Extreme Networks A4

Fast Ethernet Switches CLI Reference

Firmware Version 6.81.xx

P/N 9034705-01
March 2014
Copyright © 2014 Extreme Networks, Inc. All Rights Reserved.

Legal Notices
Extreme Networks, Inc., on behalf of or through its wholly-owned subsidiary, Enterasys
Networks, Inc., reserves the right to make changes in specifications and other information
contained in this document and its website without prior notice. The reader should in all cases
consult representatives of Extreme Networks to determine whether any such changes have
been made.
The hardware, firmware, software or any specifications described or referred to in this
document are subject to change without notice.

Trademarks
Extreme Networks and the Extreme Networks logo are trademarks or registered trademarks
of Extreme Networks, Inc. in the United States and/or other countries.
All other names (including any product names) mentioned in this document are the property
of their respective owners and may be trademarks or registered trademarks of their
respective companies/owners.
For additional information on Extreme Networks trademarks, please see:
www.extremenetworks.com/company/legal/trademarks/

Support
For product support, including documentation, visit: www.extremenetworks.com/support/

Contact
Extreme Networks, Inc.
145 Rio Robles
San Jose, CA 19534
Tel: +1 408-579-2800
Toll-free: +1 888-257-3000

i
 Enterasys Networks, Inc. Firmware License Agreement
BEFORE OPENING OR UTILIZING THE ENCLOSED PRODUCT,
CAREFULLY READ THIS LICENSE AGREEMENT.
This document is an agreement ("Agreement") between the end user ("You") and Enterasys
Networks, Inc., a wholly-owned subsidiary of Extreme Networks, Inc., on behalf of itself and its
Affiliates (as hereinafter defined) ("Enterasys"), that sets forth Your rights and obligations
with respect to the Enterasys software program/firmware (including any accompanying
documentation, hardware or media) (collectively, the "Program") in the package and prevails
over any additional, conflicting or inconsistent terms and conditions appearing on any
purchase order or other document submitted by You. "Affiliate" means any person,
partnership, corporation, limited liability company, other form of enterprise that directly or
indirectly through one or more intermediaries, controls, or is controlled by, or is under
common control with the party specified.
This Agreement constitutes the entire understanding between the parties, with respect to the
subject matter of this Agreement. The Program may be contained in firmware, chips or other
media.
BY INSTALLING OR OTHERWISE USING THE PROGRAM, YOU REPRESENT THAT YOU ARE
AUTHORIZED TO ACCEPT THESE TERMS ON BEHALF OF THE END USER (IF THE END
USER IS AN ENTITY ON WHOSE BEHALF YOU ARE AUTHORIZED TO ACT, “YOU” AND
“YOUR” SHALL BE DEEMED TO REFER TO SUCH ENTITY) AND THAT YOU AGREE THAT
YOU ARE BOUND BY THE TERMS OF THIS AGREEMENT, WHICH INCLUDES, AMONG
OTHER PROVISIONS, THE LICENSE, THE DISCLAIMER OF WARRANTY AND THE
LIMITATION OF LIABILITY. IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT
OR ARE NOT AUTHORIZED TO ENTER INTO THIS AGREEMENT, ENTERASYS IS
UNWILLING TO LICENSE THE PROGRAM TO YOU AND YOU AGREE TO RETURN THE
UNOPENED PRODUCT TO ENTERASYS OR YOUR DEALER, IF ANY, WITHIN TEN (10) DAYS
FOLLOWING THE DATE OF RECEIPT FOR A FULL REFUND.
IF YOU HAVE ANY QUESTIONS ABOUT THIS AGREEMENT, CONTACT EXTREME
NETWORKS, LEGAL DEPARTMENT AT (408) 579-2800.
You and Enterasys agree as follows:
1. LICENSE. You are granted a revocable, non-exclusive and non-transferable right to use
only one (1) copy of the Program provided in this package subject to the terms and
conditions of this Agreement.
2. RESTRICTIONS. Except as otherwise authorized in writing by Enterasys, You may not, nor
may You permit any third party to:
(a) Reverse engineer, decompile, disassemble or modify the Program, in whole or in part,
including for reasons of error correction or interoperability, except to the extent
expressly permitted by applicable law and to the extent the parties shall not be
permitted by that applicable law, such rights are expressly excluded. Information
necessary to achieve interoperability or correct errors is available from Enterasys upon
request and payment of Enterasys’ applicable fee.
(b) Incorporate the Program in whole or in part, in any other product or create derivative
works based on the Program, in whole or in part.
(c) Publish, disclose, copy reproduce or transmit the Program, in whole or in part.
(d) Assign, sell, license, sublicense, rent, lease, encumber by way of security interest, pledge
or otherwise transfer the Program, in whole or in part.
(e) Remove any copyright, trademark, proprietary rights, disclaimer or warning notice
included on or embedded in any part of the Program.

