Cisco 3845 - Security Bundle Router Guida rapida

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

Cisco ME 3800X and 3600X Switch

Software Configuration Guide

Cisco IOS Release 12.2(52)EY

October 2010

Text Part Number: OL-23400-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL

STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT

WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT

SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE

OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH

ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT

LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF

DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,

WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO

OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at

www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership

relationship between Cisco and any other company. (1005R)

Cisco ME 3800X and 3600X Switch Software Configuration Guide

iii

Cisco ME 3800X and 3600X Switch Software Configuration Guide

OL-23400-01

CONTENTS

Preface xxxv

Audience xxxv

Purpose xxxv

Conventions xxxv

Related Publications xxxvi

Obtaining Documentation and Submitting a Service Request xxxvii

CHAPTER

1Overview 1-1

Software Licenses and Features 1-1

Features 1-2

Performance Features 1-2

Management Options 1-3

Manageability Features 1-3

Availability Features 1-5

VLAN Features 1-5

Security Features 1-6

Switch Security 1-6

Network Security 1-6

Quality of Service and Class of Service Features 1-7

Layer 2 Virtual Private Network Services 1-7

Layer 3 Features 1-8

Layer 3 VPN Services 1-8

Monitoring Features 1-9

Feature Support per License 1-9

Where to Go Next 1-11

CHAPTER

2Using the Command-Line Interface 2-1

Understanding Command Modes 2-1

Understanding the Help System 2-3

Understanding Abbreviated Commands 2-3

Understanding no and default Forms of Commands 2-4

Understanding CLI Error Messages 2-4

Using Command History 2-4

Contents

Cisco ME 3800X and 3600X Switch Software Configuration Guide OL-23400-01

Changing the Command History Buffer Size 2-5

Recalling Commands 2-5

Disabling the Command History Feature 2-5

Using Editing Features 2-6

Enabling and Disabling Editing Features 2-6

Editing Commands through Keystrokes 2-6

Editing Command Lines that Wrap 2-8

Searching and Filtering Output of show and more Commands 2-8

Accessing the CLI 2-9

Accessing the CLI through a Console Connection or through Telnet 2-9

CHAPTER

3Assigning the Switch IP Address and Default Gateway 3-1

Understanding the Boot Process 3-1

Initial Configuration 3-2

Assigning Switch Information 3-3

Default Switch Information 3-3

Understanding DHCP-Based Autoconfiguration 3-4

DHCP Client Request Process 3-4

Understanding DHCP-based Autoconfiguration and Image Update 3-5

DHCP Autoconfiguration 3-5

DHCP Auto-Image Update 3-5

Limitations and Restrictions 3-6

Configuring DHCP-Based Autoconfiguration 3-6

DHCP Server Configuration Guidelines 3-7

Configuring the TFTP Server 3-7

Configuring the DNS 3-8

Configuring the Relay Device 3-8

Obtaining Configuration Files 3-9

Example Configuration 3-10

Configuring the DHCP Auto Configuration and Image Update Features 3-11

Configuring DHCP Autoconfiguration (Only Configuration File) 3-12

Configuring DHCP Auto-Image Update (Configuration File and Image) 3-13

Configuring the Client 3-14

Manually Assigning IP Information 3-15

Checking and Saving the Running Configuration 3-16

Modifying the Startup Configuration 3-17

Default Boot Configuration 3-18

Automatically Downloading a Configuration File 3-18

Specifying the Filename to Read and Write the System Configuration 3-18

Contents

Cisco ME 3800X and 3600X Switch Software Configuration Guide

OL-23400-01

Booting Manually 3-19

Booting a Specific Software Image 3-19

Controlling Environment Variables 3-20

Scheduling a Reload of the Software Image 3-21

Configuring a Scheduled Reload 3-22

Displaying Scheduled Reload Information 3-23

CHAPTER

4Configuring Cisco IOS Configuration Engine 4-1

Understanding Cisco Configuration Engine Software 4-1

Configuration Service 4-2

Event Service 4-3

NameSpace Mapper 4-3

What You Should Know About the CNS IDs and Device Hostnames 4-3

ConfigID 4-3

DeviceID 4-4

Hostname and DeviceID 4-4

Using Hostname, DeviceID, and ConfigID 4-4

