRP periodic state

machine.

Syntax

mmrp periodic state machine

no mmrp periodic state machine

Default Configuration

By default, the MMRP periodic state machine is disabled globally.

Command Mode

Global Configuration

Audio Visual Bridging Commands 1080

User Guidelines

The MMRP periodic state machine ages out unused MMRP entries. Use the

show mmrp summary command to display the global MMRP administrative

status.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example enables the MMRP periodic state machine.

console(config)#mmrp periodic state machine

show mmrp

Use this command to display the MMRP configuration for an interface or

globally.

Syntax

show mmrp [ summary | interface [ interface-id | summary ] ]

•summary—Show the global MMRP configuration.

• interface-id—Show the MMRP configuration for the specified interface.

•interface summary—Show the per interface MMRP configuration for all

interfaces.

Default Configuration

This command has no defaults.

Command Mode

Privileged Exec, Global Configuration, and all submodes

User Guidelines

MMRP is not compatible the GMRP. Do not enable GMRP/GVRP on MMRP

enabled switches.

Audio Visual Bridging Commands 1081

Command History

Introduced in version 6.2.0.1 firmware.

Example

console#show mmrp summary

MMRP Global Admin Mode......................... Disabled

MMRP Periodic State Machine.................... Disabled

console#show mmrp interface Gi1/0/12

MMRP Interface Admin Mode...................... Disabled

console#show mmrp interface summary

Intf Mode

--------- ---------

Gi1/0/1 Disabled

Gi1/0/2 Disabled

Gi1/0/3 Disabled

Gi1/0/4 Disabled

show mmrp statistics

Use this command to display the MMRP statistics for an interface or globally.

Syntax

show mmrp statistics {interface-id}

• interface-id—Displays the MMRP statistics for the specified interface.

Default Configuration

By default, the global statistics are displayed.

Command Mode

Privileged Exec, Global Configuration, and all submodes

User Guidelines

MMRP is not compatible with GMRP. Do not enable GMRP on MMRP

enabled switches.

Audio Visual Bridging Commands 1082

Command History

Introduced in version 6.2.0.1 firmware.

Example

console#show mmrp statistics gi1/0/12

Port........................................... Gi1/0/12

MMRP messages received......................... 21

MMRP messages received with bad header......... 0

MMRP messages received with bad format......... 0

MMRP messages transmitted...................... 8

MMRP messages failed to transmit............... 0

Audio Visual Bridging Commands 1083

Multiple VLAN Registration

Protocol Commands

Dell EMC Networking N4000 Series Switches

This section covers commands related to Multiple VLAN Registration

Protocol (MVRP). MVRP is an implementation of IEEE 802.1ak in support of

Audio-Video Bridging. Dell EMC Networking MVRP supports registration

(dynamic VLAN creation) and propagation of VLAN membership

information.

Commands in this Section

This section explains the following commands:

clear mvrp statistics

This command clears the MVRP statistics for an interface or all interfaces.

Syntax

clear mvrp statistics [ interface-id | all ]

• All—Clear MVRP statistics for all interfaces

• interface-id—Clear statistics for the specified interface.

Default Configuration

This command has no defaults.

Command Mode

Privileged Exec

clear mvrp statistics mvrp periodic state machine

mvrp show mvrp

mvrp global show mvrp statistics

Audio Visual Bridging Commands 1084

User Guidelines

MVRP is not compatible with GVRP. Do not enable GMRP/GVRP on MVRP

enabled switches.

The clear counters command also clears all MVRP statistics for all interfaces

in addition to clearing other counters.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example clears the MVRP counters on port channel 1

console#clear mmrp statistics po1

mvrp

This command enables MVRP on a specific interface. Use the no form of the

command to disable MVRP on an interface.

Syntax

mvrp

no mvrp

Default Configuration

By default, MVRP is disabled globally and on all interfaces.

Command Mode

Interface Configuration (physical and port channel) and Interface Range

(physical and port channel)

User Guidelines

MVRP is not compatible with GVRP/GMRP. Do not enable MVRP on

switches enabled for GVRP/GMRP.

MVRP operates in dynamic mode only. It both propagates VLAN

configuration and learns (and creates) VLANs learned from the link peer.

Audio Visual Bridging Commands 1085

Enabling MVRP on a port channel associated interface has no effect as long

as the interface is a member of the port channel.

MVRP is not compatible with private VLAN configured interfaces. Do not

enable GVRP on private VLAN enabled interfaces.

MVRP must also be enabled globally in order to become operational.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example enables MVRP on port channel 1

console(config)#interface po1

console(config-if-Po1)#mvrp

mvrp global

Use the mvrp global command to globally enable MVRP. Use the no form of

the command to globally disable MVRP.

Syntax

mvrp global

no mvrp global

Default Configuration

By default, MVRP is disabled globally and on all interfaces.

Command Mode

Global Configuration mode

User Guidelines

MVRP is not compatible with GVRP/GMRP. Do not enable MVRP on

switches enabled for GVRP/GMRP.

Audio Visual Bridging Commands 1086

MVRP propagates VLAN registration information to allow switches in the

network to dynamically learn and configure VLANs. Refer to IEEE Std.

802.1Q-2005 and IEEE Std. 802.1Qbe-2010 for further information. In

particular, MVRP must also be enabled on the individual interfaces to

become operational.

MVRP does not support configuration of default group filtering behavior.

MVRP does not support the optional Registrar Administrative Control for

VLANs.

If a VLAN is statically configured on an interface and MVRP requests

registration (dynamic creation) of the VLAN, it is deleted and added back as a

tagged static VLAN. If subsequently deleted by the operator, the VLAN is

dynamically created.

If a VLAN is configured as forbidden on an interface and MVRP requests

registration (dynamic creation) of the same VLAN, MVRP does not configure

the port association.

MVRP is only supported on trunk or general mode ports.

This command is only available on the N4000 Series switches.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example enables MVRP globally.

console(config)#mvrp global

mvrp periodic state machine

Use this command to globally enable the MVRP periodic state machine. Use

the no form of the command to globally disable the MVRP periodic state

machine.

Syntax

mvrp periodic state machine

no mvrp periodic state machine

Audio Visual Bridging Commands 1087

Default Configuration

By default, the MVRP periodic state machine is disabled globally.

Command Mode

Global Configuration

User Guidelines

The periodic state machine ages out MVRP created dynamic VLANs. Use the

show mvrp summary command to display the global MVRP administrative

status.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example enables the MVRP periodic state machine.

console(config)#mvrp periodic state machine

show mvrp

Use this command to display the MVRP configuration for an interface or

globally.

Syntax

show mvrp [ summary | interface [ interface-id | summary ] ]

•summary—Show the global MMRP configuration.

• interface-id—Show the MMRP configuration for the specified interface.

•interface summary—Show the per interface MMRP configuration for all

interfaces.

Default Configuration

This command has no defaults.

Audio Visual Bridging Commands 1088

Command Mode

Privileged Exec, Global Configuration, and all submodes

User Guidelines

MVRP is not compatible with GMRP. Do not enable GMRP/GVRP on MVRP

enabled switches.

Command History

Introduced in version 6.2.0.1 firmware.

Example

The following shows example CLI display output for the command.

console#show mvrp summary

MVRP global state.............................. Disabled

MVRP Periodic State Machine state.............. Disabled

VLANs created via MVRP......................... 20-45, 3001-3050

The following shows example CLI display output for the command.

(Switching) #show mvrp interface 0/12

MVRP interface state........................... Enabled

VLANs declared................................. 20-45, 3001-3050

VLANs registered............................... none

show mvrp statistics

Use this command to display the MVRP statistics for an interface or globally.

Syntax

show mvrp statistics {interface-id}

• interface-id—Displays the MVRP statistics for the specified interface.

Default Configuration

By default, the global statistics are displayed.

Command Mode

Privileged Exec, Global Configuration, and all submodes

Audio Visual Bridging Commands 1089

User Guidelines

MVRP is not compatible with GMRP/GVRP. Do not enable GVRP on MMRP

enabled switches.

Command History

Introduced in version 6.2.0.1 firmware.

Example

The following shows example CLI display output for the command.

console#show mvrp statistics summary

MVRP messages received......................... 45

MVRP messages received with bad header......... 0

MVRP messages received with bad format......... 0

MVRP messages transmitted...................... 16

MVRP messages failed to transmit............... 0

MVRP Message Queue Failures.................... 0

The following shows example CLI display output for the command.

(Switching) #show mvrp statistics 0/12

Port........................................... 0/12

MVRP messages received......................... 21

MVRP messages received with bad header......... 0

MVRP messages received with bad format......... 0

MVRP messages transmitted...................... 8

MVRP messages failed to transmit............... 0

MVRP failed reservations....................... 0

Audio Visual Bridging Commands 1090

Multiple Stream Reservation

Protocol Commands

Dell EMC Networking N4000 Series Switches

This section covers commands related to Multiple Stream Reservation

Protocol (MSRP). MSRP supports registration of stream membership and

resource reservation in support of Audio-Visual Bridging as defined by IEEE

802.1Qat and IEEE 802.1Qav. These commands are only available on the Dell

EMC Networking N4000 Series switches.

Commands in this Section

This section explains the following commands:

clear msrp statistics

Use this command to clear the MSRP statistics for an interface or all

interfaces.

Syntax

clear msrp statistics [ interface-id | all ]

•all—Clear MSRP statistics for all interfaces

• interface-id—Clear statistics for the specified interface. Argument must

be a physical interface identifier.

clear msrp statistics msrp srclassqav

msrp (Interface) msrp talker-pruning

msrp boundary-propagate show msrp

msrp delta-bw show msrp reservations

msrp global show msrp statistics

msrp max-fan-in-ports show msrp stream

msrp srclass-pvid

–

Audio Visual Bridging Commands 1091

Default Configuration

This command has no defaults.

Command Mode

Privileged Exec

User Guidelines

The clear counters command also clears all MSRP statistics for all interfaces

in addition to clearing other counters.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example clears the MSRP counters on interface Gi1/0/4

console#clear msrp statistics gi1/0/4

msrp (Interface)

Use this command to enable MSRP on a specific interface. Use the no form

of the command to disable MSRP on an interface.

Syntax

msrp

no msrp

Default Configuration

By default, MSRP is disabled globally and on all interfaces.

Command Mode

Interface Configuration and Interface Range modes

User Guidelines

Enabling MSRP on a port channel associated interface has no effect as long as

the interface remains a member of the port channel.

Audio Visual Bridging Commands 1092

MSRP must also be enabled globally in order to become operational.

This command is only available on the N4000 Series switches.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example enables MSRP on interface Gi1/0/1

console(config)#interface gi1/0/1

console(config-if-Gi1/0/1)#msrp

msrp boundary-propagate

Use this command to configure the IEEE 802.1Qav boundary propagation.

Use the no form of the command set the class configuration to the default.

Syntax

msrp boundary-propagate

no msrp boundary-propagate

Default Configuration

Talkers on a boundary port are ignored by default.

Command Mode

Global Configuration mode

User Guidelines

Use the boundary propagation configuration to administratively define the

edge of the IEEE 802.1Qav domain. Disable boundary propagation to ignore

talkers on boundary ports.

Boundary propagation can only be configured when MSRP is globally

disabled.

Command History

Introduced in version 6.2.0.1 firmware.

Audio Visual Bridging Commands 1093

Example

This example administratively enables MSRP talker propagation from outside

the domain.

console(config)#no msrp global

console(config)#msrp boundary-propagate

console(config)#msrp global

console(config)#show msrp summary

MSRP Global Admin Mode......................... Enabled

MSRP Talker Pruning............................ Disabled

MSRP Maximum Fan-in Ports...................... 12

MSRP Boundary Propagation...................... Enabled

QAV class A priority........................... 4

QAV class A remap priority..................... 1

QAV class B priority........................... 3

QAV class B remap priority..................... 1

msrp delta-bw

Use this command to configure the MSRP VLAN ID for the SR traffic class

on the interface.

Syntax

msrp delta-bw [a | b ] bandwidth

no msrp delta-bw [a | b ]

bandwidth—The maximum percentage of bandwidth which may be reserved

for a traffic class on an interface. The range is 0–75.

Default Configuration

By default, up to 75% of the interface bandwidth may be reserved for class A

traffic and 0% may be reserved for class B traffic.

Command Mode

Interface Configuration mode (physical and port channel), Interface range

mode (physical and port channel)

User Guidelines

MSRP must also be enabled globally in order to become operational.

Audio Visual Bridging Commands 1094

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example configure MSRP delta bandwidth for class A traffic on interface

Gi1/0/3 to be 50%

console(config)#interface gi1/0/3

console(config-if-Gi1/0/3)#msrp

console(config-if-Gi1/0/3)#msrp delta-bw a 50

msrp global

Use this command to globally enable MSRP. Use the no form of the

command to globally disable MSRP.

Syntax

msrp global

no msrp global

Default Configuration

By default, MSRP is disabled globally and on all interfaces.

Command Mode

Global Configuration mode

User Guidelines

MSRP is not compatible with GMRP/GVRP. Do not enable GMRP/GVRP on

MMRP/MVRP/MSRP enabled switches.

MSRP must also be enabled on individual interfaces to become operational.

MSRP propagates stream reservation registration information to/from talkers

and listeners and implements admission. Refer to IEEE Std. 802.1Qat-2010

and IEEE 802.1Q-2011 for further information.

Audio Visual Bridging Commands 1095

MSRP is internally mapped onto multicast queues 2 and 3. Generally, unicast

traffic does not use these queues except for destination lookup failures which

are broadcast to all ports in the VLAN. Delay limits are not calculated to

accommodate such traffic.

Likewise, static configuration can place traffic onto the multicast queues and

interfere with AVB traffic. Delay limits cannot be guaranteed in such cases.

This command is only available on the N4000 Series switches.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example enables MSRP globally.

console(config)#msrp global

msrp max-fan-in-ports

Use this command to configure the fan-in value used in calculating available

bandwidth. Use the no form of the command to return the fan in to the

default.

Syntax

msrp max-fan-in-ports fan-in

no msrp max-fan-in-ports

• fan-in—The fan in value used in the calculation of available bandwidth.

The range is 0–52.

Default Configuration

The default fan-in value is 12.

Command Mode

Global Configuration

Audio Visual Bridging Commands 1096

User Guidelines

This command configures the maximum number of ingress ports that are

capable of transmitting into a single egress port (i.e., the maximum number

of talker registrations on a switch). If the fan in is reduced below the number

of active registrations, the switch attempts to remove the lowest priority

registrations until the fan in limit is reached.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example configures the fan in to 14 interfaces.

console(config)#msrp max-fan-in-ports 14

console(config)#show msrp summary

MSRP Global Admin Mode......................... Enabled

MSRP Talker Pruning............................ Enabled

MSRP Maximum Fan-in Ports...................... 14

MSRP Boundary Propagation...................... Enabled

QAV class A priority........................... 4

QAV class A remap priority..................... 1

QAV class B priority........................... 3

QAV class B remap priority..................... 1

msrp srclass-pvid

Use this command to configure the MSRP VLAN ID for the SR traffic class

on the interface.

Syntax

msrp srclass-pvid vlan-id

no msrp srclass-pvid

• vlan-id—The VLAN ID of the MSRP SR traffic. The range is 1–4093.

Default Configuration

By default, VLAN 2 is used to carry SR traffic.

Audio Visual Bridging Commands 1097

Command Mode

Interface Configuration, Interface range

User Guidelines

The VLAN must be configured on the interface is order to carry traffic. The

interface must be configured to carry tagged traffic (i.e., trunk mode).

MSRP must also be enabled globally in order to become operational.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example configure MSRP traffic on interface Gi1/0/2 for VLAN 12

console(config)#interface gi1/0/2

console(config-if-Gi1/0/2)#msrp

console(config-if-Gi1/0/2)#msrp srclass-pvid 12

msrp srclassqav

Use this command to configure the IEEE Qav class priority map. Use the no

form of the command set the class configuration to the default.

Syntax

msrp srclassqav class [a | b] [pcp | remap] 0-7

no msrp srclassqav class [ a | b ]

•class a | b—Specifies the class to be configured. Dell EMC Networking

switches support class A and class B priorities.

• pcp—Specifies the priority of the selected MSRP traffic class. The range is

0–7. This is the value received in the Ethernet frame for trusted ports or

assigned by the system as a default.

• remap—Specifies the priority of the non-AVB traffic with AVB traffic class

PCP. The range is 0–7. This is the priority to which traffic is remapped.

Default Configuration

The defaults for the traffic classes are:

Audio Visual Bridging Commands 1098

• Class A : pcp = 3, remap = 1

• Class B : pcp = 2, remap = 1

Command Mode

Global Configuration

User Guidelines

The IEEE802.1 Qav standard supports time-sensitive traffic streams by

pacing all switch traffic, including legacy asynchronous Ethernet traffic,

through queuing and forwarding. Dell EMC Networking switches support

two stream reservation (SR) classes (A and B). Received traffic using a code

point identified as belonging to class A or B are placed on a queue that uses a

credit based shaper on egress. IEEE 802.1Qav does not specify any form of

ingress metering or policing.

When an IEEE 802.1Qav talker registers a stream, it identifies whether the

stream is class A or B and specifies the bandwidth required. Class A traffic has

a higher transmission priority than class B traffic. The bandwidth that may be

reserved is limited to 75% of the total bandwidth.

The priorities received in a frame are mapped onto traffic classes for trusted

ports. See the output of the show classofservice dot1pmapping command for

the mappings.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example maps class A traffic onto user priority 4.

console(config)#msrp srclassqav class a pcp 4

console(config)#show msrp summary

MSRP Global Admin Mode......................... Enabled

MSRP Talker Pruning............................ Disabled

MSRP Maximum Fan-in Ports...................... 12

MSRP Boundary Propagation...................... Disabled

QAV class A priority........................... 4

QAV class A remap priority..................... 1

QAV class B priority........................... 2

QAV class B remap priority..................... 1

Audio Visual Bridging Commands 1099

This example maps class B traffic onto user priority 3.

console(config)#msrp srclassqav class b pcp 3

console(config)#show msrp summary

MSRP Global Admin Mode......................... Enabled

MSRP Talker Pruning............................ Disabled

MSRP Maximum Fan-in Ports...................... 12

MSRP Boundary Propagation...................... Disabled

QAV class A priority........................... 4

QAV class A remap priority..................... 1

QAV class B priority........................... 3

QAV class B remap priority..................... 1

msrp talker-pruning

Use this command to enable source pruning. Use the no form of the

command to disable source pruning.

Syntax

msrp talker-pruning

no msrp talker-pruning

Default Configuration

By default, talkers are not pruned.

Command Mode

Global Configuration

User Guidelines

Source pruning allows service users (such as a bridge) that are sources of

frames destined for a number of groups, such as server stations or routers, to

avoid unnecessary flooding of traffic on their local LANs in circumstances

where there are no current group members in the network that wish to receive

such traffic.

Talker pruning can only be configured if MSRP is globally disabled.

Audio Visual Bridging Commands 1100

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example administratively enables MSRP source pruning.

console(config)#no msrp global

console(config)#msrp talker-pruning

console(config)#msrp global

console(config)#show msrp summary

MSRP Global Admin Mode......................... Enabled

MSRP Talker Pruning............................ Enabled

MSRP Maximum Fan-in Ports...................... 12

MSRP Boundary Propagation...................... Enabled

QAV class A priority........................... 4

QAV class A remap priority..................... 1

QAV class B priority........................... 3

QAV class B remap priority..................... 1

show msrp

Use this command to display the MSRP configuration for an interface or

globally.

Syntax

show msrp [ summary | interface [ interface-id | summary ] ]

•summary—Show global MSRP configuration information.

• interface-id—Show the MSRP configuration for the specified interface.

The interface id must be a physical interface identifier.

•interface summary—Show the per interface MSRP configuration for all

interfaces

Default Configuration

This command has no defaults.

Command Mode

Privileged Exec mode, Global Configuration mode and all sub-modes.

Audio Visual Bridging Commands 1101

User Guidelines

The following fields are displayed for the summary command.

The following fields are displayed for the interface command.

Field Description

MSRP Global Admin Mode If MSRP global admin mode is enabled or disabled.

MSRP Talker Pruning If MSRP talker pruning is enabled or disabled.

MSRP Maximum Fan-in

Ports

The configured MSRP maximum fan-in ports value.

MSRP Boundary

Propagation

If MSRP boundary propagation is enabled or disabled.

QAV class A priority The class A priority for traffic class mapping.

QAV class A remap priority The class A remap priority for traffic class mapping.

QAV class B priority The class B priority for traffic class mapping.

QAV class B remap priority The class B remap priority for traffic class mapping.

Field Description

MSRP Interface Admin

Mode

If MSRP admin mode is enabled or disabled on the

interface.

SRclass PVID The MSRP VLAN ID configured for the SR traffic class

on the interface.

MSRP class A Boundary

port status

The status of the MSRP class A boundary port.

MSRP class B Boundary

port status

The status of the MSRP class B boundary port.

MSRP QAV class A delta

bandwidth

The MSRP delta bandwidth for SR traffic class A.

MSRP QAV class B delta

bandwidth

The MSRP delta bandwidth for SR traffic class B.

MSRP QAV class A

bandwidth (allocated/total)

The allocated and total bandwidth allocated to MSRP

QAV class A.