ii
3. APPLICABLE LAW. This Agreement shall be interpreted and governed under the laws and
in the state and federal courts of the State of California without regard to its conflicts of
laws provisions. You accept the personal jurisdiction and venue of the Superior Court of
California in Santa Clara County or the United States District Court for the Northern District
of California in San Jose, California. None of the 1980 United Nations Convention on the
Limitation Period in the International Sale of Goods, and the Uniform Computer Information
Transactions Act shall apply to this Agreement.
4. EXPORT RESTRICTIONS. You acknowledge and agree that the Program and its
accompanying materials/documentation are subject to the export control laws and
regulations of the United States, including but not limited to the Export Administration
Regulations (EAR), the International Traffic in Arms Regulations (ITAR), and the sanction
regimes of the U.S. Department of Treasury, Office of Foreign Assets Control's Foreign
Assets Control Regulations (FACR). You agree that You will comply with these laws and
regulations.

You agree that You will not, without prior U.S. Government authorization, export, reexport,
or transfer the Program, either directly or indirectly, to any country subject to a U.S. trade
embargo or sanction (e.g. Cuba, N. Korea, Iran, Syria, Sudan) or to any resident or national
of said countries, or to any person, organization, or entity on any of the restricted parties
lists maintained by the U.S. Departments of State, Treasury, or Commerce. In addition, You
agree that You will not export, reexport or transfer the Program to any end-user engaged
in activities, or for any end-use, directly or indirectly related to the design, development,
production, use, or stockpiling of weapons of mass destruction, e.g. nuclear, chemical, or
biological weapons, and the missile technology to deliver them.
5. UNITED STATES GOVERNMENT RESTRICTED RIGHTS. The enclosed Program (i) was
developed solely at private expense; (ii) contains “restricted computer software” submitted
with restricted rights in accordance with section 52.227-19 (a) through (d) of the
Commercial Computer Software-Restricted Rights Clause and its successors, and (iii) in all
respects is proprietary data belonging to Enterasys, its Affiliates and/or its suppliers. For
Department of Defense units, the Program is considered commercial computer software in
accordance with DFARS section 227.7202-3 and its successors, and use, duplication, or
disclosure by the U.S. Government is subject to restrictions set forth herein.
6. DISCLAIMER OF WARRANTY. EXCEPT FOR THOSE WARRANTIES EXPRESSLY
PROVIDED TO YOU IN WRITING BY ENTERASYS, ENTERASYS DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
IMPLIED WARRANTIES OF MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR
A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT WITH RESPECT TO THE
PROGRAM. IF THE IMPLIED WARRANTIES MAY NOT BE DISCLAIMED BY APPLICABLE
LAW, THEN ANY IMPLIED WARRANTIES ARE LIMITED IN DURATION TO THIRTY (30)
DAYS AFTER DELIVERY OF THE PROGRAM TO YOU.
7. LIMITATION OF LIABILITY. IN NO EVENT SHALL ENTERASYS OR ITS AFFILIATES AND
SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER (INCLUDING, WITHOUT
LIMITATION, DAMAGES FOR LOSS OF BUSINESS, PROFITS, BUSINESS INTERRUPTION,
LOSS OF BUSINESS INFORMATION, SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR
RELIANCE DAMAGES, OR OTHER LOSS) ARISING OUT OF THE USE OR INABILITY TO
USE THE PROGRAM, EVEN IF ENTERASYS HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES. THIS FOREGOING LIMITATION SHALL APPLY REGARDLESS OF THE
CAUSE OF ACTION UNDER WHICH DAMAGES ARE SOUGHT.
NOTWITHSTANDING THE FOREGOING, THE CUMULATIVE LIABILITY OF ENTERASYS
TO YOU FOR ALL CLAIMS RELATING TO THE PROGRAM, IN CONTRACT, TORT OR