Understanding Cisco IOS Agents 4-5

Initial Configuration 4-5

Incremental (Partial) Configuration 4-6

Synchronized Configuration 4-6

Configuring Cisco IOS Agents 4-6

Enabling Automated CNS Configuration 4-6

Enabling the CNS Event Agent 4-7

Enabling the Cisco IOS CNS Agent 4-8

Enabling an Initial Configuration 4-9

Enabling a Partial Configuration 4-12

Upgrading Devices with Cisco IOS Image Agent 4-13

Prerequisites for the CNS Image Agent 4-13

Restrictions for the CNS Image Agent 4-13

Displaying CNS Configuration 4-14

CHAPTER

5Administering the Switch 5-1

Managing the System Time and Date 5-1

Understanding the System Clock 5-1

Understanding Network Time Protocol 5-2

Configuring NTP 5-3

Default NTP Configuration 5-4

Configuring NTP Authentication 5-4

Contents

Cisco ME 3800X and 3600X Switch Software Configuration Guide OL-23400-01

Configuring NTP Associations 5-5

Configuring NTP Broadcast Service 5-6

Configuring NTP Access Restrictions 5-8

Configuring the Source IP Address for NTP Packets 5-10

Displaying the NTP Configuration 5-11

Configuring Time and Date Manually 5-11

Setting the System Clock 5-11

Displaying the Time and Date Configuration 5-12

Configuring the Time Zone 5-12

Configuring Summer Time (Daylight Saving Time) 5-13

Configuring a System Name and Prompt 5-14

Default System Name and Prompt Configuration 5-15

Configuring a System Name 5-15

Understanding DNS 5-15

Default DNS Configuration 5-16

Setting Up DNS 5-16

Displaying the DNS Configuration 5-17

Creating a Banner 5-17

Default Banner Configuration 5-17

Configuring a Message-of-the-Day Login Banner 5-18

Configuring a Login Banner 5-19

Managing the MAC Address Table 5-19

Building the Address Table 5-20

MAC Addresses and VLANs 5-20

Default MAC Address Table Configuration 5-21

Changing the Address Aging Time 5-21

Removing Dynamic Address Entries 5-21

Configuring MAC Address Change Notification Traps 5-22

Configuring MAC Address Move Notification Traps 5-24

Configuring MAC Threshold Notification Traps 5-25

Adding and Removing Static Address Entries 5-26

Configuring Unicast MAC Address Filtering 5-27

Disabling MAC Address Learning on a VLAN 5-28

Displaying Address Table Entries 5-29

Managing the ARP Table 5-30

CHAPTER

6Configuring Synchronous Ethernet 6-1

Understanding SyncE 6-1

Reference Clocks 6-1

Contents

vii

Cisco ME 3800X and 3600X Switch Software Configuration Guide

OL-23400-01

SyncE Timing Using REP for Loop Prevention and Resiliency 6-2

BITS Interface 6-5

Configuring SyncE 6-5

Default SyncE Configuration 6-6

Configuring the Network Clock Selection 6-6

Configuring the BITS Interface 6-7

Selecting the Network Clock 6-9

Configuring REP for the SyncE Network 6-10

Monitoring SyncE 6-11

CHAPTER

7Configuring the Switch External Alarms 7-1

Understanding Switch Alarms 7-1

Configuring Switch Alarms 7-2

CHAPTER

8Configuring Switch-Based Authentication 8-1

Preventing Unauthorized Access to Your Switch 8-1

Protecting Access to Privileged EXEC Commands 8-2

Default Password and Privilege Level Configuration 8-2

Setting or Changing a Static Enable Password 8-3

Protecting Enable and Enable Secret Passwords with Encryption 8-3

Disabling Password Recovery 8-5

Setting a Telnet Password for a Terminal Line 8-6

Configuring Username and Password Pairs 8-6

Configuring Multiple Privilege Levels 8-7

Setting the Privilege Level for a Command 8-8

Changing the Default Privilege Level for Lines 8-9

Logging into and Exiting a Privilege Level 8-9

Controlling Switch Access with TACACS+ 8-10

Understanding TACACS+ 8-10

TACACS+ Operation 8-12

Configuring TACACS+ 8-12

Default TACACS+ Configuration 8-13

Identifying the TACACS+ Server Host and Setting the Authentication Key 8-13

Configuring TACACS+ Login Authentication 8-14

Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services 8-16

Starting TACACS+ Accounting 8-16

Displaying the TACACS+ Configuration 8-17

Controlling Switch Access with RADIUS 8-17

Understanding RADIUS 8-17

Contents

viii

Cisco ME 3800X and 3600X Switch Software Configuration Guide OL-23400-01

RADIUS Operation 8-19

Configuring RADIUS 8-19

Default RADIUS Configuration 8-20

Identifying the RADIUS Server Host 8-20

Configuring RADIUS Login Authentication 8-22

Defining AAA Server Groups 8-24

Configuring RADIUS Authorization for User Privileged Access and Network Services 8-26

