Catalyst 2950 Desktop Switch Software

Configuration Guide

Cisco IOS Release 12.1(11)EA1

August 2002

Corporate Headquarters

Cisco Systems, Inc. 170 West Tasman Drive

San Jose, CA 95134-1706

USA http://www.cisco.com Tel: 408 526-4000

800 553-NETS (6387) Fax: 408 526-4100

Customer Order Number: DOC-7811380=

Text Part Number: 78-11380-05

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL

STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT

WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT

SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE

OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB???s public domain version of the UNIX operating system. All rights reserved. Copyright ?? 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED ???AS IS??? WITH

ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT

LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF

DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,

WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO

OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

CCIP, the Cisco Arrow logo, the Cisco Powered Network mark, the Cisco Systems Verified logo, Cisco Unity, Follow Me Browsing, FormShare, Internet Quotient, iQ Breakthrough, iQ Expertise, iQ FastTrack, the iQ Logo, iQ Net Readiness Scorecard, Networking Academy, ScriptShare, SMARTnet, TransPath, and Voice LAN are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, Discover All That???s Possible, The Fastest Way to Increase Your Internet Quotient, and iQuick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, IOS, IP/TV, LightStream, MGX, MICA, the Networkers logo, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, SlideCast, StrataView Plus, Stratm, SwitchProbe, TeleRouter, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.

All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0206R)

Catalyst 2950 Desktop Switch Software Configuration Guide

Copyright ?? 2001-2002, Cisco Systems, Inc.

All rights reserved.

C O N T E N T S

Catalyst 2950 Desktop Switch Software Configuration Guide

Contents

Contents

Contents

Catalyst 2950 Desktop Switch Software Configuration Guide

Contents

Controlling Switch Access with TACACS+ 7-9

Understanding TACACS+ 7-9

TACACS+ Operation 7-11

Catalyst 2950 Desktop Switch Software Configuration Guide

Contents

Catalyst 2950 Desktop Switch Software Configuration Guide

Contents

Contents

Contents

Contents

Contents

Catalyst 2950 Desktop Switch Software Configuration Guide

Contents

Contents

Contents

Catalyst 2950 Desktop Switch Software Configuration Guide

Contents

SPAN and RSPAN Interaction with Other Features 20-5

Catalyst 2950 Desktop Switch Software Configuration Guide

Contents

Contents

Configuring SNMP Groups and Users 23-8

Configuring SNMP Notifications 23-10

Setting the Agent Contact and Location Information 23-13

Limiting TFTP Servers Used Through SNMP 23-13

SNMP Examples 23-14

Catalyst 2950 Desktop Switch Software Configuration Guide

Contents

Catalyst 2950 Desktop Switch Software Configuration Guide

Contents

I N D E X

Contents

Catalyst 2950 Desktop Switch Software Configuration Guide

Preface

Audience

The Catalyst 2950 Desktop Switch Software Configuration Guide is for the network manager responsible for configuring the Catalyst 2950 switches, hereafter referred to as the switches. Before using this guide, you should be familiar with the concepts and terminology of Ethernet and local area networking.

Purpose

This guide provides information about configuring and troubleshooting a switch or switch clusters. It includes descriptions of the management interface options and the features supported by the switch software. The switch is supported by either the standard software image (SI) or the enhanced software image (EI). The EI provides a richer set of features, including access control lists (ACLs), enhanced quality of service (QoS) features, extended-range VLANs, and Remote Switch Port Analyzer (RSPAN).

The EI supports these switches:

???Catalyst 2950C-24

???Catalyst 2950G-12-EI

???Catalyst 2950G-24-EI

???Catalyst 2950G-24-EI-DC

???Catalyst 2950G-48-EI

???Catalyst 2950T-24

The SI supports these switches:

???Catalyst 2950-12

???Catalyst 2950-24

???Catalyst 2950SX-24

Use this guide with other documents for information about these topics:

???Requirements???This guide assumes that you have met the hardware and software requirements and cluster compatibility requirements described in the release notes.

???Start-up information???This guide assumes that you have assigned switch IP information and passwords by using the setup program described in the release notes.

Catalyst 2950 Desktop Switch Software Configuration Guide

Preface

Organization

???Cluster Management Suite (CMS) information???This guide provides an overview of the CMS web-based, switch management interface. For information about CMS requirements and the procedures for browser and plug-in configuration and accessing CMS, refer to the release notes. For CMS field-level window descriptions and procedures, refer to the CMS online help.

???Cluster configuration???This guide provides information about planning for, creating, and maintaining switch clusters. Because configuring switch clusters is most easily performed through CMS, this guide does not provide the command-line interface (CLI) procedures. For the cluster commands, refer to the command reference for this release.

???CLI command information???This guide provides an overview for using the CLI. For complete syntax and usage information about the commands that have been specifically created or changed for the switches, refer to the command reference for this release.

This guide does not describe system messages you might encounter or how to install your switch. For more information, refer to the Catalyst 2950 Desktop Switch System Message Guide for this release and to the Catalyst 2950 Desktop Switch Hardware Installation Guide.

Note This guide does not repeat the concepts and CLI procedures provided in the standard Cisco IOS Release 12.1 documentation. For information about the standard IOS Release 12.1 commands, refer to the IOS documentation set available from the Cisco.com home page at Service and Support > Technical Documents. On the Cisco Product Documentation home page, select Release 12.1 from the Cisco IOS Software drop-down list.

Organization

This guide is organized into these chapters:

Chapter 1, ???Overview,??? lists the software features of this release and provides examples of how the switch can be deployed in a network.

Chapter 2, ???Using the Command-Line Interface,??? describes how to access the command modes, use the CLI, and describes CLI messages that you might receive. It also describes how to get help, abbreviate commands, use no and default forms of commands, use command history and editing features, and how to search and filter the output of show and more commands.

Chapter 3, ???Getting Started with CMS,??? describes the CMS web-based, switch management interface. For information about configuring your web browser and accessing CMS, refer to the release notes. For field-level descriptions of all CMS windows and procedures for using the CMS windows, refer to the online help.

Chapter 4, ???Assigning the Switch IP Address and Default Gateway,??? describes how to create the initial switch configuration (for example, assign the switch IP address and default gateway information) by using a variety of automatic and manual methods.

Chapter 5, ???Configuring IE2100 CNS Agents,??? describes how to configure Cisco Intelligence Engine 2100 (IE2100) Series Cisco Networking Services (CNS) embedded agents on your switch. By using the

IE2100 Series Configuration Registrar network management application, you can automate initial configurations and configuration updates by generating switch-specific configuration changes, sending them to the switch, executing the configuration change, and logging the results.

Chapter 6, ???Clustering Switches,??? describes switch clusters and the considerations for creating and maintaining them. The online help provides the CMS procedures for configuring switch clusters. Configuring switch clusters is most easily performed through CMS; therefore, CLI procedures are not provided. Cluster commands are described in the Catalyst 2950 Desktop Switch Command Reference.

Catalyst 2950 Desktop Switch Software Configuration Guide

Preface

Organization

Chapter 7, ???Administering the Switch,??? describes how to perform one-time operations to administer your switch. It describes how to prevent unauthorized access to your switch through the use of passwords, privilege levels, the Terminal Access Controller Access Control System Plus (TACACS+), and the Remote Authentication Dial-In User Service (RADIUS). It also describes how to set the system date and time, set system name and prompt, create a login banner, and how to manage the MAC address and Address Resolution Protocol (ARP) tables.

Chapter 8, ???Configuring 802.1X Port-Based Authentication,??? describes how to configure 802.1X port-based authentication to prevent unauthorized devices (clients) from gaining access to the network. As LANs extend to hotels, airports, and corporate lobbies, insecure environments could be created.

Chapter 9, ???Configuring Interface Characteristics,??? defines the types of interfaces on the switch. It describes the interface global configuration command and provides procedures for configuring physical interfaces.

Chapter 10, ???Configuring STP,??? describes how to configure the Spanning Tree Protocol (STP) on your switch.

Chapter 11, ???Configuring RSTP and MSTP,??? describes how to configure the Cisco implementation of the IEEE 802.1W Rapid STP (RSTP) and the IEEE 802.1S Multiple STP (MSTP) on your switch. RSTP provides rapid convergence, and MSTP enables VLANs to be grouped into a spanning-tree instance.

Chapter 12, ???Configuring Optional Spanning-Tree Features,??? describes how to configure optional spanning-tree features that can be used when your switch is running the per-VLAN spanning-tree (PVST) or the MSTP.

Chapter 13, ???Configuring VLANs,??? describes how to create and maintain VLANs. It includes information about the VLAN database, VLAN configuration modes, extended-range VLANs, VLAN trunks, and the VLAN Membership Policy Server (VMPS).

Chapter 14, ???Configuring VTP,??? describes how to use the VLAN Trunking Protocol (VTP) VLAN database for managing VLANs. It includes VTP characteristics and configuration.

Chapter 15, ???Configuring Voice VLAN,??? describes how to configure voice VLANs on the switch for a connection to an IP phone.

Chapter 16, ???Configuring IGMP Snooping and MVR,??? describes how to configure Internet Group Management Protocol (IGMP) snooping. It also describes Multicast VLAN Registration (MVR), a local IGMP snooping feature available on the switch, and how to use IGMP filtering to control multicast group membership.

Chapter 17, ???Configuring Port-Based Traffic Control,??? describes how to reduce traffic storms by setting broadcast, multicast, and unicast storm-control threshold levels; how to protect ports from receiving traffic from other ports on a switch; how to configure port security by using secure MAC addresses; and how to set the aging time for all secure addresses.

Chapter 19, ???Configuring CDP,??? describes how to configure Cisco Discovery Protocol (CDP) on your switch.

Chapter 20, ???Configuring SPAN and RSPAN,??? describes how to configure Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN), which select network traffic for analysis by a network analyzer such as a SwitchProbe device or other Remote Monitoring (RMON) probe.

Chapter 21, ???Configuring RMON,??? describes how to configure remote monitoring (RMON). The RMON feature, which is used with the Simple Network Management Protocol (SNMP) agent in the switch, means that you can monitor all the traffic flowing among switches on all connected LAN segments.

Catalyst 2950 Desktop Switch Software Configuration Guide

Preface

Conventions

Chapter 22, ???Configuring System Message Logging,??? describes how to configure system message logging. It describes the message format and how to change the message display destination device, limit the type of messages sent, configure the UNIX server syslog daemon, and define the UNIX system logging facility and timestamp messages.

Chapter 23, ???Configuring SNMP,??? describes how to configure the Simple Network Management Protocol (SNMP). It describes how to configure community strings, enable trap managers and traps, set the agent contact and location information, and how to limit TFTP servers used through SNMP.

Chapter 24, ???Configuring Network Security with ACLs,??? describes how to configure network security by using access control lists (ACLs).

Chapter 25, ???Configuring QoS,??? describes how to configure quality of service (QoS) on your switch. With this feature, you can provide preferential treatment to certain types traffic.

Chapter 26, ???Configuring EtherChannels,??? describes how to bundle a set of individual ports into a single logical link on the interfaces.

Chapter 27, ???Troubleshooting,??? describes how to identify and resolve software problems related to the IOS software.

Appendix A, ???Supported MIBs,??? lists the supported MIBs for this release and how to use FTP to access the MIB files.

Conventions

This guide uses these conventions to convey instructions and information:

Command descriptions use these conventions:

???Commands and keywords are in boldface text.

???Arguments for which you supply values are in italic.

???Square brackets ([ ]) indicate optional elements.

???Braces ({ }) group required choices, and vertical bars ( | ) separate the alternative elements.

???Braces and vertical bars within square brackets ([{ | }]) indicate a required choice within an optional element.

Interactive examples use these conventions:

???Terminal sessions and system displays are in screen font.

???Information you enter is in boldface screen font.

???Nonprinting characters, such as passwords or tabs, are in angle brackets (< >). Notes, cautions, and tips use these conventions and symbols:

Note Means reader take note. Notes contain helpful suggestions or references to materials not contained in this manual.

Caution Means reader be careful. In this situation, you might do something that could result in equipment damage or loss of data.

Catalyst 2950 Desktop Switch Software Configuration Guide

Preface

Related Publications

Tip Means the following will help you solve a problem. The tips information might not be troubleshooting or even an action, but could be useful information.

Related Publications

These documents provide complete information about the switch and are available from this

Cisco.com site:

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/index.htm

You can order printed copies of documents with a DOC-xxxxxx= number from the Cisco.com sites and from the telephone numbers listed in the ???Obtaining Documentation??? section on page xxvii.

??? Release Notes for the Catalyst 2950 Switch (not orderable but is available on Cisco.com)

Note Switch requirements and procedures for initial configurations and software upgrades tend to change and therefore appear only in the release notes. Before installing, configuring, or upgrading the switch, refer to the release notes on Cisco.com for the latest information.

???Catalyst 2950 Desktop Switch Software Configuration Guide (order number DOC-7811380=)

???Catalyst 2950 Desktop Switch Command Reference (order number DOC-7811381=)

???Catalyst 2950 Desktop Switch System Message Guide (order number DOC-7814233=)

???Catalyst 2950 Desktop Switch Hardware Installation Guide (order number DOC-7811157=)

???Catalyst GigaStack Gigabit Interface Converter Hardware Installation Guide

(order number DOC-786460=)

???CWDM Passive Optical System Installation Note (not orderable but is available on Cisco.com)

???1000BASE-T GBIC Installation Notes (not orderable but is available on Cisco.com)

Obtaining Documentation

These sections explain how to obtain documentation from Cisco Systems.

World Wide Web

You can access the most current Cisco documentation on the World Wide Web at this URL:

http://www.cisco.com

Translated documentation is available at this URL:

http://www.cisco.com/public/countries_languages.shtml

Preface

Obtaining Technical Assistance

Documentation CD-ROM

Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which is shipped with your product. The Documentation CD-ROM is updated monthly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual subscription.

Ordering Documentation

You can order Cisco documentation in these ways:

???Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Networking Products MarketPlace:

http://www.cisco.com/cgi-bin/order/order_root.pl

???Registered Cisco.com users can order the Documentation CD-ROM through the online Subscription Store:

http://www.cisco.com/go/subscription

???Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, U.S.A.) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387).

Documentation Feedback

If you are reading Cisco product documentation on the World Wide Web, you can send us your comments by completing the online survey. When you display the document listing for this platform, click Give Us Your Feedback. After you display the survey, select the manual that you wish to comment on. Click Submit to send your comments to the Cisco documentation group.

You can e-mail your comments to bug-doc@cisco.com.

To submit your comments by mail, use the response card behind the front cover of your document, or write to the following address:

Cisco Systems

Attn: Document Resource Connection

170 West Tasman Drive

San Jose, CA 95134-9883

We appreciate your comments.

Obtaining Technical Assistance

Cisco provides Cisco.com as a starting point for all technical assistance. Customers and partners can obtain online documentation, troubleshooting tips, and sample configurations from online tools by using the Cisco Technical Assistance Center (TAC) Web Site. Cisco.com registered users have complete access to the technical support resources on the Cisco TAC Web Site.

Preface

Obtaining Technical Assistance

Cisco.com

Cisco.com is the foundation of a suite of interactive, networked services that provides immediate, open access to Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world.

Cisco.com is a highly integrated Internet application and a powerful, easy-to-use tool that provides a broad range of features and services to help you with these tasks:

???Streamline business processes and improve productivity

???Resolve technical issues with online support

???Download and test software packages

???Order Cisco learning materials and merchandise

???Register for online skill assessment, training, and certification programs

If you want to obtain customized information and service, you can self-register on Cisco.com. To access Cisco.com, go to this URL:

http://www.cisco.com

Technical Assistance Center

The Cisco Technical Assistance Center (TAC) is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two levels of support are available: the Cisco TAC

Web Site and the Cisco TAC Escalation Center.

Cisco TAC inquiries are categorized according to the urgency of the issue:

???Priority level 4 (P4)???You need information or assistance concerning Cisco product capabilities, product installation, or basic product configuration.

???Priority level 3 (P3)???Your network performance is degraded. Network functionality is noticeably impaired, but most business operations continue.

???Priority level 2 (P2)???Your production network is severely degraded, affecting significant aspects of business operations. No workaround is available.

???Priority level 1 (P1)???Your production network is down, and a critical impact to business operations will occur if service is not restored quickly. No workaround is available.

The Cisco TAC resource that you choose is based on the priority of the problem and the conditions of service contracts, when applicable.

Cisco TAC Website

You can use the Cisco TAC Web Site to resolve P3 and P4 issues yourself, saving both cost and time. The site provides around-the-clock access to online tools, knowledge bases, and software. To access the Cisco TAC Web Site, go to this URL:

http://www.cisco.com/tac

All customers, partners, and resellers who have a valid Cisco service contract have complete access to the technical support resources on the Cisco TAC Web Site. The Cisco TAC Web Site requires a Cisco.com login ID and password. If you have a valid service contract but do not have a login ID or password, go to this URL to register:

http://www.cisco.com/register/

Catalyst 2950 Desktop Switch Software Configuration Guide

Preface

Obtaining Technical Assistance

If you are a Cisco.com registered user, and you cannot resolve your technical issues by using the Cisco TAC Web Site, you can open a case online by using the TAC Case Open tool at this URL:

http://www.cisco.com/tac/caseopen

If you have Internet access, we recommend that you open P3 and P4 cases through the Cisco TAC Web Site.

Cisco TAC Escalation Center

The Cisco TAC Escalation Center addresses priority level 1 or priority level 2 issues. These classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer automatically opens a case.

To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to this URL:

http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml

Before calling, please check with your network operations center to determine the level of Cisco support services to which your company is entitled: for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). When you call the center, please have available your service agreement number and your product serial number.

Catalyst 2950 Desktop Switch Software Configuration Guide

C H A P T E R 1

Overview

This chapter provides these topics about the Catalyst 2950 switch software:

???Features, page 1-1

???Management Options, page 1-5

???Network Configuration Examples, page 1-7

???Where to Go Next, page 1-17

Features

The Catalyst 2950 software supports the switches listed in the ???Purpose??? section on page xxiii and in the release notes. This section describes the features supported in this release:

Note Some features require that you have the enhanced software image (EI) installed on your switch. For a list of the switches that support the EI, see the ???Purpose??? section on page xxiii, or refer to the release notes for this release.

Ease of Use and Ease of Deployment

???Cluster Management Suite (CMS) software for simplifying switch and switch cluster management through a web browser, such as Netscape Communicator or Microsoft Internet Explorer, from anywhere in your intranet

???Switch clustering technology used with CMS for

???Unified configuration, monitoring, authentication, and software upgrade of multiple switches (refer to the release notes for a list of eligible cluster members).