Audio Visual Bridging Commands 1102

The following fields are displayed for the interface summary command.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console#show msrp summary

MSRP Global Admin Mode......................... Enabled

MSRP Talker Pruning............................ Disabled

MSRP Maximum Fan-in Ports...................... 12

MSRP Boundary Propagation...................... Disabled

QAV class A priority........................... 3

QAV class A remap priority..................... 1

QAV class B priority........................... 2

MSRP QAV class B

bandwidth (allocated/total)

The allocated and total bandwidth allocated to MSRP

QAV class B.

MSRP total bandwidth The allocated and total bandwidth allocated to MSRP.

QAV class A priority The class A priority for traffic class mapping.

QAV class A remap priority The class A remap priority for traffic class mapping.

QAV class B priority The class B priority for traffic class mapping.

QAV class B remap priority The class B remap priority for traffic class mapping.

Field Description

Intf The interface for which information is displayed.

Mode The current mode of the interface (enabled/disabled).

SrPVID The MSRP VLAN ID for the SR traffic class on the

interface.

A-Prio The class A priority for the interface.

A-Remap The remap class A priority for the interface.

B-Prio The class B priority for the interface.

B-Remap The remap class B priority for the interface.

Boundary (A/B) If boundary propagation is enabled for class A and class

Audio Visual Bridging Commands 1103

QAV class B remap priority..................... 1

console#show msrp interface Gi1/0/12

MSRP Interface Admin Mode...................... Enabled

SRclassPVID.................................... 2

MSRP class A Boundary port status.............. True

MSRP class B Boundary port status.............. True

MSRP QAV class A delta bandwidth............... 75

MSRP QAV class A delta bandwidth............... 0

MSRP class A bandwidth (allocated/total)....... 0 / 0

MSRP class B bandwidth (allocated/total)....... 0 / 0

MSRP total bandwidth (allocated/total)......... 0 / 0

QAV class A priority........................... 3

QAV class A remap priority..................... 1

QAV class B priority........................... 2

QAV class B remap priority..................... 1

console#show msrp interface summary

Intf Mode SrPVID A-Prio A-Remap B-Prio B-Remap Boundary(A/B)

--------- --------- ------ ------ ------- ------ ------- -------------

Gi1/0/1 Enabled 2 3 1 2 1 True / True

Gi1/0/2 Enabled 2 3 1 2 1 True / True

Gi1/0/3 Enabled 2 3 1 2 1 True / True

Gi1/0/4 Enabled 2 3 1 2 1 True / True

Gi1/0/5 Enabled 2 3 1 2 1 True / True

Gi1/0/6 Enabled 2 3 1 2 1 True / True

show msrp reservations

Use this command to display the MSRP reservation information for an

interface.

Syntax

show msrp reservations [interface-id] [detail | summary ]

• interface-id—An interface identifier (physical).

•detail—Show detailed information on the reservations.

•summary—Show summary information on the reservations.

Default Configuration

This command has no defaults.

Audio Visual Bridging Commands 1104

Command Mode

Privileged Exec mode, Global Configuration mode and all sub-modes.

User Guidelines

Use the clear msrp statistics command to clear the MMRP counters.

The clear counters command also clears all MSRP statistics for all interfaces

in addition to clearing other counters.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console#show msrp reservations gi1/0/10 summary

Stream Stream Talker Listener Fail Information Stream

ID MAC Address Type Type Code Interface Age

------ ---------------- ------ -------- --------------- -----

41543 12:22:e1:65:a3:f8 R.Adv D.Ready 0 0 0

console#show msrp reservations gi1/0/10 detail

Stream Stream Failure Information Acc

ID MAC Address Code Intf MAC Address Latency

------- ----------------- --------------------------- ---------

41543 12:22:e1:65:a3:f8 0 0 00:00:00:00:00:00 647

show msrp statistics

Use this command to display the MSRP statistics for an interface or globally.

Syntax

show msrp statistics { interface-id }

• interface-id—Show the MSRP statistics for the specified interface.

Default Configuration

By default, the global statistics are shown.

Audio Visual Bridging Commands 1105

Command Mode

Privileged Exec mode, Global Configuration mode and all sub-modes.

User Guidelines

The following information is displayed for the summary command.

The following information is displayed for the statistics command.

Field Description

MSRP messages received The number of MSRP messages that have been

received.

MSRP messages received

with bad header

The number of MSRP messages that have been received

with a bad header.

MSRP messages received

with bad format

The number of MSRP messages that have been received

in a bad format.

MSRP messages

transmitted

The number of MSRP messages that have been

transmitted.

MSRP messages failed to

transmit

The number of MSRP messages that failed to transmit.

MSRP messages Queue

Failures

The number of MSRP message queue failures.

Field Description

Port The interface port number.

MSRP messages received The number of MSRP messages that have been

received.

MSRP messages received

with bad header

The number of MSRP messages that have been received

with a bad header.

MSRP messages received

with bad format

The number of MSRP messages that have been received

in a bad format.

MSRP messages

transmitted

The number of MSRP messages that have been

transmitted.

MSRP messages failed to

transmit

The number of MSRP messages that failed to transmit.

Audio Visual Bridging Commands 1106

Command History

Introduced in version 6.2.0.1 firmware.

Example

console# show msrp statistics summary

MSRP messages received......................... 1790

MSRP messages received with bad header......... 0

MSRP messages received with bad format......... 0

MSRP messages transmitted...................... 830

MSRP messages failed to transmit............... 0

MSRP Message Queue Failures.................... 0

console# show msrp statistics gi1/0/10

Port........................................... Gi1/0/10

MSRP messages received......................... 741

MSRP messages received with bad header......... 0

MSRP messages received with bad format......... 0

MSRP messages transmitted...................... 674

MSRP messages failed to transmit............... 0

MSRP failed registrations...................... 0

show msrp stream

Use this command to display MSRP stream information.

Syntax

show msrp stream [ detail | summary ]

•detail—Show detailed information on the streams.

•summary—Show summary information on the streams.

Default Configuration

The command has no defaults.

Command Mode

Privileged Exec mode, Global Configuration mode and all sub-modes.

MSRP failed registrations The number of MSRP failed registrations.

Audio Visual Bridging Commands 1107

User Guidelines

The following information is displayed for the detail command.

The following information is displayed for the summary command.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console#show msrp stream detail

Stream Stream Traff Stream Failure Information Talker

ID MAC Address Class TSpec Code Intf MAC Address Port

------- ----------------- ----- ------- ----------------------- --------

41543 12:22:e1:65:a3:f8 A 128 1 0 0 00:00:00:00:00:00 Gi1/0/10

Field Description

Stream Talker ID The MSRP stream talker ID.

Stream MAC Address The MSRP stream MAC address.

Traff Class The MSRP traffic class.

Stream TSpec The MSRP stream TSpec.

Failure Code The MSRP failure code.

Failure Intf The MSRP interface.

Failure MAC Address The MSRP MAC address.

Port The port interface.

Field Description

Stream Talker ID The MSRP stream talker ID.

Stream MAC Address The MSRP stream MAC address.

Destination MAC Address The destination MAC address.

Acc. Latency The MSRP stream latency.

VLAN ID The VLAN ID.

Stream Rank The MSRP stream rank.

Audio Visual Bridging Commands 1108

console#show msrp stream summary

Stream Stream Destination Acc. VLAN Stream

ID MAC Address MAC Address Latency ID Rank

------- ----------------- ----------------- ------- ---- ---------

41543 12:22:e1:65:a3:f8 01:00:00:80:42:01 647 2 Regular

Audio Visual Bridging Commands 1109

802.1AS Timesync Commands

Dell EMC Networking N4000 Series Switches

This section covers commands related to IEEE 802.1AS timesync. The Dell

EMC Networking 802.1AS capability implements the 2008 PTP Version 2 of

the IEEE 1588 protocol in support of Audio-Visual Bridging. Dell EMC

Networking 802.1AS implements the best master clock algorithm to select a

precise time source and to measure propagation delay accurately. Dell EMC

Networking switches are not Grand Master clock capable. A Grand Master

clock time source must be supplied for a precise measurement of propagation

delay.

Commands in this Section

This section explains the following commands:

clear dot1as statistics

Use this command to clear the IEEE 802.1AS statistics for an interface or all

interfaces.

Syntax

clear dot1as statistics [ interface-id | all ]

•All—Clear

802.1

AS statistics for all interfaces.

• interface-id—Clear

802.1

AS statistics for the specified interface.

clear dot1as statistics dot1as timeout announce

dot1as (Global Configuration) dot1as timeout sync

dot1as (Interface Configuration) dot1as pdelay-threshold

dot1as priority dot1as interval pdelay-loss

dot1as interval announce show dot1as

dot1as interval sync show dot1as statistics

dot1as interval pdelay

–

Audio Visual Bridging Commands 1110

Default Configuration

This command has no defaults.

Command Mode

Privileged Exec.

User Guidelines

The clear counters command also clears all IEEE 802.1AS statistics for all

interfaces in addition to clearing other counters.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example clears the 802.1AS counters on port channel 1

console#clear dot1as statistics po1

dot1as (Global Configuration)

Use this command to globally enable IEEE 802.1AS. Use the no form of the

command to globally disable IEEE 802.1AS.

Syntax

dot1as

no dot1as

Default Configuration

By default, IEEE 802.1AS is disabled globally and on all interfaces.

Command Mode

Global Configuration

Audio Visual Bridging Commands 1111

User Guidelines

IEEE 802.1AS propagates time information from master clocks and

synchronizes internally with the clock in support of delivering streams to the

destination device with the same relative timing as sampled at the source.

All IEEE 802.1AS interfaces must reside on the same stack member.

Propagation of timing information across a stack is not supported.

IEEE 802.1AS must also be enabled on individual interfaces to become

operational.

This command is only available on the N4000 Series switches.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config)#dot1as

dot1as (Interface Configuration)

Use this command to enable IEEE 802.1AS on an interface. Use the no form

of the command to disable IEEE 802.1AS on an interface.

Syntax

dot1as

no dot1as

Default Configuration

By default, IEEE 802.1AS is disabled globally and on all interfaces.

Command Mode

Interface Configuration

User Guidelines

IEEE 802.1AS propagates time information from master clocks and

synchronizes with the internal clock in support of delivering streams to the

destination device with the same relative timing as sampled at the source.

Audio Visual Bridging Commands 1112

All IEEE 802.1AS interfaces must reside on the same stack member.

Propagation of timing information across a stack is not supported.

IEEE 802.1AS must also be enabled globally as well as on an interface to

become operational.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config)#interface gi1/0/1

console(config-if-Gi1/0/1)#dot1as

dot1as priority

Use this command to globally configure the priority 1 or priority 2 value. Use

the no form of the command to return the priority value to the default.

Syntax

dot1as priority [ 1 | 2 ] [ priority-value]

no dot1as priority [ 1 | 2 ]

•

priority [ 1 | 2 ]

— Selects the priority value to configure. Priority 1 and 2

are used in the selection of the grand master clock.

Default Configuration

By default, priority 1 is 246 and priority 2 is 248.

Command Mode

Global Configuration

User Guidelines

The best master clock algorithm considers the priority1 attribute before any

other attributes; therefore, the priority1 attribute can be used to force a

desired ordering of time-aware end stations with respect to best master clock

selection.

IEEE 802.1AS must also be enabled globally as well as on an interface to

become operational.

Audio Visual Bridging Commands 1113

IEEE 802.1AS propagates time information from master clocks and

synchronizes internally with the clock in support of delivering streams to the

destination device with the same relative timing as sampled at the source.

While disabled, IEEE 802.1AS configuration is retained and can be changed,

but is not operationally active.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example configures a switch as grand master capable.

console(config)#dot1as priority 1 255

console(config)#show dot1as summary

802.1AS Global Admin Mode...................... Enabled

Grandmaster Capable............................ Yes

Best Clock Identity............................ 00:1E:C9:FF:FE:DE:B1:37

Best Clock Priority1........................... 255

Best Clock Priority2........................... 248

Steps to Best Clock............................ 0

Local Clock Identity........................... 00:1E:C9:FF:FE:DE:B1:37

Local Clock Priority1.......................... 255

Local Clock Priority2.......................... 248

Grandmaster Change Count....................... 0

Last Grandmaster Change Timestamp.............. 0

dot1as interval announce

Use this command to configure the initial log announcement interval for an

interface. Use the no form of the command to return the announcement

interval to the default.

Syntax

dot1as interval announce int-val

no dot1as interval announce

• int-val—The initial log announcement interval in log base 2 format. The

range is –5 to 5.

Audio Visual Bridging Commands 1114

Default Configuration

By default, the announcement interval is 0.

Command Mode

Interface Configuration

User Guidelines

The initial log announcement interval is used to initialize the value of

announce interval; it is the mean time interval between transmission of

successive ANNOUNCE messages. The ANNOUNCE interval may be

modified by the operation of the protocol (i.e., it is set to the initial value

when the port is initialized and when a signaling message is received with a

field announce interval set to 126). It may also be modified if the port

receives a signaling message that carries a message interval request TLV.

IEEE 802.1AS must also be enabled globally as well as on an interface to

become operational.

IEEE 802.1AS propagates time information from master clocks and

synchronizes internally with the clock in support of delivering streams to the

destination device with the same relative timing as sampled at the source.

While disabled, IEEE 802.1AS configuration is retained and can be changed,

but is not operationally active.

Refer to IEEE Std. 802.1AS-2011 and IEEE Std. 1588-2008 for further

information on the initialLogAnnounceInterval attribute.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example configures the switch with an initial log announcement interval

of 3.

console(config-if-Gi1/0/1)#dot1as interval announce 3

console(config-if-Gi1/0/1)#show dot1as interface gi1/0/1

802.1AS Interface Admin Mode................... Enabled

802.1AS Capable................................ No

Is Measuring Delay............................. No

Audio Visual Bridging Commands 1115

Propagation Delay.............................. 0

Port Role...................................... Disabled

PDELAY Threshold............................... 2500

PDELAY lost responses allowed.................. 3

Neighbor Rate Ratio............................ 0

Initial Sync Interval.......................... -3

Current Sync Interval.......................... -3

Initial Pdelay Interval........................ 0

Current Pdelay Interval........................ 0

Initial Announce Interval...................... 3

Current Announce Interval...................... 0

Sync Receipt Timeout........................... 3

Announce Receipt Timeout....................... 3

dot1as interval sync

Use this command to configure the sync interval for an interface. Use the no

form of the command to return the sync interval to the default.

Syntax

dot1as interval sync int-val

no dot1as interval sync

• int-val— The time sync interval in log base 2 format. The range is –5 to 5.

Default Configuration

By default, the initial sync interval is –3.

Command Mode

Interface Configuration

User Guidelines

This value is the logarithm to the base 2 of the desired mean time interval

between successive time-synchronization event messages sent by the link

peer.

IEEE 802.1AS must also be enabled globally as well as on an interface to

become operational.

Audio Visual Bridging Commands 1116

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example configures the switch with an initial log sync interval of 3.

console(config-if-Gi1/0/1)#dot1as interval sync 3

console(config-if-Gi1/0/1)#show dot1as interface gi1/0/1

AS Interface Admin Mode................... Enabled

AS Capable................................ No

Is Measuring Delay............................. No

Propagation Delay.............................. 0

Port Role...................................... Disabled

PDELAY Threshold............................... 2500

PDELAY lost responses allowed.................. 3

Neighbor Rate Ratio............................ 0

Initial Sync Interval.......................... 3

Current Sync Interval.......................... -3

Initial Pdelay Interval........................ 0

Current Pdelay Interval........................ 0

Initial Announce Interval...................... 3

Current Announce Interval...................... 0

Sync Receipt Timeout........................... 3

Announce Receipt Timeout....................... 3

dot1as interval pdelay

Use this command to configure the pdelay interval for an interface. Use the

no form of the command to return the pdelay interval to the default.

Syntax

dot1as interval pdelay int-val

no dot1as interval pdelay

• int-val—The initial pdelay interval in log base 2 format. The range is –5 to

Default Configuration

By default, the pdelay interval is 0.

Audio Visual Bridging Commands 1117

Command Mode

Interface Configuration

User Guidelines

This value is the logarithm to the base 2 of the desired mean time interval

between successive Pdelay_req messages sent by the link peer.

IEEE 802.1AS must also be enabled globally as well as on an interface to

become operational.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example configures the switch with an initial log sync interval of 3.

console(config-if-Gi1/0/1)#dot1as interval pdelay 3

console(config-if-Gi1/0/1)#show dot1as interface gi1/0/1

AS Interface Admin Mode................... Enabled

AS Capable................................ No

Is Measuring Delay............................. No

Propagation Delay.............................. 0

Port Role...................................... Disabled

PDELAY Threshold............................... 2500

PDELAY lost responses allowed.................. 3

Neighbor Rate Ratio............................ 0

Initial Sync Interval.......................... 3

Current Sync Interval.......................... -3

Initial Pdelay Interval........................ 3

Current Pdelay Interval........................ 0

Initial Announce Interval...................... 3

Current Announce Interval...................... 0

Sync Receipt Timeout........................... 3

Announce Receipt Timeout....................... 3

dot1as timeout announce

Use this command to configure the number of announce intervals expiries

with no received announce message in which case the master is considered to

be no longer transmitting. Use the no form of the command to return the

announce expiries to the default.

Audio Visual Bridging Commands 1118

Syntax

dot1as timeout announce expiries

no dot1as timeout announce

• expiries—The number of

expiries

with no received announce message on

which the master is considered to be no longer transmitting. The range is

2–255.

Default Configuration

By default, the number of expiries is set to 3.

Command Mode

Interface Configuration

User Guidelines

IEEE 802.1AS must also be enabled globally as well as on an interface to

become operational.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example configures interface Gi1/0/4 to delay expiring the master clock,

if found, for up to 5 announce intervals.

console(config-if-Gi1/0/4)#dot1as timeout announce 5

console(config-if-Gi1/0/4)#show dot1as interface gi1/0/4

AS Interface Admin Mode................... Enabled

AS Capable................................ No

Is Measuring Delay............................. No

Propagation Delay.............................. 0

Port Role...................................... Disabled

PDELAY Threshold............................... 2500

PDELAY lost responses allowed.................. 3

Neighbor Rate Ratio............................ 0

Initial Sync Interval.......................... -3

Current Sync Interval.......................... -3

Initial Pdelay Interval........................ 3

Current Pdelay Interval........................ 0

Audio Visual Bridging Commands 1119

Initial Announce Interval...................... 0

Current Announce Interval...................... 0

Sync Receipt Timeout........................... 3

Announce Receipt Timeout....................... 5

dot1as timeout sync

Use this command to configure the number of sync intervals expiries with no

received announce message in which case the master is considered to be no

longer transmitting. Use the no form of the command to return the sync-

expiries to the default.

Syntax

dot1as timeout sync expiries

no dot1as timeout announce

Default Configuration

By default, the number of expiries is set to 3.

Command Mode

Interface Configuration

User Guidelines

IEEE 802.1AS must also be enabled globally as well as on an interface to

become operational.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example configures interface Gi1/0/4 to delay expiring the master clock,

if found, for up to 5 sync intervals.

console(config-if-Gi1/0/4)#dot1as timeout sync 5

console(config-if-Gi1/0/4)#show dot1as interface gi1/0/4

AS Interface Admin Mode................... Enabled

AS Capable................................ No

Audio Visual Bridging Commands 1120

Is Measuring Delay............................. No

Propagation Delay.............................. 0

Port Role...................................... Disabled

PDELAY Threshold............................... 2500

PDELAY lost responses allowed.................. 3

Neighbor Rate Ratio............................ 0

Initial Sync Interval.......................... -3

Current Sync Interval.......................... -3

Initial Pdelay Interval........................ 3

Current Pdelay Interval........................ 0

Initial Announce Interval...................... 3

Current Announce Interval...................... 0

Sync Receipt Timeout........................... 5

Announce Receipt Timeout....................... 3

dot1as pdelay-threshold

Use this command to configure the propagation delay threshold in

nanoseconds, above which an interface is not considered capable of

participating in the AS protocol.

Use the no form of the command to return the threshold to the default.

Syntax

dot1as pdelay-threshold thresh-val

no dot1as pdelay-threshold

Default Configuration

By default, the number of expiries is set to 2500 nanoseconds for copper

interfaces and 8000 nanoseconds for fiber thresholds.

Command Mode

Interface Configuration

User Guidelines

IEEE 802.1AS must also be enabled globally as well as on an interface to

become operational.

Audio Visual Bridging Commands 1121

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example configures interface Gi1/0/4 to delay retiring the interface for

10 ms.

console(config-if-Gi1/0/4)#dot1as pdelay-threshold 10000

console(config-if-Gi1/0/4)#show dot1as interface gi1/0/4

AS Interface Admin Mode................... Enabled

AS Capable................................ No

Is Measuring Delay............................. No

Propagation Delay.............................. 0

Port Role...................................... Disabled

PDELAY Threshold............................... 10000

PDELAY lost responses allowed.................. 3

Neighbor Rate Ratio............................ 0

Initial Sync Interval.......................... -3

Current Sync Interval.......................... -3

Initial Pdelay Interval........................ 3

Current Pdelay Interval........................ 0

Initial Announce Interval...................... 3

Current Announce Interval...................... 0

Sync Receipt Timeout........................... 5

Announce Receipt Timeout....................... 3

dot1as interval pdelay-loss

Use this command to configure the number of Pdelay_Req messages for

which a valid response has not been received, above which a port is considered

to not be exchanging peer delay messages with its neighbor. Use the no form

of the command to return the interval to the default.