Starting RADIUS Accounting 8-27

Configuring Settings for All RADIUS Servers 8-28

Configuring the Switch to Use Vendor-Specific RADIUS Attributes 8-28

Configuring the Switch for Vendor-Proprietary RADIUS Server Communication 8-29

Configuring RADIUS Server Load Balancing 8-30

Displaying the RADIUS Configuration 8-30

Controlling Switch Access with Kerberos 8-31

Understanding Kerberos 8-31

Kerberos Operation 8-33

Authenticating to a Boundary Switch 8-33

Obtaining a TGT from a KDC 8-34

Authenticating to Network Services 8-34

Configuring Kerberos 8-34

Configuring the Switch for Local Authentication and Authorization 8-35

Configuring the Switch for Secure Shell 8-36

Understanding SSH 8-36

SSH Servers, Integrated Clients, and Supported Versions 8-36

Limitations 8-37

Configuring SSH 8-37

Configuration Guidelines 8-37

Setting Up the Switch to Run SSH 8-37

Configuring the SSH Server 8-38

Displaying the SSH Configuration and Status 8-39

Configuring the Switch for Secure Copy Protocol 8-39

Information About Secure Copy 8-40

CHAPTER

9Configuring Interfaces 9-1

Understanding Interface Types 9-1

NNI Port Type 9-2

Port-Based VLANs 9-2

Switch Ports 9-2

Access Ports 9-3

Contents

Cisco ME 3800X and 3600X Switch Software Configuration Guide

OL-23400-01

Trunk Ports 9-3

Routed Ports 9-3

Ethernet Management Port 9-4

Switch Virtual Interfaces 9-4

EtherChannel Port Groups 9-4

Ethernet Flow Points 9-5

Connecting Interfaces 9-5

Using Interface Configuration Mode 9-6

Procedures for Configuring Interfaces 9-6

Configuring a Range of Interfaces 9-7

Configuring and Using Interface Range Macros 9-8

Using the Ethernet Management Port 9-10

Understanding the Ethernet Management Port 9-10

Supported Features on the Ethernet Management Port 9-12

Configuring the Ethernet Management Port 9-12

TFTP and the Ethernet Management Port 9-12

Configuring Ethernet Interfaces 9-13

Default Ethernet Interface Configuration 9-13

Configuring Interface Speed and Duplex Mode 9-14

Speed and Duplex Configuration Guidelines 9-14

Setting the Interface Speed and Duplex Parameters 9-15

Configuring IEEE 802.3x Flow Control 9-17

Configuring Auto-MDIX on an Interface 9-18

Adding a Description for an Interface 9-19

Configuring Layer 3 Interfaces 9-19

Configuring the Interface MTU 9-21

Monitoring and Maintaining the Interfaces 9-21

Monitoring Interface Status 9-21

Clearing and Resetting Interfaces and Counters 9-23

Shutting Down and Restarting the Interface 9-23

CHAPTER

10 Configuring VLANs 10-1

Understanding VLANs 10-1

Supported VLANs 10-3

Normal-Range VLANs 10-3

Extended-Range VLANs 10-4

VLAN Port Membership Modes 10-4

UNI VLANs 10-4

Creating and Modifying VLANs 10-5

Contents

Cisco ME 3800X and 3600X Switch Software Configuration Guide OL-23400-01

Default Ethernet VLAN Configuration 10-5

VLAN Configuration Guidelines 10-6

Creating or Modifying an Ethernet VLAN 10-7

Assigning Static-Access Ports to a VLAN 10-8

Displaying VLANs 10-9

Configuring VLAN Trunks 10-9

Trunking Overview 10-9

IEEE 802.1Q Configuration Considerations 10-10

Default Layer 2 Ethernet Interface VLAN Configuration 10-10