???Automatic discovery of candidate switches and creation of clusters of up to 16 switches that can be managed through a single IP address.

???Extended discovery of cluster candidates that are not directly connected to the command switch.

???Hot Standby Router Protocol (HSRP) for command-switch redundancy. The redundant command switches used for HSRP must have compatible software releases.

Note See the ???Advantages of Using CMS and Clustering Switches??? section on page 1-6. Refer to the release notes for the CMS, cluster hardware, software, and browser requirements.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 1 Overview

Features

Performance

???Autosensing of speed on the 10/100 and 10/100/1000 ports and autonegotiation of duplex mode on the 10/100 ports for optimizing bandwidth

???IEEE 802.3X flow control on Gigabit Ethernet ports operating in full-duplex mode

???Fast EtherChannel and Gigabit EtherChannel for enhanced fault tolerance and for providing up to 2 Gbps of bandwidth between switches, routers, and servers

???Support for frames larger than 1500 bytes. The Catalyst 2950G-12-EI, 2950G-24-EI, 2950G-24-EI-DC, and 2950G-48-EI switches running Cisco IOS Release 12.1(6)EA2 or later support frame sizes from 1500 to 1530 bytes

???Per-port broadcast storm control for preventing faulty end stations from degrading overall system performance with broadcast storms

???Port Aggregation Protocol (PAgP) for automatic creation of EtherChannel links

???Internet Group Management Protocol (IGMP) snooping support to limit flooding of IP multicast traffic

???Multicast VLAN registration (MVR) to continuously send multicast streams in a multicast VLAN while isolating the streams from subscriber VLANs for bandwidth and security reasons

???IGMP filtering for controlling the set of multicast groups to which hosts on a switch port can belong

???Protected port (private VLAN edge port) option for restricting the forwarding of traffic to designated ports on the same switch

???Dynamic address learning for enhanced security

Manageability

???Cisco Intelligence Engine 2100 (IE2100) Series Cisco Networking Services (CNS) embedded agents for automating switch management, configuration storage and delivery (available only with the EI)

???Dynamic Host Configuration Protocol (DHCP)-based autoconfiguration for automatically configuring the switch during startup with IP address information and a configuration file that it receives during DHCP-based autoconfiguration

Note DHCP replaces the Bootstrap Protocol (BOOTP) feature autoconfiguration to ensure retrieval of configuration files by unicast TFTP messages. BOOTP is available in earlier software releases for this switch.

???Address Resolution Protocol (ARP) for identifying a switch through its IP address and its corresponding MAC address

???Cisco Discovery Protocol (CDP) versions 1 and 2 for network topology discovery and mapping between the switch and other Cisco devices on the network

???Network Time Protocol (NTP) for providing a consistent timestamp to all switches from an external source

???Directed unicast requests to a Trivial File Transfer Protocol (TFTP) server for obtaining software upgrades from a TFTP server

???Default configuration storage in Flash memory to ensure that the switch can be connected to a network and can forward traffic with minimal user intervention

???In-band management access through a CMS web-based session

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 1 Overview

Features

???In-band management access through up to 16 simultaneous Telnet connections for multiple command-line interface (CLI)-based sessions over the network

???In-band management access through Simple Network Management Protocol (SNMP) versions 1, 2c, and 3 get and set requests

???Out-of-band management access through the switch console port to a directly-attached terminal or to a remote terminal through a serial connection and a modem

Note For additional descriptions of the management interfaces, see the ???Management Options??? section on page 1-5.

Redundancy

???HSRP for command-switch redundancy

???UniDirectional link detection (UDLD) on all Ethernet ports for detecting and disabling unidirectional links on fiber-optic interfaces caused by incorrect fiber-optic wiring or port faults

???IEEE 802.1D Spanning Tree Protocol (STP) for redundant backbone connections and loop-free networks. STP has these features:

???Per-VLAN Spanning Tree (PVST) for balancing load across VLANs

???UplinkFast, cross-stack UplinkFast, and BackboneFast for fast convergence after a spanning-tree topology change and for achieving load balancing between redundant uplinks, including Gigabit uplinks and cross-stack Gigabit uplinks

???IEEE 802.1S Multiple STP (MSTP) for grouping VLANs into a spanning-tree instance, and providing for multiple forwarding paths for data traffic and load balancing (available only with the EI)

???IEEE 802.1W Rapid STP (RSTP) for rapid convergence of the spanning tree by immediately transitioning root and designated ports to the forwarding state (available only with the EI)

???Optional spanning-tree features available:

???Port Fast for eliminating the forwarding delay by enabling a port to immediately transition from the blocking state to the forwarding state

???BPDU guard for shutting down Port Fast-enabled ports that receive BPDUs

???BPDU filtering for preventing a Port Fast-enabled port from sending or receiving BPDUs

???Root guard for preventing switches outside the network core from becoming the spanning-tree root

???Loop guard for preventing alternate or root ports from becoming designated ports because of a failure that leads to a unidirectional link

Note The switch supports up to 64 spanning-tree instances.

VLAN Support

???The switches support 250 port-based VLANs for assigning users to VLANs associated with appropriate network resources, traffic patterns, and bandwidth

Note The Catalyst 2950-12, Catalyst 2950-24, and Catalyst 2950SX-24 switches support only 64 port-based VLANs.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 1 Overview

Features

???The switch supports up to 4094 VLAN IDs to allow service provider networks to support the number of VLANs allowed by the IEEE 802.1Q standard (available only with the EI)

???IEEE 802.1Q trunking protocol on all ports for network moves, adds, and changes; management and control of broadcast and multicast traffic; and network security by establishing VLAN groups for high-security users and network resources

???VLAN Membership Policy Server (VMPS) for dynamic VLAN membership

???VLAN Trunking Protocol (VTP) pruning for reducing network traffic by restricting flooded traffic to links destined for stations receiving the traffic

???Dynamic Trunking Protocol (DTP) for negotiating trunking on a link between two devices and for negotiating the type of trunking encapsulation (802.1Q) to be used

???Voice VLAN for creating subnets for voice traffic from Cisco IP Phones

Security

???Bridge protocol data unit (BPDU) guard for shutting down a Port Fast-configured port when an invalid configuration occurs

???Protected port option for restricting the forwarding of traffic to designated ports on the same switch

???Password-protected access (read-only and read-write access) to management interfaces (CMS and CLI) for protection against unauthorized configuration changes

???Port security option for limiting and identifying MAC addresses of the stations allowed to access the port

???Port security aging to set the aging time for secure addresses on a port

???Multilevel security for a choice of security level, notification, and resulting actions

???MAC-based port-level security for restricting the use of a switch port to a specific group of source addresses and preventing switch access from unauthorized stations (available only with the EI)

???Terminal Access Controller Access Control System Plus (TACACS+), a proprietary feature for managing network security through a TACACS server

???IEEE 802.1X port-based authentication to prevent unauthorized devices from gaining access to the network

???Standard and extended IP access control lists (ACLs) for defining security policies (available only with the EI)

Quality of Service and Class of Service

???Classification

???IP Differentiated Services Code Point (IP DSCP) and class of service (CoS) marking priorities on a per-port basis for protecting the performance of mission-critical applications (only available with the EI)

???Flow-based packet classification (classification based on information in the MAC, IP, and TCP/UDP headers) for high-performance quality of service at the network edge, allowing for differentiated service levels for different types of network traffic and for prioritizing mission-critical traffic in the network (only available in the EI)

???Support for IEEE 802.1P CoS scheduling for classification and preferential treatment of high-priority voice traffic

???Trusted boundary (detect the presence of a Cisco IP phone, trust the CoS value received, and ensure port security. If the IP phone is not detected, disable the trusted setting on the port and prevent misuse of a high-priority queue.)

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 1 Overview

Management Options

???Policing

???Traffic-policing policies on the switch port for allocating the amount of the port bandwidth to a specific traffic flow

???Policing traffic flows to restrict specific applications or traffic flows to metered, predefined rates

???Up to 60 policers on ingress Gigabit-capable Ethernet ports Up to six policers on ingress 10/100 ports

Granularity of 1 Mbps on 10/100 ports and 8 Mbps on 10/100/1000 ports

???Out-of-profile markdown for packets that exceed bandwidth utilization limits

Note Policing is available only in the EI.

???Egress Policing and Scheduling of Egress Queues???Four egress queues on all switch ports. Support for strict priority and weighted round-robin (WRR) CoS policies

Monitoring

???Switch LEDs that provide visual port and switch status

???Switched Port Analyzer (SPAN) and Remote SPAN (RSPAN) for traffic monitoring on any port or

VLAN

Note RSPAN is available only in the EI.

???Four groups (history, statistics, alarms, and events) of embedded remote monitoring (RMON) agents for network monitoring and traffic analysis

???MAC address notification for tracking the MAC addresses that the switch has learned or removed

???Syslog facility for logging system messages about authentication or authorization errors, resource issues, and time-out events

Management Options

The switches are designed for plug-and-play operation: you only need to assign basic IP information to the switch and connect it to the other devices in your network. If you have specific network needs, you can configure and monitor the switch???on an individual basis or as part of a switch cluster???through its various management interfaces.

This section discusses these topics:

???Management Interface Options, page 1-6

???Advantages of Using CMS and Clustering Switches, page 1-6

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 1 Overview

Management Options

Management Interface Options

You can configure and monitor individual switches and switch clusters by using these interfaces:

???CMS???CMS is a graphical user interface that can be launched from anywhere in your network through a web browser such as Netscape Communicator or Microsoft Internet Explorer. CMS is already installed on the switch. Using CMS, you can configure and monitor a standalone switch, a specific cluster member, or an entire switch cluster. You can also display network topologies to gather link information and display switch images to modify switch and port level settings.

For more information about CMS, see Chapter 3, ???Getting Started with CMS.???

???CLI???The switch IOS CLI software is enhanced to support desktop-switching features. You can configure and monitor the switch and switch cluster members from the CLI. You can access the CLI either by connecting your management station directly to the switch console port or by using Telnet from a remote management station.

For more information about the CLI, see Chapter 2, ???Using the Command-Line Interface.???

???IE2100???Cisco Intelligence Engine 2100 Series Configuration Registrar is a network management device that works with embedded CNS Agents in the switch software. You can automate initial configurations and configuration updates by generating switch-specific configuration changes, sending them to the switch, executing the configuration change, and logging the results.

For more information about IE2100, see Chapter 5, ???Configuring IE2100 CNS Agents.???

???SNMP???SNMP provides a means to monitor and control the switch and switch cluster members. You can manage switch configuration settings, performance, and security and collect statistics by using SNMP management applications such as CiscoWorks2000 LAN Management Suite (LMS) and HP OpenView.

You can manage the switch from an SNMP-compatible management station that is running platforms such as HP OpenView or SunNet Manager. The switch supports a comprehensive set of MIB extensions and four RMON groups.

For more information about using SNMP, see the Chapter 23, ???Configuring SNMP.???

Advantages of Using CMS and Clustering Switches

Using CMS and switch clusters can simplify and minimize your configuration and monitoring tasks. You can use Cisco switch clustering technology to manage up to 16 interconnected and supported Catalyst switches through one IP address as if they were a single entity. This can conserve IP addresses if you have a limited number of them. CMS is the easiest interface to use and makes switch and switch cluster management accessible to authorized users from any PC on your network.

By using switch clusters and CMS, you can:

???Manage and monitor interconnected Catalyst switches (refer to the release notes for a list of supported switches), regardless of their geographic proximity and interconnection media, including Ethernet, Fast Ethernet, Fast EtherChannel, Cisco GigaStack Gigabit Interface Converter (GBIC), Gigabit Ethernet, and Gigabit EtherChannel connections.

???Accomplish multiple configuration tasks from a single CMS window without needing to remember CLI commands to accomplish specific tasks.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 1 Overview

Network Configuration Examples

???Apply actions from CMS to multiple ports and multiple switches at the same time to avoid re-entering the same commands for each individual port or switch. Here are some examples of globally setting and managing multiple ports and switches:

???Port configuration such as speed and duplex settings

???Port and console port security settings

???NTP, STP, VLAN, and quality of service (QoS) configurations

???Inventory and statistic reporting and link and switch-level monitoring and troubleshooting

???Group software upgrades

???View a topology of interconnected devices to identify existing switch clusters and eligible switches that can join a cluster. You can also use the topology to quickly identify link information between switches.

???Monitor real-time status of a switch or multiple switches from the LEDs on the front-panel images. The system, redundant power system (RPS), and port LED colors on the images are similar to those on the physical LEDs.

???Use an interactive mode that takes you step-by-step through configuring complex features such as VLANs, ACLs, and QoS.

???Use a wizard that prompts you to provide the minimum required information to configure complex features such as QoS priorities for video traffic, priority levels for data applications, and security.

For more information about CMS, see Chapter 3, ???Getting Started with CMS.??? For more information about switch clusters, see Chapter 6, ???Clustering Switches.???

Network Configuration Examples

This section provides network configuration concepts and includes examples of using the switch to create dedicated network segments and interconnecting the segments through Fast Ethernet and Gigabit Ethernet connections.

Design Concepts for Using the Switch

As your network users compete for network bandwidth, it takes longer to send and receive data. When you configure your network, consider the bandwidth required by your network users and the relative priority of the network applications they use.

Table 1-1 describes what can cause network performance to degrade and how you can configure your network to increase the bandwidth available to your network users.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 1 Overview

Network Configuration Examples

Table 1-1 Increasing Network Performance

Bandwidth alone is not the only consideration when designing your network. As your network traffic profiles evolve, consider providing network services that can support applications such as voice and data integration and security.

Table 1-2 describes some network demands and how you can meet those demands.

Table 1-2 Providing Network Services

Figure 1-1 shows configuration examples of using the Catalyst switches to create these networks:

???Cost-effective wiring closet???A cost-effective way to connect many users to the wiring closet is to connect up to nine Catalyst 2900 XL, Catalyst 2950, Catalyst 3500 XL, and Catalyst 3550 switches through GigaStack GBIC connections. When you use a stack of Catalyst 2950G-48 switches, you can connect up to 432 users. To preserve switch connectivity if one switch in the stack fails, connect the bottom switch to the top switch to create a GigaStack loopback, and enable cross-stack UplinkFast on the cross-stack Gigabit uplinks.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 1 Overview

Network Configuration Examples

You can create backup paths by using Fast Ethernet, Gigabit, Fast EtherChannel, or Gigabit EtherChannel links. Using Gigabit modules on two of the switches, you can have redundant uplink connections to a Gigabit backbone switch such as the Catalyst 3550-12G switch. If one of the redundant connections fails, the other can serve as a backup path. You can configure the stack members and the Catalyst 3550-12G switch as a switch cluster to manage them through a single IP address.

???High-performance workgroup???For users who require high-speed access to network resources, use Gigabit modules to connect the switches directly to a backbone switch in a star configuration. Each switch in this configuration provides users with a dedicated 1-Gbps connection to network resources in the backbone. Compare this with the switches in a GigaStack configuration, where the 1-Gbps connection is shared among the switches. With the high speed uplink to the distribution server, the user can efficiently obtain and store data from servers. Using these Gigabit modules also provides flexibility in media and distance options:

???1000BASE-T GBIC: copper connections of up to 328 feet (100 meters)

???1000BASE-SX GBIC: fiber connections of up to 1804 feet (550 meters)

???1000BASE-LX/LH GBIC: fiber connections of up to 32,808 feet (10 kilometers)

???1000BASE-ZX GBIC: fiber connections of up to 328,084 feet (100 kilometers)

???GigaStack GBIC module for creating a 1-Gbps stack configuration of up to nine supported switches. The GigaStack GBIC supports one full-duplex link (in a point-to-point configuration) or up to nine half-duplex links (in a stack configuration) to other Gigabit Ethernet devices. Using the required Cisco proprietary signaling and cabling, the GigaStack GBIC-to-GigaStack GBIC connection cannot exceed 3 feet (1 meter).

???Redundant Gigabit backbone???Using HSRP, you can create backup paths between

Catalyst 3550-12T-L3 switches. To enhance network reliability and load balancing for different VLANs and subnets, you can connect the Catalyst 2950 switches, again in a star configuration, to two backbone switches. If one of the backbone switches fails, the second backbone switch preserves connectivity between the switches and network resources.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 1 Overview

Network Configuration Examples

Collapsed Backbone and Switch Cluster Configuration

Figure 1-3 shows a configuration for a network of approximately 500 employees. This network uses a collapsed backbone and switch clusters. A collapsed backbone has high-bandwidth uplinks from all segments and subnetworks to a single device, such as a Gigabit switch, that serves as a single point for monitoring and controlling the network. You can use a Catalyst 3550-12T-L3 switch, as shown, or a Catalyst 3508G XL switch to create a Gigabit backbone. A Catalyst 3550-12T-L3 backbone switch provides the benefits of inter-VLAN routing and allows the router to focus on WAN access.

The workgroups are created by clustering all the Catalyst switches except the Catalyst 4908G-L3 switch. Using CMS and Cisco switch clustering technology, you can group the switches into multiple clusters, as shown, or into a single cluster. You can manage a cluster through the IP address of its active and standby command switches, regardless of the geographic location of the cluster members.

This network uses VLANs to segment the network logically into well-defined broadcast groups and for security management. Data and multimedia traffic are configured on the same VLAN. Voice traffic from the Cisco IP Phones are configured on separate voice VLAN IDs (VVIDs). You can have up to

four VVIDs per wiring closet. If data, multimedia, and voice traffic are assigned to the same VLAN, only one VLAN can be configured per wiring closet. For any switch port connected to Cisco IP Phones, 802.1P/Q QoS gives forwarding priority to voice traffic over data traffic.

Grouping servers in a centralized location provides benefits such as security and easier maintenance. The Gigabit connections to a server farm provide the workgroups full access to the network resources (such as a call-processing server running Cisco CallManager software, a DHCP server, or an IP/TV multicast server).

Cisco IP Phones are connected???using standard straight-through, twisted-pair cable with RJ-45 connectors???to the 10/100 inline-power ports on the Catalyst 3524-PWR XL switches and to the 10/100 ports on the Catalyst 2950 switches. These multiservice switch ports automatically detect if an IP phone is connected. Cisco CallManager controls call processing, routing, and IP phone features and configuration. Users with workstations running Cisco SoftPhone software can place, receive, and control calls from their PCs. Using Cisco IP Phones, Cisco CallManager software, and Cisco SoftPhone software integrates telephony and IP networks, and the IP network supports both voice and data.