Syntax

dot1as interval pdelay-loss expiries

no dot1as interval pdelay-loss

• expiries—The number of expiries with no received Pdelay_Resp message

after which the port is no longer considered to be exchanging messages

with the peer. The range is 0–65535.

Audio Visual Bridging Commands 1122

Default Configuration

By default, the number of expiries is set to three responses. If three

Pdelay_Resp messages are received within that time, the port is considered to

be no longer exchanging messages with the peer.

Command Mode

Interface Configuration

User Guidelines

IEEE 802.1AS must also be enabled globally as well as on an interface to

become operational.

Command History

Introduced in version 6.2.0.1 firmware.

Example

This example configures interface Gi1/0/4 to delay retiring the interface for 10

ms.

console(config-if-Gi1/0/4)#dot1as interval pdelay-loss 5

console(config-if-Gi1/0/4)#show dot1as interface gi1/0/4

AS Interface Admin Mode................... Enabled

AS Capable................................ No

Is Measuring Delay............................. No

Propagation Delay.............................. 0

Port Role...................................... Disabled

PDELAY Threshold............................... 10000

PDELAY lost responses allowed.................. 5

Neighbor Rate Ratio............................ 0

Initial Sync Interval.......................... -3

Current Sync Interval.......................... -3

Initial Pdelay Interval........................ 3

Current Pdelay Interval........................ 0

Initial Announce Interval...................... 3

Current Announce Interval...................... 0

Sync Receipt Timeout........................... 5

Announce Receipt Timeout....................... 3

Audio Visual Bridging Commands 1123

show dot1as

Use this command to show the IEEE 802.1AS configuration for an interface

or globally.

Syntax

show dot1as[ summary | interface [ interface-id | summary ] ]

•summary—Show the global IEEE 802.1AS configuration.

• interface-id—Show the IEEE 802.1AS configuration for the specified

interface.

•interface summary—Show the per interface IEEE 802.1AS configuration

for all interfaces.

Default Configuration

The command has no defaults.

Command Mode

Privileged Exec, Global Configuration, and all sub-modes

User Guidelines

The following information is displayed for the summary command.

Field Description

AS Global Admin Mode Configured value of AS global admin mode.

Grandmaster Present Indicates where a AS grandmaster is present or not.

Best Clock Identity Specifies the clock identity of the AS grandmaster.

Best Clock Priority1 Specifies the priority1 value of AS grandmaster.

Best Clock Priority2 Specifies the priority2 value of AS grandmaster.

Steps to Best Clock Specifies the number of hops between the local clock

and the grandmaster.

Local Clock Identity Specifies the clock identity of the local clock.

Local Clock Priority1 Specifies the priority1 value of AS local clock.

Local Clock Priority2 Specifies the priority2 value of local clock.

Audio Visual Bridging Commands 1124

The following information is displayed for the interface command.

Grandmaster Change

Count

Specifies the number of GM change events occurred.

Last Grandmaster Change

Timestamp

Specifies the timestamp of the last GM change event.

Field Description

Intf Slot/port

Mode IEEE 802.1AS interface admin mode (enabled/disabled)

asCapable Indicates if the interface is asCapable.

measuringPdelay Indicates if the interface is measuring PDELAY.

Pdelay Indicates the value of the propagation delay on this

interface.

Role Indicates one of the IEEE 802.1AS port roles

(MASTER, SLAVE, PASSIVE, DISABLED)

Pdelay Threshold Specifies the propagation delay threshold in

nanoseconds, above which an interface is not considered

capable of participating in the AS protocol.

Pdelay lost responses

allowed

Specifies the number of Pdelay_Req messages for which

a valid response is not received, above which a port is

considered to not be exchanging peer delay messages

with its neighbor.

Neighbor Rate Ratio Specifies an estimate of the ratio of the frequency of the

LocalClock entity of the time-aware system at the other

end of the link attached to this port, to the frequency of

the LocalClock entity of this time-aware system.

Initial Pdelay interval Specifies the configured mean time interval between

successive PDELAY_REQ messages sent over a link, in

logarithm to base 2 format.

Initial Announce Interval Specifies the configured mean time interval between

successive ANNOUNCE messages in logarithm to base

2 format.

Audio Visual Bridging Commands 1125

Command History

Introduced in version 6.2.0.1 firmware.

Example

console#show dot1as interface summary

Intf Mode asCapable measuringPdelay Pdelay Role

------- ------- --------- --------------- ------ --------

Gi1/0/1 Enabled No No 0 Disabled

Gi1/0/2 Enabled Yes Yes 811 Master

Gi1/0/3 Enabled No No 0 Disabled

Gi1/0/4 Enabled Yes Yes 806 Master

Gi1/0/5 Enabled No No 0 Disabled

console#show dot1as interface gi1/0/1

AS Interface Admin Mode................... Enabled

AS Capable................................ No

Is Measuring Delay............................. No

Propagation Delay.............................. 0

Initial Sync Interval Specifies the configured mean time interval between

successive SYNC messages, in logarithm to base 2

format

Current Pdelay interval Specifies the current mean time interval between

successive PDELAY_REQ messages sent over a link, in

logarithm to base 2 format.

Current Announce Interval Specifies the current mean time interval between

successive ANNOUNCE messages in logarithm to base

2 format.

Current Sync Interval Specifies the current mean time interval between

successive SYNC messages, in logarithm to base 2

format

Sync Timeout Specifies the number of SYNC intervals that have to

pass without receipt of SYNC information, before

considering that the master is no longer transmitting.

Announce Timeout Specifies the number of ANNOUNCE intervals that

have to pass without receipt of ANNOUNCE PDU,

before considering that the master is no longer

transmitting.

Audio Visual Bridging Commands 1126

Port Role...................................... Disabled

PDELAY Threshold............................... 2500

PDELAY lost responses allowed.................. 3

Neighbor Rate Ratio............................ 0

Initial Sync Interval.......................... -5

Initial Pdelay Interval........................ 3

Initial Announce Interval...................... 5

Current Sync Interval.......................... 0

Current Pdelay Interval........................ 0

Current Announce Interval...................... 0

Sync Receipt Timeout........................... 3

Announce Receipt Timeout....................... 3

console#show dot1as summary

AS Global Admin Mode......... Enabled

Grandmaster Present............... TRUE

Best Clock Identity............... 02:10:18:FF:FE:57:80:10

Best Clock Priority1.............. 127

Best Clock Priority2.............. 255

Steps to Best Clock............... 1

Local Clock Identity.............. 00:10:18:FF:FE:82:11:DB

Local Clock Priority1............. 246

Local Clock Priority2............. 248

Grandmaster Change Count....................... 5

Last Grandmaster Change Timestamp.............. 2819202563

show dot1as statistics

Use this command to show the IEEE 802.1AS statistics for an interface.

Syntax

show dot1as statistics [ interface-id ]

• interface-id—Show statistics for the specified interface.

Default Configuration

This command has no defaults.

Command Mode

Privileged Exec, Global Configuration, and all sub-modes

Audio Visual Bridging Commands 1127

User Guidelines

Use the clear dot1as statistics or the clear counters command to clear the

counters.

Command History

Introduced in version 6.2.0.1 firmware.

Example

#show dot1as statistics gi1/0/3

Port........................................... Gi1/0/3

Sync messages transmitted...................... 0

Sync messages received......................... 0

Followup messages transmitted.................. 0

Followup messages received..................... 0

Announce messages transmitted.................. 0

Announce messages received..................... 0

Pdelay_Req messages transmitted................ 0

Pdelay_Req messages received................... 0

Pdelay_Resp messages transmitted............... 0

Pdelay_Resp messages received.................. 0

Pdelay_Resp_Followup messages transmitted...... 0

Pdelay_Resp_Followup messages received......... 0

Signaling messages transmitted................. 0

Signaling messages received.................... 0

Sync receipt timeouts.......................... 0

Sync messages discarded........................ 0

Announce receipt timeouts...................... 0

Announces messages discarded................... 0

Pdelay receipt timeouts........................ 0

Pdelay messages discards....................... 0

PTP message discards........................... 0

Pdelay allowed lost responses.................. 0

Invalid AS messages received....................0

Audio Visual Bridging Commands 1128

Data Center Technology Commands 1129

Data Center Technology Commands

Dell EMC Networking N4000 Series Switches

The data center commands allow network operators to deploy lossless

Ethernet capabilities in support of a converged network with Fibre Channel

and Ethernet data, as specified by the FC-BB-5 working group of ANSI T11.

This capability allows operators to deploy networks at a lower cost while still

maintaining the same SAN network management operations that exists

today.

NOTE: Data Center Technologies such as ETS, DCBX, and PFC are only available on

Dell EMC Networking N4000 series switches.

This section of the document contains the following data center bridging

commands:

Data Center Bridging Commands

OpenFlow Commands

Priority Flow Control Commands

Data Center Technology Commands 1130

Data Center Bridging Commands

Dell EMC Networking N4000 Series Switches

NOTE: Enhanced Transmission Selection commands are only supported on N4000 series

switches. CLI commands and Dell OpenManage Switch Administrator pages are

not available for other switch models.

Data Center Bridging Exchange Protocol

The Data Center Bridging Exchange Protocol (DCBX) is used by DCB

devices to exchange configuration information with directly connected peers.

The protocol is also used to detect misconfiguration of the peer DCB devices

and, optionally, for configuration of peer DCB devices.

DCBX is expected to be deployed in support of lossless operation for FCoE or

iSCSI traffic. In these scenarios, all network elements are DCBX-enabled

(DCBX is enabled end-to-end).

The Dell EMC Networking implementation of the DCBX protocol supports

the propagation of configuration information for the following features:

Enhanced Transmission Selection (ETS)

Priority-based Flow Control (PFC)

Application Priorities

The features listed above use DCBX to send and receive device configuration

and capability information and configuration details to peer DCBX devices.

The PFC and ETS information exchange is discussed in Priority Flow

Control Commands and Enhanced Transmission Selection. Application

Priority information is captured from the configuration source and

propagated to other auto-configuration peers by the DCBX component.

When iSCSI is enabled on an operationally active PFC port, the application

priority information is supplemented with the configured iSCSI priority.

Enhanced Transmission Selection

NOTE: Enhanced Transmission Selection commands are only supported on N4000 series

switches. CLI commands and Dell OpenManage Switch Administrator pages are

not available for other switch models.

Data Center Technology Commands 1131

In a typical switch or router, each physical port supports one or more queues

for transmitting packets on the attached network. Multiple queues per port

are often provided to give preference to certain packets over others based on

user-defined criteria. When a packet is queued for transmission in a port, the

rate at which it is serviced depends on how the queue is configured and

possibly the amount of traffic present in the other queues of the port. If a

delay is necessary, packets get held in the queue until the scheduler

authorizes the queue for transmission. As queues become full, packets have

no place to be held for transmission and get dropped by the device.

The drop precedence of a packet is an indication of whether the packet is

more or less likely to be dropped during times of queue congestion. Often

referred to as packet coloring, a low drop precedence (green) allows the packet

to be transmitted under most circumstances, a higher drop precedence

(yellow) subjects the packet to dropping when bursts become excessive, while

the highest drop precedence (red) discards the packet whenever the queue is

congested. In some hardware implementations, the queue depth can be

managed using tail dropping or a weighted random early discard, or a

weighted random early discard (WRED), technique. These methods often

use customizable threshold parameters that are specified on a per-drop-

precedence basis.

The Dell EMC Networking QoS implementation contains Differentiated

Services (DiffServ) support that allows traffic to be classified into streams and

given certain QOS treatment in accordance with defined per-hop behaviors.

However, the DiffServ feature does not offer direct configuration of the

hardware CoS queue resources.

The CoS Queuing feature offers a new capability for the user to directly

configure certain aspects of device queuing to provide the desired QOS

behavior for different types of network traffic when the complexities of

DiffServ are not required. The priority of a packet arriving at an interface can

be used to steer the packet to the appropriate outbound CoS queue through a

mapping table. CoS queue characteristics such as minimum guaranteed

bandwidth, transmission rate shaping, etc. are now user configurable at the

queue (or port) level.

The CoS queue feature provides a method to configure Traffic Class Groups

(TCGs) to extend the CoS queue management. Multiple CoS queues can be

mapped to a single TCG. Each TCG can have a configured minimum

guaranteed bandwidth allocation and a scheduling algorithm similar to the

Data Center Technology Commands 1132

CoS queue configuration. The TCG scheduling and bandwidth enforcement

occurs after the CoS queue scheduling and bandwidth enforcement is

performed. Therefore all CoS queues mapped to the same TCG share the

scheduling and bandwidth properties of the TCG.

ETS Operations

ETS provides an operational model for priority processing and bandwidth

allocation for the switch in a Data Center Bridging environment. Using

priority-based processing and bandwidth allocations, different Traffic Class

Groups (TCGs) within different types of traffic such as LAN, SAN and

Management can be configured to provide bandwidth allocation or best effort

transmit characteristics.

For ETS to be operational, the following configuration steps need to be

performed:

Configure CoS queues to Traffic Class Group mapping for the egress

ports.

Configure weight percentage (bandwidth allocation) for each TCG.

Enable appropriate scheduling algorithm for each TCG

CoS information is exchanged with peer DCBX devices using ETS TLVs. As

part of the transmitted ETS TLVs, by default, DCBX advertises the following

parameters, and these parameters are populated in the switch hardware on a

per port basis.

Mapping between ingress ports 802.1p priority to Traffic Class Group

(TCG).

Bandwidth percentage (weight percentage) of each Traffic Class Group.

Scheduling algorithm for each Traffic Class Group.

For Dell EMC Networking switches which do not support configuration of

ETS traffic classes in the hardware, the ETS information is propagated from

the configuration source to the other DCBX peers.

The mapping between the ingress port’s 802.1p priority and TCG is not

direct. The mapping depends upon:

• The CoS map defining the CoS queue that a packet is egress forwarded for

the ingress 802.1p priority.

• Traffic Class Group map defining the CoS queue to TCG mapping.

Data Center Technology Commands 1133

The indirect mapping between the 802.1p priorities and the associated Traffic

Class Group mapping is advertised by DCBX as part of ETS TLVs. For this

indirect mapping to be valid, the following parameters need to be configured

in addition to the configuration of the TCGs.

Configure 802.1p priority to CoS mapping for the ingress ports.

Enable Trust mode on the ingress ports to trust the 802.1p priority present

in the frames.

ETS TLVs use DCBX Asymmetric attribute exchange mechanism to

exchange ETS information between the peers. In this exchange, each peer

device sends its ETS configuration via the “configuration” ETS TLV and

recommended ETS settings for the peer using the “recommend” ETS TLV.

Both the configuration and recommendation ETS TLVs are implemented for

Dell EMC Networking switches.

The peer ETS TLVs are stored in the DCBX database and are accessible using

show commands.

The Application Priority TLV is accepted from auto-upstream devices and

propagated to auto-downstream devices. In addition, if iSCSI CoS is enabled,

an additional entry in the Application Priority TLV is added as discussed in

the iSCSI section.

Data Center Bridging Exchange Protocol Main Objective

The DCBX protocol implementation conforms to the IEEE 802.1Qaz

specification with some exceptions. To be interoperable with legacy industry

implementations of DCBX protocol, a hybrid model is used to support both

the IEEE version of DCBX and legacy DCBX versions. The hybrid version of

the DCBX conforms to all aspects of the legacy standards to the degree

necessary to support interoperability with a wide variety of FCoE capable

switches.

The main objective of DCBX is to perform the following operations:

• Discovery of DCB capability in a peer

DCBX is used to learn about the capabilities of the peer device. It is a

means to determine if the peer device supports a particular feature such as

PFC.

• DCB feature misconfiguration detection

Data Center Technology Commands 1134

DCBX can be used to detect misconfiguration of a feature between the

peers on a link. Misconfiguration detection is feature-specific because

some features may allow asymmetric configuration.

• Peer configuration of DCB features

DCBX can be used by a device to perform configuration of DCB features

in its peer device if the peer device is willing to accept configuration.

Interoperability with IEEE DCBX

The Dell EMC Networking switch automatically detects if a peer is operating

with either of the two CEE DCBX versions or the IEEE standard DCBX

version. This is the default mode. DCBX can also be configured to manually

select one of the legacy versions or IEEE standard mode. In auto-detect

mode, the switch starts operating in IEEE DCBX mode on a port and if it

detects a legacy DCBX device based on the OUI of the organization TLV,

then the switch changes its DCBX mode on that port to support the version

detected. There is no time out mechanism to move back to IEEE mode.

Once the DCBX peer times out, multiple peers are detected, the link is reset

(link down/up) or as commanded by the operator, DCBX resets its operational

mode to IEEE.

The interaction between DCBX component and other components remains

the same irrespective of the operational mode it is executing. For instance,

DCBX component interacts with PFC to get needed information to pack the

TLVs to be sent out on the interface. Based on the operational control mode

of the port, DCBX packs it in the proper frame format.

Port Roles

Each port’s behavior is dependent on the operational mode of that port and

of other ports in the stack. The port mode is a DCBX configuration item that

is passed to the DCBX clients to control the processing of their configuration

information. There are four port roles:

Manual

Auto-Upstream

Auto-Downstream

Configuration Source

Data Center Technology Commands 1135

Manual

Ports operating in the Manual role do not have their configuration affected

by peer devices or by internal propagation of configuration. These ports have

their operational mode and TC and bandwidth information specified

explicitly by the operator. These ports will advertise their configuration to

their peer if DCBX is enabled on that port. Incompatible peer configurations

will be logged and counted with an error counter.

The default operating mode for each port is Manual for Dell EMC

Networking releases; however, customer platforms may change the default

mode for selected ports to either Auto-Upstream or Auto-Downstream mode.

An example of this would be a blade switch that needed to support touchless

configuration and has certain ports that are upstream ports and other ports

that are downstream ports. A port that is set to manual mode sets the willing

bit for DCBX client TLVs to false. Manually configured ports never internally

propagate or accept internal or external configuration from other ports.

Manually configured ports may notify the operator of incompatible

configurations if client configuration exchange over DCBX is enabled.

Manually configured ports are always operationally enabled for DCBX clients,

regardless of whether DCBX is enabled.

Auto-Upstream

Advertises a configuration, but is also willing to accept a configuration from

the link-partner and propagate it internally to the auto-downstream ports as

well as receive configuration propagated internally by other auto-upstream

ports. The local operational parameters for PFC and ETS, if any, are

overridden with the negotiated configuration. Specifically, the willing

parameter is enabled on the port and the recommendation TLV is sent to the

peer and processed if received locally. The first auto-upstream port to

successfully accept a compatible configuration becomes the configuration

source. The configuration source propagates its configuration to other auto-

upstream and auto-downstream ports. Only the configuration source may

propagate configuration to other ports internally. Auto-upstream ports that

receive internally propagated information ignore their local configuration and

utilize the internally propagated information.

Peer configurations received on auto-upstream ports other than the

configuration source result in one of two possibilities.

Data Center Technology Commands 1136

If the configuration is compatible with the configuration source, then the

DCBX client becomes operationally active on the upstream port.

If the configuration is not compatible with the configuration source, then

a message is logged indicating an incompatible configuration, an error

counter is incremented, and the DCBX client is operationally disabled on

the port. The expectation is that the network administrator configures the

upstream devices appropriately so that all such devices advertise a

compatible configuration.

Auto-Downstream

An auto-downstream port advertises a configuration but is not willing to

accept one from the link partner. However, the port will accept a

configuration propagated internally by the configuration source. The local

operational parameters for PFC and ETS, if any, are overridden with the

negotiated configuration.Specifically, the willing parameter is disabled on

auto-downstream ports. By default, auto-downstream ports have the

recommendation TLV parameter enabled. Auto-downstream ports that

receive internally propagated information ignore their local configuration and

utilize the internally propagated operational information.

Configuration Source

In this role, the port has been manually selected to be the configuration

source. Configuration received over this port is propagated to the other auto-

configuration ports, however, no automatic election of a new configuration

source port is allowed. Only one port can be configured as the configuration

source. The local configuration parameters for PFC and ETS, if any, are

overridden with the received configuration. Events that cause selection of a

new configuration source are ignored. The configuration received over the

configuration source port is maintained until cleared by the operator (set the

port to the manual role). FIP snooping must be enabled to set a port to

configuration source. For interfaces configured in a port-channel for which it

is desirable to receive configuration information, it is strongly recommended

that the auto-up setting be used on the physical interfaces in the port channel

in preference to the configuration source parameter.

Data Center Technology Commands 1137

Configuration Source Port Selection Process

When an auto-upstream or auto-downstream port receives a configuration

from a peer, the DCBX client first checks if there is an active configuration

source. If there is a configuration source already selected, the received

configuration is checked against the local port operational values as received

from the configuration source, and if compatible, the client marks the port as

operationally enabled. If the configuration received from the peer is

determined to not be compatible, a message is logged, an error counter is

incremented and the DCBX clients become operationally disabled on the

port. The port continues to keep link up and exchanges DCBX packets. If a

compatible configuration is later received, the DCBX clients will become

operationally enabled.

If there is no configuration source, a port may elect itself as the configuration

source on a first-come, first-serve basis from the set of eligible ports. A port is

eligible to become the configuration source if:

• No other port is the configuration source.

• The port role is auto-upstream.

• The port is enabled with link up and DCBX enabled.