Configuring an Ethernet Interface as a Trunk Port 10-11

Interaction with EtherChannels 10-11

Configuring a Trunk Port 10-11

Defining the Allowed VLANs on a Trunk 10-12

Configuring the Native VLAN for Untagged Traffic 10-13

Configuring Trunk Ports for Load Sharing 10-14

Load Sharing Using STP Port Priorities 10-14

Load Sharing Using STP Path Cost 10-15

CHAPTER

11 Configuring Ethernet Virtual Connections (EVCs) 11-1

Supported EVC Features 11-2

Understanding EVC Features 11-3

Ethernet Virtual Connections 11-3

Service Instances and EFPs 11-3

Encapsulation 11-4

Bridge Domains 11-6

Split-Horizon 11-6

Rewrite Operations 11-7

Configuring EFPs 11-8

Default EVC Configuration 11-8

Configuration Guidelines 11-8

Creating Service Instances 11-9

Configuration Examples 11-10

Configuring a Service Instance 11-10

Encapsulation Using a VLAN Range 11-10

Two Service Instances Joining the Same Bridge Domain 11-10

Bridge Domains and VLAN Encapsulation 11-11

Rewrite 11-11

Split Horizon 11-11

Hairpinning 11-12

Altri manuali per 3845 - Security Bundle Router

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Cisco Interruttore

Cisco

Cisco 4948 Series Manuale utente

Cisco

Cisco SLM2005 - Small Business Smart Switch Manuale utente

Cisco

Cisco SG 200-08P Manuale utente

Cisco

Cisco Catalyst 9300 Series Manuale utente

Cisco

Cisco SRW248G4 - Small Business Managed Switch Manuale utente

Cisco

Cisco MS200X-24 Manuale utente

Cisco

Cisco 2950 - Catalyst Switch Guida rapida

Cisco

Cisco SFS 7008 Istruzioni per l'installazione

Cisco

Cisco SRW224G4P - Small Business Managed Switch Manuale utente

Cisco

Cisco Nexus 7000 Series Manuale utente

Cisco

Cisco Nexus 93180YC-FX Manuale

Cisco

Cisco CBS Series Scheda tecnica

Cisco

Cisco Nexus 9348GC-FXP NX-OS Manuale

Cisco

Cisco Nexus 3000 series Manuale utente

Cisco

Cisco WS-C2950-12 Manuale

Cisco

Cisco 500 Series Manuale utente

Cisco

Cisco LightStream 1010 Manuale utente

Cisco

Cisco 11500 Series Istruzioni originali

Cisco

Cisco SG300 series Manuale utente

Cisco

Cisco Catalyst Express 520-8PC Dimensioni

Cisco

Cisco IE 3010 Manuale utente

Cisco

Cisco Nexus 5000 Series Manuale utente

Cisco

Cisco 6500 - Catalyst Series 10 Gigabit EN Interface Module... Manuale utente

Cisco

Cisco MGX 8850 Istruzioni operative e di manutenzione

Manuali Interruttore popolari di altre marche

URC

URC Total Control MFS-8 Manuale utente

Azbil

Azbil HPQ-D11 Manuale utente

Sony

Sony DFS-900M Manuale utente

SICK

SICK i17S Manuale utente

F&F

F&F SZR-277 Manuale utente

Shure

Shure UAMS/BK Manuale utente

Dräger

Dräger X-zone Switch Off Manuale utente

Asco

Asco Joucomatic 349 Series Manuale utente

BT Mini Hub Manuale utente

D-Link

D-Link DES-1226G Manuale utente

Johnson Controls

Johnson Controls FS80-C Manuale utente

Alcatel-Lucent

Alcatel-Lucent 7450 ESS-12 Manuale utente

MicroNet

MicroNet SP1200A Manuale utente

Ruijie

Ruijie RG-PF2920 Series Manuale di installazione e funzionamento

Altinex

Altinex DA1914SX Manuale utente

MiLAN

MiLAN MIL-SM2401M Manuale utente

RJM

RJM MASTERMIND PBC/6X Manuale utente

Atlas

Atlas MMK-KVM8 Manuale utente