Each 10/100 inline-power port on the Catalyst 3524-PWR XL switches provides ???48 VDC power to the Cisco IP Phone. The IP phone can receive redundant power when it also is connected to an AC power source. IP phones not connected to the Catalyst 3524-PWR XL switches receive power from an AC power source.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 1 Overview

Network Configuration Examples

Figure 1-4 Large Campus Configuration

IP telephony

WANnetwork or

PSTN

Multidwelling Network Using Catalyst 2950 Switches

A growing segment of residential and commercial customers are requiring high-speed access to Ethernet metropolitan-area networks (MANs). Figure 1-5 shows a configuration for a Gigabit Ethernet MAN ring using Catalyst 3550 multilayer switches as aggregation switches in the mini-point-of-presence (POP) location. These switches are connected through 1000BASE-X GBIC ports.

The resident switches can be Catalyst 2950 switches, providing customers with high-speed connections to the MAN. Catalyst 2912-LRE or 2924-LRE XL Layer 2-only switches also can be used as residential switches for customers requiring connectivity through existing telephone lines. The Catalyst 2912-LRE or 2924-LRE XL switches can then connect to another residential switch or to an aggregation switch.

For more information about the LRE switches, refer to the Catalyst 2900 Series XL Hardware Installation Guide.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 1 Overview

Where to Go Next

Where to Go Next

Before configuring the switch, review these sections for start up information:

???Chapter 2, ???Using the Command-Line Interface???

???Chapter 3, ???Getting Started with CMS???

???Chapter 4, ???Assigning the Switch IP Address and Default Gateway???

???Chapter 5, ???Configuring IE2100 CNS Agents???

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 1 Overview

Where to Go Next

Catalyst 2950 Desktop Switch Software Configuration Guide

C H A P T E R 2

Using the Command-Line Interface

This chapter describes the IOS command-line interface (CLI) that you can use to configure your switches. It contains these sections:

???IOS Command Modes, page 2-1

???Getting Help, page 2-3

???Abbreviating Commands, page 2-3

???Using no and default Forms of Commands, page 2-4

???Understanding CLI Messages, page 2-4

???Using Command History, page 2-5

???Using Editing Features, page 2-6

???Searching and Filtering Output of show and more Commands, page 2-9

???Accessing the CLI, page 2-9

IOS Command Modes

The Cisco IOS user interface is divided into many different modes. The commands available to you depend on which mode you are currently in. Enter a question mark (?) at the system prompt to obtain a list of commands available for each command mode.

When you start a session on the switch, you begin in user mode, often called user EXEC mode. Only a limited subset of the commands are available in user EXEC mode. For example, most of the user EXEC commands are one-time commands, such as show commands, which show the current configuration status, and clear commands, which clear counters or interfaces. The user EXEC commands are not saved when the switch reboots.

To have access to all commands, you must enter privileged EXEC mode. Normally, you must enter a password to enter privileged EXEC mode. From this mode, you can enter any privileged EXEC command or enter global configuration mode.

Using the configuration modes (global, interface, and line), you can make changes to the running configuration. If you save the configuration, these commands are stored and used when the switch reboots. To access the various configuration modes, you must start at global configuration mode. From global configuration mode, you can enter interface configuration mode and line configuration mode.

Table 2-1 describes the main command modes, how to access each one, the prompt you see in that mode, and how to exit the mode. The examples in the table use the host name Switch.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 2 Using the Command-Line Interface

IOS Command Modes

Table 2-1 Command Mode Summary

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 2 Using the Command-Line Interface

Getting Help

Getting Help

You can enter a question mark (?) at the system prompt to display a list of commands available for each command mode. You can also obtain a list of associated keywords and arguments for any command, as shown in Table 2-2.

Table 2-2 Help Summary

Abbreviating Commands

You have to enter only enough characters for the switch to recognize the command as unique. This example shows how to enter the show configuration privileged EXEC command:

Switch# show conf

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 2 Using the Command-Line Interface

Using no and default Forms of Commands

Using no and default Forms of Commands

Almost every configuration command also has a no form. In general, use the no form to disable a feature or function or reverse the action of a command. For example, the no shutdown interface configuration command reverses the shutdown of an interface. Use the command without the keyword no to re-enable a disabled feature or to enable a feature that is disabled by default.

Configuration commands can also have a default form. The default form of a command returns the command setting to its default. Most commands are disabled by default, so the default form is the same as the no form. However, some commands are enabled by default and have variables set to certain default values. In these cases, the default command enables the command and sets variables to their default values.

Understanding CLI Messages

Table 2-3 lists some error messages that you might encounter while using the CLI to configure your switch.

Table 2-3 Common CLI Error Messages

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 2 Using the Command-Line Interface

Using Command History

Using Command History

The IOS provides a history or record of commands that you have entered. This feature is particularly useful for recalling long or complex commands or entries, including access lists. You can customize the command history feature to suit your needs as described in these sections:

???Changing the Command History Buffer Size, page 2-5

???Recalling Commands, page 2-5

???Disabling the Command History Feature, page 2-6

Changing the Command History Buffer Size

By default, the switch records ten command lines in its history buffer. Beginning in privileged EXEC mode, enter this command to change the number of command lines that the switch records during the current terminal session:

Switch# terminal history [size number-of-lines]

The range is from 0 to 256.

Beginning in line configuration mode, enter this command to configure the number of command lines the switch records for all sessions on a particular line:

Switch(config-line)# history [size number-of-lines]

The range is from 0 to 256.

Recalling Commands

To recall commands from the history buffer, perform one of the actions listed in Table 2-4:

Table 2-4 Recalling Commands

1. The arrow keys function only on ANSI-compatible terminals such as VT100s.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 2 Using the Command-Line Interface

Using Editing Features

Disabling the Command History Feature

The command history feature is automatically enabled.

To disable the feature during the current terminal session, enter the terminal no history privileged EXEC command.

To disable command history for the line, enter the no history line configuration command.

Using Editing Features

This section describes the editing features that can help you manipulate the command line. It contains these sections:

???Enabling and Disabling Editing Features, page 2-6

???Editing Commands through Keystrokes, page 2-7

???Editing Command Lines that Wrap, page 2-8

Enabling and Disabling Editing Features

Although enhanced editing mode is automatically enabled, you can disable it.

To re-enable the enhanced editing mode for the current terminal session, enter this command in privileged EXEC mode:

Switch# terminal editing

To reconfigure a specific line to have enhanced editing mode, enter this command in line configuration mode:

Switch(config-line)# editing

To globally disable enhanced editing mode, enter this command in line configuration mode:

Switch(config-line)# no editing

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 2 Using the Command-Line Interface

Using Editing Features

Editing Commands through Keystrokes

Table 2-5 shows the keystrokes that you need to edit command lines.

Table 2-5 Editing Commands through Keystrokes

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 2 Using the Command-Line Interface

Using Editing Features

Table 2-5 Editing Commands through Keystrokes (continued)

1. The arrow keys function only on ANSI-compatible terminals such as VT100s.

Editing Command Lines that Wrap

You can use a wraparound feature for commands that extend beyond a single line on the screen. When the cursor reaches the right margin, the command line shifts ten spaces to the left. You cannot see the first ten characters of the line, but you can scroll back and check the syntax at the beginning of the command.

To scroll back to the beginning of the command entry, press Ctrl-B or the left arrow key repeatedly. You can also press Ctrl-A to immediately move to the beginning of the line.

Note The arrow keys function only on ANSI-compatible terminals such as VT100s.

In this example, the access-list global configuration command entry extends beyond one line. When the cursor first reaches the end of the line, the line is shifted ten spaces to the left and redisplayed. The dollar sign ($) shows that the line has been scrolled to the left. Each time the cursor reaches the end of the line, the line is again shifted ten spaces to the left.

Switch(config)# access-list 101 permit tcp 131.108.2.5 255.255.255.0 131.108.1

Switch(config)# $ 101 permit tcp 131.108.2.5 255.255.255.0 131.108.1.20 255.25

Switch(config)# $t tcp 131.108.2.5 255.255.255.0 131.108.1.20 255.255.255.0 eq

Switch(config)# $108.2.5 255.255.255.0 131.108.1.20 255.255.255.0 eq 45

After you complete the entry, press Ctrl-A to check the complete syntax before pressing the Return key to execute the command. The dollar sign ($) appears at the end of the line to show that the line has been scrolled to the right:

Switch(config)# access-list 101 permit tcp 131.108.2.5 255.255.255.0 131.108.1$

The software assumes you have a terminal screen that is 80 columns wide. If you have a width other than that, use the terminal width privileged EXEC command to set the width of your terminal.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 2 Using the Command-Line Interface

Searching and Filtering Output of show and more Commands

Use line wrapping with the command history feature to recall and modify previous complex command entries. For information about recalling previous command entries, see the ???Editing Commands through Keystrokes??? section on page 2-7.

Searching and Filtering Output of show and more Commands

You can search and filter the output for show and more commands. This is useful when you need to sort through large amounts of output or if you want to exclude output that you do not need to see.

To use this functionality, enter a show or more command followed by the pipe character (|), one of the keywords begin, include, or exclude, and an expression that you want to search for or filter out:

command | {begin | include | exclude} regular-expression

Expressions are case sensitive. For example, if you enter | exclude output, the lines that contain output are not displayed, but the lines that contain Output are displayed.

This example shows how to include in the output display only lines where the expression protocol appears:

Switch# show interfaces | include protocol

Vlan1 is up, line protocol is up

Vlan10 is up, line protocol is down

GigabitEthernet0/1 is up, line protocol is down

GigabitEthernet0/2 is up, line protocol is up

Accessing the CLI

Before you can access the CLI, you need to connect a terminal or PC to the switch console port and power on the switch as described in the hardware installation guide that shipped with your switch. Then, to understand the boot process and the options available for assigning IP information, see Chapter 4, ???Assigning the Switch IP Address and Default Gateway.???

If your switch is already configured, you can access the CLI through a local console connection or through a remote Telnet session, but your switch must first be configured for this type of access. For more information, see the ???Setting a Telnet Password for a Terminal Line??? section on page 7-5.

You can establish a connection with the switch in one of two ways:

???Connecting the switch console port to a management station or dial-up modem. For information about connecting to the console port, refer to the switch hardware installation guide.

???Using any Telnet TCP/IP package from a remote management station. The switch must have network connectivity with the Telnet client, and the switch must have an enable secret password configured.

For information about configuring the switch for Telnet access, see the ???Setting a Telnet Password for a Terminal Line??? section on page 7-5. The switch supports up to 16 simultaneous Telnet sessions. Changes made by one Telnet user are reflected in all other Telnet sessions.

After you connect through the console port or through a Telnet session, the user EXEC prompt appears on the management station.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 2 Using the Command-Line Interface

Accessing the CLI from a Browser

Accessing the CLI from a Browser

This procedure assumes you have met the software requirements (including browser and Java plug-in configurations) and have assigned IP information and a Telnet password to the switch or command switch, as described in the release notes.

To access the CLI from a web browser, follow these steps:

Step 1 Start one of the supported browsers.

Step 2 In the URL field, enter the IP address of the command switch.

Step 3 When the Cisco Systems Access page appears, click Telnet to start a Telnet session.

You can also access the CLI by clicking Monitor the router- HTML access to the command line interface from the Cisco Systems Access page. For information about the Cisco Systems Access page, see the ???Accessing CMS??? section in the release notes.

Step 4 Enter the switch password.

The user EXEC prompt appears on the management station.

Note Copies of the CMS pages that you display are saved in your browser memory cache until you exit the browser session. A password is not required to redisplay these pages, including the Cisco Systems Access page. You can access the CLI by clicking Web Console - HTML access to the command line interface from a cached copy of the Cisco Systems Access page. To prevent unauthorized access to CMS and the CLI, exit your browser to end the browser session.

Catalyst 2950 Desktop Switch Software Configuration Guide

C H A P T E R 3

Getting Started with CMS

This chapter provides these topics about the Cluster Management Suite (CMS) software:

???Features, page 3-2

???Front Panel View, page 3-4

???Topology View, page 3-9

???Menus and Toolbar, page 3-14

???Interaction Modes, page 3-23

???Wizards, page 3-24

???Online Help, page 3-25

???CMS Window Components, page 3-26

???Accessing CMS, page 3-28

???Verifying Your Changes, page 3-30

???Saving Your Configuration, page 3-30

???Restoring Your Configuration, page 3-31

???CMS Preferences, page 3-31

???Using Different Versions of CMS, page 3-31

???Where to Go Next, page 3-32

Note For system requirements and for browser and Java plug-in configuration procedures, refer to the release notes.

??? For procedures for using CMS, refer to the online help.

Note This chapter describes CMS on the Catalyst 2950 switches. Refer to the appropriate switch documentation for descriptions of the web-based management software used on other Catalyst switches.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Features

Features

CMS provides these features (Figure 3-1) for managing switch clusters and individual switches from Web browsers such as Netscape Communicator or Microsoft Internet Explorer:

???Two views of your network that can be displayed at the same time:

???The Front Panel view displays the front-panel image of a specific switch or the front-panel images of all switches in a cluster. From this view, you can select multiple ports or multiple switches and configure them with the same settings.

When CMS is launched from a command switch, the Front Panel view displays the front-panel images of all switches in the cluster. When CMS is launched from a noncommand switch, the Front Panel view displays only the front panel of the specific switch.

Note CMS from a standalone switch or from a noncommand switch is referred to as Device Manager (also referred to as Switch Manager). Device Manager is for configuring an individual switch. When you select Device Manager for a specific switch in the cluster, you launch a separate CMS session. The Device Manager interface can vary between the Catalyst switch platforms.

???The Topology view displays a network map that uses icons that represent switch clusters, cluster members, cluster candidates, neighboring devices that are not eligible to join a cluster, and link types. From this view, you can select multiple switches and configure them to run with the same settings. You can also display link information in the form of link reports and link graphs.

This view is available only when CMS is launched from a command switch.

???Menus and toolbar to access configuration and management options:

???The menu bar provides the complete list of options for managing a single switch and switch clusters.

???The toolbar provides buttons for commonly used switch and cluster configuration options and information windows such as legends and online help.

???The port popup menu, in the Front Panel view, provides options specific for configuring and monitoring switch ports.

???The device popup menu, in either the Front Panel or the Topology views, provides switch and cluster configuration and monitoring options.

???The candidate, member, and link popup menus provide options for configuring and monitoring devices and links in the Topology view.

The toolbar and popup menus provide quick ways to access frequently used menu-bar options.

???Tools to simplify configuration tasks:

???Interactive modes???guide mode and expert mode???that control the presentation of some complex configuration options

???Wizards that require minimal information from you to configure some complex features

???Comprehensive online help that provides high-level concepts and procedures for performing tasks from the window

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Front Panel View

Cluster Tree

The cluster tree (Figure 3-2) appears in the left frame of the Front Panel view and shows the name of the cluster and a list of its members. The sequence of the cluster-tree icons (Figure 3-4) mirror the sequence of the front-panel images. You can change the sequence by selecting View > Arrange Front Panel. The colors of the devices in the cluster tree show the status of the devices (Table 3-1).

If you want to configure switch or cluster settings on one or more switches, select the appropriate front-panel images.

???To select a front-panel image, click either the cluster-tree icon or the corresponding front-panel image. The front-panel image is then highlighted with a yellow outline.

???To select multiple front-panel images, press the Ctrl key, and left-click the cluster-tree icons or the front-panel images. To deselect an icon or image, press the Ctrl key, and left-click the icon or image.

If the cluster has many switches, you might need to scroll down the window to display the rest of the front-panel images. Instead of scrolling, you can click an icon in the cluster tree, and CMS then scrolls and displays the corresponding front-panel image.

Figure 3-4 Cluster-Tree Icons

Table 3-1 Cluster Tree Icon Colors

Front-Panel Images

You can manage the switch from a remote station by using the front-panel images. The front-panel images are updated based on the network polling interval that you set from CMS > Preferences.

This section includes descriptions of the LED images. Similar descriptions of the switch LEDs are provided in the switch hardware installation guide.

Note The Preferences window is available if your switch access level is read-only. For more information about the read-only access mode, see the ???Access Modes in CMS??? section on page 3-29.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Front Panel View

Figure 3-5 shows the port icons as they appear in the front-panel images. To select a port, click the port on the front-panel image. The port is then highlighted with a yellow outline. To select multiple ports, you can:

???Press the left mouse button, drag the pointer over the group of ports that you want to select, and then release the mouse button.

???Press the Ctrl key, and click the ports that you want to select.

???Right-click a port, and select Select All Ports from the port popup menu.

Figure 3-5 Port Icons

Table 3-2 describes the colors representing the wavelengths on the CWDM GBIC modules. For port status LED information, see the ???Port Modes and LEDs??? section on page 3-7.

Table 3-2 Port Icon Colors for the CWDM GBIC Module Ports

Redundant Power System LED

The Redundant Power System (RPS) LED shows the RPS status (Table 3-3). Certain switches in the switch cluster use a specific RPS model:

???Cisco RPS 300 (model PWR300-AC-RPS-N1)???Catalyst 2900 LRE XL, Catalyst 2950, Catalyst 3524-PWR XL, and Catalyst 3550 switches

???Cisco RPS 600 (model PWR600-AC-RPS)???Catalyst 2900 XL and Catalyst 3500 XL switches, except the Catalyst 2900 LRE XL and Catalyst 3524-PWR XL switches

Refer to the appropriate switch hardware documentation for RPS descriptions specific for the switch.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Front Panel View

Table 3-3 RPS LED

Port Modes and LEDs

The port modes (Table 3-4) determine the type of information displayed through the port LEDs. When you change port modes, the meanings of the port LED colors (Table 3-5) also change.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Front Panel View

VLAN Membership Modes

Ports in the Front Panel view are outlined by colors (Table 3-6) when you click Highlight VLAN Port Membership Modes on the Configure VLANs tab on the VLAN window

(VLAN > VLAN > Configure VLANs). The colors show the VLAN membership mode of each port. The VLAN membership mode determines the kind of traffic the port carries and the number of VLANs it can belong to. For more information about these modes, see the ???VLAN Port Membership Modes??? section on page 13-3.

Note This feature is not supported on the Catalyst 1900 and Catalyst 2820 switches.

Table 3-6 VLAN Membership Modes

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Topology View

Topology View

The Topology view displays how the devices within a switch cluster are connected and how the switch cluster is connected to other clusters and devices. From this view, you can add and remove cluster members. This view provides two levels of detail of the network topology:

???When you right-click a cluster icon and select Expand Cluster, the Topology view displays the switch cluster in detail. This view shows the command switch and member switches in a cluster. It also shows candidate switches that can join the cluster. This view does not display the details of any neighboring switch clusters (Figure 3-6).