• The port has negotiated a DCBX relationship with the partner.

• The switch is capable of supporting the received configuration values,

either directly or by translating the values into an equivalent configuration

N.B. Whether or not the peer configuration is compatible with the

configured values is NOT considered.

The newly elected configuration source propagates DCBX client information

to the other ports and is internally marked as being the port over which

configuration has been received. Configuration changes received from the

peer over the configuration source port are propagated to the other auto-

configuration ports. Ports receiving auto-configuration information from the

configuration source ignore their current settings and utilize the

configuration source information.

When a configuration source is selected, local ETS and PFC configuration

for all auto-up, auto-down and config-source ports is overridden by the

configuration received from the configuration source.

Data Center Technology Commands 1138

In order to reduce flapping of configuration information, if the configuration

source port is disabled, disconnected or loses LLDP connectivity, the system

clears the selection of configuration source port (if not manually selected)

and enables the willing bit on all auto-upstream ports. The configuration on

the auto-configuration ports is not cleared (configuration holdover). If the

user wishes to clear the configuration on the system in this scenario, the user

can put the configuration source port into manual mode.

When a new port is selected as configuration source, it is marked as the

configuration source, the DCBX configuration is refreshed on all auto-

configuration ports and each port may begin configuration negotiation with

their peer again (if any information has changed).

Commands in this Section

This section explains the following commands:

Data Center Bridging Capability Exchange

Commands

datacenter-bridging

Use the datacenter-bridging command for an Ethernet interface in order to

enter the DataCenterBridging mode. Priority-Flow-Control is configurable

from within the DataCenterBridging mode.

Data Center Bridging Capability Exchange Commands

datacenter-bridging lldp dcbx port-role

lldp dcbx version show lldp tlv-select

lldp tlv-select dcbxp (dcb enable) show lldp dcbx

Enhanced Transmission Selection Commands

classofservice traffic-class-group traffic-class-group weight

traffic-class-group max-bandwidth show classofservice traffic-class-group

traffic-class-group min-bandwidth show interfaces traffic

traffic-class-group strict show interfaces traffic-class-group

Data Center Technology Commands 1139

Syntax

datacenter-bridging

Default Configuration

This command has no default configuration.

Command Mode

Interface Configuration (Ethernet) mode

User Guidelines

NOTE: This command is only available on N40xx series switches.

Datacenter bridging mode is only available on physical interfaces, not on

port-channel interfaces. To ensure proper operation, users must configure all

physical interfaces in a port channel to have the same data-center bridging

configuration.

Example

console#config

console(config)#interface range ethernet all

console(config-if)#datacenter-bridging

console(config-if-dcb)#priority-flow-control mode on

console(config-if-dcb)#priority-flow-control priority 1 no-drop

lldp dcbx version

Use the lldp dcbx version command in Global Configuration mode to

configure the administrative version for the Data Center Bridging Capability

Exchange (DCBX) protocol. This command enables the switch to support a

specific version of the DCBX protocol or to detect the peer version and match

it. DCBX can be configured to operate in IEEE mode or CEE mode or CIN

mode. In auto mode, version detection is based on the peer device DCBX

version. The switch operates in either IEEE or one of the legacy modes on

each interface.

NOTE: CIN is Cisco Intel Nuova DCBX (version 1.0). CEE is converged enhanced

ethernet DCBX (version 1.06).

Use the no form of the command to reset the dcbx version to the default

value of auto.

Data Center Technology Commands 1140

Syntax

lldp dcbx version {auto | cin | cee | ieee}

no lldp dcbx version

•auto—Automatically select the version based on the peer response.

•CIN—Force the mode to Cisco-Intel-Nuova. (DCBX 1.0)

•CEE—Force the mode to CEE (DCBX 1.06)

•IEEE—Force the mode to IEEE 802.1Qaz

Default Configuration

The default version is auto.

Command Mode

Global Config

User Guidelines

NOTE: This command is only available on N40xx series switches.

In auto mode, the switch will attempt to jump start the exchange by sending

an IEEE frame, followed by a CEE frame followed by a CIN frame. The

switch will parse the received response and immediately switch to the peer

version. Because LLDP is a link local protocol, it cannot be configured on a

port channel or VLAN interface. It is recommended that all ports configured

in a port channel utilize the same LLDP configuration.

Example

The following example configures the switch to use CEE DCBX.

s1(config)#lldp dcbx version cee

lldp tlv-select dcbxp (dcb enable)

Use the lldp tlv-select dcbxp command in Global Configuration or Interface

Configuration mode to enable the LLDP to send DCBX TLVs if LLDP is

enabled to transmit on the given interface. If no parameter is given, all DCBX

TLVs are enabled for transmission. The default is all DCBX TLVs are enabled

Data Center Technology Commands 1141

for transmission. If executed in Interface mode, the interface configuration

overrides the global configuration for that interface. Entering the command

with no parameters enables transmission of all TLVs.

Use the no form of the command to return the configuration to the default

settings.

Syntax

lldp tlv-select dcbxp [ets-config|ets-recommend|pfc|application-

priority|congestion-notification] [dcb enable]

no lldp tlv-select dcbxp [ets-config|ets-recommend|pfc|application-

priority|congestion-notification] [dcb enable]

•Ets-config—Transmit the ETS configuration TLV.

•Ets-recommend—Transmit the ETS recommendation TLV.

•Pfc—Transmit the PFC configuration TLV.

•Application-priority—Transmit the application priority TLV.

•Congestion-notification—Transmit the congestion notification TLV.

Default Configuration

The default value is to transmit all DCBX TLVs as received from the auto-

configuration configuration source port. In manual mode, the default is to

transmit all DCBX TLVs per the switch (global or interface) configuration.

Command Mode

Global Config, Interface Config

User Guidelines

NOTE: This command is only available on N40xx series switches.

Global configuration and interface configuration are separate. Interface

configuration overrides the global configuration on a configured interface.

Example

The following example configures the port to not transmit any DCBX TLVs.

console(interface-config-te1/0/1)#no lldp tlv-select dcbxp

Data Center Technology Commands 1142

The following example globally configures all ports to not transmit any DCBX

TLVs.

console(config)#no dcb enable

lldp dcbx port-role

Use the lldp dcbx port-role command in Interface Configuration mode to

configure the port role to manual, auto-upstream, auto-downstream and

configuration source. The default port role is manual.

Syntax

lldp dcbx port-role {auto-up |auto-down | manual | configuration-source}

•Manual—Ports operating in the ‘Manual’ role do not have their

configuration affected by peer devices or by internal propagation of

configuration. These ports will advertise their configuration to their peer if

DCBX is enabled on that port. The willing bit is set to disabled on manual

role ports.

•Auto-up—Advertises a configuration, but is also willing to accept a

configuration from the link-partner and propagate it internally to the auto-

downstream ports as well as receive configuration propagated internally by

other auto-upstream ports. These ports have the willing bit enabled. These

ports should be connected to FCFs.

•Auto-down—Advertises a configuration but is not willing to accept one

from the link partner. However, the port will accept a configuration

propagated internally by the configuration source. These ports have the

willing bit set to disabled. Selection of a port based upon compatibility of

the received configuration is suppressed. These ports should be connected

to a trusted FCF.

•Configuration Source—In this role, the port has been manually selected

to be the configuration source. Configuration received over this port is

used to configure the switch and is propagated to the other auto-

configuration ports. Selection of a port based upon compatibility of the

received configuration is suppressed. These ports should be connected to a

trusted FCF. These ports have the willing bit enabled.

Data Center Technology Commands 1143

Default Configuration

The default port role is manual.

Command Mode

Interface Config

User Guidelines

NOTE: This command is only available on N40xx series switches.

In order to reduce configuration flapping, ports that obtain configuration

information from a configuration source port will maintain that configuration

for 2x the LLDP time out, even if the configuration source port becomes

operationally disabled.

Examples

This example configures an FCF facing port:

console(config-if-Te1/1/1)#lldp dcbx port-role auto-up

This example configures an FCoE host facing port:

console(config-if-Te1/1/1)#lldp dcbx port-role auto-down

show lldp tlv-select

Use the lldp tlv-select command to display the Traffic Class to Traffic Class

Group mapping.

Syntax

show lldp tlv-select interface [all|interface-id]

• interface-id—A valid physical interface specifier

•all—All interfaces

Default Configuration

The default is to show the per interface TLV configuration.

Command Mode

Privileged Exec

Data Center Technology Commands 1144

User Guidelines

NOTE: This command is only available on N40xx series switches.

This command has no user guidelines.

Examples

console# show lldp tlv-select interface te1/0/1

Interface ETS Config ETS Recommend PFC App Priority QCN

------------ ---------- ------------- --- ------------ ---

te1/0/1 Yes No Yes No Yes

console# show lldp tlv-select interface all

Interface ETS Config ETS Recommend PFC App Priority QCN

----------- ---------- ------------- --- ------------ ---

te1/0/1 Yes No Yes No Yes

te1/0/2 No No Yes No Yes

show lldp dcbx

Use the show lldp dcbx command to display the Traffic Class to Traffic Class

Group mapping.

Syntax

show lldp dcbx [interface [all|interface-id detail|status]]

•

interface-id

—A valid physical interface specifier.

•all—All interfaces.

•detail—Display detailed DCBX information.

•status—Display a status summary.

Default Configuration

This command has no default setting.

Command Mode

Privileged Exec

User Guidelines

NOTE: This command is only available on N40xx series switches.

Data Center Technology Commands 1145

This command has no user guidelines.

Example #1

DCBX Status:

console# show lldp dcbx interface all status

Config DCBX DCBX Frame TLV

Interface Status Role Version Rx Tx Errors Dscrd Dscrd

---------- ------- -------- -------- ------ ------ ------ ------ -----

te1/0/1 Enabled Auto-up CEE 1.06 Yes 32 37 0 0

te1/0/2 Enabled Auto-up IEEE 32 37 0 0

te2/0/1 Enabled Auto-dn CIN 1.0 32 37 0 0

te2/0/2 Enabled Auto-dn IEEE 32 37 0 0

te3/0/1 Enabled Auto-dn CIN 1.0 32 37 0 0

te3/0/2 Disabled Manual IEEE 0 0 0 0

Example #2

DCBX not enabled:

console# show lldp dcbx interface te1/0/1

Interface te1/0/1

DCBX Admin Status: Disabled

Configured DCBX Version: Auto-detect

Peer DCBX Version:

Peer MAC:

Peer Description:

Auto-configuration Port Role: Manual

Peer Is Configuration Source: False

Error Counters:

ETS Incompatible Configuration: 0

PFC Incompatible Configuration: 0

Disappearing Neighbor: 0

Multiple Neighbors Detected: 0

Example #3

DCBX enabled – legacy device (CIN/CEE):

console# show lldp dcbx interface te1/0/1

Interface te1/0/1

DCBX Admin Status: Enabled

Configured Version: Auto-detect

Peer DCBX Version: CIN Version 1.0

Peer MAC: 00:23:24:A4:21:03

Peer Description: Cisco Nexus 5020 IOS Version 5.00

Data Center Technology Commands 1146

Auto-configuration Port Role: Auto-downstream

Peer Is Configuration Source: False

Local Configuration:

Max/Oper

Type Subtype Version En/Will/Adv

PFC(3) 000 000 Y/Y/Y

PG(2) 000 000 Y/Y/Y

APP(4) 000 000 Y/Y/Y

Number of TCs Supported: 3

Priority Group Id: 0:00 1:01 2:02 3:03 4:04 5:05 6:06 7:07

PG Percentage (%): 0:12 1:10 2:12 3:00 4:00 5:66 6:00 7:00

Strict Priority: 0:0 1:2 2:0 3:0 4:0 5:0 6:0 7:0

PFC Enable Vector: 0:0 1:1 2:0 3:0 4:0 5:0 6:0 7:0

Peer Configuration:

Operation version: 00 Max version: 00 Seq no: 23 Ack no: 22

Max/Oper

Type Subtype Version En/Will/Err

PFC(3) 000 000/000 Y/N/N

PG(2) 000 000/000 Y/N/N

APP(4) 000 000/000 Y/N/N

Number of TCs Supported: 3

Priority Group Id: 0:00 1:01 2:02 3:03 4:04 5:05 6:06 7:07

PG Percentage (%): 0:0 1:10 2:12 3:00 4:00 5:78 6:00 7:00

PFC Enable Vector: 0:0 1:1 2:0 3:0 4:0 5:1 6:0 7:0

Application Priority (TX Enabled)

Type Application Priority Status

---------------------------------------------------

Ethernet FC0E 3 Enabled

TCP/SCTP 860 4 Disabled

TCP/SCTP 3260 4 Disabled

Error Counters:

ETS Incompatible Configuration: 0

PFC Incompatible Configuration: 0

Disappearing Neighbor: 0

Multiple Neighbors Detected: 0

Data Center Technology Commands 1147

Example #4

DCBX enabled – IEEE device (DCBX Version Forced):

console# show lldp dcbx interface te1/0/1

Interface te1/0/1

DCBX Admin Status: Enabled

Configured DCBX Version: CIN 1.0

Peer DCBX Version: CEE 1.6

Peer MAC: 00:23:24:A4:21:03

Peer Description: Cisco Nexus 5020 IOS Version 5.00

Auto-configuration Port Role: Auto-upstream

Peer Is Configuration Source: True

Error Counters:

ETS Incompatible Configuration: 7

PFC Incompatible Configuration: 0

Disappearing Neighbor: 0

Multiple Neighbors Detected: 0

Example #5

DCBX enabled – detailed view:

console# show lldp dcbx interface te1/0/1 detail

Interface te1/0/1

DCBX Admin Status: Enabled

Configured Version: Auto-detect

Auto-configuration Port Role: Configuration Source

Peer Is Configuration Source: True

PFC Capability (TX Enabled)

Willing: True MBC: False Max PFC classes supported: 3

PFC Enable Vector: 0:0 1:1 2:0 3:0 4:0 5:1 6:0 7:0

ETS Configuration (TX Enabled)

Willing: True Credit Shaper: True Traffic Classes Supported: 8

Priority Assignment: 0:0 1:1 2:2 3:3 4:4 5:5 6:6 7:7

Traffic Class Bandwidth (%): 0:00 1:10 2:12 3:00 4:00 5:78 6:00 7:00

Traffic Selection Algorithm: 0:0 1:1 2:2 3:0 4:0 5:3 6:0 7:0

ETS Recommendation (TX Enabled)

Peer DCBX Version: CEE 1.6

Peer Description: Cisco Nexus 5020 IOS Version 5.00

Peer MAC: 00:23:24:A4:21:03

Peer PFC Capability:

Willing: False MBC: False Max PFC classes supported: 3

PFC Enable Vector 0:0 1:1 2:0 3:0 4:0 5:1 6:0 7:0

Data Center Technology Commands 1148

Peer ETS Configuration:

Willing: False Peer ETS Detected: True Credit Shaper: True

Traffic Classes Supported: 8

Priority Assignment: 0:0 1:1 2:1 3:0 4:0 5:1 6:0 7:0

Traffic Class Bandwidth: 0:00 1:10 2:12 3:00 4:00 5:78 6:00 7:00

Traffic Selection Algorithm: 0:0 1:1 2:2 3:0 4:0 5:3 6:0 7:0

Peer ETS Recommendation:

Traffic Class Bandwidth: 0:0 1:1 2:2 3:0 4:0 5:3 6:0 7:0

Traffic Selection Algorithm: 0:0 1:1 2:2 3:0 4:0 5:3 6:0 7:0

Peer Application Priority

Type Application Priority

-------------------------------------

Ethernet FC0E 3

TCP/SCTP 3260 4

Enhanced Transmission Selection (ETS)

Commands

NOTE: Enhanced Transmission Selection commands are only supported on N4000 series

switches. CLI commands and Dell OpenManage Switch Administrator pages are

not available for other switch models.

classofservice traffic-class-group

This command maps the internal Traffic Class to an internal Traffic Class

Group (TCG). The Traffic Class can range from 0-6, although the actual

number of available traffic classes depends on the platform.

Use the no form of this command to return system (Global Configuration

mode) or interface (Interface Configuration mode) to the default mapping.

Syntax

classofservice traffic-class-group trafficclass traffic class group

no classofservice traffic-class-group

•

trafficclass

—

The selected traffic class. Range is 0-6.

•

trafficclassgroup

—

The selected group. Range 0-2.

Data Center Technology Commands 1149

Default Configuration

By default, all the traffic classes are mapped to TCG 0. In the default

configuration, all the Traffic Classes are grouped as one Traffic Class Group

and TCG0 is configured as weighted round robin.

Command Mode

Global Config, Interface Configuration modes

User Guidelines

NOTE: This command is only available on N40xx series switches.

For a given Traffic Class, a value specified in Interface Configuration mode

only affects a single interface, whereas a change in Global Configuration

mode is applied to all interfaces. The Interface Configuration mode

command is only available on platforms that support independent per-port

class of service mappings. Ports that are configured to use the DCBX auto-

configuration roles (auto-up or auto-down) have their ETS settings

overridden. Only ports configured as DCBX manual role utilize the

configured ETS settings.

It is recommended that all strict priority traffic classes be mapped to a single

TCG.

Internally, frames are selected for transmission from the strict priority TCGs

first, then, once the constraints of the TCGs are satisfied, frames from the

WRR TCGs are selected for transmission. For example, grouping strict

priority assignments into TCG 1 and weighted assignments into TCG 0 will

result in all frames of the highest priority in TCG 1 being transmitted first,

then the next lower priority, et. seq. until no frames remain for transmission

in TCG 1. Then the scheduler will process frames from TCG 0, giving them

appropriate treatment based upon the weights, minimum bandwidth and

maximum bandwidth constraints.

Traffic class group 7 is reserved by the system for internal use.

Example

The following example demonstrates how to globally map priorities 1 and 2 to

TCG 1.

console(config)# classofservice traffic-class-group 1 1

console(config)# classofservice traffic-class-group 2 1

Data Center Technology Commands 1150

traffic-class-group max-bandwidth

Use this command in Global Config or Interface Configuration mode to

specify the maximum transmission bandwidth limit for each TCG as a

percentage of the interface rate. Also known as rate shaping, this has the

effect of smoothing temporary traffic bursts over time so that the transmitted

traffic rate is bound.

Syntax

traffic-class-group max-bandwidth bw-0 bw-1 … bw-n

no traffic-class-group max-bandwidth

• bw-0..7—The maximum percentage bandwidth to be transmitted by the

TCG. Range 0 to 100.

Default Configuration

The default maximum bandwidth for all TCGs is 0% (unlimited).

Command Mode

Global Config, Interface Configuration modes

User Guidelines

NOTE: This command is only available on N40xx series switches.

This command specified in Interface Configuration mode only affects a

single interface; whereas, the Global Configuration mode setting is applied to

all interfaces. Interface configuration overrides the global configuration on

the designated interface. The Interface Configuration mode command is only

available on platforms that support independent per-port class of service

queue configuration.

Each bw-x value is a percentage that ranges from 0 to 100 in increments of 1.

All n bandwidth values must be specified with this command and each is

independent of the others. The number n is platform dependent and

corresponds to the number of supported traffic classes groups. The default

maximum bandwidth value for each TCG is 0, meaning no upper limit is

enforced, which allows the TCG queue to consume any available non-

guaranteed bandwidth of the interface.

Data Center Technology Commands 1151

If a non-zero value is specified for any bw-x maximum bandwidth parameter,

it must not be less than the current minimum bandwidth value for the

corresponding queue. A bw-x maximum bandwidth parameter value of 0 may

be specified at any time without restriction.

The maximum bandwidth limits may be used with either a weighted or strict

priority scheduling scheme. Note that a value of 0 (the default) implies an

unrestricted upper transmission limit, which is similar to 100%, although

there may be subtle operational differences depending on how the device

handles a no limit case versus limit to 100%.

Example

The following example demonstrates how to limit the maximum bandwidth

percentage for TCG 1 and 2 to 25% each.

console(config)# traffic-class-group max-bandwidth 50 25 25

traffic-class-group min-bandwidth

Use this command in Global Config or Interface Configuration mode to

specify the minimum transmission bandwidth guaranteed for each TCG

before processing frames from other TCGs on an interface.

Use the no form of the command to return the bandwidth reservations to the

default values.

Syntax

traffic-class-group min-bandwidth bw-0 bw-1 … bw-n

no traffic-class-group min-bandwidth

• bw-0..7—The maximum percentage bandwidth to be transmitted by the

TCG. Range 0 to 100.

Default Configuration

The default minimum bandwidth for all TCGs is 0% (no minimum

guarantee).

Command Mode

Global Configuration mode, Interface Configuration mode

Data Center Technology Commands 1152

User Guidelines

NOTE: This command is only available on N40xx series switches.

This command specified in Interface Configuration mode only affects a

single interface, whereas the Global Configuration mode setting is applied to

all interfaces. The Interface Configuration mode command is only available

on the N4000 series switches.

Each bw-x value is a percentage that ranges from 0 to 100 in increments of 1.

All n bandwidth values must be specified with this command, and their

combined sum must not exceed 100%. The default minimum bandwidth

value for each TCG is 0, meaning no bandwidth is guaranteed (best effort) In

order to better accommodate bursty traffic, it is recommended that the sum

of the minimum bandwidths configured be much less than 100%.