iii
 OTHERWISE, SHALL NOT EXCEED THE TOTAL AMOUNT OF FEES PAID TO
ENTERASYS BY YOU FOR THE RIGHTS GRANTED HEREIN.
8. AUDIT RIGHTS. You hereby acknowledge that the intellectual property rights associated
with the Program are of critical value to Enterasys and its Affiliates, and, accordingly, You
hereby agree to maintain complete books, records and accounts showing: (i) license fees
due and paid, and (ii) the use, copying and deployment of the Program. You also grant to
Enterasys and its authorized representatives, upon reasonable notice, the right to audit and
examine during Your normal business hours, Your books, records, accounts and hardware
devices upon which the Program may be deployed to verify compliance with this
Agreement, including the verification of the license fees due and paid to Enterasys and the
use, copying and deployment of the Program. Enterasys' right of examination shall be
exercised reasonably, in good faith and in a manner calculated to not unreasonably
interfere with Your business. In the event such an audit discovers any non-compliance with
this Agreement, including copies of the Program made, used or deployed in breach of this
Agreement, You shall promptly cease such unauthorized conduct, pay to Enterasys the
appropriate license fees and be subject to any other available claim from Enterasys
pursuant to applicable law. Enterasys reserves the right, to be exercised in its sole
discretion and without prior notice, to terminate this Agreement, including the license,
effective immediately, for failure to comply with this Agreement. Upon any such
termination, You shall immediately cease all use of the Program and shall return to
Enterasys the Program and all copies of the Program.
9. OWNERSHIP. This is a license agreement and not an agreement for sale. You acknowledge
and agree that the Program constitutes trade secrets and/or copyrighted material of
Enterasys and/or its suppliers. You agree to implement reasonable security measures to
protect such trade secrets and copyrighted material. All right, title and interest in and to
the Program shall remain with Enterasys and/or its Affiliates and suppliers. All rights not
specifically granted to You shall be reserved to Enterasys.
10. TRADEMARKS. ENTERASYS, ENTERASYS NETWORKS, ENTERASYS SECURE
NETWORKS, NETSIGHT, ENTERASYS NETSIGHT, and any logos associated therewith, are
trademarks or registered trademarks of Enterasys Networks, Inc., in the United States
and/or other countries. Extreme Networks and the Extreme Networks logo are
trademarks or registered trademarks of Extreme Networks, Inc. in the United States and/or
other countries. For more information on Enterasys and Extreme trademarks, see:
www.extremenetworks.com/about-extreme/trademarks.aspx.

All other product names mentioned in Program may be trademarks or registered

trademarks of their respective companies.
11. ENFORCEMENT. You acknowledge and agree that any breach of this Agreement by You
may cause Enterasys irreparable damage for which recovery of money damages would be
inadequate, and that Enterasys may be entitled to seek timely injunctive relief to protect
Enterasys’ rights under this Agreement in addition to any and all remedies available at law.
12. ASSIGNMENT. You may not assign, transfer or sublicense this Agreement or any of Your
rights or obligations under this Agreement, except that You may assign this Agreement to
any person or entity that acquires substantially all of Your stock assets. Enterasys may
assign this Agreement in its sole discretion to anyone or any entity without Your consent
and without notice, including assigning this Agreement to its parent company, Extreme
Networks, Inc. This Agreement shall be binding upon and inure to the benefit of the parties,
their legal representatives, permitted transferees, successors and assigns as permitted by
this Agreement. Any attempted assignment, transfer or sublicense in violation of the terms
of this Agreement shall be void and a breach of this Agreement.

iv
13. WAIVER. A waiver by Enterasys of a breach of any of the terms and conditions of this
Agreement must be in writing and will not be construed as a waiver of any subsequent
breach of such term or condition. Enterasys’ failure to enforce a term upon Your breach of
such term shall not be construed as a waiver of Your breach or prevent enforcement on
any other occasion.
14. SEVERABILITY. In the event any provision of this Agreement is found to be invalid, illegal
or unenforceable, the validity, legality and enforceability of any of the remaining provisions
shall not in any way be affected or impaired thereby, and that provision shall be reformed,
construed and enforced to the maximum extent permissible. Any such invalidity, illegality,
or unenforceability in any jurisdiction shall not invalidate or render illegal or unenforceable
such provision in any other jurisdiction.
15. TERMINATION. Enterasys may terminate this Agreement immediately upon Your breach
of any of the terms and conditions of this Agreement. Upon any such termination, You shall
immediately cease all use of the Program and shall return to Enterasys the Program and all
copies of the Program.

v
vi
 Contents
About This Guide
Using This Guide ........................................................................................................................................... xxix
Structure of This Guide .................................................................................................................................. xxix
Related Documents ....................................................................................................................................... xxxi
Conventions Used in This Guide ................................................................................................................... xxxi
Getting Help .................................................................................................................................................. xxxii

Chapter 1: Configuring Switches in a Stack

About A4 Switch Operation in a Stack ............................................................................................................ 1-1
Installing a New Stackable System of Up to Eight Units ................................................................................ 1-2
Installing Previously-Configured Systems in a Stack ..................................................................................... 1-3
Adding a New Unit to an Existing Stack ......................................................................................................... 1-3
Creating a Virtual Switch Configuration .......................................................................................................... 1-3
Considerations About Using Clear Config in a Stack ..................................................................................... 1-4
Configuring Standalone A4 Stack Ports ........................................................................................................ 1-4
Stacking Configuration and Management Commands ................................................................................... 1-5
Purpose .................................................................................................................................................... 1-5
Commands ............................................................................................................................................... 1-5
show switch ........................................................................................................................................ 1-5
show switch switchtype ...................................................................................................................... 1-6
show switch stack-ports...................................................................................................................... 1-7
set switch stack-port ........................................................................................................................... 1-8
set switch ............................................................................................................................................ 1-9
set switch copy-fw .............................................................................................................................. 1-9
set switch description ....................................................................................................................... 1-10
set switch movemanagement ........................................................................................................... 1-10
set switch member............................................................................................................................ 1-11
clear switch member......................................................................................................................... 1-11