???When you right-click a command-switch icon and select Collapse Cluster, the cluster is collapsed and represented by a single icon. The view shows how the cluster is connected to other clusters, candidate switches, and devices that are not eligible to join the cluster (such as routers, access points, IP phones, and so on) (Figure 3-7).

Note The Topology view displays only the switch cluster and network neighborhood of the specific command or member switch that you access. To display a different switch cluster, you need to access the command switch or member switch of that cluster.

You can arrange the device icons in this view. To move a device icon, click and drag the icon. To select multiple device icons, you can either:

???Press the left mouse button, drag the pointer over the group of device icons that you want to select, and then release the mouse button.

???Press the Ctrl key, and click the device icons that you want to select.

After selecting the icons, drag the icons to any area in the view.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Topology View

Topology Icons

The Topology view and the cluster tree use the same set of device icons to represent clusters, command and standby command switches, and member switches (Figure 3-8). The Topology view also uses additional icons to represent these types of neighboring devices:

???Customer premises equipment (CPE) devices that are connected to Long-Reach Ethernet (LRE) switches

???Devices that are not eligible to join the cluster, such as Cisco IP phones, Cisco access points, and Cisco Discovery Protocol (CDP)-capable hubs and routers

Note The System Switch Processor (SSP) card in the Cisco Integrated Communications System (ICS) 7750 appears as a Layer 2 switch. SSP cards are not eligible to join switch clusters.

???Devices that are identified as unknown devices, such as some Cisco devices and third-party devices

Tip Neighboring devices are only displayed if they are connected to cluster members. To display neighboring devices in the Topology view, either add the switch to which they are connected to a cluster, or enable that switch as a command switch.

Note Candidate switches are distinguished by the color of their device label. Device labels and their colors are described in the ???Colors in the Topology View??? section on page 3-12.

To select a device, click the icon. The icon is then highlighted. To select multiple devices, you can either:

???Press the left mouse button, drag the pointer over the group of icons that you want to select, and then release the mouse button.

???Press the Ctrl key, and click the icons that you want to select.

Figure 3-8 Topology-View Device Icons

The Topology view also uses a set of link icons (Figure 3-9) to show the link type and status between two devices. To select a link, click the link that you want to select. To select multiple links, press the Ctrl key, and click the links that you want to select.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Topology View

Figure 3-9 Topology-View Link Icons

Device and Link Labels

The Topology view displays device and link information by using these labels:

???Cluster and switch names

???Switch MAC and IP addresses

???Link type between the devices

???Link speed and IDs of the interfaces on both ends of the link When using these labels, keep these considerations in mind:

???The IP address displays only in the labels for the command switch and member switches.

???The label of a neighboring cluster icon only displays the IP address of the command-switch IP address.

???The displayed link speeds are the actual link speeds except on the LRE links, which display the administratively assigned speed settings.

You can change the label settings from the Topology Options window, which is displayed by selecting

View > Topology Options.

Colors in the Topology View

The colors of the Topology view icons show the status of the devices and links (Table 3-7, Table 3-8, and Table 3-9).

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Topology View

Table 3-7 Device Icon Colors

1. Available only on the cluster members.

Table 3-8 Single Link Icon Colors

The color of a device label shows the cluster membership of the device (Table 3-10).

Table 3-10 Device Label Colors

Topology Display Options

You can set the type of information displayed in the Topology view by changing the settings in the Topology Options window. To display this window, select View > Topology Options. From this window, you can select:

???Device icons that you want displayed in or filtered from the Topology View window

???Interface IDs and Actual Speed values that you want displayed in the Link window

???Host Names, IP addresses, and MAC address labels that you want displayed in the Node window

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Menus and Toolbar

Menus and Toolbar

The configuration and monitoring options for configuring switches and switch clusters are available from menus and a toolbar.

Menu Bar

The menu bar provides the complete list of options for managing a single switch and switch cluster.

Options displayed from the menu bar can vary:

Note The menu-bar options on a Catalyst 2950 switch change depending on whether the switch is running the enhanced software image (EI) or the standard image (SI). The footnotes in Table 3-11 list the options available if the switch is running the EI.

???Access modes affect the availability of features from CMS. The footnotes in Table 3-11 describe the availability of an option based on your access mode in CMS: read-only (access level 1???14) and read-write (access level 15). For more information about how access modes affect CMS, see the ???Access Modes in CMS??? section on page 3-29.

???The option for enabling a command switch is only available from a CMS session launched from a command-capable switch.

???Cluster management tasks, such as upgrading the software of groups of switches, are available only from a CMS session launched from a command switch.

???If you launch CMS from a specific switch, the menu bar displays the features supported only by that switch.

???If you launch CMS from a command switch, the menu bar displays the features supported on the switches in the cluster, with these exceptions:

???If the command switch is a Layer 3 switch, such as a Catalyst 3550 switch, the menu bar displays the features of all Layer 3 and Layer 2 switches in the cluster.

???If the command switch is a Layer 2 switch, such as a Catalyst 2950 or Catalyst 3500 XL switch, the menu bar displays the features of all Layer 2 switches in the cluster. The menu bar does not display Layer 3 features even if the cluster has Catalyst 3550 Layer 3 member switches.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Menus and Toolbar

???If you have a Catalyst 3550 command switch, the standby command switches should be Catalyst 3550 switches.

???If you have a Catalyst 2950 command switch, the standby command switches should be Catalyst 2950 switches.

???If you have a Catalyst 2900 XL or Catalyst 3500 XL command switch, the standby command switches should be Catalyst 2900 XL and Catalyst 3500 XL switches.

Refer to the release notes for the Catalyst switches that can be part of a switch cluster.

Note Unless noted otherwise, Table 3-11 lists the menu-bar options available from a Catalyst 2950 command switch when the cluster contains only Catalyst 2950 member switches. The menu bar of the command switch displays all menu-bar options available from the cluster, including options from member switches from other cluster-capable switch platforms.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Menus and Toolbar

Table 3-11 Menu Bar

Chapter 3 Getting Started with CMS

Chapter 3 Getting Started with CMS

Menus and Toolbar

Table 3-11 Menu Bar (continued)

1.Not available in read-only mode. For more information about the read-only and read-write access modes, see the ???Access Modes in CMS??? section on page 3-29.

2.Some options from this menu option are not available in read-only mode.

3.Available only from a Device Manager session on a cluster member.

4.Available only from a Device Manager session on a command-capable switch that is not a cluster member.

5.Available only from a cluster management session.

6.Available only from a switch running the EI.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Menus and Toolbar

Toolbar

The toolbar buttons display commonly-used switch and cluster configuration options and information windows such as legends and online help. Hover the cursor over an icon to display the feature. Table 3-12 describes the toolbar options, from left to right on the toolbar.

Table 3-12 Toolbar Buttons

1.Not available in read-only mode. For more information about the read-only and read-write access modes, see the ???Access Modes in CMS??? section on page 3-29.

2.Some options from this menu option are not available in read-only mode.

3.Available only from a cluster-management session.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Menus and Toolbar

Front Panel View Popup Menus

These popup menus are available in the Front Panel view.

Device Popup Menu

You can display all switch and cluster configuration windows from the menu bar, or you can display commonly used configuration windows from the device popup menu (Table 3-13). To display the device popup menu, click the switch icon from the cluster tree or the front-panel image itself, and right-click.

Table 3-13 Device Popup Menu

1.Available from a cluster member switch but not from the command switch.

2.Not available in read-only mode. For more information about the read-only mode, see the ???Access Modes in CMS??? section on page 3-29.

3.Available only from the command switch.

4.Available only from a cluster-management session.

Port Popup Menu

You can display all port configuration windows from the Port menu on the menu bar, or you can display commonly used port configuration windows from the port popup menu (Table 3-14). To display the port popup menu, click a specific port image, and right-click.

Table 3-14 Port Popup Menu

1.Some options from this menu option are not available in read-only mode.

2.Available on switches that support the Port Security feature.

3.Available only when there is an active link on the port (that is, the port LED is green when in port status mode).

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Menus and Toolbar

Topology View Popup Menus

These popup menus are available in the Topology view.

Link Popup Menu

You can display reports and graphs for a specific link displayed in the Topology view (Table 3-15). To display the link popup menu, click the link icon, and right-click.

Table 3-15 Link Popup Menu

The Link Report and Link Graph options are not available if at both ends of the link are

???Candidate switches

???Catalyst 1900 and Catalyst 2820 switches

???Devices that are not eligible to join the cluster

If multiple links are configured between two devices, when you click the link icon and right-click, the Multilink Content window appears (Figure 3-10). Click the link icon in this window, and right-click to display the link popup menu specific for that link.

Figure 3-10 Multilink Decomposer Window

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Menus and Toolbar

Device Popup Menus

Specific devices in the Topology view display a specific popup menu:

???Cluster (Table 3-16)

???Command switch (Table 3-17)

???Member or standby command switch (Table 3-18)

???Candidate switch with an IP address (Table 3-19)

???Candidate switch without an IP address (Table 3-20)

???Neighboring devices (Table 3-21)

Note The Device Manager option in these popup menus is available in read-only mode on Catalyst 2900 XL and Catalyst 3500 XL switches running Release 12.0(5)WC2 and later. It is also available on

Catalyst 2950 switches running Release 12.1(6)EA2 and later and on Catalyst 3550 switch running Release 12.1(8)EA1 or later. It is not available on the Catalyst 1900 and Catalyst 2820 switches.

To display a device popup menu, click an icon, and right-click.

Table 3-16 Device Popup Menu of a Cluster Icon

1.Not available in read-only mode. For more information about the read-only and read-write access modes, see the ???Access Modes in CMS??? section on page 3-29.

Table 3-18 Device Popup Menu of a Member or Standby Command-Switch Icon

1.Available only from a cluster-management session.

2.Available from a cluster member switch but not from the command switch.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Interaction Modes

Table 3-19 Device Popup Menu of a Candidate-Switch Icon (When the Candidate Switch Has an IP Address)

1.Not available in read-only mode. For more information about the read-only and read-write access modes, see the ???Access Modes in CMS??? section on page 3-29.

2.Available from a cluster member switch but not from the command switch.

Table 3-20 Device Popup Menu of a Candidate-Switch Icon (When the Candidate Switch Does Not Have an IP Address)

1.Not available in read-only mode. For more information about the read-only and read-write access modes, see the ???Access Modes in CMS??? section on page 3-29.

Table 3-21 Device Popup Menu of a Neighboring-Device Icon

1. Available from a cluster member switch but not from the command switch.

Interaction Modes

You can change the interaction mode of CMS to either guide or expert mode. Guide mode steps you through each feature option and provides information about the parameter. Expert mode displays a configuration window in which you configure the feature options.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Wizards

Guide Mode

Note Guide mode is not available if your switch access level is read-only. For more information about the read-only access mode, see the ???Access Modes in CMS??? section on page 3-29.

Guide mode is for users who want a step-by-step approach for completing a specific configuration task. This mode is not available for all features. A menu-bar option that has a person icon means that guide mode is available for that option.

When you click Guide Mode and then select a menu-bar option that supports guide mode, CMS displays a specific parameter of the feature with information about the parameter field. To configure the feature, you provide the information that CMS requests in each step until you click Finish in the last step.

Clicking Cancel at any time closes and ends the configuration task without applying any changes.

If Expert Mode is selected and you want to use guide mode, you must click Guide Mode before selecting an option from the menu bar, tool bar, or popup menu. If you change the interaction mode after selecting a configuration option, the mode change does not take effect until you select another configuration option.

Expert Mode

Expert mode is for users who prefer to display all the parameter fields of a feature in a single CMS window. Information about the parameter fields is available by clicking the Help button.

Wizards

Note Wizards are not available if your switch access level is read-only. For more information about the read-only access mode, see the ???Access Modes in CMS??? section on page 3-29.

Wizards simplify some configuration tasks on the switch. Similar to the guide mode, wizards provide a step-by-step approach for completing a specific configuration task. Unlike guide mode, a wizard does not prompt you to provide information for all of the feature options. Instead, it prompts you to provide minimal information and then uses the default settings of the remaining options to set up default configurations.

Wizards are not available for all features. A menu-bar option that has wizard means that selecting that option launches the wizard for that feature.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

CMS Window Components

window does not include Catalyst 1900 and Catalyst 2820 switches even though they are part of the cluster. Similarly, the Host Name list on the LRE Profiles window only lists the LRE switches in the cluster.

Tabs, Lists, and Tables

Some CMS windows have tabs that present different sets of information. Tabs are arranged like folder headings across the top of the window. Click the tab to display its information.

Listed information can often be changed by selecting an item from a list. To change the information, select one or more items, and click Modify. Changing multiple items is limited to those items that apply to at least one of the selections.

Some CMS windows present information in a table format. You can edit the information in these tables.

Note You can resize the width of the columns to display the column headings, or you can hover your cursor over the heading to display a popup description of the column.

Icons Used in Windows

Some window have icons for sorting information in tables, for showing which cells in a table are editable, and for displaying further information from Cisco.com (Figure 3-13).

Figure 3-13 Window Icons

Buttons

These are the most common buttons that you use to change the information in a CMS window:

???OK???Save any changes and close the window. If you made no changes, the window closes. If CMS detects errors in your entry, the window remains open. For more information about error detection, see the ???Error Checking??? section on page 3-30.

???Apply???Save any changes made in the window and leave the window open. If you made no changes, the Apply button is disabled.

???Refresh???Update the CMS window with the latest status of the device. Unsaved changes are lost.

???Cancel???Do not save any changes made in the window and close the window.

???Help???Display procedures on performing tasks from the window.

???Modify???Display the secondary window for changing information on the selected item or items. You usually select an item from a list or table and click Modify.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Accessing CMS

Accessing CMS

This section assumes the following:

???You know the IP address and password of the command switch or a specific switch. This information is either:

???Assigned to the switch by following the setup program, as described in the release notes.

???Changed on the switch by following the information in the ???Assigning Switch Information??? section on page 4-2 and ???Preventing Unauthorized Access to Your Switch??? section on page 7-1. Considerations for assigning IP addresses and passwords to a command switch and cluster members are described in the ???IP Addresses??? section on page 6-16 and the ???Passwords??? section on page 6-17.

???You know your access privilege level to the switch.

???You have referred to the release notes for system requirements and have followed the procedures for installing the required Java plug-ins and configuring your browser.

Caution Copies of the CMS pages you display are saved in your browser memory cache until you exit the browser session. A password is not required to redisplay these pages, including the Cisco Systems Access page. You can access the CLI by clicking Monitor the router - HTML access to the command line interface from a cached copy of the Cisco Systems Access page. To prevent unauthorized access to CMS and the CLI, exit your browser to end the browser session.

Note If you have configured the Terminal Access Controller Access Control System Plus (TACACS+) or Remote Authentication Dial-In User Service (RADIUS) feature on the switch, you can still access the switch through CMS. For information about how inconsistent authentication configurations in switch clusters can affect access through CMS, see the ???TACACS+ and RADIUS??? section on page 6-18.

To access CMS, follow these steps:

Step 1 Enter the switch IP address and your privilege level in the browser Location field (Netscape Communicator) or Address field (Microsoft Internet Explorer). For example:

http://10.1.126.45:184/level/14/

where 10.1.126.45 is the switch IP address, 184 is the HTTP port, and level/14 is the privilege level. You do not need to enter the HTTP port if the switch is using HTTP port 80 (the default) or enter the privilege level if you have read-write access to the switch (privilege level is 15). For information about the HTTP port, see the ???HTTP Access to CMS??? section on page 3-29. For information about privilege levels, see the ???Access Modes in CMS??? section on page 3-29.

Step 2 When prompted for a username and password, enter only the switch enable password. CMS prompts you a second time for a username and password. Enter only the enable password again.

If you configure a local username and password, make sure you enable it by using the ip http authentication global configuration command. Enter your username and password when prompted.

Step 3 Click Web Console.

If you access CMS from a standalone or member switch, Device Manager appears. If you access CMS from a command switch, you can display the Front Panel and Topology views.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Accessing CMS

Access Modes in CMS

CMS provides two levels of access to the configuration options: read-write access and read-only access. Privilege levels 0 to 15 are supported.

???Privilege level 15 provides you with read-write access to CMS.

???Privilege levels 1 to 14 provide you with read-only access to CMS. Any options in the CMS windows, menu bar, toolbar, and popup menus that change the switch or cluster configuration are not shown in read-only mode.

???Privilege level 0 denies access to CMS.

If you do not include a privilege level when you access CMS, the switch verifies if you have privilege-level 15. If you do not, you are denied access to CMS. If you do have privilege-level 15, you are granted read-write access. Therefore, you do not need to include the privilege level if it is 15. Entering zero denies access to CMS. For more information about privilege levels, see the ???Preventing Unauthorized Access to Your Switch??? section on page 7-1.

HTTP Access to CMS

CMS uses Hypertext Transfer Protocol (HTTP), which is an in-band form of communication with the switch through any one of its Ethernet ports and that allows switch management from a standard web browser. The default HTTP port is 80.

If you change the HTTP port, you must include the new port number when you enter the IP address in the browser Location or Address field (for example, http://10.1.126.45:184 where 184 is the new HTTP port number).

Do not disable or otherwise misconfigure the port through which your management station is communicating with the switch. You might want to write down the port number to which you are connected. Changes to the switch IP information should be done with care.

For information about connecting to a switch port, refer to the switch hardware installation guide.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Verifying Your Changes

Verifying Your Changes

CMS provides notification cues to help you track and confirm the changes you make.

Change Notification

A green border around a field or table cell means that you made an unsaved change to the field or table cell. Previous information in that field or table cell is displayed in the window status bar. When you save the changes or if you cancel the change, the green border disappears.

Error Checking

A red border around a field means that you entered invalid data in the field. An error message also displays in the window status bar. When you enter valid data in the field, a green border replaces the red border until you either save or cancel the change.

If there is an error in communicating with the switch or if you make an error while performing an action, a message notifies you about the error.

Saving Your Configuration

Note The Save Configuration option is not available if your switch access level is read-only. For more information about the read-only access mode, see the ???Access Modes in CMS??? section on page 3-29.

Tip As you make cluster configuration changes (except for changes to the Topology view and in the Preferences window), make sure that you periodically save the configuration from the command switch. The configuration is saved on the command and member switches.

The front-panel images and CMS windows always display the running configuration of the switch. When you make a configuration change to a switch or switch cluster, the change becomes part of the running configuration. The change does not automatically become part of the configuration file, which is the startup configuration used each time the switch restarts. If you do not save your changes, they are lost when the switch restarts.