If the value of any bw-x minimum bandwidth parameter is specified as greater

than the current maximum bandwidth value for the corresponding TCG,

then its corresponding maximum bandwidth automatically increases the

maximum to the same value. Min-bandwidth may be configured manually by

the operator on manual and auto-configuration ports. If the port is an auto-

configuration port, the weights received via ETS TLVs are taken into account

by the scheduler along with the min-bandwidth parameters supplied by the

operator.

Refer to the cos-queue min-bandwidth command for information regarding

scheduling frame for transmission across TCGs.

Example

The following example demonstrates how to reserve the minimum bandwidth

percentage for TCG 1 and 2 to 25% each and reserve the remaining

bandwidth for TCG 0.

console(config)# traffic-class-group min-bandwidth 50 25 25

traffic-class-group strict

Use this command in Global Config or Interface Configuration mode to

activate the strict priority scheduler mode for each specified TCG.

Use the no form of the command to return the TCGs to the default weighted

scheduler mode.

Data Center Technology Commands 1153

Syntax

traffic-class-group strict tcg-id [tcg-id … tcg-id]

no traffic-class-group strict

• tcg-id—The TCG identifier. Range is 0 to 2

Default Configuration

The default scheduling mode for all TCGs is weighted scheduling.

Command Mode

Global Configuration mode, Interface Configuration mode

User Guidelines

NOTE: This command is only available on N40xx series switches.

This command specified in Interface Configuration mode only affects a

single interface, whereas the Global Configuration mode setting is applied to

all interfaces. The Interface Configuration mode command is only available

on platforms that support independent per-port class of service queue

configuration.

At least one, but no more than n, tcg-id values are specified with this

command. Duplicate tcg-id values are ignored. Each tcg-id value ranges from

0 to (n-1), where n is the total number of TCG supported per interface. The

number n is platform dependent and corresponds to the number of supported

Traffic Class Groups.

When strict priority scheduling is used for a TCG, the minimum bandwidth

setting for the TCG is ignored and packets are scheduled for transmission as

soon as they arrive. A maximum bandwidth setting for the queue, if

configured, serves to limit the outbound transmission rate of a strict priority

TCG queue so that it does not consume the entire capacity of the interface.

If multiple TCGs on the same interface are configured for strict priority

mode, the method of handling their packet transmission, gives preference

among the strict priority TCGs to the one with the highest tcg-id. Strict

priority or weighted scheduling may be configured manually or via DCBX

using the ETS TLVs.

Data Center Technology Commands 1154

Example

The following example demonstrates how to set TCGs 1 and 2 to strict

priority scheduling.

console(config)# traffic-class-group strict 1 2

traffic-class-group weight

Use the traffic-class-group weight command in Global Config or Interface

Configuration mode to specify the scheduling weight for each TCG. The

scheduler attempts to balance the traffic selected for transmission from the

TCGs such that, when the switch is congested, traffic is selected from the

round robin configured TCGs in proportion to their weights.

Use the no form of the command to return the TCGs to the default weighted

scheduler mode.

Syntax

traffic-class-group weight wp-0 wp-1 wp-2

no traffic-class-group strict

• wp-n—The weight percentage. Range 0 to 100.

Default Configuration

The default weight is in the ratio of 1:2:3 for

TCG0:TCG1:TCG2(100%:0%:0%).

Command Mode

Global Configuration mode, Interface Configuration mode

User Guidelines

NOTE: This command is only available on N40xx series switches.

This command specified in Interface Configuration mode only affects a

single interface, whereas the Global Configuration mode setting is applied to

all interfaces. The Interface Configuration mode command is only available

on platforms that support independent per-port class of service queue

configuration.

Data Center Technology Commands 1155

The weight percentage is not considered for Traffic Class Groups that are

configured for strict priority scheduling. Auto-configuration ports utilize the

weights received from the auto-configuration source but do no alter the

manual settings. Manually configured ports enabled for DCBX transmit the

manually configured weights in the TC Bandwidth table in the ETS TLVs.

Each wp-x (weight percentage) value is a percentage that ranges from 0 to

100 in increments of 1. All n bandwidth values must be specified with this

command, and their combined sum must equal 100%. The weight percentage

may be configured manually or via the DCBX protocol using the ETS TLVs.

Example

The following example demonstrates how to set TCG 0 to 50% weight and

TCG 1 to 50%.

console(config)# traffic-class-group weight 50 5 0

show classofservice traffic-class-group

Use the show classofservice traffic-class-group command to display the

Traffic Class to Traffic Class Group mapping.

Syntax

show classofservice traffic-class-group [interface-id]

• interface-id—The ID for the interface for which to display information.

Default Configuration

The default is to show the global traffic class to group mapping.

Command Mode

Privileged Exec mode

User Guidelines

NOTE: This command is only available on N40xx series switches.

The interface-id parameter is optional. If specified, the TCG mapping table

of the interface is displayed. If omitted, the global configuration settings are

displayed (these may have been subsequently overridden by per-port

configuration).

Data Center Technology Commands 1156

Traffic class group 7 is reserved by the system and is not shown.

Auto-configuration ports utilize the traffic class group mappings received

from the auto-configuration source. Manually configured ports enabled for

DCBX transmit the traffic class groups in the ETS TLVs.

Example

The following example demonstrates how to display the global traffic class to

group mappings:

s1# show classofservice traffic-class-group

Traffic Class Traffic Class Group

------------- ---------------------

0 0

1 1

2 1

3 1

4 2

5 1

6 1

show interfaces traffic

Use the show interfaces traffic command to display traffic information.

Syntax

show interfaces traffic [interface-id]

interface-id—A valid physical interface specifier.

Port-channels are not allowed

with this command as the queuing and drops occur on the individual

interfaces and not on the port channel.

Default Configuration

The default is to show the global traffic class group configuration.

Command Mode

Privileged Exec mode

Data Center Technology Commands 1157

User Guidelines

The interface-id parameter is optional. The following information is

displayed:

The above counters are cleared by the clear counters command. The queue

sizes cannot be cleared as they are instantaneous

Example

This example shows Gi1/0/1 is suffering from congestion (Tx Queue high)

and is dropping packets, either due to WRED drops or due to exceeding the

internal buffer limits.

console#show interfaces traffic

Intf Congestion Tx Queue Rx Queue Color Drops (Pkts) Tx Queue

Name Drops (Pkts) (Cells) (Cells) Yellow Red (Pkts)

------- ------------ -------- -------- ------------ ------------ --------

Gi1/0/1 18981 132 0 0 0 13

Gi1/0/2 0 0 0 0 0 0

Field Description

Congestion drops Packets dropped due to congestion. This includes packets

that exceeded an upper WRED threshold and packet

dropped by WRED. ECN marked packets are not

counted as dropped.

Tx Queue The instantaneous number of cells queued for egress on

the interface. Cells are 208 bytes.

Rx Queue The instantaneous number of cells queued for ingress on

the switch. Cells are 208 bytes. If a port is configured for

PFC, cells are buffered on ingress. If not, cells are

buffered on egress.

Color drops The number of packets dropped due to WRED dropping

of packets. Packets exceeding the upper WRED

threshold are counted in the drops bucket. ECN marked

packets are not counted as dropped.

WRED TX Queue The instantaneous number of packets queued for

transmission on the interface as smoothed by the

exponential weighting function.

Data Center Technology Commands 1158

Gi1/0/3 0 0 0 0 0 0

show interfaces traffic-class-group

Use the show interfaces traffic-class-group command to display the Traffic

Class to Traffic Class Group mapping.

Syntax

show interfaces traffic-class-group [interface-id]

• interface-id—A valid physical interface specifier.

Default Configuration

The default is to show the global traffic class group configuration.

Command Mode

Privileged Exec mode

User Guidelines

NOTE: This command is only available on N40xx series switches.

The interface-id parameter is optional. If specified, the TCG mapping table

of the interface is displayed. If omitted, the global configuration settings are

displayed (these may have been subsequently overridden by per-port

configuration).

The following information is displayed:

Field Description

Interface Displays the slot/port of the interface. If displaying the global

configuration, this output line is replaced with a Global Config

indication.

Traffic Class Group The traffic class Group identifier.

Min-Bandwidth The minimum transmission bandwidth, expressed as a

percentage. A value of 0 means bandwidth is not guaranteed.

This is a configured value.

Data Center Technology Commands 1159

Example

The following example demonstrates how to display the global traffic class

group configuration:

s1# show interfaces traffic-class-group

Global Configuration

TCG Id Min. Max Scheduler Weight

Bandwidth Bandwidth Type Percentage

------- ---------- --------- --------- ----------

0 0 0 Strict 0

1 0 0 WDRR 50

2 0 0 WDRR 50

Max-Bandwidth The maximum transmission bandwidth g, expressed as a

percentage. A value of 0 means no upper limit is enforced, so

the queue may use any or all of the available bandwidth of the

interface. This is a configured value.

Scheduler Type Indicates whether this queue is scheduled for transmission

using a strict priority or a weighted scheme. Strict priority

scheduler is to provide lower latency to the higher CoS classes

of traffic. Weighted scheduling is a round robin mechanism

with weights associated to each CoS class of traffic. This is a

configured value.

Weight Percentage The weight of the TCG used during non-strict scheduling.

Field Description

Data Center Technology Commands 1160

OpenFlow Commands

Dell EMC Networking N2000/N2100-ON/N3000/N3100/N4000 Series

Switches

The OpenFlow feature configures the switch to be managed by a centralized

OpenFlow Controller using the OpenFlow protocol. Openflow is not

supported in a stacking environment. The OpenFlow agent has been

validated with the Helium release of OpenDaylight (ODL).

Commands in this Section

This section explains the following commands:

controller

Use the controller command to configure a connection to an OpenFlow

controller. Use the no form of the command to remove an OpenFlow

controller connection.

Syntax

controller ipv4 ipv4-address [port port-number] security { none | ssl }

no controller ipv4 { ipv4-address [port port-number] | all }

• ipv4-address—The IPv4 address of the controller.

• port-number—The TCP port number used for the connection on the

controller.

•security { none | ssl }—The security used for connection to the controller.

•all—Delete all OpenFlow controllers

controller openflow

hardware profile openflow passive

ipv4 address protocol-version

mode show openflow

Data Center Technology Commands 1161

Default Configuration

No controllers are configured by default.

Command Mode

OpenFlow Configuration

User Guidelines

If connection to the controller over an interface other than the OOB interface

is desired, use the OpenFlow mode command prior to issuing this command.

Issuing the mode command after a connection has been established drops the

connection. The connections are then re-attempted over the new interface as

specified by the mode command.

If the OOB interface is used to connect to the OpenFlow controllers, the

controllers should be on the same subnet as the OOB interface.

When using the no form of the command, if no port number is given, all

controller entries for the IP address are deleted.

If SSL is used, an SSL certificate should be downloaded using the copy

command prior to configuring the controller.

OpenFlow operates on the stack master only. Flows may not be configured on

stack members. Failover to the stack standby unit is not supported.

OpenFlow should only be enabled on stand-alone switches and should not be

enabled on stacks of switches. This restriction is not enforced.

Command History

Introduced in version 6.3.0.1 firmware.

Example

This example enables OpenFlow 1.3 on a switch and configures a connection

the controller at IPv4 address 1.2.3.4 TCP port 3435 using SSL security. A

signed CA certificate, switch certificate, and switch private key should be

downloaded to the switch using the copy command.

console(config)#openflow

WARNING! OpenFlow does not operate on stack members. Enable OpenFlow on

stand-alone switches only.

Data Center Technology Commands 1162

console(config-of-switch)#controller ipv4 1.2.3.4 port 3435 security ssl

hardware profile openflow

Use the hardware profile openflow command to select the forwarding mode

for the OpenFlow hybrid capability. Use the no form of the command to

select the default forwarding capability.

Syntax

hardware profile openflow { full-match | layer2-match }

no hardware profile openflow

•full-match—Perform full matching when configured in OpenFlow 1.0

mode.

•layer2-match—Perform L2 matching when configured in OpenFlow 1.0

mode.

Default Configuration

By default, layer2 matching is performed.

Command Mode

Global Configuration

User Guidelines

This command configures the switch when operating in OpenFlow 1.0 mode.

It has no effect when operating in OpenFlow 1.3 mode.

If the administrator changes the default hardware table for OpenFlow 1.0 and

if the switch is currently operating in OpenFlow 1.0 variant then the

OpenFlow feature is automatically disabled and re-enabled.

OpenFlow operates on the stack master only. Flows may not be configured on

stack members. Failover to the stack standby unit is not supported.

OpenFlow should only be enabled on stand-alone switches and should not be

enabled on stacks of switches. This restriction is not enforced.

Data Center Technology Commands 1163

Command History

Introduced in version 6.3.0.1 firmware.

Example

The following example configures OpenFlow 1.0 full matching, configures a

connection to the controller at IPv4 address 1.2.3.4 TCP port 3435 using SSL

security, and enables OpenFlow 1.0 on the switch.

console(config)#hardware profile openflow full-match

console(config)#openflow

WARNING! OpenFlow does not operate on stack members. Enable OpenFlow on

stand-alone switches only.

console(config-of-switch)#controller ipv4 1.2.3.4 port 3435 security ssl

console(config-of-switch)#protocol-version 1.0

console(config-of-switch)#mode auto

console(config-of-switch)#exit

ipv4 address

Use the ipv4 address command to assign the IPv4 source address utilized for

controller connections. Use the no form of the command to return the setting

to the default.

Syntax

ipv4 address ipv4-address

no ipv4 address

• ipv4-address— The configured IPv4 address of the switch. A VLAN

interface must exist with an identical address.

Default Configuration

By default, the switch selects an address automatically.

Command Mode

OpenFlow Configuration

Data Center Technology Commands 1164

User Guidelines

This command configures the switch with a static IPv4 address. The switch

must be configured in static mode in order to use the configured static

address.

Only IPv4 addresses are supported for OpenFlow controllers.

OpenFlow operates on the stack master only. Flows may not be configured on

stack members. Failover to the stack standby unit is not supported.

OpenFlow should only be enabled on stand-alone switches and should not be

enabled on stacks of switches. This restriction is not enforced.

Command History

Introduced in version 6.3.0.1 firmware.

Example

This example configures an interface using VLAN 10 with IPv4 address

1.2.3.1, configures a connection to the controller at IPv4 address 1.2.3.4 TCP

port 3435 using SSL security and initiates the connection over the switch

front panel interface. The local switch is configured with a static IP address

after being configured into static address mode.

console(config)#vlan 10

console(config-vlan10)#interface vlan 10

console(config-if-vlan10)#ip address 1.2.3.1 255.255.0.0

console(config-if-vlan10)#interface gi1/0/1

console(config-if-Gi1/0/1)#switchport mode access

console(config-if-Gi1/0/1)#switchport access vlan 10

console(config)#openflow

WARNING! OpenFlow does not operate on stack members. Enable OpenFlow on

stand-alone switches only.

console(config-of-switch)#controller ipv4 1.2.3.4 port 3435 security ssl

console(config-of-switch)#mode static

console(config-of-switch)#ipv4 address 1.2.3.1

console(config-of-switch)#exit

Data Center Technology Commands 1165

mode

Use the mode command to configure the selection of interfaces used to

assign the IP address utilized for controller connections. Use the no form of

the command to return the setting to the default.

Syntax

mode { auto | static | oob }

no mode

•auto—Automatically select the switch IP address

•static—Use the configured static IP address

•oob—Use the OOB interface IP address

Default Configuration

By default, the switch selects an IP address automatically (auto mode).

Command Mode

OpenFlow Configuration

User Guidelines

This command configures the switch to select an IP address from a particular

type of interface. The selected IP address is used as the local end-point of the

IP connections to the OpenFlow controllers.

The administrator can allow the switch to automatically assign an IP address

to the OpenFlow feature or to specifically select which address should be

used. The administrator can also direct the OpenFlow feature to always use

the out-of-band interface.

When in auto mode, the switch selects an IP address from an interface in this

order:

The loopback interfaces.

The routing interfaces.

The out-of-band interface.

Data Center Technology Commands 1166

Once the IP address is selected, it is used until the interface goes down or the

OpenFlow feature is disabled or, in case of automatic address selection, a

more preferred interface becomes available.

Only IPv4 addresses are supported for OpenFlow controllers.

Changing the mode causes the connections to controllers to be dropped, and

if properly configured, re-established.

If the switch is configured in static mode, OpenFlow will remain operationally

disabled until a static IPv4 address is configured, the IPv4 address matches

exactly an IPv4 address on a VLAN interface, and the VLAN interface is

operationally enabled.

If the OOB interface is manually selected as the OpenFlow IP address then

the Open Flow feature becomes enabled immediately, even if there is no IP

address assigned to the service port.

If the OOB interface is used to connect to the OpenFlow controllers, the

controllers should be on the same subnet as the OOB interface.

OpenFlow operates on the stack master only. Flows may not be configured on

stack members. Failover to the stack standby unit is not supported.

OpenFlow should only be enabled on stand-alone switches and should not be

enabled on stacks of switches. This restriction is not enforced.

Command History

Introduced in version 6.3.0.1 firmware.

Example

This example configures an interface using VLAN 10 with IPv4 address

1.2.3.1, configures a connection to the controller at IPv4 address 1.2.3.4 TCP

port 3435 using SSL security and initiates the connection over the switch

front panel interface.

console(config)#vlan 10

console(config-vlan10)#interface vlan 10

console(config-if-vlan10)#ip address 1.2.3.1 255.255.0.0

console(config-if-vlan10)#interface gi1/0/1

console(config-if-Gi1/0/1)#switchport mode access

console(config-if-Gi1/0/1)#switchport access vlan 10

console(config)#openflow

Data Center Technology Commands 1167

WARNING! OpenFlow does not operate on stack members. Enable OpenFlow on

stand-alone switches only.

console(config-of-switch)#controller ipv4 1.2.3.4 port 3435 security ssl

console(config-of-switch)#mode auto

console(config-of-switch)#exit

openflow

Use the openflow command to enable OpenFlow on the switch (if disabled)

and enter into OpenFlow configuration mode. Use the exit command to

return to Global Configuration mode.

Syntax

openflow

no openflow

Default Configuration

The OpenFlow capability is disabled by default. No controllers are configured

by default. OpenFlow 1.3 mode is selected by default when OpenFlow is

enabled. The OpenFlow protocol operates over the OOB interface by default.

Command Mode

Global Configuration

User Guidelines

When the OpenFlow feature is administratively disabled, the switch drops

connections with the OpenFlow Controllers. The switch also purges all flows

programmed by the controllers and removes the controller configuration.

Dell OpenFlow implements a true hybrid mode implementation of

OpenFlow. Resources are allocated on a first-come first serve basis among the

legacy switch UI and the OpenFlow controllers. No arbitration of resources is

performed and conflicting actions are allowed.

Data Center Technology Commands 1168

OpenFlow operates on the stack master only. Flows may not be configured on

stack members. Failover to the stack standby unit is not supported.

OpenFlow should only be enabled on stand-alone switches and should not be

enabled on stacks of switches. This restriction is not enforced.

Command History

Introduced in version 6.3.0.1 firmware.

Example

This example enables OpenFlow 1.3 on a switch and configures a connection

the controller at IPv4 address 1.2.3.4 TCP port 3435 using SSL security.

console(config)#openflow

WARNING! OpenFlow does not operate on stack members. Enable OpenFlow on

stand-alone switches only.

console(config-of-switch)#controller ipv4 1.2.3.4 port 3435 security ssl

passive

Use the passive command to set the switch to accept connections initiated by

a controller.

Syntax

passive

no passive

Default Configuration

By default, the switch initiates the connection to the controllers.

Command Mode

OpenFlow Configuration

Data Center Technology Commands 1169

User Guidelines

This command configures the switch to accept a connection request from a

controller. When passive mode is enabled, the switch accepts TCP

connections to ports 6632 and 6633 respectively using any switch IP address.

In this mode, the switch continues to attempt to initiate connections to

configured controllers.

The OpenFlow component always initiates the SSL connections and does not

accept SSL connections.

OpenFlow operates on the stack master only. Flows may not be configured on

stack members. Failover to the stack standby unit is not supported.

OpenFlow should only be enabled on stand-alone switches and should not be

enabled on stacks of switches. This restriction is not enforced.

Command History

Introduced in version 6.3.0.1 firmware.

Example

This example configures a connection to the controller at IPv4 address 1.2.3.4

TCP port 3435 using SSL security and also configures the controller to accept

TCP connections to the switch on port 6633.

console(config)#openflow

WARNING! OpenFlow does not operate on stack members. Enable OpenFlow on

stand-alone switches only.

console(config-of-switch)#controller ipv4 1.2.3.4 port 3435 security ssl

console(config-of-switch)#passive

console(config-of-switch)#mode auto

console(config-of-switch)#exit

protocol-version

Use the protocol-version command to select the version of the protocol in

which to operate. Use the no form of the command to return the

configuration to the default.

Data Center Technology Commands 1170

Syntax

protocol-version { 1.0 | 1.3 }

no protocol-version

• 1.0—Operate in OpenFlow 1.0 mode

• 1.3—Operate in OpenFlow 1.3 mode

Default Configuration

By default, the switch operates in OpenFlow 1.3 mode.

Command Mode

OpenFlow Configuration

User Guidelines

If the administrator changes the OpenFlow variant while the OpenFlow

feature is enabled, the switch automatically disables and re-enables the

OpenFlow feature causing all flows to be deleted and connections to the

controllers to be dropped.

OpenFlow operates on the stack master only. Flows may not be configured on

stack members. Failover to the stack standby unit is not supported.

OpenFlow should only be enabled on stand-alone switches and should not be

enabled on stacks of switches. This restriction is not enforced.

Command History

Introduced in version 6.3.0.1 firmware.

Example

This example enables OpenFlow 1.3 on a switch and configures a connection

the controller at IPv4 address 1.2.3.4 TCP port 3435 using SSL security.

console(config)#openflow

WARNING! OpenFlow does not operate on stack members. Enable OpenFlow on

stand-alone switches only.

console(config-of-switch)#protocol-version 1.3

console(config-of-switch)#mode auto

Data Center Technology Commands 1171

console(config-of-switch)#controller ipv4 1.2.3.4 port 3435 security ssl

show openflow

Use the show openflow command to display OpenFlow configuration and

status.

Syntax

show openflow [ switch controllers | switch flows | switch groups | switch

tables ]

•switch controllers—Show information about configured controllers

•switch flows—Show information regarding flows

•switch groups—Show information regarding OpenFlow groups

•switch tables—Show information regarding the switch tables

Default Configuration

When invoked with no parameters, the show openflow command shows

summary information regarding OpenFlow.

Command Mode

Privileged Exec and Global Configuration

User Guidelines

OpenFlow operates on the stack master only. Flows may not be configured on

stack members. Failover to the stack standby unit is not supported.

OpenFlow should only be enabled on stand-alone switches and should not be

enabled on stacks of switches. This restriction is not enforced.

The command has the following output.

Parameter Description

Administrative Mode The OpenFlow feature administrative mode set by the

‘openflow enable’ command.

Administrative Status The operational status of the OpenFlow feature. Although

the feature may be administratively enabled, it could be

operationally disabled due to various reasons.

Data Center Technology Commands 1172

When the switch tables parameter is given, the following information is

displayed:

Disable Reason If the OpenFlow feature is operationally disabled then this

status shows the reason for the feature to be disabled.

IP Address IPv4 Address assigned to the feature. If the IP address is

not assigned then the status is ‘None’.

IP Mode IP mode assigned by the ‘openflow ip-mode’ command.

The IP Mode can be “Auto”, “Static” or “ServicePort IP”

Static IP Address Static IP address assigned by the ‘openflow static-ip-

address’ command.

Network MTU Maximum network packet size excluding the VLAN Tag.

OpenFlow Variant OpenFlow Protocol Variant. The OpenFlow protocol can

be “OpenFlow 1.0” or “OpenFlow 1.3”.

Default Table The Hardware Table used as the target for flows installed

by an OpenFlow 1.0 controller which is not enhanced to

handle multiple hardware tables.

Passive Mode The OpenFlow passive mode set by the ‘passive’ command.

Parameter Description

Flow Table. OpenFlow Table Identifier (0 – 255).

Flow Table Name. The name of this table.

Flow Table Description. A detailed description for this table.

Maximum Size. Platform-defined maximum size for this flow table.

Number of Entries. Total number of entries in this table. The count includes

delete-pending entries.

Hardware Entries. Number of entries currently inserted into the hardware.

Software-Only Entries. Number of entries that are not installed in the hardware

for any reason. This includes entries pending for insertion,

entries that cannot be inserted due to missing interfaces

and entries that cannot be inserted due to table-full

condition.

Parameter Description

Data Center Technology Commands 1173

When the switch groups parameter is given, the following information is

displayed:

When the switch flows parameter is selected, the following output is shown:

Waiting for Space

Entries

Number of entries that are not currently in the hardware

because the attempt to insert the entry failed.

Flow Insertion Count. Total number of flows that were added to this table since

the switch powered up.

Flow Deletion Count. Total number of flows that were deleted from this table

since the switch powered up.

Insertion Failure Count. Total number of hardware insertion attempts that were

rejected due to lack of space since the switch powered up.

Parameter Description

Group Type Type of Group: Indirect, All, Select, etc.

Group Id Unique ID for the Group

Reference Count This count indicates how many Select groups are referring

to the current Indirect group. Reference Count is used

only for Indirect groups.

Duration The time since the group was created.

Bucket Count Number of Buckets in the group.

Reference Group Id References the Indirect group ID and used for Select

group only.

Parameter Description

Flow Type Type of the Flow 1.0 Flow or Layer 2 Match etc.

Flow Table The hardware table where the flow is installed.

Flow Priority Priority of the flow versus other flows. Higher is better.

Match Criterion The match criterion specified by the flow with the field

and value like ingress port or ether type

Ingress Port The port on which the flow is active.

Parameter Description

Data Center Technology Commands 1174

Command History

Introduced in version 6.3.0.1 firmware.

Example

This output shows an operationally disabled switch:

console#show openflow

Administrative Mode............................ Enable

Administrative Status.......................... Disabled

Disable Reason................................. No-Suitable-IP-Interface

IP Address..................................... None

IP Mode........................................ Auto

Static IP Address.............................. 10.1.1.1

Network MTU.................................... 1518

OpenFlow Variant............................... OpenFlow 1.0

Default Table.................................. layer-2-match

Passive Mode................................... Enable

This output shows an operationally enabled switch:

console#show openflow

Administrative Mode............................ Enable

Administrative Status.......................... Enabled

Disable Reason................................. None

IP Address..................................... 10.27.65.64

IP Mode........................................ Auto

Static IP Address.............................. 10.1.1.1

Network MTU.................................... 1518

OpenFlow Variant............................... OpenFlow 1.3

Default Table.................................. full-match

Passive Mode................................... Enable

Action The action specified by the flow.

Duration The time since the flow was created

Idle The time since the flow was hit.

Installed in hardware Shows 0 if for some reason the flow could not be added in

the hardware.

Parameter Description

Data Center Technology Commands 1175

This example shows the output for OpenFlow 1.0 using the switch tables

parameter:

console#show openflow switch tables

Flow Table...............................1

Flow Table Name..........................Forwarding Database

Maximum Size.............................64

Number of Entries........................8

Hardware Entries.........................7

Software-Only Entries....................1

Waiting for Space Entries................0

Flow Insertion Count.....................1

Flow Deletion Count......................0

Insertion Failure Count..................0

Flow Table Description:

The forwarding database maps non-multicast MAC addresses and the ports on

which these addresses are located.

This example shows the output for OpenFlow 1.3 using the switch tables

parameter:

console#show openflow switch tables

Flow Table..................................... 60

Flow Table Name................................ Openflow 1.3

Maximum Size................................... 1920

Number of Entries.............................. 0

Hardware Entries............................... 0

Software-Only Entries.......................... 0

Waiting for Space Entries...................... 0

Flow Insertion Count........................... 0

Flow Deletion Count............................ 0

Insertion Failure Count........................ 0

Flow Table Description......................... The Openflow 1.3 table

matches on the packet layer-2 header, including DA-MAC, SA-MAC, VLAN, Vlan

priority ether type; layer-3 header, including SRC-IP, DST-IP, IP protocol,

IP-TOS; layer-4 header, including UDP/TCP source and dest port, ICMP type,

and code; SRC-IPv6, DST_IPv6, IPv6 Flow Label, ECN, ICMPv6 type and code,

source L4 Port for TCP / UDP / SCTP and input port including physical port

and LAG port.

Data Center Technology Commands 1176

The following example shows the output when the switch groups parameter

is given:

console#show openflow switch groups

Max Indirect Group Entries......................................... 1234

Current Indirect Group Entries in database......................... 123

Max All Group Entries.............................................. 1234

Current All Group Entries in database.............................. 123

Max Select Group Entries........................................... 1234

Current Select Group Entries in database........................... 123

Group Id 12345678 type “Indirect”

=================================

Ref Count 1 : Duration 8 : Bucket Count 1

Bucket Entry List:

------------------

Bucket Index 25 : Output Port 1

Src MAC 00:00:00:00:00:AB : Dst MAC 00:00:00:00:00:CD

VLAN 101 : Reference Group Id NA

Group Id 23456789 type “All”

============================

Ref Count NA : Duration 10 : Bucket Count 2

Bucket Entry List:

------------------

Bucket Index 26 : Output Port 2

Src MAC NA : Dst MAC NA

VLAN 102 : Reference Group Id NA

Bucket Index 27 : Output Port 3

Src MAC NA : Dst MAC NA

VLAN 103 : Reference Group Id NA

Group Id 34567890 type “Select”

===============================

Ref Count NA : Duration 10 : Bucket Count 3

Bucket Entry List:

------------------

Data Center Technology Commands 1177

Bucket Index 28 : Output Port NA

Src MAC NA : Dst MAC NA

VLAN NA : Reference Group Id 12345678

Bucket Index 29 : Output Port NA

Src MAC NA : Dst MAC NA

VLAN NA : Reference Group Id 12345678

Bucket Index 30 : Output Port NA

Src MAC NA : Dst MAC NA

VLAN NA : Reference Group Id 12345678

This examples shows the output for OpenFlow 1.0 flows:

console#show openflow switch flows

Flow: 00000000 Type: “1DOT0”

Flow Table: 60 Priority: 1 Type: Untagged MAC

Match Criteria:

Ingress port: Gi1/0/1 Egress Port:

VLAN ID: VLAN PCP: EtherType: 0x0800

Src MAC: Src IP: Src IP Port:

Dst MAC: Dst IP: Dst IP Port:

IP Protocol: TOS: DSCP:

Action: Drop

Duration (secs): 55 Idle (secs): 45 In HW: Yes

Packet Count: 12321 HW Priority: 2131

This example shows the output for OpenFlow 1.3 flows:

console#show openflow switch flows

Flow: 000000E1 Type: “1DOT3”

Match Criteria:

Flow Table: 60 Priority: 10

Ingress port: Gi1/0/1 Egress Port: Gi1/0/2

VLAN ID: 1 VLAN PCP: 1 EtherType: 0x0800

Src MAC: 00:00:02:37:38:01 Src IP: 100.0.0.225 Src IP Port: 1

Dst MAC: 00:00:18:37:22:01 Dst IP: 192.0.0.225 Dst IP Port: 1

IP Protocol: 17 TOS: 32 DSCP: 8

Action:

Data Center Technology Commands 1178

Duration (secs): 5 Idle (secs): 2 In HW: Yes

Packet Count: 3 HW Priority: 65464

Flow 000001F9 type “1DOT3”

Match Criteria:

Flow Table: 60 Priority: 10

Ingress port: Gi1/0/1 Egress Port: Gi1/0/1

VLAN ID: 1 VLAN PCP: 1 EtherType: 0x0800

Src MAC: 00:00:02:37:38:01 Src IP: 100.0.1.249 Src IP Port: 1

Dst MAC: 00:00:18:37:22:01 Dst IP: 192.0.1.249 Dst IP Port: 1

IP Protocol: 17 TOS: 32 DSCP: 8

Action:

Duration (secs): 2 Idle (secs): 0 In HW: Yes

Packet Count: 9879 HW Priority: 786743

Data Center Technology Commands 1179

Priority Flow Control Commands

Dell EMC Networking N4000 Series Switches

Priority Flow Control (PFC) provides a means of pausing frames based on

individual priorities on a single physical link. By pausing the congested

priority or priorities independently, protocols that are highly loss sensitive can

share the same link with traffic that has different loss tolerances with less

congestion spreading than standard flow control. The priorities are

differentiated by the priority field of the 802.1Q VLAN header. PFC is

standardized by the IEEE 802.1Qbb specification.

PFC uses a new control packet defined in 802.1Qbb and therefore is not

compatible with standard flow control. An interface that is configured for

PFC will be automatically disabled for 802.3x flow control. When PFC is

disabled on an interface, the flow control configuration for the interface

becomes active. Any flow control frames received on a PFC configured

interface are ignored.

Each priority is configured as either drop or no-drop. If a priority that is

designated as no-drop is congested, the priority is paused. Drop priorities do

not participate in pause. By default there are no priority classifications

configured and PFC is not enabled.

While several no-drop priorities may be configured on a supporting system,

the actual number of lossless priorities supported on a given system is a

function of the switch chips packet buffer, the maximum supported MTU

size, pause delay, the media type and the total number of ports enabled for

lossless behavior. In order to guarantee lossless behavior, the switch chip must

send a pause message prior to exhausting its available packet buffer and have

sufficient buffer to absorb the delay. In order to accomplish this, it must

reserve enough memory (headroom) to handle the max delay in processing

the pause packet.

The maximum number of lossless priorities per interface is two. The

headroom is only used for guaranteeing lossless behavior. There must be

enough dynamic memory to handle the typical work load of the switch in

addition to the headroom. With two no-drop priorities per interface and

static allocations, there is only about 30 percent of the buffer space available

for normal forwarding behavior.

Data Center Technology Commands 1180

The effective default behavior on an interface enabled for PFC without a no-

drop priority is that no flow control (legacy or PFC) is enabled. If the user

enables PFC but does not create any no-drop priorities, the interface will not

be lossless.

Changing the drop and no-drop capabilities on an interface, either in flow

control or priority flow control, may require that all ports briefly drop link.

The priority to flow control group cannot be changed while traffic is running.

When 802.3 link flow control is enabled, all priorities are mapped to a single

flow control group. When Qbb is enabled, the priorities are each mapped into

their own flow control group, where lossless groups have additional buffer to

handle the round trip delay for flow control. In order to minimize the impact,

the link will only be dropped when changing between 802.3 and Qbb.

Commands in this Section

This section explains the following commands:

priority-flow-control mode

Use the priority-flow-control mode on command in Datacenter-Bridging

Configuration mode to enable Priority-Flow-Control (PFC) on an interface.

To disable Priority-Flow-Control, use the no form of the command.

Syntax

priority-flow-control mode on

priority-flow-control mode off

no priority-flow-control mode

•on—Enable PFC on the interface.

•off—Disable PFC on the interface.

Data Center Bridging Capability Exchange Commands

priority-flow-control priority

clear priority-flow-control statistics

show interfaces priority-flow-control

Data Center Technology Commands 1181

Default Configuration

Priority-flow-control mode is off (disabled) by default.

Command Mode

Datacenter-Bridging Configuration mode

User Guidelines

NOTE: This command is only available on N40xx series switches.

PFC must be enabled before FIP snooping can operate over the interface. Use

the no form of the command to return the mode to the default (off). VLAN

tagging (trunk or general mode) must be enabled on the interface in order to

carry the 802.1p value through the network. Additionally, the dot1mapping to

class-of-service must be set to one-to-one. Ports that are configured to use the

DCBX auto-configuration roles (auto-up or auto-down) have their PFC

settings overridden. Only ports configured as DCBX manual role utilize the

configured PFC settings.

When PFC is enabled on an interface, the normal PAUSE control mechanism

is operationally disabled. Because PFC is a link local protocol, it must be

configured on all the interfaces aggregated in a port channel. Only

configuring some of the ports in a port channel to use PFC will cause

unexpected results and is not supported.

Example

The following example enables PFC on an interface.

s1(config)#interface te1/0/1

s1(config-if-Te1/0/1)#datacenter-bridging

s1(config-if-dcb)#priority-flow-control mode on

priority-flow-control priority

Use the priority-flow-control priority command in Datacenter-Bridging

Configuration mode to enable the priority group for lossless (no-drop) or

lossy (drop) behavior on the selected interface. Up to two lossless priorities

can be enabled on an interface.

Use the no form of the command to return all priorities to their default lossy

behavior.

Data Center Technology Commands 1182

Syntax

priority-flow-control priority priority-list {drop | no-drop}

no priority-flow-control priority

•drop—Disable lossless behavior on the selected priorities.

•no-drop—Enable lossless behavior on the selected priorities.

• priority-list —A list of IEEE 802.1p priorities (up to two) which are to be

configured as lossless.

Default Configuration

The default behavior for all priorities is tail-drop.

Command Mode

Datacenter-Bridging Configuration mode

User Guidelines

NOTE: This command is only available on N40xx series switches.

The administrator must configure the same no-drop priorities across the

network in order to ensure end-to-end lossless behavior. Ports that are

configured to use the DCBX auto-configuration roles (auto-up or auto-down)

have their PFC settings overridden. Only ports configured as DCBX manual

role utilize the configured PFC settings.

Example

The following example sets priority 3 to no drop behavior.

s1(config)#interface te1/0/1

s1(config-if-Te1/0/1)#datacenter-bridging

s1(config-if-dcb)#priority-flow-control mode on

s1(config-if-dcb)#priority-flow-control priority 1 no-drop

clear priority-flow-control statistics

Use the clear priority-flow-control statistics command to clear all or interface

Priority-Flow-Control statistics.

Data Center Technology Commands 1183

Syntax

clear priority-flow-control statistics [ethernet interface ]

• interface — A valid Ethernet port.

Command Mode

Privileged Exec mode

User Guidelines

This command has no user guidelines.

Example #1

console#clear priority-flow-control statistics tengigabitethernet 1/0/1

Example #2

console#clear priority-flow-control statistics

show interfaces priority-flow-control

Use the show interfaces priority-flow-control command to display the global

or interface priority flow control status and statistics.

Syntax

show interfaces interface-id priority-flow-control

• interface-id—A valid Ethernet port identifier.

Command Mode

Privileged Exec, Global Configuration mode and all Configuration submodes

User Guidelines

NOTE: This command is only available on N40xx series switches.

This command has no user guidelines.

Examples

The following examples show the priority flow control status and statistics.

s1#show interfaces tengigabitethernet 1/0/1 priority-flow-control

Data Center Technology Commands 1184

Interface Detail:te1/0/1

PFC Configured State: Disabled

PFC Operational State: Enabled

Configured Drop Priorities: 2-7

Operational Drop Priorities: 2-7

Configured No-Drop Priorities: 0-1

Operational No-Drop Priorities:0-1

Delay Allowance: 32456 bit times

Peer Configuration Compatible: True

Compatible Configuration Count: 3

Incompatible Configuration Count: 1

Priority Received PFC Frames Transmitted PFC Frames

-------- ----------------- ----------------------

00 0

10 0

20 0

30 0

40 0

50 0

60 0

70 0

console#show interfaces priority-flow-control

Port Drop No-Drop Operational

Priorities Priorities Status

-------- --------------- --------------- ----------

Te1/0/1 0-2,4-7 3 Active

Te1/0/2 0-2,4-7 3 Active

Te1/0/3 0-7 Inactive

Te1/0/4 0-7 Inactive

Te1/0/5 0-7 Inactive

Te1/0/6 0-7 Inactive

Te1/0/7 0-7 Inactive

Te1/0/8 0-7 Inactive

Te1/0/9 0-7 Inactive

Te1/0/10 0-7 Inactive

Te1/0/11 0-7 Inactive

Te1/0/12 0-7 Inactive

Te1/0/13 0-7 Inactive

Te1/0/14 0-7 Inactive

Te1/0/15 0-7 Inactive

Te1/0/16 0-7 Inactive

Te1/0/17 0-7 Inactive

Te1/0/18 0-7 Inactive

Data Center Technology Commands 1185

Te1/0/19 0-7 Inactive

Te1/0/20 0-7 Inactive

Te1/0/21 0-7 Inactive

Te1/0/22 0-7 Inactive

Te1/0/23 0-2,4-7 3 Active

Te1/0/24 0-7 Inactive

Data Center Technology Commands 1186

Layer 3 Routing Commands 1187

Layer 3 Routing Commands

The sections that follow describe commands that conform to the OSI model’s

Network Layer (Layer 3). Layer 3 Routing commands enable routing

protocols to perform a series of exchanges over various data links to route data

between any two nodes in a network. These commands define the addressing

and routing structure of the Internet.

The Dell EMC N1100-ON Series switches do not support routing.

This section of the document contains the following Layer 3 topics:

ARP Commands Loopback Interface Commands

Bidirectional Forwarding Detection

Commands

IP Multicast Commands

Border Gateway Protocol Commands IPv6 Multicast Commands

BGP Routing Policy OSPF Commands

DVMRP Commands OSPFv3 Commands

IGMP Commands Router Discovery Protocol Commands

IGMP Commands Routing Information Protocol Commands

IGMP Proxy Commands Tunnel Interface Commands

IP Helper/DHCP Relay Commands Virtual Router Commands

IP Routing Commands Virtual Router Redundancy Protocol

Commands

IPv6 Routing Commands

–

Layer 3 Routing Commands 1188

ARP Commands

Dell EMC Networking N1500/N2000/N2100-ON/N3000/N3100-

ON/N4000 Series Switches

When a host has an IP packet to send on an Ethernet network, it must

encapsulate the IP packet in an Ethernet frame. The Ethernet header requires

a destination MAC address. If the destination IP address is on the same

network as the sender, the sender uses the Address Resolution Protocol (ARP)

to determine the MAC address associated with destination IP address. The

network device broadcasts an ARP request, identifying the IP address for

which it wants a corresponding MAC address. The IP address is called the

target IP. If a device on the same physical network is configured with the

target IP, it sends an ARP response giving its MAC address. This MAC address

is called the target MAC.

If the destination IP address is not on the same network as the sender, the

sender generally forwards the packet to a default gateway. The default

gateway is a router that forwards the packet to its destination. The host may

be configured with a default gateway or may dynamically learn a default

gateway.

The router discovery protocol is one method that enables hosts to learn a

default gateway. If a host does not know a default gateway, it can learn the

first hop to the destination through proxy ARP. Proxy ARP (RFC 1027) is a

technique used to make a machine physically located on one network appear

to be logically part of a different physical network connected to the same

router (may also be a firewall). Typically Proxy ARP hides a machine with a

public IP address on a private network behind a router and still allows the

machine to appear to be on the public network. The router proxies ARP

requests and all network traffic to and from the hidden machine to make this

fiction possible.