Note Catalyst 1900 and Catalyst 2820 switches automatically save configuration changes to Flash memory as they occur.

For CMS procedures for saving your switch configuration, refer to the online help.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Restoring Your Configuration

Restoring Your Configuration

After you save a switch configuration, you can restore the configuration to one or more switches for these reasons:

???You made an incorrect change to the current running configuration and want to reload a saved configuration.

???You need to reload a switch after a switch failure or power failure.

???You want to copy the configuration of a switch to other switches.

For CMS procedures for restoring a switch configuration, refer to the online help.

CMS Preferences

When you exit from CMS, your CMS preferences are saved to your PC in a file called .cms_properties. You can copy this file to other PCs. The file is stored in a default configuration directory, such as C:\Documents and Settings\username. If you cannot locate the CMS preferences file, select

Start > Search > For Files or Folders..., and search for .cms_properties.

Note In previous CMS versions, the preferences were saved in Flash memory when you exited from CMS.

Using Different Versions of CMS

When managing switch clusters through CMS, remember that clusters can have a mix of switch models using different IOS releases and that CMS in earlier IOS releases and on different switch platforms might look and function differently from CMS in this IOS release.

When you select Device > Device Manager for a cluster member, a new browser session is launched, and the CMS version for that switch is displayed.

Here are examples of how CMS can differ between IOS releases and switch platforms:

???On Catalyst switches running Release 12.0(5)WC2 or earlier or Release 12.1(6)EA1 or earlier, the CMS versions in those software releases might appear similar but are not the same as this release. For example, the Topology view in this release is not the same as the Topology view or Cluster View in those earlier software releases.

???CMS on the Catalyst 1900 and Catalyst 2820 switches is referred to as Switch Manager. Cluster management options are not available on these switches. This is the earliest version of CMS.

Refer to the documentation specific to the switch and its IOS release for descriptions of the CMS version you are using.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 3 Getting Started with CMS

Where to Go Next

Where to Go Next

Before configuring the switch, refer to these places for start-up information:

???Switch release notes on Cisco.com:

???CMS software requirements

???Procedures for running the setup program

???Procedures for browser configuration

???Procedures for accessing CMS

???Chapter 4, ???Assigning the Switch IP Address and Default Gateway???

???Chapter 7, ???Administering the Switch???

The rest of this guide provides information about and CLI procedures for the software features supported in this release. For CMS procedures and window descriptions, refer to the online help.

Catalyst 2950 Desktop Switch Software Configuration Guide

C H A P T E R 4

Assigning the Switch IP Address and Default

Gateway

This chapter describes how to create the initial switch configuration (for example, assign the switch IP address and default gateway information) by using a variety of automatic and manual methods.

Note For complete syntax and usage information for the commands used in this chapter, refer to the command reference for this release.

This chapter consists of these sections:

???Understanding the Boot Process, page 4-1

???Assigning Switch Information, page 4-2

???Checking and Saving the Running Configuration, page 4-10

Understanding the Boot Process

Before you can assign switch information (IP address, subnet mask, default gateway, secret and Telnet passwords, and so forth), you need to install and power on the switch as described in the hardware installation guide that shipped with your switch.

The normal boot process involves the operation of the boot loader software, which performs these activities:

???Performs low-level CPU initialization. It initializes the CPU registers, which control where physical memory is mapped, its quantity, its speed, and so forth.

???Performs power-on self-test (POST) for the CPU subsystem. It tests the CPU DRAM and the portion of the Flash device that makes up the Flash file system.

???Initializes the Flash file system on the system board.

???Loads a default operating system software image into memory and boots the switch.

The boot loader provides access to the Flash file system before the operating system is loaded. Normally, the boot loader is used only to load, uncompress, and launch the operating system. After the boot loader gives the operating system control of the CPU, the boot loader is not active until the next system reset or power-on.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 4 Assigning the Switch IP Address and Default Gateway

Assigning Switch Information

The boot loader also provides trap-door access into the system if the operating system has problems serious enough that it cannot be used. The trap-door mechanism provides enough access to the system so that if it is necessary, you can format the Flash file system, reinstall the operating system software image by using the XMODEM Protocol, recover from a lost or forgotten password, and finally restart the operating system. For more information, see the ???Recovering from Corrupted Software??? section on page 27-2 and the ???Recovering from a Lost or Forgotten Password??? section on page 27-2.

Before you can assign switch information, make sure you have connected a PC or terminal to the console port, and configured the PC or terminal-emulation software baud rate and character format to match those of the switch console port. For more information, refer to the hardware installation guide that shipped with your switch.

Assigning Switch Information

You can assign IP information through the switch setup program, through a Dynamic Host Configuration Protocol (DHCP) server, or manually.

Use the switch setup program if you are a new user and want to be prompted for specific IP information. With this program, you can also configure a host name and an enable secret password. It gives you the option of assigning a Telnet password (to provide security during remote management) and configuring your switch as a command or member switch of a cluster or as a standalone switch. For more information about the setup program, refer to the release notes on Cisco.com.

Use a DHCP server for centralized control and automatic assignment of IP information once the server is configured.

Note If you are using DHCP, do not respond to any of the questions in the setup program until the switch receives the dynamically-assigned IP address and reads the configuration file.

Use the manual method of configuration if you are an experienced user familiar with the switch configuration steps; otherwise, use the setup program described earlier.

This section contains this configuration information:

???Default Switch Information, page 4-3

???Understanding DHCP-Based Autoconfiguration, page 4-3

???Manually Assigning IP Information, page 4-10

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 4 Assigning the Switch IP Address and Default Gateway

Assigning Switch Information

Default Switch Information

Table 4-1 shows the default switch information.

Table 4-1 Default Switch Information

Understanding DHCP-Based Autoconfiguration

The DHCP provides configuration information to Internet hosts and internetworking devices. This protocol consists of two components: one for delivering configuration parameters from a DHCP server to a device and a mechanism for allocating network addresses to devices. DHCP is built on a client-server model, in which designated DHCP servers allocate network addresses and deliver configuration parameters to dynamically configured devices.

During DHCP-based autoconfiguration, your switch (DHCP client) is automatically configured at startup with IP address information and a configuration file.

With DHCP-based autoconfiguration, no DHCP client-side configuration is needed on your switch. However, you need to configure the DHCP server for various lease options associated with IP addresses. If you are using DHCP to relay the configuration file location on the network, you might also need to configure a Trivial File Transfer Protocol (TFTP) server and a Domain Name System (DNS) server.

The DHCP server can be on the same LAN or on a different LAN than the switch. If the DHCP server is running on a different LAN, you should configure a DHCP relay. A relay device forwards broadcast traffic between two directly connected LANs. A router does not forward broadcast packets, but it forwards packets based on the destination IP address in the received packet.

DHCP-based autoconfiguration replaces the BOOTP client functionality on your switch.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 4 Assigning the Switch IP Address and Default Gateway

Assigning Switch Information

Configuring the DHCP Server

You should configure the DHCP server with reserved leases that are bound to each switch by the switch hardware address.

If you want the switch to receive IP address information, you must configure the DHCP server with these lease options:

???IP address of the client (required)

???Subnet mask of the client (required)

???DNS server IP address (optional)

???Router IP address (default gateway address to be used by the switch) (required)

If you want the switch to receive the configuration file from a TFTP server, you must configure the DHCP server with these lease options:

???TFTP server name (required)

???Boot filename (the name of the configuration file that the client needs) (recommended)

???Host name (optional)

Depending on the settings of the DHCP server, the switch can receive IP address information, the configuration file, or both.

If you do not configure the DHCP server with the lease options described earlier, it replies to client requests with only those parameters that are configured. If the IP address and subnet mask are not in the reply, the switch is not configured. If the router IP address or TFTP server name are not found, the switch might send broadcast, instead of unicast, TFTP requests. Unavailability of other lease options does not affect autoconfiguration.

The DHCP server can be on the same LAN or on a different LAN than the switch. If the DHCP server is running on a different LAN, you should configure a DHCP relay. For more information, see the ???Configuring the Relay Device??? section on page 4-6. If your DHCP server is a Cisco device, refer to the ???IP Addressing and Services??? section in the Cisco IOS IP and IP Routing Configuration Guide for Release 12.1.

Configuring the TFTP Server

Based on the DHCP server configuration, the switch attempts to download one or more configuration files from the TFTP server. If you configured the DHCP server to respond to the switch with all the options required for IP connectivity to the TFTP server, and if you configured the DHCP server with a TFTP server name, address, and configuration filename, the switch attempts to download the specified configuration file from the specified TFTP server.

If you did not specify the configuration filename, the TFTP server, or if the configuration file could not be downloaded, the switch attempts to download a configuration file by using various combinations of filenames and TFTP server addresses. The files include the specified configuration filename (if any) and these files: network-config, cisconet.cfg, hostname.config, or hostname.cfg, where hostname is the switch???s current hostname. The TFTP server addresses used include the specified TFTP server address (if any) and the broadcast address (255.255.255.255).

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 4 Assigning the Switch IP Address and Default Gateway

Assigning Switch Information

For the switch to successfully download a configuration file, the TFTP server must contain one or more configuration files in its base directory. The files can include these files:

???The configuration file named in the DHCP reply (the actual switch configuration file).

???The network-confg or the cisconet.cfg file (known as the default configuration files).

???The router-confg or the ciscortr.cfg file (These files contain commands common to all switches. Normally, if the DHCP and TFTP servers are properly configured, these files are not accessed.)

If you specify the TFTP server name in the DHCP server-lease database, you must also configure the TFTP server name-to-IP-address mapping in the DNS-server database.

If the TFTP server to be used is on a different LAN from the switch, or if it is to be accessed by the switch through the broadcast address (which occurs if the DHCP server response does not contain all the required information described earlier), a relay must be configured to forward the TFTP packets to the TFTP server. For more information, see the ???Configuring the Relay Device??? section on page 4-6. The preferred solution is to configure the DHCP server with all the required information.

Configuring the DNS

The DHCP server uses the DNS server to resolve the TFTP server name to an IP address. You must configure the TFTP server name-to-IP address map on the DNS server. The TFTP server contains the configuration files for the switch.

You can configure the IP addresses of the DNS servers in the lease database of the DHCP server from where the DHCP replies will retrieve them. You can enter up to two DNS server IP addresses in the lease database.

The DNS server can be on the same or on a different LAN as the switch. If it is on a different LAN, the switch must be able to access it through a router.

Configuring the Relay Device

You must configure a relay device when a switch sends broadcast packets that need to be responded to by a host on a different LAN. Examples of broadcast packets that the switch might send are DHCP, DNS, and in some cases, TFTP packets. You must configure this relay device to forward received broadcast packets on an interface to the destination host.

If the relay device is a Cisco router, enable IP routing (ip routing global configuration command), and configure helper addresses by using the ip helper-address interface configuration command.

For example, in Figure 4-2, configure the router interfaces as follows:

On interface 10.0.0.2:

router(config-if)# ip helper-address 20.0.0.2 router(config-if)# ip helper-address 20.0.0.3 router(config-if)# ip helper-address 20.0.0.4

On interface 20.0.0.1

router(config-if)# ip helper-address 10.0.0.1

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 4 Assigning the Switch IP Address and Default Gateway

Assigning Switch Information

DNS Server Configuration

The DNS server maps the TFTP server name maritsu to IP address 10.0.0.3.

TFTP Server Configuration (on UNIX)

The TFTP server base directory is set to /tftpserver/work/. This directory contains the network-confg file used in the two-file read method. This file contains the host name to be assigned to the switch based on its IP address. The base directory also contains a configuration file for each switch (switch1-confg, switch2-confg, and so forth) as shown in this display:

prompt> cd /tftpserver/work/ prompt> ls

network-confg switch1-confg switch2-confg switch3-confg switch4-confg

prompt> cat network-confg ip host switch1 10.0.0.21 ip host switch2 10.0.0.22 ip host switch3 10.0.0.23 ip host switch4 10.0.0.24

DHCP Client Configuration

No configuration file is present on Switch 1 through Switch 4.

Configuration Explanation

In Figure 4-3, Switch 1 reads its configuration file as follows:

???It obtains its IP address 10.0.0.21 from the DHCP server.

???If no configuration filename is given in the DHCP server reply, Switch 1 reads the network-confg file from the base directory of the TFTP server.

???It adds the contents of the network-confg file to its host table.

???It reads its host table by indexing its IP address 10.0.0.21 to its host name (switch1).

???It reads the configuration file that corresponds to its host name; for example, it reads switch1-confg from the TFTP server.

Switches 2 through 4 retrieve their configuration files and IP addresses in the same way.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 4 Assigning the Switch IP Address and Default Gateway

Checking and Saving the Running Configuration

!

hostname Switch

!

enable secret 5 $1$ej9.$DMUvAUnZOAmvmgqBEzIxE0

!

ip subnet-zero

!

vlan 3020

cluster enable Test 0

cluster member 1 mac-address 0030.9439.0900 cluster member 2 mac-address 0001.425b.4d80

!

spanning-tree extend system-id

!

!

interface Port-channel1 no ip address

!

interface FastEthernet0/1 switchport mode access switchport voice vlan 400 switchport priority extend cos 5 no ip address

spanning-tree portfast trunk

!

interface FastEthernet0/2 switchport mode access no ip address

!

...

interface FastEthernet0/8 switchport mode access switchport voice vlan 350 no ip address

spanning-tree portfast trunk

!

interface FastEthernet0/9 switchport mode access no ip address

shutdown

!

interface FastEthernet0/10

switchport trunk native vlan 2

no ip address

speed 100

!

interface FastEthernet0/11 switchport voice vlan 4046 no ip address

shutdown

spanning-tree portfast trunk

!

interface FastEthernet0/12 switchport mode access switchport voice vlan 4011 no ip address

shutdown

spanning-tree portfast trunk

!

interface GigabitEthernet0/1 no ip address

shutdown

!

interface GigabitEthernet0/2

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 4 Assigning the Switch IP Address and Default Gateway

Checking and Saving the Running Configuration

no ip address shutdown

!

interface Vlan1

ip address 172.20.139.133 255.255.255.224 no ip route-cache

!

ip default-gateway 172.20.139.129 ip http server

!

ip access-list extended CMP-NAT-ACL

!

snmp-server engineID local 8000000903000005742809C1 snmp-server community public RO

snmp-server community public@es0 RO snmp-server enable traps MAC-Notification

!

line con 0 password letmein

line vty 0 4 password letmein login

line vty 5 15 password letmein login

!

end

To store the configuration or changes you have made to your startup configuration in Flash memory, enter this privileged EXEC command:

Switch# copy running-config startup-config

Destination filename [startup-config]?

Building configuration...

This command saves the configuration settings that you made. If you fail to do this, your configuration will be lost the next time you reload the system. To display information stored in the NVRAM section of Flash memory, use the show startup-config or more startup-config privileged EXEC command.

Catalyst 2950 Desktop Switch Software Configuration Guide

C H A P T E R 5

Configuring IE2100 CNS Agents

This chapter describes how to configure the Intelligence Engine 2100 (IE2100) Series Cisco Networking Services (CNS) embedded agents on your switch. To use the feature described in this chapter, you must have the enhanced software image (EI) installed on your switch.

Note For complete syntax and usage information for the commands used in this section, refer to the Cisco Intelligence Engine 2100 Series Configuration Registrar Manual, and select Cisco IOS Software Release 12.2 > New Feature Documentation > 12.2(2)T on Cisco.com.

This chapter consists of these sections:

???Understanding IE2100 Series Configuration Registrar Software, page 5-1

???Understanding CNS Embedded Agents, page 5-5

???Configuring CNS Embedded Agents, page 5-6

???Displaying CNS Configuration, page 5-12

Understanding IE2100 Series Configuration Registrar Software

The IE2100 Series Configuration Registrar is a network management device that acts as a configuration service for automating the deployment and management of network devices and services

(see Figure 5-1). Each Configuration Registrar manages a group of Cisco IOS devices (switches and routers) and the services that they deliver, storing their configurations and delivering them as needed. The Configuration Registrar automates initial configurations and configuration updates by generating device-specific configuration changes, sending them to the device, executing the configuration change, and logging the results.

The Configuration Registrar supports standalone and server modes and has these CNS components:

???Configuration service (web server, file manager, and namespace mapping server)

???Event service (event gateway)

???Data service directory (data models and schema)

In standalone mode, the Configuration Registrar supports an embedded CNS Directory Service. In this mode, no external directory or other data store is required. In server mode, the Configuration Registrar supports the use of a user-defined external directory.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 5 Configuring IE2100 CNS Agents

Understanding IE2100 Series Configuration Registrar Software

Figure 5-1 Configuration Registrar Architectural Overview

Service provider network

Data service Configurationdirectory

registrar

Configuration server

Event service

Web-based user interface

71444

Order entry configuration management

These sections contain this conceptual information:

???CNS Configuration Service, page 5-2

???CNS Event Service, page 5-3

???What You Should Know About ConfigID, DeviceID, and Host Name, page 5-3

CNS Configuration Service

The CNS Configuration Service is the core component of the Configuration Registrar. It consists of a configuration server that works with CNS configuration agents located on the switch. The CNS Configuration Service delivers device and service configurations to the switch for initial configuration and mass reconfiguration by logical groups. Switches receive their initial configuration from the CNS Configuration Service when they start up on the network for the first time.

The CNS Configuration Service uses the CNS Event Service to send and receive configuration change events and to send success and failure notifications.

The configuration server is a web server that uses configuration templates and the device-specific configuration information stored in the embedded (standalone mode) or remote (server mode) directory.

Configuration templates are text files containing static configuration information in the form of CLI commands. In the templates, variables are specified using lightweight directory access protocol (LDAP) URLs that reference the device-specific configuration information stored in a directory.

The configuration agent can perform a syntax check on received configuration files and publish events to indicate the success or failure of the syntax check. The configuration agent can either apply configurations immediately or delay the application until receipt of a synchronization event from the configuration server.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 5 Configuring IE2100 CNS Agents

Understanding IE2100 Series Configuration Registrar Software

CNS Event Service

The Configuration Registrar uses the CNS Event Service for receipt and generation of configuration events. The CNS event agent resides on the switch and facilitates the communication between the switch and the event gateway on the Configuration Registrar.

The CNS Event Service is a highly-scalable publish-and-subscribe communication method. The CNS Event Service uses subject-based addressing to send messages to their destinations. Subject-based addressing conventions define a simple, uniform namespace for messages and their destinations.

NameSpace Mapper

The Configuration Registrar includes the NameSpace Mapper (NSM) that provides a lookup service for managing logical groups of devices based on application, device ID or group ID, and event.

Cisco IOS devices recognize only event subject-names that match those configured in Cisco IOS software; for example, cisco.cns.config.load. You can use the namespace mapping service to designate events by using any desired naming convention. When you have populated your data store with your subject names, NSM resolves your event subject-name strings to those known by IOS.

For a subscriber, when given a unique device ID and event, the namespace mapping service returns a set of events to which to subscribe. Similarly, for a publisher, when given a unique group ID, device ID, and event, the mapping service returns a set of events on which to publish.

What You Should Know About ConfigID, DeviceID, and Host Name

The Configuration Registrar assumes that a unique identifier is associated with each configured switch. This unique identifier can take on multiple synonyms, where each synonym is unique within a particular namespace. The event service uses namespace content for subject-based addressing of messages.

The Configuration Registrar intersects two namespaces, one for the event bus and the other for the configuration server. Within the scope of the configuration server namespace, the term configID is the unique identifier for a device. Within the scope of the event bus namespace, the term deviceID is the CNS unique identifier for a device.

Because the Configuration Registrar uses both the event bus and the configuration server to provide configurations to devices, you must define both configID and deviceID for each configured switch.

Within the scope of a single instance of the configuration server, no two configured switches can share the same value for configID. Within the scope of a single instance of the event bus, no two configured switches can share the same value for deviceID.

ConfigID

Each configured switch has a unique configID, which serves as the key into the Configuration Registrar directory for the corresponding set of switch CLI attributes. The configID defined on the switch must match the configID for the corresponding switch definition on the Configuration Registrar.

The configID is fixed at boot time and cannot be changed until reboot, even when the switch host name is reconfigured.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 5 Configuring IE2100 CNS Agents

Understanding IE2100 Series Configuration Registrar Software

DeviceID

Each configured switch participating on the event bus has a unique deviceID, which is analogous to the switch source address so that the switch can be targeted as a specific destination on the bus. All switches configured with the cns config partial global configuration command must access the event bus.

Therefore, the deviceID, as originated on the switch, must match the deviceID of the corresponding switch definition in the Configuration Registrar.

The origin of the deviceID is defined by the Cisco IOS host name of the switch. However, the deviceID variable and its usage reside within the event gateway, which is adjacent to the switch.

The logical Cisco IOS termination point on the event bus is embedded in the event gateway, which in turn functions as a proxy on behalf of the switch. The event gateway represents the switch and its corresponding deviceID to the event bus.

The switch declares its host name to the event gateway immediately after the successful connection to the event gateway. The event gateway couples the deviceID value to the Cisco IOS host name each time this connection is established. The event gateway caches this deviceID value for the duration of its connection to the switch.

Host Name and DeviceID

The deviceID is fixed at the time of the connection to the event gateway and does not change even when the switch host name is reconfigured.

When changing the switch host name on the switch, the only way to refresh the deviceID is to break the connection between the switch and the event gateway. Enter the no cns event global configuration command followed by the cns event global configuration command.

When the connection is re-established, the switch sends its modified host name to the event gateway. The event gateway redefines the deviceID to the new value.

Caution When using the Configuration Registrar user interface, you must first set the deviceID field to the host name value that the switch acquires after???not before???you use the cns config initial global configuration command at the switch. Otherwise, subsequent cns config partial global configuration command operations malfunction.

Using Host Name, DeviceID, and ConfigID

In standalone mode, when a host name value is set for a switch, the configuration server uses the host name as the deviceID when an event is sent on host name. If the host name has not been set, the event is sent on the cn=<value> of the device.

In server mode, the host name is not used. In this mode, the unique deviceID attribute is always used for sending an event on the bus. If this attribute is not set, you cannot update the switch.

These and other associated attributes (tag value pairs) are set when you run Setup on the Configuration Registrar.

Note For more information about running the setup program on the Configuration Registrar, refer to the Cisco Intelligence Engine 2100 Series Configuration Registrar Manual.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 5 Configuring IE2100 CNS Agents

Configuring CNS Embedded Agents

Incremental (Partial) Configuration

After the network is running, new services can be added by using the CNS configuration agent. Incremental (partial) configurations can be sent to the switch. The actual configuration can be sent as an event payload by way of the event gateway (push operation) or as a signal event that triggers the switch to initiate a pull operation.

The switch can check the syntax of the configuration before applying it. If the syntax is correct, the switch applies the incremental configuration and publishes an event that signals success to the configuration server. If the switch does not apply the incremental configuration, it publishes an event showing an error status. When the switch has applied the incremental configuration, it can write it to nonvolatile RAM (NVRAM) or wait until signaled to do so.

Synchronized Configuration

When the switch receives a configuration, it can defer application of the configuration upon receipt of a write-signal event. The write-signal event tells the switch not to save the updated configuration into its NVRAM. The switch uses the updated configuration as its running configuration. This ensures that the switch configuration is synchronized with other network activities before saving the configuration in NVRAM for use at the next reboot.

Configuring CNS Embedded Agents

The CNS agents embedded in the switch IOS software allow the switch to be connected and automatically configured as described in the ???Enabling Automated CNS Configuration??? section on page 5-6. If you want to change the configuration or install a custom configuration, see these sections for instructions:

???Enabling the CNS Event Agent, page 5-8

???Enabling the CNS Configuration Agent, page 5-9

Enabling Automated CNS Configuration

To enable automated CNS configuration of the switch, you must first complete the prerequisites in Table 5-1. When you complet them, power on the switch. At the setup prompt, do nothing: The switch begins the initial configuration as described in the ???Initial Configuration??? section on page 5-5. When the full configuration file is loaded on your switch, you need to do nothing else.

Table 5-1 Prerequisites for Enabling Automatic Configuration

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 5 Configuring IE2100 CNS Agents

Configuring CNS Embedded Agents

Table 5-1 Prerequisites for Enabling Automatic Configuration (continued)

Note For more information about running the setup program and creating templates on the Configuration Registrar, refer to the Cisco Intelligence Engine 2100 Series Configuration Registrar Manual.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 5 Configuring IE2100 CNS Agents

Displaying CNS Configuration

Table 5-2 Displaying CNS Configuration (continued)

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 5 Configuring IE2100 CNS Agents

Displaying CNS Configuration

Catalyst 2950 Desktop Switch Software Configuration Guide

C H A P T E R 6

Clustering Switches

This chapter provides these topics to help you get started with switch clustering:

???Understanding Switch Clusters, page 6-2

???Planning a Switch Cluster, page 6-5

???Creating a Switch Cluster, page 6-20

???Using the CLI to Manage Switch Clusters, page 6-26

???Using SNMP to Manage Switch Clusters, page 6-27

Configuring switch clusters is more easily done from the Cluster Management Suite (CMS) web-based interface than through the command-line interface (CLI). Therefore, information in this chapter focuses on using CMS to create a cluster. See Chapter 3, ???Getting Started with CMS,??? for additional information about switch clusters and the clustering options. For complete procedures about using CMS to configure switch clusters, refer to the online help.

For the CLI cluster commands, refer to the switch command reference.

Refer to the release notes for the list of Catalyst switches eligible for switch clustering, including which ones can be command switches and which ones can only be member switches, and for the required software versions and browser and Java plug-in configurations.

Note This chapter focuses on Catalyst 2950 switch clusters. It also includes guidelines and limitations for clusters mixed with other cluster-capable Catalyst switches, but it does not provide complete descriptions of the cluster features for these other switches. For complete cluster information for a specific Catalyst platform, refer to the software configuration guide for that switch.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Understanding Switch Clusters

Understanding Switch Clusters

A switch cluster is a group of connected Catalyst switches that are managed as a single entity. In a switch cluster, 1 switch must be the command switch and up to 15 switches can be member switches. The total number of switches in a cluster cannot exceed 16 switches. The command switch is the single point of access used to configure, manage, and monitor the member switches. Cluster members can belong to only one cluster at a time.

The benefits of clustering switches include:

???Management of Catalyst switches regardless of their interconnection media and their physical locations. The switches can be in the same location, or they can be distributed across a Layer 2 or Layer 3 (if your cluster is using a Catalyst 3550 multilayer switch as a Layer 3 router between the Layer 2 switches in the cluster) network.

Cluster members are connected to the command switch according to the connectivity guidelines described in the ???Automatic Discovery of Cluster Candidates and Members??? section on page 6-5.

???Command-switch redundancy if a command switch fails. One or more switches can be designated as standby command switches to avoid loss of contact with cluster members. A cluster standby group is a group of standby command switches.

???Management of a variety of Catalyst switches through a single IP address. This conserves on IP addresses, especially if you have a limited number of them. All communication with the switch cluster is through the command switch IP address.

For other clustering benefits, see the ???Advantages of Using CMS and Clustering Switches??? section on page 1-6.

Refer to the release notes for the list of Catalyst switches eligible for switch clustering, including which ones can be command switches and which ones can only be member switches, and the required software versions.

These sections describe:

???Command Switch Characteristics, page 6-3

???Standby Command Switch Characteristics, page 6-3

???Candidate Switch and Member Switch Characteristics, page 6-4

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Understanding Switch Clusters

Command Switch Characteristics

A Catalyst 2950 command switch must meet these requirements:

???It is running Release 12.0(5.2)WC(1) or later.

???It has an IP address.

???It has Cisco Discovery Protocol (CDP) version 2 enabled (the default).

???It is not a command or member switch of another cluster.

???If the Catalyst 2950 command switch is running Release 12.1(9)EA1 or later, it is connected to the standby command switches through the managmement VLAN and to the member switches through a common VLAN.

???If the Catalyst 2950 command switch is running a release earlier than Release 12.1(9)EA1, it is connected to the standby command switches and member switches through its management VLAN.

Note The CMP-NAT-ACL access list is created when a device is configured as the command switch. Configuring any other access list on the switch can restrict access to it and affect the discovery of member and candidate switches.

???If your switch cluster has a Catalyst 3550 switch, that switch should be the command switch.

???If your switch cluster has Catalyst 2900 XL, Catalyst 2950, and Catalyst 3500 XL switches, the Catalyst 2950 should be the command switch.

???If your switch cluster has Catalyst 1900, Catalyst 2820, Catalyst 2900 XL, and

Catalyst 3500 XL switches, either the Catalyst 2900 XL or Catalyst 3500 XL should be the command switch.

Standby Command Switch Characteristics

A Catalyst 2950 standby command switch must meet these requirements:

???It is running Release 12.0(5.2)WC(1) or later.

???It has an IP address.

???It has CDP version 2 enabled.

???If the Catalyst 2950 standby command switch is running Release 12.1(9)EA1 or later, it is connected to other standby switches through its managment VLAN and to all member switches through a common VLAN.

???If the Catalyst 2950 standby command switch is running a release earlier than Release 12.1(9)EA1, it is connected to the command switch and to other standby command switches and member switches through its management VLAN.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Understanding Switch Clusters

Note Catalyst 2950 command switches running Release 12.1(9)EA1 or later can connect to standby command switches in the management VLAN.

???It is redundantly connected to the cluster so that connectivity to member switches is maintained.

???It is not a command or member switch of another cluster.

Candidate Switch and Member Switch Characteristics

Candidate switches are cluster-capable switches that have not yet been added to a cluster. Member switches are switches that have actually been added to a switch cluster. Although not required, a candidate or member switch can have its own IP address and password (for related considerations, see the ???IP Addresses??? section on page 6-16 and ???Passwords??? section on page 6-17).

To join a cluster, a candidate switch must meet these requirements:

???It is running cluster-capable software.

???It has CDP version 2 enabled.

???It is not a command or member switch of another cluster.

???If the Catalyst 2950 member or candidate switch is running Release 12.1(9)EA1 or later, it is connected to the command switch through at least one common VLAN.

???If the Catalyst 2950 member or candidate switch is running a release earlier than

Release 12.1(9)EA1, it is connected to the command switch through the command-switch management VLAN.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Planning a Switch Cluster

Note Catalyst 2950 standby command switches running Release 12.1(9)EA1 or later can connect to candidate and member switches in VLANs different from their management VLANs.

Planning a Switch Cluster

Anticipating conflicts and compatibility issues is a high priority when you manage several switches through a cluster. This section describes these guidelines, requirements, and caveats that you should understand before you create the cluster:

???Automatic Discovery of Cluster Candidates and Members, page 6-5

???HSRP and Standby Command Switches, page 6-13

???IP Addresses, page 6-16

???Host Names, page 6-17

???Passwords, page 6-17

???SNMP Community Strings, page 6-17

???TACACS+ and RADIUS, page 6-18

???Access Modes in CMS, page 6-18

???Management VLAN, page 6-19

???LRE Profiles, page 6-19

???Availability of Switch-Specific Features in Switch Clusters, page 6-20

Refer to the release notes for the list of Catalyst switches eligible for switch clustering, including which ones can be command switches and which ones can only be member switches, and for the required software versions and browser and Java plug-in configurations.

Automatic Discovery of Cluster Candidates and Members

The command switch uses Cisco Discovery Protocol (CDP) to discover member switches, candidate switches, neighboring switch clusters, and edge devices in star or cascaded topologies.

Note Do not disable CDP on the command switch, on cluster members, or on any cluster-capable switches that you might want a command switch to discover. For more information about CDP, see Chapter 19, ???Configuring CDP.???

Following these connectivity guidelines ensures automatic discovery of the switch cluster, cluster candidates, connected switch clusters, and neighboring edge devices:

???Discovery through CDP Hops, page 6-6

???Discovery through Non-CDP-Capable and Noncluster-Capable Devices, page 6-8

???Discovery through the Same Management VLAN, page 6-9

???Discovery through Different Management VLANs, page 6-10

???Discovery of Newly Installed Switches, page 6-11

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Planning a Switch Cluster

Figure 6-2 Discovery through CDP Hops (Command Switch Running Release 12.1(9)EA1 or Later)

Command switch

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Planning a Switch Cluster

Discovery through the Same Management VLAN

A Catalyst 2900 XL command switch, a Catalyst 2950 command switch running a release earlier than Release 12.1(9)EA1, or a Catalyst 3500 XL command switch must connect to all cluster members through its management VLAN. The default management VLAN is VLAN 1. For more information about management VLANs, see the ???Management VLAN??? section on page 6-19.

Note You can avoid this limitation by using, whenever possible, a Catalyst 3550 command switch or a Catalyst 2950 command switch running Release 12.1(9)EA1 or later. These command switches can manage cluster members even if they belong to different management VLANs. See the ???Discovery through Different Management VLANs??? section on page 6-10.

The command switch in Figure 6-4 has ports assigned to management VLAN 9. It discovers all but these switches:

???Switches 7 and 10 because their management VLAN (VLAN 4) is different from the command-switch management VLAN (VLAN 9)

???Switch 9 because automatic discovery does not extend beyond a noncandidate device, which is switch 7

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Planning a Switch Cluster

Figure 6-6 Discovery through Different Management VLANs with a Layer 3 Command Switch

Discovery of Newly Installed Switches

To join a cluster, the new, out-of-the-box switch must be connected to the cluster through one of its access ports. An access port (AP) carries the traffic of and belongs to the management VLAN. By default, the new switch and its access ports are assigned to management VLAN 1.

When the new switch joins a cluster, its default management VLAN changes to the VLAN of the immediately upstream neighbor. The new switch also configures its access port to belong to the VLAN of the immediately upstream neighbor.

The command switch (running a release earlier than Release 12.1(9)EA1) in Figure 6-7 belongs to management VLAN 16. When the new Catalyst 2900 LRE XL and Catalyst 2950 switches join the cluster, their management VLAN and access ports change from VLAN 1 to VLAN 16.

The command switch (running Release 12.1(9)EA1 or later) in Figure 6-8 belongs to VLANs 9 and 16. When the new Catalyst 3550 and Catalyst 2950 switches join the cluster:

???The Catalyst 3550 switch and its access port are assigned to VLAN 9.

???The Catalyst 2950 switch and its access port are assigned to management VLAN 16.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Planning a Switch Cluster

Virtual IP Addresses

You need to assign a unique virtual IP address and group number and name to the cluster standby group. This information must be configured on the management VLAN on the active command switch. The active command switch receives traffic destined for the virtual IP address. To manage the cluster, you must access the active command switch through the virtual IP address, not through the command-switch IP address. This is in case the IP address of the active command switch is different from the virtual IP address of the cluster standby group.

If the active command switch fails, the standby command switch assumes ownership of the virtual IP address and becomes the active command switch. The passive switches in the cluster standby group compare their assigned priorities to determine the new standby command switch. The passive standby switch with the highest priority then becomes the standby command switch. When the previously active command switch becomes active again, it resumes its role as the active command switch, and the current active command switch becomes the standby command switch again. For more information about IP address in switch clusters, see the ???IP Addresses??? section on page 6-16.

Other Considerations for Cluster Standby Groups

These requirements also apply:

???Standby command switches must meet these requirements:

???When the command switch is a Catalyst 3550 switch, all standby command switches must be Catalyst 3550 switches.

???When the command switch is a Catalyst 2950 switch running Release 12.1(9)EA1 or later, all standby command switches must be Catalyst 2950 switches running Release 12.1(9)EA1 or later.

???When the command switch is a Catalyst 2950 switch running Release 12.1(6)EA2 or later, all standby command switches must be Catalyst 2950 switches running Release 12.1(6)EA2 or later.

???When the command switch is running Release 12.0(5)WC2 or earlier, the standby command switches can be these switches: Catalyst 2900 XL, Catalyst 2950, and Catalyst 3500 XL switches.

We strongly recommend that the command switch and standby command switches are of the same switch platform.

???If you have a Catalyst 3550 command switch, the standby command switches should be Catalyst 3550 switches.

???If you have a Catalyst 2950 command switch, the standby command switches should be Catalyst 2950 switches.

???If you have a Catalyst 2900 XL or Catalyst 3500 XL command switch, the standby command switches should be Catalyst 2900 XL and Catalyst 3500 XL switches.

???Only one cluster standby group can be assigned to a cluster.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Planning a Switch Cluster

Automatic Recovery of Cluster Configuration

The active command switch continually forwards cluster-configuration information (but not device-configuration information) to the standby command switch. This ensures that the standby command switch can take over the cluster immediately after the active command switch fails.

Automatic discovery has these limitations:

???This limitation applies only to clusters that have Catalyst 2950 and Catalyst 3550 command and standby command switches: If the active command switch and standby command switch become disabled at the same time, the passive command switch with the highest priority becomes the active command switch. However, because it was a passive standby command switch, the previous command switch did not forward cluster-configuration information to it. The active command switch only forwards cluster-configuration information to the standby command switch. You must therefore rebuild the cluster.