Proxy ARP is implemented by making a small change to a router's processing

of ARP requests. Without proxy ARP, a router only responds to an ARP

request if the target IP address is an address configured on the interface where

the ARP request arrived. With proxy ARP, the router may also respond if it

has a route to the target IP address. The router only responds if all next hops

on its route to the destination are through interfaces other than the interface

where the ARP request was received.

Layer 3 Routing Commands 1189

ARP Aging

Dynamic entries in the ARP cache are aged. When an entry for a neighbor

router reaches its maximum age, the system sends an ARP request to the

neighbor router to renew the entry. Entries for neighbor routers should

remain in the ARP cache as long as the neighbor continues to respond to ARP

requests. ARP cache entries for neighbor hosts are renewed more selectively.

When an ARP cache entry for a neighbor host reaches its maximum age, the

system checks if the cache entry has been used recently to forward data

traffic. If so, the system sends an ARP request to the entry's target IP address.

If a response is received, the cache entry is retained and its age is reset to 0. By

enabling the dynamic renew option, the system administrator can configure

ARP to attempt to renew aged ARP entries regardless of their use for

forwarding.

If the system learns a new ARP entry but the hardware does not have space to

add the new ARP entry, the system attempts to remove entries that have not

been used for forwarding recently. This action may create space for new

entries in the hardware's ARP table.

Commands in this Section

This section explains the following commands:

arp

Use the arp command in Global Configuration mode to create an Address

Resolution Protocol (ARP) entry. The arp command optionally creates a static

ARP entry in the selected VRF. Use the no form of the command to remove

the entry.

arp arp timeout

arp cachesize clear arp-cache

arp dynamicrenew clear arp-cache management

arp purge ip local-proxy-arp

arp resptime ip proxy-arp

arp retries show arp

Layer 3 Routing Commands 1190

Syntax

arp [vrf vrf-name]ip-address hardware-address [ interface interface-id]

no arp ip-address

• vrf-name—The name of the VRF with which the ARP entry is to be

associated. If no VRF is specified, the ARP entry is associated with the

global ARP table.

• ip-address — IP address of a device on a subnet attached to an existing

routing interface.

• hardware-address — A unicast MAC address for that device.

• interface-id—An optional IP unnumbered (VLAN) interface identifier.

Default Configuration

This command has no default configuration.

Command Mode

Global Configuration mode

User Guidelines

The VRF identified in the parameter must have been previously created or an

error is returned.

Only IPv4 addresses are supported with the vrf parameter.

The vrf parameter is only available on the N3000/N3100/N4000 switches.

The interface identifier is the identifier of the unnumbered interface, not the

loopback interface from which the IP address is borrowed.

When adding a static ARP entry with an unnumbered interface, the ip

address must match the mask of the unnumbered interface.

A static ARP entry is only installed if the IP address matches one of the local

subnets. In case of unnumbered interfaces, static ARP entries created for the

unnumbered-peer do not match any of the local subnets and cannot be

resolved to an interface. By specifying the interface explicitly in the static

ARP command, static ARP entries for unnumbered-peers can be configured.

Layer 3 Routing Commands 1191

Example

The following example creates an ARP entry consisting of an IP address and a

MAC address.

console(config)#arp 192.168.1.2 00A2.64B3.A245

arp cachesize

Use the arp cachesize command in Global Configuration mode to configure

the maximum number of entries in the ARP cache. To return the maximum

number of ARP cache entries to the default value, use the no form of this

command.

Syntax

arp cachesize integer

no arp cachesize

• integer — Maximum number of ARP entries in the cache. Use the show

sdm prefer command to display the supported ARP cache size.

Default Configuration

The switch defaults to using the maximum allowed cache size.

Command Mode

Global Configuration mode

User Guidelines

The ARP cache size is dependent on the switching hardware used. The

allowed range of values may be different from the example given below for a

given switch model.

On VRF enabled switches, the ARP cache is shared among all VRF instances.

Configuration of the cache size is shared among all VRF instances.

Example

The following example defines an arp cachesize of 1000.

console(config)#arp cachesize 1000

Layer 3 Routing Commands 1192

arp dynamicrenew

Use the arp dynamicrenew command in Global Configuration mode to

enable the ARP component to automatically renew dynamic ARP entries

when they age out. To disable the automatic renewal of dynamic ARP entries

when they age out, use the no form of the command.

Syntax

arp dynamicrenew

no arp dynamicrenew

Default Configuration

The default state is enabled.

Command Mode

Global Configuration mode

User Guidelines

When an ARP entry reaches its maximum age, the system must decide

whether to retain or delete the entry. If the entry has recently been used to

forward data packets, the system will renew the entry by sending an ARP

request to the neighbor. If the neighbor responds, the age of the ARP cache

entry is reset to 0 without removing the entry from the hardware. Traffic to

the host continues to be forwarded in hardware without interruption. If the

entry is not being used to forward data packets, the system sends an ARP

request to renew the entry. When an entry is not renewed, it is removed from

the hardware and subsequent data packets to the host trigger an ARP request.

Traffic to the host is lost until the router receives an ARP reply from the host.

Gateway entries, and entries for a neighbor router, are always renewed. The

dynamic renew option only applies to host entries.

The disadvantage of enabling dynamic renew is that once an ARP cache entry

is created, that cache entry continues to take space in the ARP cache as long

as the neighbor continues to respond to ARP requests, even if no traffic is

being forwarded to the neighbor. If the ARP cache is full and a new host is

learned, the oldest ARP cache entry is replaced with the new host entry.In a

network where the number of potential neighbors is greater than the ARP

Layer 3 Routing Commands 1193

cache capacity, enabling dynamic renew could prevent some neighbors from

communicating because the ARP cache is full. Dynamic renewal should be

disabled in these networks.

Example

console#configure

console(config)#arp dynamicrenew

console(config)#no arp dynamicrenew

arp purge

Use the arp purge command to cause the specified IP address to be removed

from the ARP cache. Only entries of type dynamic or gateway are affected by

this command. The arp purge command optionally removes a static ARP

entry in the selected VRF.

Syntax

arp purge [vrf vrf-name] ip-address [ interface interface-id]

• vrf-name—The name of the VRF associated with the ARP entry which is

to be removed. If no VRF is specified, the ARP entry is associated with the

global ARP table is removed.

• ip-address — The IP address to be removed from ARP cache.

• interface-id—An optional IP unnumbered (VLAN) interface identifier.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

The VRF identified in the parameter must have been previously created or an

error is returned.

Only IPv4 addresses are supported with the vrf parameter.

The vrf parameter is only available on the N3000/N3100/N4000 switches.

Layer 3 Routing Commands 1194

The interface identifier is the identifier of the unnumbered interface, not the

loopback interface from which the IP address is borrowed.

When the IP address does not uniquely identify an ARP entry, the interface

must be given to uniquely identify the ARP entry. The interface may be

numbered or unnumbered.

Example

The following example removes the specified IP address from arp cache.

console#arp purge 192.168.1.10

arp resptime

Use the arp resptime command in Global Configuration mode to configure

the ARP request response time-out. To return the response time-out to the

default value, use the no form of this command.

Syntax

arp resptime integer

no arp resptime

• integer — IP ARP entry response time out. (Range: 1-10 seconds)

Default Configuration

The default value is 1 second.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example defines a response time-out of 5 seconds.

console(config)#arp resptime 5

Layer 3 Routing Commands 1195

arp retries

Use the arp retries command in Global Configuration mode to configure the

ARP count of maximum requests for retries. To return to the default value,

use the no form of this command.

Syntax

arp retries integer

no arp retries

• integer — The maximum number of requests for retries. (Range: 0-10)

Default Configuration

The default value is 4 retries.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example defines 6 as the maximum number of retries.

console(config)#arp retries 6

arp timeout

Use the arp timeout command in Global Configuration mode to configure

the ARP entry age-out time. Use the no form of the command to set the age-

out time to the default.

Syntax

arp timeout integer

no arp timeout

• integer — The IP ARP entry age-out time. (Range: 15-21600 seconds)

Layer 3 Routing Commands 1196

Default Configuration

The default value is 1200 seconds.

Command Mode

Global Configuration mode

User Guidelines

This command has no user guidelines.

Example

The following example defines 900 seconds as the timeout.

console(config)#arp timeout 900

clear arp-cache

Use the clear arp-cache command to remove all ARP entries of type dynamic

from the ARP cache.

Syntax

clear arp-cache [vrf vrf-name] [gateway]

• vrf-name—The name of the VRF instance on which the command

operates. If no VRF parameter is given, counters for the default (global)

router instance is cleared.

•gateway — Removes the dynamic entries of type gateway, as well.

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

The VRF identified in the parameter must have been previously created or an

error is returned.

Layer 3 Routing Commands 1197

Example

The following example clears all entries ARP of type dynamic, including

gateway, from ARP cache.

console#clear arp-cache gateway

clear arp-cache management

Use the clear arp-cache management command to clear all entries that show

as management arp entries in the show arp command.

Syntax

clear arp-cache management

Default Configuration

This command has no default configuration.

Command Mode

Privileged Exec mode

User Guidelines

This command has no user guidelines.

Example

In the example below, out-of-band management entries are shown, for

example, those from the out-of-band interface.

console#show arp

Age Time (seconds)............................. 1200

Response Time (seconds).................... 1

Retries................................................... 4

Cache Size............................................ 6144

Dynamic Renew Mode....................... Disable

Total Entry Count Current / Peak...... 0 / 0

Static Entry Count Configured / Active / Max.. 0 / 0 / 128

IP Address MAC Address Interface Type Age

--------------- ----------------- -------------- -------- -----------

10.27.20.241 001A.A0FF.F662 Management Dynamic n/a

10.27.20.243 0019.B9D1.29A3 Management Dynamic n/a

console#clear arp-cache management

Layer 3 Routing Commands 1198

ip local-proxy-arp

Use the ip local proxy-arp command in Interface Configuration mode to

enable proxying of ARP requests. This allows the switch to respond to ARP

requests within a subnet where routing is not enabled.

Syntax

ip local-proxy-arp

no ip local-proxy-arp

Default Configuration

Proxy arp is disabled by default.

Command Mode

Interface (VLAN) Configuration

User Guidelines

This command has no user guidelines.

Example

This example enables proxying of ARP requests on VLAN 10.

console(config-if-Gi1/0/1)#interface vlan 10

console(config-if-vlan10)#ip local-proxy-arp

ip proxy-arp

Use the ip proxy-arp command in Interface Configuration mode to enable

proxy ARP on a router interface. Without proxy ARP, a device only responds

to an ARP request if the target IP address is an address configured on the

interface where the ARP request arrived. With proxy ARP, the device may also

respond if the target IP address is reachable. The device only responds if all

next hops in its route to the destination are through interfaces other than the

interface that received the ARP request. Use the no form of the command to

disable proxy ARP on a router interface.

Layer 3 Routing Commands 1199

Syntax

ip proxy-arp

no ip proxy-arp

Default Configuration

Enabled is the default configuration.

Command Mode

Privileged Exec mode, Global Configuration mode and all Configuration

submodes

User Guidelines

The ip proxy-arp command is not available in interface range mode.

Example

The following example enables proxy arp for VLAN 15.

(config)#interface vlan 15

console(config-if-vlan15)#ip proxy-arp

show arp

Use the show arp command to display all entries in the Address Resolution

Protocol (ARP) cache. The displayed results are not the total ARP entries. To

view the total ARP entries, the operator should view the show ARP results.

Syntax

show arp [vrf vrf-name][brief]

• vrf-name—The name of the VRF instance on which the command

operates. If no VRF parameter is given, information for the default

(global) router instance is shown.

• brief — Display ARP parameters.

Default Configuration

This command has no default configuration.

Layer 3 Routing Commands 1200

Command Mode

User Exec and Privileged Exec modes, Global Configuration mode and all

Configuration submodes

User Guidelines

The show arp command will display static (user-configured) ARP entries

regardless of whether they are reachable over an interface or not.

The VRF identified in the parameter must have been previously created or an

error is returned.

The VRF parameter is only available on the N3000/N3100/N4000 series

switches.

Example

The following example shows show arp command output.

console#show arp

Static ARP entries are only active

when the IP address is reachable on a local subnet

Age Time (seconds)............................. 1200

Response Time (seconds)........................ 1

Retries........................................ 4

Cache Size..................................... 6144

Dynamic Renew Mode............................ Disable

Total Entry Count Current / Peak.............. 0 / 0

Static Entry Count Configured / Active / Max .. 1 / 0 / 128

IP Address MAC Address Interface Type Age

---------- -------------- --------- ------ -------

1.1.1.3 0000.0000.0022 n/a Static n/a

Layer 3 Routing Commands 1201

Bidirectional Forwarding Detection

Commands

Dell EMC Networking N3000/N3100/N4000 Series Switches

Bidirectional Forwarding Detection (BFD) verifies bidirectional connectivity

between forwarding engines, which can be a single hop or multiple hops away.

The protocol works over any underlying transmission mechanism and

protocol layer with a wide range of detection times, especially in scenarios

where fast failure detection is required in data plane level for multiple

concurrent sessions.

Use the following commands to configure Bidirectional Forwarding Detection

commands (BFD).

Commands in this Section

This section explains the following commands:

feature bfd

Use this command to enable BFD on the router. Use the no form of the

command to disable BFD and clear any dynamic state.

Syntax

feature bfd

no feature bfd

Default Configuration

BFD is not enabled by default.

feature bfd ip ospf bfd

bfd echo ipv6 ospf bfd

bfd interval neighbor fall-over bfd

bfd slow-timer show bfd neighbor

Layer 3 Routing Commands 1202

Command Mode

Global Configuration

User Guidelines

BFD supports fast detection of forwarding failures on a routing interface.

BFD provides an advantage for forwarding plane failure detection over that

provided by the individual protocols, each having different hello protocol

timers and detection periods.

The BFD feature provides notification to BGP or OSPF when an interface is

detected to not be in a forwarding state. No other routing protocols are

supported.

BFD is supported in the default VRF only.

BFD should be configured on routed interfaces only. BFD should not be

configured on mirrored ports or on interfaces enabled for IEEE 802.1x.

BFD is supported across link aggregation groups, but does not detect

individual LAG member link failure.

BFD does not operate on the out-of-band interface.

The no feature bfd command does not remove administrator-supplied

configuration.

A BFD session is created per VLAN routing interface. On trunk ports,

multiple BFD sessions may be established.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console# configure

console(config)# feature bfd

console(config)# exit

bfd echo

This command enables BFD echo mode on an interface. Use the no form of

the command to disable BFD echo mode.

Layer 3 Routing Commands 1203

Syntax

bfd echo

no bfd echo

Default Configuration

BFD echo mode is not enabled by default.

Command Mode

Interface (VLAN) Configuration and Interface (VLAN) range mode.

User Guidelines

BFD echo mode enables fast sending and turnaround of BFD echo packets.

Use the bfd slow-timer command to adjust the sending of BFD control plane

packets when BFD echo mode is enabled.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console# configure

console(config)# interface vlan 10

console(config-if-vlan10)# bfd echo

bfd interval

This command configures BFD session parameters for a VLAN routing

interface. It overwrites any BFD configuration present on the interface. Use

the no form of the command to return the parameters to their default values.

Syntax

bfd interval transmit-interval min_rx minimum-receive-interval multiplier

detection-time-multiplier

no bfd interval

Layer 3 Routing Commands 1204

•

transmit-interval

—Refers to the desired minimum transmit interval,

which is the minimum interval the user wants to use while transmitting

BFD control packets. It is represented in milliseconds. Its range is 100 ms

to 1000 ms with a change granularity of 100 ms and with a default value of

100 ms.

•

minimum-receive-interval

—Refers to the required minimum receive

interval, which is the minimum interval at which the system can receive

BFD control packets. It is represented in milliseconds. Its range is 100 ms

to 1000 ms with a granularity of 100 ms and with a default value of 100 ms.

•

detection-time-multiplier

—Specifies the number of BFD control packets

which, if missed consecutively, will cause a session to be declared down. Its

range is 3 to 50 with a default value of 3.

Default Configuration

The default transmit-interval is 100ms.

The default minimum-receive-interval is 100ms.

The default detection-time-multiplier is 3.

Command Mode

Interface (VLAN) mode.

User Guidelines

There are no user guidelines for this command.

Command History

Introduced in version 6.2.0.1 firmware.

Example

In this example, VLAN 100 is created, assigned an IP address to make it a

routable interface, and the bfd interval is set to 100 ms, the minimum receive

interface is 100 ms, and the multiplier is 5.

console#configure

console(config)#vlan 100

console(config-vlan100)#exit

console(config)#interface vlan 100

console(config-if-vlan100)#ip address 192.168.10.11 /24

Layer 3 Routing Commands 1205

console(config-if-vlan100)#bfd interval 100 min_rx 100 multiplier 5

console(config-if-vlan100)#exit

console(config)#interface te1/0/1

console(config-if-Te1/0/1)#switchport mode trunk

bfd slow-timer

This command configures the BFD periodic slow transmission interval for

BFD Control packets. Use the no form of the command to return the slow

transmission interval value to the default.

Syntax

bfd slow-timer receive-interval

no bfd slow-timer

• receive-interval—The slow transmission interval. Range 1000–30000

milliseconds.

Default Configuration

The default receive-interval is 2000 ms.

Command Mode

Global Configuration mode

User Guidelines

The argument receive-interval refers to the slow transmission interval for

BFD Control packets. This timer is only used when the BFD echo function is

enabled. When the BFD echo mode is enabled, the rate of BFD control

packets is kept low as the echo function is used to detect forwarding failures.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console# configure

console(config)# bfd slow-timer 1000

Layer 3 Routing Commands 1206

ip ospf bfd

Use the ip ospf bfd command to enable sending of BFD events to OSPF on a

VLAN routing interface. Use the no form of the command to disable sending

of BFD events.

Syntax

ip ospf bfd

no ip ospf bfd

Default Configuration

BFD is not enabled by default.

Command Mode

Interface (VLAN) Configuration mode

User Guidelines

BFD processing notifies OSPF of L3 connectivity issues with the peer. The

interface must be a VLAN interface enabled for routing.

BFD must also be enabled in OSPF router configuration mode in order to

BFD processing to occur.

Command History

Introduced in version 6.3.0.1 firmware.

Example

The following example

console#configure

console(config)#ip routing

console(config)#interface vlan 3

console(config-if-vlan3)#ip address 192.168.0.1 /24

console(config-if-vlan3)#ip ospf area 0

console(config-if-vlan3)#ip ospf bfd

onsole(config-if-vlan3)#exit

console(config)#router ospf

console(config-router)#bfd

Layer 3 Routing Commands 1207

ipv6 ospf bfd

Use the ipv6 ospf bfd command to enable sending of BFD events to OSPF on

a VLAN routing interface. Use the no form of the command to disable

sending of BFD events.

Syntax

ipv6 ospf bfd

no ipv6 ospf bfd

Default Configuration

BFD is not enabled by default.

Command Mode

Interface (VLAN) Configuration mode

User Guidelines

BFD processing notifies OSPFv3 of level 3 connectivity issues with the peer.

The interface must be a VLAN interfaced enabled for routing.

BFD must also be enabled in OSPFv3 router configuration mode for BFD

processing to occur.

Command History

Introduced in version 6.3.0.1 firmware.

Example

console#configure

console(config)#ipv6 unicast-routing

console(config)#interface vlan 3

console(config-if-vlan3)#ipv6 address fe80::1214

console(config-if-vlan3)#ipv6 ospf area 0

console(config-if-vlan3)#ipv6 ospf bfd

onsole(config-if-vlan3)#exit

console(config)#ipv6 router ospf

console(config-router6)#bfd

Layer 3 Routing Commands 1208

neighbor fall-over bfd

This command enables BFD support for a BGP neighbor. Use the no form of

the command to disable BFD for the specified BGP neighbor.

Syntax

neighbor{ ipv4-address | ipv6-address [interface vlan vlan-id ] fall-over bfd

no neighbor { ipv4-address | ipv6-address [interface vlan vlan-id ] fall-over

bfd interval

• ipv4-address—The IPv4 address of a configured neighbor reachable over a

VLAN routing interface expressed in dotted quad notation.

• ipv6-address—The IPv6 address of a configured neighbor reachable over

an IPv6 VLAN routing interface.

•vlan-id—If specified, the VLAN on which the IPv6 address is configured.

Default Configuration

No BFD neighbors are configured by default.

Command Mode

Router BGP Configuration mode

User Guidelines

There are no user guidelines for this command.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config)# router bgp

console(config-router)# neighbor 172.16.11.6 fall-over bfd

show bfd neighbor

This command displays the neighbors for which BFD has established

adjacencies.

Layer 3 Routing Commands 1209

Syntax

show bfd neighbor [details] [ip-address]

•

details

—Display additional information regarding each BFD neighbor,

including sent and received message counts.

•

ip-address

—The IPv4 or IPv6 address of a BFD neighbor. Limits the

output to the specific neighbor.

Default Configuration

There is no default configuration for this command.

Command Mode

User mode, Privileged Exec mode, Global Configuration mode, all show

modes

User Guidelines

The local address displayed in the output is the IP address of the interface

through which the neighbor is connected.

Update is displayed in the format dd hh:mm:ss where:

• dd is days

• hh is hours

• mm is minutes

• ss is seconds

The operational intervals are the intervals used as a result of negotiation with

the BFD link partner.

The following information is displayed.

Parameters Description

Our IP address The current IP address.

Neighbor IP address The IP address of the active BFD neighbor.

State The current state, either Up or Down.

Interface The current interface.

Uptime The amount of time the interface has been up.

Layer 3 Routing Commands 1210

Command History

Introduced in version 6.2.0.1 firmware.

Example

console# show bfd neighbors

Local Address Neighbor Uptime State Interface

------------- -------------- ----------- ------ ---------

172.16.10.1 172.16.10.20 02:18:49 Up VLAN10

10.1.10.1 10.1.10.20 01:15:25 Up Gi1/0/5

fdf8:f53b::53 fdf8:f53b::58 00:38:11 Up Gi1/0/1

console# show bfd neighbors details

Registered Protocol The protocol from which the BFD session was initiated and

that is registered to receive events from BFD. (for example,

BGP).

Local Diag The diagnostic state specifying the reason for the most

recent change in the local session state.

Demand mode Indicates if the system wishes to use Demand mode.

Note: Demand mode is not supported in Dell 6.0 8.0,

Minimum transmit

interval

The minimum interval to use when transmitting BFD

control packets.

Actual TX Interval The transmitting interval being used for control packets.

Actual TX Echo interval The transmitting interval being used for echo packets.

Minimum receive

interval

The minimum interval at which the system can receive

BFD control packets.

Detection interval

multiplier

The number of BFD control packets that must be missed in

a row to declare a session down.

My discriminator Unique Session Identifier for Local BFD Session.

Your discriminator Unique Session Identifier for Remote BFD Session.

Tx Count The number of transmitted BFD packets.

Rx Count The number of received BFD packets.

Drop Count The number of dropped packets.

Parameters Description

Layer 3 Routing Commands 1211

Local IP address............................... 2.1.1.1

Neighbor IP address............................ 2.1.1.2

State.......................................... Up

Interface...................................... VLAN 10

Uptime......................................... 0 00:01:54

Registered Protocol............................ BGP

Local Diag..................................... 0

Demand mode.................................... FALSE

Minimum transmit interval...................... 100 ms

Minimum receive interval....................... 100 ms

Operational transmit interval.................. 100 ms

Operational transmit echo interval............. 0 ms

Detection interval multiplier.................. 3

Local discriminator............................ 1

Remote discriminator........................... 1

Tx Count....................................... 105

Rx Count....................................... 107

Drop Count..................................... 0

Layer 3 Routing Commands 1212

Border Gateway Protocol

Commands

Dell EMC Networking N3000/N3100/N4000 Series Switches

This section describes the commands you use to view and configure Border

Gateway Protocol (BGP), which is an exterior gateway routing protocol that

you use to route traffic between autonomous systems. The BGP CLI

commands are available in the N3000/N3100/N4000 Series switches. On the

N3000 Series switches, the BGP specific firmware must be loaded (e.g.,

N3000_BGPvA.B.C.D.stk.

CAUTION: The commands in this section are in one of three functional groups.

• Show commands display switch settings, statistics, and other information.

• Configuration commands configure features and options of the switch. For

every configuration command, there is a show command that displays the

configuration setting.

• Clear commands reset part of the protocol state.

Commands in this Section

This section explains the following commands:

router bgp maximum-paths (IPv6

Address Family

Configuration)

redistribute (BGP)

address-family maximum-paths ibgp (BGP

Router Configuration)

redistribute (BGP IPv6)

address-family ipv4 vrf maximum-paths ibgp (IPv6

Address Family

Configuration)

route-target

address-family ipv6 neighbor activate set extcommunity rt

address-family vpnv4

unicast

neighbor advertisement-

interval (BGP Router

Configuration)

set extcommunity soo

Layer 3 Routing Commands 1213

aggregate-address neighbor advertisement-

interval (IPv6 Address

Family Configuration)

show bgp ipv6

bgp aggregate-different-

meds (BGP Router

Configuration)

neighbor allowas-in show bgp ipv6 aggregate-

address

bgp aggregate-different-

meds (IPv6 Address Family

Configuration)

neighbor connect-retry-

interval

show bgp ipv6 community

bgp always-compare-med neighbor default-originate

(BGP Router

Configuration)

show bgp ipv6 community-

list

bgp client-to-client

reflection (BGP Router

Configuration)

neighbor default-originate

(IPv6 Address Family

Configuration)

show bgp ipv6 listen range

bgp client-to-client

reflection (IPv6 Address

Family Configuration)

neighbor description show bgp ipv6 neighbors

bgp cluster-id neighbor ebgp-multihop show bgp ipv6 neighbors

advertised-routes

bgp default local-preference neighbor filter-list (BGP

Router Configuration)

show bgp ipv6 neighbors

policy

bgp fast-external-fallover neighbor filter-list (IPv6

Address Family

Configuration)

show bgp ipv6 neighbors

received-routes

bgp fast-internal-fallover neighbor inherit peer show bgp ipv6 statistics

bgp listen neighbor local-as show bgp ipv6 summary

bgp log-neighbor-changes neighbor maximum-prefix

(BGP Router

Configuration)

show bgp ipv6 update-group

bgp maxas-limit neighbor maximum-prefix

(IPv6 Address Family

Configuration)

show bgp ipv6 route-

reflection

bgp router-id neighbor next-hop-self

(BGP Router

Configuration)

show ip bgp

Layer 3 Routing Commands 1214

clear ip bgp neighbor next-hop-self

(IPv6 Address Family

Configuration)

show ip bgp aggregate-

address

clear ip bgp counters neighbor password show ip bgp community

default-information

originate (BGP Router

Configuration)

neighbor prefix-list (BGP

Router Configuration)

show ip bgp community-list

default-information

originate (IPv6 Address

Family Configuration)

neighbor prefix-list (IPv6

Address Family

Configuration)

show ip bgp extcommunity-

list

default metric (BGP Router

Configuration)

neighbor remote-as show ip bgp listen range

default metric (IPv6 Address

Family Configuration)

neighbor remove-private-as show ip bgp neighbors

distance neighbor rfc5549-support show ip bgp neighbors

advertised-routes

distance bgp (BGP Router

Configuration)

neighbor route-map (BGP

Router Configuration)

show ip bgp neighbors

received-routes

distance bgp (IPv6 Address

Family Configuration)

neighbor route-map (IPv6

Address Family

Configuration)

show ip bgp neighbors

policy

distribute-list prefix in neighbor route-reflector-

client (BGP Router

Configuration)

show ip bgp route-reflection

distribute-list prefix out

(BGP Router

Configuration)

neighbor route-reflector-

client (IPv6 Address Family

Configuration)

show ip bgp statistics

distribute-list prefix out

(IPv6 Address Family

Configuration)

neighbor send-community

(BGP Router

Configuration)

show ip bgp summary

enable neighbor send-community

(IPv6 Address Family

Configuration)

show ip bgp template

ip as-path access-list neighbor shutdown show ip bgp traffic

Layer 3 Routing Commands 1215

router bgp

Use the router bgp command to enable BGP and identify the autonomous

system (AS) number for the router. Only a single instance of BGP can be run

and the router can only belong to a single AS.

Syntax

router bgp as-number

no router bgp as-number

• as-number—The router’s autonomous system number is asplain format.

Dell EMC Networking BGP supports two byte AS numbers, in the range of

0-65535.

Default Configuration

By default, BGP is inactive.

Command Mode

Global Configuration mode

User Guidelines

The no router bgp command disables BGP and all BGP configurations revert

to default values. Alternatively, the administrator can use the no enable

command in BGP router configuration mode to disable BGP globally without

clearing the BGP configuration.

ip bgp-community new-

format

neighbor timers show ip bgp update-group

ip bgp fast-external-fallover neighbor update-source show ip bgp vpn4

ip community-list network (BGP Router

Configuration)

show router-capability

ip extcommunity-list network (IPv6 Address

Family Configuration)

template peer

match extcommunity redistribute (BGP) timers bgp

maximum-paths (BGP

Router Configuration)

–

Layer 3 Routing Commands 1216

ASNs 0, 56320–64511, and 65535 are reserved and cannot be used.

Command History

Introduced in version 6.2.0.1 firmware.

Example

The following example creates a BGP routing instances and enables BGP

routing for AS 4324.

console(config)#router bgp 4324

address-family

Use the address-family command in peer template configuration mode to

configure policy parameters within a peer template to be applied to a specific

address family. To delete all policy commands for an address family in a peer

template, use the no form of this command

Syntax

address-family { ipv4 | ipv6 }

no address-family { ipv4 | ipv6 }

•ipv4—Configure policy parameters to be applied to IPv4 routes.

•ipv6—Configure policy parameters to be applied to IPv6 routes.

Default Configuration

No peer templates are configured by default.

Command Mode

Peer Template Configuration mode

User Guidelines

This command enters address family configuration mode within the peer

template. Policy commands configured within this mode apply to the address

family. The following commands can be added to a peer template in address

family configuration mode:

• activate

Layer 3 Routing Commands 1217

•advertisement-interval seconds

• default-originate

•filter-list as-path-list-number {in | out}

•maximum-prefix { maximum | unlimited } [threshold]

• next-hop-self

•prefix-list prefix-list-name { in | out }

• remove-private-as

• route-reflector-client

•route-map map-name { in | out }

•send-community

The activate command is only available in address-family ipv6 mode.

If an IPv6 peer inherits a template that specifies address family ipv4

parameters, those parameters are ignored.

Command History

Introduced in version 6.2.0.1 firmware.

Example

In this example, the peer template AGGR sets the keepalive timer to 3

seconds and the hold timer to 9 seconds, allows communities to be sent for

both IPv4 and IPv6 routes, and configures different inbound and outbound

route maps for IPv4 and IPv6. Two neighbors, 172.20.1.2 and 172.20.2.2,

inherit these parameters from the template.

console(config)# router bgp 65000

console(config-router)# neighbor 172.20.1.2 remote-as 65001

console(config-router)# neighbor 172.20.2.2 remote-as 65001

console(config-router)# template peer AGGR

console(config-rtr-tmplt)# timers 3 9

console(config-rtr-tmplt)# address-family ipv4

console(config-rtr-tmplt-af)# send-community

console(config-rtr-tmplt-af)# route-map RM4-IN in

console(config-rtr-tmplt-af)# route-map RM4-OUT out

console(config-rtr-tmplt-af)# exit

console(config-rtr-tmplt)# address-family ipv6

console(config-rtr-tmplt-af)# send-community

console(config-rtr-tmplt-af)# route-map RM6-IN in

console(config-rtr-tmplt-af)# route-map RM6-OUT out

console(config-rtr-tmplt-af)# exit

Layer 3 Routing Commands 1218

console(config-rtr-tmplt)# exit

console(config-router)# neighbor 172.20.1.2 inherit peer AGGR

console(config-router)# neighbor 172.20.2.2 inherit peer AGGR

console(config-router)# address-family ipv6

console(config-router)# neighbor 172.20.1.2 activate

console(config-router)# neighbor 172.20.2.2 activate

address-family ipv4 vrf

Use the address-family ipv4 vrf command to enter IPv4 VRF configuration

mode for a particular VRF instance to configure the BGP VRF parameters.

Use the no form of this command to delete the IPv4 VRF configuration.

Syntax

address-family ipv4 vrf vrf-name

no address-family ipv4 vrf vrf-name

• vrf-name — The VRF instance name.

Default Configuration

There is no default configuration.

Command Mode

BGP Router Configuration mode

User Guidelines

Commands entered in this mode enable peering with BGP neighbors in this

VRF instance. All the neighbor specific commands are given in this mode as

well.

VRF configuration is disabled by default.

Command History

Introduced in version 6.3.0.1 firmware.

Example

console(config-router)# address-family ipv4 vrf Red

Layer 3 Routing Commands 1219

address-family ipv6

Use the address-family ipv6 command to enter IPv6 family configuration

mode to specify IPv6 configuration parameters. Use the no form of the

command to delete all IPv6 configuration.

Syntax

address-family ipv6

no address-family ipv6

Default Configuration

By default, the exchange of IPv6 routes is disabled.

Command Mode

BGP Router Configuration mode

User Guidelines

The address-family ipv6 command moves the CLI to IPv6 address family

configuration mode. Commands entered in this mode can be used to enable

exchange of IPv6 routes over IPv6 or IPv4 peering sessions, specify IPv6

prefixes to be originated, and configure inbound and outbound policies to be

applied to IPv6 routes. The no version of this command clears all IPv6 address

family configuration

ASNs 0, 56320–64511, and 65535 are reserved cannot be used.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config-router)# address-family ipv6

address-family vpnv4 unicast

Use the address-family vpnv4 unicast command to configure a BGP routing

session to advertise VPN IPv4 prefixes.

Use the no form of this command to delete the VPN IPv4 configuration.

Layer 3 Routing Commands 1220

Syntax

address-family vpn4 unicast

no address-family vpn4 unicast

Default Configuration

VPN-IPv4 address family mode is not configured by default.

Command Mode

Router BGP Configuration mode

User Guidelines

When an iBGP neighbor is configured in this mode, each VPN-IPv4 prefix is

made globally unique by the addition of an 8-byte route distinguisher (RD).

Only unicast prefixes are advertised to the iBGP neighbor. To exit from VPN-

IPv4 address family mode, use the exit command.

This command enters VPN-IPv4 address family configuration mode. All

neighbor commands available in IPv4 Address Family configuration mode are

applicable to this mode as well.

Two additional options to the neighbor command are available in VPN-IPv4

address family configuration mode. See the bold keywords in the commands

below for the additions:

• neighbor ip-address activate

• neighbor ip-address send-community extended

Command History

Introduced in version 6.3.0.1 firmware.

Example

The following example shows how to enter the VPN-IPv4 address family

mode and to distribute VPN4-IPv4 addresses to a neighbor with the extended

community attribute:

console(config)# router bgp 10

console(config-router)# neighbor 1.1.1.1 remote-as 5000

console(config-router)# address-family vpnv4 unicast

console(config-router-af)# neighbor 1.1.1.1 activate

Layer 3 Routing Commands 1221

console(config-router-af)# neighbor 1.1.1.1 send-community extended

console(config-router-af)# exit

console(config-router)#

aggregate-address

Use the aggregate-address command to configure a summary address for BGP.

Syntax

aggregate-address { ipv4-prefix mask | ipv6-prefix/prefix-length } [as-set]

[summary-only]

no aggregate-address { ipv4-prefix mask | ipv6-prefix/prefix-length } [as-set]

[summary-only]

•

ipv4-prefix mask

—A summary prefix and mask in dotted-quad notation.

The default route (0.0.0.0 0.0.0.0) cannot be configured as an aggregate-

address. The mask cannot be a 32-bit mask (255.255.255.255). The

combination of prefix and mask must be a valid IPv4 unicast destination

prefix

•

ipv6-prefix

—An IPv6 network prefix. This argument must be in the form

documented in RFC 2373 where the address is specified in hexadecimal

using 16-bit values between 0x00 and 0xff and separated by colons.

Counters are cleared only for the matching prefixes.

•

prefix-length

—The length of the IPv6 prefix given as part of the ipv6-

prefix. This is required if a prefix is specified. A decimal value in the range

0 to 128 that indicates how many of the high-order contiguous bits of the

address comprise the prefix (the network portion of the address) in /length

format. A slash must precede the decimal value in /length format.

•as-set— If the as-set option is configured, the aggregate is advertised with

a non-empty AS_PATH. (Normally, the aggregate is advertised with an

empty AS path and the ATOMIC_AGGREGATE attribute.) If the

AS_PATH of all contained routes is the same, the AS_PATH of the

aggregate is the AS_PATH of the contained routes. Otherwise, if the

contained routes have different AS_PATHs, the AS_PATH attribute

includes an AS_SET with each of the AS numbers listed in the AS PATHs

of the aggregated routes. If the as-set option is not configured, the

aggregate is advertised with an empty AS_PATH.

Layer 3 Routing Commands 1222

•summary-only

–

When specified, the more-specific routes within the

aggregate address are not advertised to neighbors.

Default Configuration

No aggregate addresses are configured by default. Unless the options are

specified, the aggregate is advertised with the ATOMIC_AGGREGATE

attribute and an empty AS path, and the more specific routes are advertised

along with the aggregate.

Command Mode

• BGP Router Configuration mode

• IPv6 Address Family Configuration mode

User Guidelines

To be considered a match for an aggregate address, a prefix must be more

specific (i.e., have a longer prefix length) than the aggregate address. A prefix

whose prefix length equals the length of the aggregate address is not

considered a match.

When BGP originates a summary address, it installs a reject route in the

common routing table for the summary prefix. Any received packets that

match the summary prefix but not a more specific route match the reject

route and are dropped.

BGP accepts up to 128 summary addresses for each address family.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config-router)#aggregate-address 10.27.21.0 255.255.255.0

bgp aggregate-different-meds (BGP Router

Configuration)

Use the bgp aggregate-different-meds command to control the aggregation of

routes with different multi-exit discriminator (MED) attributes. By default,

BGP only aggregates routes that have the same MED value.

Layer 3 Routing Commands 1223

Syntax

bgp aggregate-different-meds

no bgp aggregate-different-meds

Default Configuration

By default, all the routes aggregated by a given aggregate address must have

the same MED value.

Command Mode

BGP Router Configuration mode

User Guidelines

When this command is used, the path for an active aggregate address is

advertised without an MED attribute and the MED attribute is not

considered in aggregating routes. When this command is not used, if

multiple routes match an aggregate address, but have different MEDs, the

aggregate takes the MED of the first matching route and any other matching

prefix with the same MED is included in the aggregate. Matching prefixes

with different MEDs are not considered part of the aggregate and continue to

be advertised as individual routes.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config-router)#bgp aggregate-different-meds

bgp aggregate-different-meds (IPv6 Address

Family Configuration)

Use the bgp aggregate-different-meds command to allow IPv6 routes with

different MEDs to be aggregated.

Syntax

bgp aggregate-different-meds

Layer 3 Routing Commands 1224

no bgp aggregate-different-meds

Default Configuration

By default, all the routes aggregated by a given aggregate address must have

the same MED value.

Command Mode

IPv6 Address Family Configuration mode

User Guidelines

When this command is used, the path for an active aggregate address is

advertised without an MED attribute and the MED attribute is not

considered in aggregating routes. When this command is not used, if

multiple routes match an aggregate address, but have different MEDs, the

aggregate takes the MED of the first matching route and any other matching

prefix with the same MED is included in the aggregate. Matching prefixes

with different MEDs are not considered part of the aggregate and continue to

be advertised as individual routes.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config-router-af)#bgp aggregate-different-meds

bgp always-compare-med

Use this command to compare MED values during the decision process in

paths received from different autonomous systems. To revert to the default

behavior, only comparing MED values from paths received from neighbors in

the same AS, use the no form of this command.

Syntax

bgp always-compare-med

no bgp aways-compare-med

Layer 3 Routing Commands 1225

Default Configuration

By default, all routes aggregated by a given aggregate address must have the

same MED value.

Command Mode

• BGP Router Configuration mode

• IPv6 Address Family Configuration mode

User Guidelines

The MED is a 32-bit integer, commonly set by an external peer to indicate

the internal distance to a destination. The decision process compares MED

values to prefer paths that have a shorter internal distance. Since different

autonomous systems may use different internal distance metrics or have

different policies for setting the MED, the decision process normally does not

compare MED values in paths received from peers in different autonomous

systems. This command allows you to force BGP to compare MEDs regardless

of if paths are received from a common AS.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config-router)#bgp always-compare-med

bgp client-to-client reflection (BGP Router

Configuration)

Use the bgp client-to-client reflection command to enable client-to-client

reflection. By default, a route reflector reflects routes received from its clients

to its other clients. However, if a route reflector’s clients have a full iBGP

mesh, the route reflector does not reflect to the clients.

Syntax

bgp client-to-client reflection

no bgp client-to-client reflection

Layer 3 Routing Commands 1226

Default Configuration

Client-to-client reflection is enabled by default when a router is configured as

a route reflector.

Command Mode

BGP Router Configuration mode

User Guidelines

Route reflection can change the routes clients select. A route reflector only

reflects those routes it selects as best routes. Best route selection can be

influenced by the IGP metric of the route to reach the BGP next hop. Since a

client’s IGP distance to a given next hop may differ from route reflector’s IGP

distance, a route reflector may not re-advertise a route a client would have

selected as best in the absence of route reflection. One way to avoid this

effect is to fully mesh the clients within a cluster. When clients are fully

meshed, there is no need for the cluster’s route reflectors to reflect client

routes to other clients within the cluster. When client-to-client reflection is

disabled, a route reflector continues to reflect routes from non-clients to

clients and from clients to non-clients.

In BGP Router Configuration mode, this command only affects

advertisement of IPv4 routes. The same command is available in Address-

Family IPv6 Configuration mode for IPv6 routes.

Command History

Introduced in version 6.2.0.1 firmware.

Example

console(config-router)#bgp client-to-client reflection

bgp client-to-client reflection (IPv6 Address

Family Configuration)

Use the bgp client-to-client reflection command to enable client-to-client

reflection. By default, a route reflector reflects routes received from its clients

to its other clients. However, if a route reflector’s clients have a full iBGP

mesh, the route reflector does not reflect to the clients.

Layer 3 Routing Commands 1227