???This limitation applies to all clusters: If the active command switch fails and there are more than two switches in the cluster standby group, the new command switch does not discover any Catalyst 1900, Catalyst 2820, and Catalyst 2916M XL member switches. You must re-add these member switches to the cluster.

???This limitation applies to all clusters: If the active command switch fails and becomes active again, it does not discover any Catalyst 1900, Catalyst 2820, and Catalyst 2916M XL member switches. You must again add these member switches to the cluster.

When the previously active command switch resumes its active role, it receives a copy of the latest cluster configuration from the active command switch, including members that were added while it was down. The active command switch sends a copy of the cluster configuration to the cluster standby group.

IP Addresses

You must assign IP information to a command switch. You can access the cluster through the command-switch IP address. If you configure a cluster standby group, you must use the standby-group virtual IP address to manage the cluster from the active command switch. Using the virtual IP address ensures that you retain connectivity to the cluster if the active command switch fails and that a standby command switch becomes the active command switch.

If the active command switch fails and the standby command switch takes over, you must either use the standby-group virtual IP address or the IP address available on the new active command switch to access the cluster.

You can assign an IP address to a cluster-capable switch, but it is not necessary. A member switch is managed and communicates with other member switches through the command-switch IP address. If the member switch leaves the cluster and it does not have its own IP address, you then must assign IP information to it to manage it as a standalone switch.

Note Changing the command switch IP address ends your CMS session on the switch. Restart your CMS session by entering the new IP address in the browser Location field (Netscape Communicator) or Address field (Internet Explorer), as described in the release notes.

For more information about IP addresses, see Chapter 4, ???Assigning the Switch IP Address and Default Gateway.???

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Planning a Switch Cluster

Host Names

You do not need to assign a host name to either a command switch or an eligible cluster member. However, a host name assigned to the command switch can help to identify the switch cluster. The default host name for the switch is Switch.

If a switch joins a cluster and it does not have a host name, the command switch appends a unique member number to its own host name and assigns it sequentially as each switch joins the cluster. The number means the order in which the switch was added to the cluster. For example, a command switch named eng-cluster could name the fifth cluster member eng-cluster-5.

If a switch has a host name, it retains that name when it joins a cluster. It retains that host name even after it leaves the cluster.

If a switch received its host name from the command switch, was removed from a cluster, was then added to a new cluster, and kept the same member number (such as 5), the old host name (such as eng-cluster-5) is overwritten with the host name of the command switch in the new cluster (such as mkg-cluster-5). If the switch member number changes in the new cluster (such as 3), the switch retains the previous name (eng-cluster-5).

Passwords

You do not need to assign passwords to an individual switch if it will be a cluster member. When a switch joins a cluster, it inherits the command-switch password and retains it when it leaves the cluster. If no command-switch password is configured, the member switch inherits a null password. Member switches only inherit the command-switch password.

If you change the member-switch password to be different from the command-switch password and save the change, the switch is not manageable by the command switch until you change the member-switch password to match the command-switch password. Rebooting the member switch does not revert the password back to the command-switch password. We recommend that you do not change the member-switch password after it joins a cluster.

For more information about passwords, see the ???Preventing Unauthorized Access to Your Switch??? section on page 7-1.

For password considerations specific to the Catalyst 1900 and Catalyst 2820 switches, refer to the installation and configuration guides for those switches.

SNMP Community Strings

A member switch inherits the command-switch first read-only (RO) and read-write (RW) community strings with @esN appended to the community strings:

???command-switch-readonly-community-string@esN, where N is the member-switch number.

???command-switch-readwrite-community-string@esN, where N is the member-switch number.

If the command switch has multiple read-only or read-write community strings, only the first read-only and read-write strings are propagated to the member switch.

The switches support an unlimited number of community strings and string lengths. For more information about SNMP and community strings, see Chapter 23, ???Configuring SNMP.???

For SNMP considerations specific to the Catalyst 1900 and Catalyst 2820 switches, refer to the installation and configuration guides specific to those switches.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Planning a Switch Cluster

TACACS+ and RADIUS

Inconsistent authentication configurations in switch clusters cause CMS to continually prompt for a user name and password. If Terminal Access Controller Access Control System Plus (TACACS+) is configured on a cluster member, it must be configured on all cluster members. Similarly, if Remote Authentication Dial-In User Service (RADIUS) is configured on a cluster member, it must be configured on all cluster members. Further, the same switch cluster cannot have some members configured with TACACS+ and other members configured with RADIUS.

For more information about TACACS+, see the ???Controlling Switch Access with TACACS+??? section on page 7-9. For more information about RADIUS, see the ???Controlling Switch Access with RADIUS??? section on page 7-17.

Access Modes in CMS

CMS provides two levels of access to the configuration options: read-write access and read-only access. Privilege levels 0 to 15 are supported.

???Privilege level 15 provides you with read-write access to CMS.

???Privilege levels 1 to 14 provide you with read-only access to CMS. Any options in the CMS windows, menu bar, toolbar, and popup menus that change the switch or cluster configuration are not shown in read-only mode.

???Privilege level 0 denies access to CMS.

For more information about CMS access modes, see the ???Access Modes in CMS??? section on page 3-29.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Planning a Switch Cluster

Management VLAN

Communication with the switch management interfaces is through the command-switch IP address. The IP address is associated with the management VLAN, which by default is VLAN 1. To manage switches in a cluster, the command switch, member switches, and candidate switches must be connected through ports assigned to the command-switch management VLAN.

If you add a new, out-of-box switch to a cluster and the cluster is using a management VLAN other than the default VLAN 1, the command switch automatically senses that the new switch has a different management VLAN and has not been configured. The command switch issues commands to change the management VLAN of the new switch to the one the cluster is using. This automatic VLAN change only occurs for new, out-of-box switches that do not have a config.text file and that have no changes to the running configuration. For more information, see the ???Discovery of Newly Installed Switches??? section on page 6-11.

You can change the management VLAN of a member switch (not the command switch). However, the command switch will not be able to communicate with it. In this case, you will need to manage the switch as a standalone switch.

You can globally change the management VLAN for the cluster as long as each member switch has either a trunk connection or a connection to the new command-switch management VLAN. From the command switch, use the cluster management vlan global configuration command to change the cluster management VLAN to a different management VLAN.

Caution You can change the management VLAN through a console connection without interrupting the console connection. However, changing the management VLAN ends your CMS session. Restart your CMS session by entering the new IP address in the browser Location field (Netscape Communicator) or Address field (Microsoft Internet Explorer), as described in the release notes.

For more information about changing the management VLAN, see the ???Management VLAN??? section on page 6-19.

LRE Profiles

A configuration conflict occurs if a switch cluster has Long-Reach Ethernet (LRE) switches that use both private and public profiles. If one LRE switch in a cluster is assigned a public profile, all LRE switches in that cluster must have that same public profile. Before you add an LRE switch to a cluster, make sure that you assign it the same public profile used by other LRE switches in the cluster.

A cluster can have a mix of LRE switches that use different private profiles.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Creating a Switch Cluster

Availability of Switch-Specific Features in Switch Clusters

The menu bar on the command switch displays all options available from the switch cluster. Therefore, features specific to a member switch are available from the command-switch menu bar. For example, Device > LRE Profile appears in the command-switch menu bar when at least one

Catalyst 2900 LRE XL switch is in the cluster.

Creating a Switch Cluster

Using CMS to create a cluster is easier than using the CLI commands. This section provides this information:

???Enabling a Command Switch, page 6-20

???Adding Member Switches, page 6-21

???Creating a Cluster Standby Group, page 6-23

???Verifying a Switch Cluster, page 6-25

This section assumes you have already cabled the switches, as described in the switch hardware installation guide, and followed the guidelines described in the ???Planning a Switch Cluster??? section on page 6-5.

Note Refer to the release notes for the list of Catalyst switches eligible for switch clustering, including which ones can be command switches and which ones can only be member switches, and for the required software versions and browser and Java plug-in configurations.

Enabling a Command Switch

The switch you designate as the command switch must meet the requirements described in the ???Command Switch Characteristics??? section on page 6-3, the ???Planning a Switch Cluster??? section on page 6-5, and the release notes.

???If your switch cluster has a Catalyst 3550 switch, that switch should be the command switch.

???If your switch cluster has Catalyst 2900 XL, Catalyst 2950, and Catalyst 3500 XL switches, the Catalyst 2950 should be the command switch.

???If your switch cluster has Catalyst 1900, Catalyst 2820, Catalyst 2900 XL, and

Catalyst 3500 XL switches, either the Catalyst 2900 XL or Catalyst 3500 XL should be the command switch.

You can enable a command switch, name the cluster, and assign an IP address and a password to the command switch when you run the setup program during initial switch setup. For information about using the setup program, refer to the release notes.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Creating a Switch Cluster

If you did not enable a command switch during initial switch setup, launch Device Manager from a command-capable switch, and select Cluster > Create Cluster. Enter a cluster number (the default is 0), and use up to 31 characters to name the cluster (Figure 6-10). Instead of using CMS to enable a command switch, you can use the cluster enable global configuration command.

Figure 6-10 Create Cluster Window

C3550-12T

Enter up to 31 characters to name the cluster.

56520

Adding Member Switches

As explained in the ???Automatic Discovery of Cluster Candidates and Members??? section on page 6-5, the command switch automatically discovers candidate switches. When you add new cluster-capable switches to the network, the command switch discovers them and adds them to a list of candidate switches. To display an updated cluster candidates list from the Add to Cluster window (Figure 6-11), either relaunch CMS and redisplay this window, or follow these steps:

1.Close the Add to Cluster window.

2.Select View > Refresh.

3.Select Cluster > Add to Cluster to redisplay the Add to Cluster window. From CMS, there are two ways to add switches to a cluster:

???Select Cluster > Add to Cluster, select a candidate switch from the list, click Add, and click OK. To add more than one candidate switch, press Ctrl, and make your choices, or press Shift, and choose the first and last switch in a range.

???Display the Topology view, right-click a candidate-switch icon, and select Add to Cluster (Figure 6-12). In the Topology view, candidate switches are cyan, and member switches are green. To add more than one candidate switch, press Ctrl, and left-click the candidates that you want to add.

Instead of using CMS to add members to the cluster, you can use the cluster member global configuration command from the command switch. Use the password option in this command if the candidate switch has a password.

You can select 1 or more switches as long as the total number of switches in the cluster does not exceed 16 (this includes the command switch). When a cluster has 16 members, the Add to Cluster option is not available for that cluster. In this case, you must remove a member switch before adding a new one.

If a password has been configured on a candidate switch, you are prompted to enter it before it can be added it to the cluster. If the candidate switch does not have a password, any entry is ignored.

If multiple candidates switches have the same password, you can select them as a group, and add them at the same time.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Creating a Switch Cluster

These abbreviations are appended to the switch host names in the Standby Command Group list to show their eligibility or status in the cluster standby group:

???AC???Active command switch

???SC???Standby command switch

???PC???Member of the cluster standby group but not the standby command switch

???HC???Candidate switch that can be added to the cluster standby group

???CC???Command switch when HSRP is disabled

You must enter a virtual IP address for the cluster standby group. This address must be in the same subnet as the IP addresses of the switch. The group number must be unique within the IP subnet. It can be from 0 to 255, and the default is 0. The group name can have up to 31 characters.

The Standby Command Configuration window uses the default values for the preempt and name commands that you have set by using the CLI. If you use this window to create the HSRP group, all switches in the group have the preempt command enabled. You must also provide a name for the group.

Note The HSRP standby hold time interval should be greater than or equal to 3 times the hello time interval. The default HSRP standby hold time interval is 10 seconds. The default HSRP standby hello time interval is 3 seconds. For more information about the standby hold time and hello time intervals, refer to the Cisco IOS Release 12.1 documentation set on Cisco.com.

Figure 6-13 Standby Command Configuration Window

Must be a valid IP address in the same subnet as the active command switch.

Once entered, this information cannot be changed.

65726

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Creating a Switch Cluster

Verifying a Switch Cluster

When you finish adding cluster members, follow these steps to verify the cluster:

Step 1 Enter the command switch IP address in the browser Location field (Netscape Communicator) or Address field (Microsoft Internet Explorer) to access all switches in the cluster.

Step 2 Enter the command-switch password.

Step 3 Select View > Topology to display the cluster topology and to view link information (Figure 3-6 on page 3-10). For complete information about the Topology view, including descriptions of the icons, links, and colors, see the ???Topology View??? section on page 3-9.

Step 4 Select Reports > Inventory to display an inventory of the switches in the cluster (Figure 6-14).

The summary includes information such as switch model numbers, serial numbers, software versions, IP information, and location.

You can also display port and switch statistics from Reports > Port Statistics and Port > Port Settings > Runtime Status.

Instead of using CMS to verify the cluster, you can use the show cluster members user EXEC command from the command switch or use the show cluster user EXEC command from the command switch or from a member switch.

Figure 6-14 Inventory Window

10.1.1.2, 10.10.10.1, 10. 12.1(4)EA1 10.10.10.2

65727

If you lose connectivity with a member switch or if a command switch fails, see the ???Using Recovery Procedures??? section on page 27-1.

For more information about creating and managing clusters, refer to the online help. For information about the cluster commands, refer to the switch command reference.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Using the CLI to Manage Switch Clusters

Using the CLI to Manage Switch Clusters

You can configure member switches from the CLI by first logging into the command switch. Enter the rcommand user EXEC command and the member switch number to start a Telnet session (through a console or Telnet connection) and to access the member switch CLI. The command mode changes, and the IOS commands operate as usual. Enter the exit privileged EXEC command on the member switch to return to the command-switch CLI.

This example shows how to log into member-switch 3 from the command-switch CLI:

switch# rcommand 3

If you do not know the member-switch number, enter the show cluster members privileged EXEC command on the command switch. For more information about the rcommand command and all other cluster commands, refer to the switch command reference.

The Telnet session accesses the member-switch CLI at the same privilege level as on the command switch. The IOS commands then operate as usual. For instructions on configuring the switch for a Telnet session, see the ???Setting a Telnet Password for a Terminal Line??? section on page 7-5.

Catalyst 1900 and Catalyst 2820 CLI Considerations

If your switch cluster has Catalyst 1900 and Catalyst 2820 switches running standard edition software, the Telnet session accesses the management console (a menu-driven interface) if the command switch is at privilege level 15. If the command switch is at privilege level 1 to 14, you are prompted for the password to access the menu console.

Command-switch privilege levels map to the Catalyst 1900 and Catalyst 2820 member switches running standard and Enterprise Edition Software as follows:

???If the command-switch privilege level is 1 to 14, the member switch is accessed at privilege level 1.

???If the command-switch privilege level is 15, the member switch is accessed at privilege level 15.

Note The Catalyst 1900 and Catalyst 2820 CLI is available only on switches running Enterprise Edition Software.

For more information about the Catalyst 1900 and Catalyst 2820 switches, refer to the installation and configuration guides for those switches.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 6 Clustering Switches

Using SNMP to Manage Switch Clusters

Catalyst 2950 Desktop Switch Software Configuration Guide

C H A P T E R 7

Administering the Switch

This chapter describes how to perform one-time operations to administer your switch. This chapter consists of these sections:

???Preventing Unauthorized Access to Your Switch, page 7-1

???Protecting Access to Privileged EXEC Commands, page 7-2

???Controlling Switch Access with TACACS+, page 7-9

???Controlling Switch Access with RADIUS, page 7-17

???Configuring the Switch for Local Authentication and Authorization, page 7-31

???Managing the System Time and Date, page 7-32

???Configuring a System Name and Prompt, page 7-46

???Creating a Banner, page 7-49

???Managing the MAC Address Table, page 7-52

???Managing the ARP Table, page 7-59

Preventing Unauthorized Access to Your Switch

You can prevent unauthorized users from reconfiguring your switch and viewing configuration information. Typically, you want network administrators to have access to your switch while you restrict access to users who dial from outside the network through an asynchronous port, connect from outside the network through a serial port, or connect through a terminal or workstation from within the local network.

To prevent unauthorized access into your switch, you should configure one or more of these security features:

???At a minimum, you should configure passwords and privileges at each switch port. These passwords are locally stored on the switch. When users attempt to access the switch through a port or line, they must enter the password specified for the port or line before they can access the switch. For more information, see the ???Protecting Access to Privileged EXEC Commands??? section on page 7-2.

???For an additional layer of security, you can also configure username and password pairs, which are locally stored on the switch. These pairs are assigned to lines or interfaces and authenticate each user before that user can access the switch. If you have defined privilege levels, you can also assign a specific privilege level (with associated rights and privileges) to each username and password pair. For more information, see the ???Configuring Username and Password Pairs??? section on page 7-6.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 7 Administering the Switch

Protecting Access to Privileged EXEC Commands

???If you want to use username and password pairs, but you want to store them centrally on a server instead of locally, you can store them in a database on a security server. Multiple networking devices can then use the same database to obtain user authentication (and, if necessary, authorization) information. For more information, see the ???Controlling Switch Access with TACACS+??? section on page 7-9.

Protecting Access to Privileged EXEC Commands

A simple way of providing terminal access control in your network is to use passwords and assign privilege levels. Password protection restricts access to a network or network device. Privilege levels define what commands users can enter after they have logged into a network device.

Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Security Command Reference for Release 12.1.

This section describes how to control access to the configuration file and privileged EXEC commands. It contains this configuration information:

???Default Password and Privilege Level Configuration, page 7-2

???Setting or Changing a Static Enable Password, page 7-3

???Protecting Enable and Enable Secret Passwords with Encryption, page 7-4

???Setting a Telnet Password for a Terminal Line, page 7-5

???Configuring Username and Password Pairs, page 7-6

???Configuring Multiple Privilege Levels, page 7-7

Default Password and Privilege Level Configuration

Table 7-1 shows the default password and privilege level configuration.

Table 7-1 Default Password and Privilege Levels

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 7 Administering the Switch

Protecting Access to Privileged EXEC Commands

Configuring Multiple Privilege Levels

By default, the IOS software has two modes of password security: user EXEC and privileged EXEC. You can configure up to 16 hierarchical levels of commands for each mode. By configuring multiple passwords, you can allow different sets of users to have access to specified commands.

For example, if you want many users to have access to the clear line command, you can assign it level 2 security and distribute the level 2 password fairly widely. But if you want more restricted access to the configure command, you can assign it level 3 security and distribute that password to a more restricted group of users.

This section includes this configuration information:

???Setting the Privilege Level for a Command, page 7-7

???Changing the Default Privilege Level for Lines, page 7-8

???Logging into and Exiting a Privilege Level, page 7-9

Setting the Privilege Level for a Command

Beginning in privileged EXEC mode, follow these steps to set the privilege level for a command mode:

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 7 Administering the Switch

Controlling Switch Access with TACACS+

Logging into and Exiting a Privilege Level

Beginning in privileged EXEC mode, follow these steps to log in to a specified privilege level and to exit to a specified privilege level:

Controlling Switch Access with TACACS+

This section describes how to enable and configure Terminal Access Controller Access Control System Plus (TACACS+), which provides detailed accounting information and flexible administrative control over authentication and authorization processes. TACACS+ is facilitated through authentication, authorization, accounting (AAA) and can be enabled only through AAA commands.

Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Security Command Reference for Release 12.1.

This section contains this configuration information:

???Understanding TACACS+, page 7-9

???TACACS+ Operation, page 7-11

???Configuring TACACS+, page 7-11

???Displaying the TACACS+ Configuration, page 7-16

Understanding TACACS+

TACACS+ is a security application that provides centralized validation of users attempting to gain access to your switch. TACACS+ services are maintained in a database on a TACACS+ daemon typically running on a UNIX or Windows NT workstation. You should have access to and should configure a TACACS+ server before the configuring TACACS+ features on your switch.

TACACS+ provides for separate and modular authentication, authorization, and accounting facilities. TACACS+ allows for a single access control server (the TACACS+ daemon) to provide each service???authentication, authorization, and accounting???independently. Each service can be tied into its own database to take advantage of other services available on that server or on the network, depending on the capabilities of the daemon.

The goal of TACACS+ is to provide a method for managing multiple network access points from a single management service. Your switch can be a network access server along with other Cisco routers and access servers. A network access server provides connections to a single user, to a network or subnetwork, and to interconnected networks as shown in Figure 7-1.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 7 Administering the Switch

Controlling Switch Access with TACACS+

TACACS+ Operation

When a user attempts a simple ASCII login by authenticating to a switch using TACACS+, this process occurs:

1.When the connection is established, the switch contacts the TACACS+ daemon to obtain a username prompt, which is then displayed to the user. The user enters a username, and the switch then contacts the TACACS+ daemon to obtain a password prompt. The switch displays the password prompt to the user, the user enters a password, and the password is then sent to the TACACS+ daemon.

TACACS+ allows a conversation to be held between the daemon and the user until the daemon receives enough information to authenticate the user. The daemon prompts for a username and password combination, but can include other items, such as the user???s mother???s maiden name.

2.The switch eventually receives one of these responses from the TACACS+ daemon:

???ACCEPT???The user is authenticated and service can begin. If the switch is configured to require authorization, authorization begins at this time.

???REJECT???The user is not authenticated. The user can be denied access or is prompted to retry the login sequence, depending on the TACACS+ daemon.

???ERROR???An error occurred at some time during authentication with the daemon or in the network connection between the daemon and the switch. If an ERROR response is received, the switch typically tries to use an alternative method for authenticating the user.

???CONTINUE???The user is prompted for additional authentication information.

After authentication, the user undergoes an additional authorization phase if authorization has been enabled on the switch. Users must first successfully complete TACACS+ authentication before proceeding to TACACS+ authorization.

3.If TACACS+ authorization is required, the TACACS+ daemon is again contacted, and it returns an ACCEPT or REJECT authorization response. If an ACCEPT response is returned, the response contains data in the form of attributes that direct the EXEC or NETWORK session for that user, determining the services that the user can access:

???Telnet, rlogin, or privileged EXEC services

???Connection parameters, including the host or client IP address, access list, and user timeouts

Configuring TACACS+

This section describes how to configure your switch to support TACACS+. At a minimum, you must identify the host or hosts maintaining the TACACS+ daemon and define the method lists for TACACS+ authentication. You can optionally define method lists for TACACS+ authorization and accounting. A method list defines the sequence and methods to be used to authenticate, to authorize, or to keep accounts on a user. You can use method lists to designate one or more security protocols to be used, thus ensuring a backup system if the initial method fails. The software uses the first method listed to authenticate, to authorize, or to keep accounts on users; if that method does not respond, the software selects the next method in the list. This process continues until there is successful communication with a listed method or the method list is exhausted.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 7 Administering the Switch

Controlling Switch Access with TACACS+

This section contains this configuration information:

???Default TACACS+ Configuration, page 7-12

???Identifying the TACACS+ Server Host and Setting the Authentication Key, page 7-12

???Configuring TACACS+ Login Authentication, page 7-13

???Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services, page 7-15

???Starting TACACS+ Accounting, page 7-16

Default TACACS+ Configuration

TACACS+ and AAA are disabled by default.

To prevent a lapse in security, you cannot configure TACACS+ through a network management application.When enabled, TACACS+ can authenticate users accessing the switch through the CLI.

Note Although TACACS+ configuration is performed through the CLI, the TACACS+ server authenticates HTTP connections that have been configured with a privilege level of 15.

Identifying the TACACS+ Server Host and Setting the Authentication Key

You can configure the switch to use a single server or AAA server groups to group existing server hosts for authentication. You can group servers to select a subset of the configured server hosts and use them for a particular service. The server group is used with a global server-host list and contains the list of IP addresses of the selected server hosts.

Beginning in privileged EXEC mode, follow these steps to identify the IP host or host maintaining TACACS+ server and optionally set the encryption key:

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 7 Administering the Switch

Controlling Switch Access with RADIUS

Controlling Switch Access with RADIUS

This section describes how to enable and configure the Remote Authentication Dial-In User Service (RADIUS), which provides detailed accounting information and flexible administrative control over authentication and authorization processes. RADIUS is facilitated through AAA and can be enabled only through AAA commands.

Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Security Command Reference for Release 12.1.

This section contains this configuration information:

???Understanding RADIUS, page 7-17

???RADIUS Operation, page 7-18

???Configuring RADIUS, page 7-19

???Displaying the RADIUS Configuration, page 7-30

Understanding RADIUS

RADIUS is a distributed client/server system that secures networks against unauthorized access. RADIUS clients run on supported Cisco routers and switches, including Catalyst 3550 multilayer switches and Catalyst 2950 series switches. Clients send authentication requests to a central RADIUS server, which contains all user authentication and network service access information. The RADIUS host is normally a multiuser system running RADIUS server software from Cisco (Cisco Secure Access Control Server version 3.0), Livingston, Merit, Microsoft, or another software provider. For more information, refer to the RADIUS server documentation.

Use RADIUS in these network environments that require access security:

???Networks with multiple-vendor access servers, each supporting RADIUS. For example, access servers from several vendors use a single RADIUS server-based security database. In an IP-based network with multiple vendors??? access servers, dial-in users are authenticated through a RADIUS server that has been customized to work with the Kerberos security system.

???Turnkey network security environments in which applications support the RADIUS protocol, such as in an access environment that uses a smart card access control system. In one case, RADIUS has been used with Enigma???s security cards to validates users and to grant access to network resources.

???Networks already using RADIUS. You can add a Cisco switch containing a RADIUS client to the network. This might be the first step when you make a transition to a TACACS+ server. See Figure 7-2 on page 7-18.

???Network in which the user must only access a single service. Using RADIUS, you can control user access to a single host, to a single utility such as Telnet, or to the network through a protocol such as IEEE 802.1X. For more information about this protocol, see Chapter 8, ???Configuring 802.1X Port-Based Authentication.???

???Networks that require resource accounting. You can use RADIUS accounting independently of RADIUS authentication or authorization. The RADIUS accounting functions allow data to be sent at the start and end of services, showing the amount of resources (such as time, packets, bytes, and so forth) used during the session. An Internet service provider might use a freeware-based version of RADIUS access control and accounting software to meet special security and billing needs.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 7 Administering the Switch

Controlling Switch Access with RADIUS

Configuring RADIUS

This section describes how to configure your switch to support RADIUS. At a minimum, you must identify the host or hosts that run the RADIUS server software and define the method lists for RADIUS authentication. You can optionally define method lists for RADIUS authorization and accounting.

A method list defines the sequence and methods to be used to authenticate, to authorize, or to keep accounts on a user. You can use method lists to designate one or more security protocols to be used (such as TACACS+ or local username lookup), thus ensuring a backup system if the initial method fails. The software uses the first method listed to authenticate, to authorize, or to keep accounts on users; if that method does not respond, the software selects the next method in the list. This process continues until there is successful communication with a listed method or the method list is exhausted.

You should have access to and should configure a RADIUS server before configuring RADIUS features on your switch.

This section contains this configuration information:

???Default RADIUS Configuration, page 7-19

???Identifying the RADIUS Server Host, page 7-19 (required)

???Configuring RADIUS Login Authentication, page 7-22 (required)

???Defining AAA Server Groups, page 7-24 (optional)

???Configuring RADIUS Authorization for User Privileged Access and Network Services, page 7-26 (optional)

???Starting RADIUS Accounting, page 7-27 (optional)

???Configuring Settings for All RADIUS Servers, page 7-28 (optional)

???Configuring the Switch to Use Vendor-Specific RADIUS Attributes, page 7-28 (optional)

???Configuring the Switch for Vendor-Proprietary RADIUS Server Communication, page 7-29 (optional)

Default RADIUS Configuration

RADIUS and AAA are disabled by default.

To prevent a lapse in security, you cannot configure RADIUS through a network management application. When enabled, RADIUS can authenticate users accessing the switch through the CLI.

Identifying the RADIUS Server Host

Switch-to-RADIUS-server communication involves several components:

???Host name or IP address

???Authentication destination port

???Accounting destination port

???Key string

???Timeout period

???Retransmission value

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 7 Administering the Switch

Controlling Switch Access with RADIUS

You identify RADIUS security servers by their host name or IP address, host name and specific UDP port numbers, or their IP address and specific UDP port numbers. The combination of the IP address and the UDP port number creates a unique identifier, allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service. This unique identifier enables RADIUS requests to be sent to multiple UDP ports on a server at the same IP address.

If two different host entries on the same RADIUS server are configured for the same service???for example, accounting???the second host entry configured acts as a fail-over backup to the first one. Using this example, if the first host entry fails to provide accounting services, the switch tries the second host entry configured on the same device for accounting services. (The RADIUS host entries are tried in the order that they are configured.)

A RADIUS server and the switch use a shared secret text string to encrypt passwords and exchange responses. To configure RADIUS to use the AAA security commands, you must specify the host running the RADIUS server daemon and a secret text (key) string that it shares with the switch.

The timeout, retransmission, and encryption key values can be configured globally for all RADIUS servers, on a per-server basis, or in some combination of global and per-server settings. To apply these settings globally to all RADIUS servers communicating with the switch, use the three unique global configuration commands: radius-server timeout, radius-server retransmit, and radius-server key. To apply these values on a specific RADIUS server, use the radius-server host global configuration command.

Note If you configure both global and per-server functions (timeout, retransmission, and key commands) on the switch, the per-server timer, retransmission, and key value commands override global timer, retransmission, and key value commands. For information on configuring these setting on all RADIUS servers, see the ???Configuring Settings for All RADIUS Servers??? section on page 7-28.

You can configure the switch to use AAA server groups to group existing server hosts for authentication. For more information, see the ???Defining AAA Server Groups??? section on page 7-24.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 7 Administering the Switch

Controlling Switch Access with RADIUS

This example shows how to configure one RADIUS server to be used for authentication and another to be used for accounting:

Switch(config)# radius-server host 172.29.36.49 auth-port 1612 key rad1

Switch(config)# radius-server host 172.20.36.50 acct-port 1618 key rad2

This example shows how to configure host1 as the RADIUS server and to use the default ports for both authentication and accounting:

Switch(config)# radius-server host host1

Note You also need to configure some settings on the RADIUS server. These settings include the IP address of the switch and the key string to be shared by both the server and the switch. For more information, refer to the RADIUS server documentation.

Configuring RADIUS Login Authentication

To configure AAA authentication, you define a named list of authentication methods and then apply that list to various interfaces. The method list defines the types of authentication to be performed and the sequence in which they are performed; it must be applied to a specific interface before any of the defined authentication methods are performed. The only exception is the default method list (which, by coincidence, is named default). The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined.

A method list describes the sequence and authentication methods to be queried to authenticate a user. You can designate one or more security protocols to be used for authentication, thus ensuring a backup system for authentication in case the initial method fails. The software uses the first method listed to authenticate users; if that method fails to respond, the software selects the next authentication method in the method list. This process continues until there is successful communication with a listed authentication method or until all defined methods are exhausted. If authentication fails at any point in this cycle???meaning that the security server or local username database responds by denying the user access???the authentication process stops, and no other authentication methods are attempted.

Beginning in privileged EXEC mode, follow these steps to configure login authentication. This procedure is required.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 7 Administering the Switch

Controlling Switch Access with RADIUS

To disable AAA, use the no aaa new-model global configuration command. To disable AAA authentication, use the no aaa authentication login {default | list-name} method1 [method2...] global configuration command. To either disable RADIUS authentication for logins or to return to the default value, use the no login authentication {default | list-name} line configuration command.

Defining AAA Server Groups

You can configure the switch to use AAA server groups to group existing server hosts for authentication. You select a subset of the configured server hosts and use them for a particular service. The server group is used with a global server-host list, which lists the IP addresses of the selected server hosts.

Server groups also can include multiple host entries for the same server if each entry has a unique identifier (the combination of the IP address and UDP port number), allowing different ports to be individually defined as RADIUS hosts providing a specific AAA service. If you configure two different host entries on the same RADIUS server for the same service, (for example, accounting), the second configured host entry acts as a fail-over backup to the first one.

You use the server group server configuration command to associate a particular server with a defined group server. You can either identify the server by its IP address or identify multiple host instances or entries by using the optional auth-port and acct-port keywords.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 7 Administering the Switch

Managing the System Time and Date

Managing the System Time and Date

You can manage the system time and date on your switch using automatic configuration, such as the Network Time Protocol (NTP), or manual configuration methods.

Note For complete syntax and usage information for the commands used in this section, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1.

This section contains this configuration information:

???Understanding the System Clock, page 7-32

???Understanding Network Time Protocol, page 7-32

???Configuring NTP, page 7-34

???Configuring Time and Date Manually, page 7-41

Understanding the System Clock

The heart of the time service is the system clock. This clock runs from the moment the system starts up and keeps track of the date and time.

The system clock can then be set from these sources:

???Network Time Protocol

???Manual configuration

The system clock can provide time to these services:

???User show commands

???Logging and debugging messages

The system clock keeps track of time internally based on Universal Time Coordinated (UTC), also known as Greenwich Mean Time (GMT). You can configure information about the local time zone and summer time (daylight saving time) so that the time is correctly displayed for the local time zone.

The system clock keeps track of whether the time is authoritative or not (that is, whether it has been set by a time source considered to be authoritative). If it is not authoritative, the time is available only for display purposes and is not redistributed. For configuration information, see the ???Configuring Time and Date Manually??? section on page 7-41.

Understanding Network Time Protocol

The NTP is designed to time-synchronize a network of devices. NTP runs over User Datagram Protocol (UDP), which runs over IP. NTP is documented in RFC 1305.

An NTP network usually gets its time from an authoritative time source, such as a radio clock or an atomic clock attached to a time server. NTP then distributes this time across the network. NTP is extremely efficient; no more than one packet per minute is necessary to synchronize two devices to within a millisecond of one another.

NTP uses the concept of a stratum to describe how many NTP hops away a device is from an authoritative time source. A stratum 1 time server has a radio or atomic clock directly attached, a stratum 2 time server receives its time through NTP from a stratum 1 time server, and so on. A device

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 7 Administering the Switch

Managing the System Time and Date

running NTP automatically chooses as its time source the device with the lowest stratum number with which it communicates through NTP. This strategy effectively builds a self-organizing tree of NTP speakers.

NTP avoids synchronizing to a device whose time might not be accurate by never synchronizing to a device that is not synchronized. NTP also compares the time reported by several devices and does not synchronize to a device whose time is significantly different than the others, even if its stratum is lower.

The communications between devices running NTP (known as associations) are usually statically configured; each device is given the IP address of all devices with which it should form associations. Accurate timekeeping is possible by exchanging NTP messages between each pair of devices with an association. However, in a LAN environment, NTP can be configured to use IP broadcast messages instead. This alternative reduces configuration complexity because each device can simply be configured to send or receive broadcast messages. However, in that case, information flow is one-way only.

The time kept on a device is a critical resource; you should use the security features of NTP to avoid the accidental or malicious setting of an incorrect time. Two mechanisms are available: an access list-based restriction scheme and an encrypted authentication mechanism.

Cisco???s implementation of NTP does not support stratum 1 service; it is not possible to connect to a radio or atomic clock. We recommend that the time service for your network be derived from the public NTP servers available on the IP Internet. Figure 7-3 show a typical network example using NTP.

If the network is isolated from the Internet, Cisco???s implementation of NTP allows a device to act as though it is synchronized through NTP, when in fact it has determined the time by using other means. Other devices then synchronize to that device through NTP.

When multiple sources of time are available, NTP is always considered to be more authoritative. NTP time overrides the time set by any other method.

Several manufacturers include NTP software for their host systems, and a publicly available version for systems running UNIX and its various derivatives is also available. This software allows host systems to be time-synchronized as well.

Catalyst 2950 Desktop Switch Software Configuration Guide

Chapter 7 Administering the Switch

Managing the System Time and Date

Beginning in privileged EXEC mode, follow these steps to configure a specific interface from which the IP source address is to be taken:

The specified interface is used for the source address for all packets sent to all destinations. If a source address is to be used for a specific association, use the source keyword in the ntp peer or ntp server global configuration command as described in the ???Configuring NTP Associations??? section on page 7-36.

Displaying the NTP Configuration

You can use two privileged EXEC commands to display NTP information:

???show ntp associations [detail]

???show ntp status

For detailed information about the fields in these displays, refer to the Cisco IOS Configuration Fundamentals Command Reference for Release 12.1.

Configuring Time and Date Manually

If no other source of time is available, you can manually configure the time and date after the system is restarted. The time remains accurate until the next system restart. We recommend that you use manual configuration only as a last resort. If you have an outside source to which the switch can synchronize, you do not need to manually set the system clock.

This section contains this configuration information:

???Setting the System Clock, page 7-42

???Displaying the Time and Date Configuration, page 7-42

???Configuring the Time Zone, page 7-43

???Configuring Summer Time (Daylight Saving Time), page 7-44

Catalyst 2950 Desktop Switch Software Configuration Guide