Chapter 2: Basic Configuration

Quick Start Setup Commands ........................................................................................................................ 2-1
Setting Basic Switch Properties ...................................................................................................................... 2-2
show ip address.................................................................................................................................. 2-3
set ip address ..................................................................................................................................... 2-4
clear ip address .................................................................................................................................. 2-5
show ip protocol.................................................................................................................................. 2-5
set ip protocol ..................................................................................................................................... 2-6
show ip route ...................................................................................................................................... 2-6
show system....................................................................................................................................... 2-7
show system hardware....................................................................................................................... 2-8
show system utilization....................................................................................................................... 2-9
set system utilization ........................................................................................................................ 2-10
clear system utilization ..................................................................................................................... 2-11
show system enhancedbuffermode .................................................................................................. 2-12
set system enhancedbuffermode ..................................................................................................... 2-12
set system temperature .................................................................................................................... 2-13
clear system temperature ................................................................................................................. 2-13
show time ......................................................................................................................................... 2-14
set time ............................................................................................................................................. 2-15
show summertime ............................................................................................................................ 2-15

vii
 set summertime ................................................................................................................................ 2-16
set summertime date ........................................................................................................................ 2-16
set summertime recurring ................................................................................................................. 2-17
clear summertime ............................................................................................................................. 2-18
set prompt......................................................................................................................................... 2-18
show banner ..................................................................................................................................... 2-19
set banner......................................................................................................................................... 2-19
clear banner...................................................................................................................................... 2-20
show version..................................................................................................................................... 2-21
set system name .............................................................................................................................. 2-22
set system location ........................................................................................................................... 2-22
set system contact............................................................................................................................ 2-23
set width ........................................................................................................................................... 2-23
set length .......................................................................................................................................... 2-24
show logout ...................................................................................................................................... 2-24
set logout ......................................................................................................................................... 2-25
show console .................................................................................................................................... 2-25
set console baud .............................................................................................................................. 2-26
set console vt100.............................................................................................................................. 2-26
Downloading a Firmware Image ................................................................................................................... 2-27
Downloading from a TFTP or SFTP Server ........................................................................................... 2-28
Downloading via the Serial Port ............................................................................................................. 2-28
Reverting to a Previous Image ............................................................................................................... 2-30
Reviewing and Selecting a Boot Firmware Image ........................................................................................ 2-31
show boot system ............................................................................................................................. 2-31
set boot system ................................................................................................................................ 2-31
Setting the Authentication Login Method ...................................................................................................... 2-32
show authentication login ................................................................................................................. 2-33
set authentication login..................................................................................................................... 2-33
clear authentication login.................................................................................................................. 2-34
Starting and Configuring Telnet .................................................................................................................... 2-34
show telnet ....................................................................................................................................... 2-35
set telnet ........................................................................................................................................... 2-35
telnet................................................................................................................................................. 2-36
Configuring Secure Shell (SSH) ................................................................................................................... 2-37
show ssh status ................................................................................................................................ 2-37
set ssh .............................................................................................................................................. 2-37
set ssh hostkey................................................................................................................................. 2-38
Managing Switch Configuration and Files .................................................................................................... 2-38
show snmp persistmode ................................................................................................................... 2-39
set snmp persistmode ...................................................................................................................... 2-39
save config ....................................................................................................................................... 2-40
dir...................................................................................................................................................... 2-41
show file............................................................................................................................................ 2-42
show config....................................................................................................................................... 2-43
configure ........................................................................................................................................... 2-44
copy .................................................................................................................................................. 2-45
delete................................................................................................................................................ 2-45
show tftp settings.............................................................................................................................. 2-46
set tftp timeout .................................................................................................................................. 2-46
clear tftp timeout ............................................................................................................................... 2-47
set tftp retry....................................................................................................................................... 2-47
clear tftp retry.................................................................................................................................... 2-48
Clearing and Closing the CLI ........................................................................................................................ 2-48
cls (clear screen) .............................................................................................................................. 2-48
exit .................................................................................................................................................... 2-49

viii
 Resetting the Switch ..................................................................................................................................... 2-49
reset.................................................................................................................................................. 2-50
reset at.............................................................................................................................................. 2-51
reset in .............................................................................................................................................. 2-51
show reset ........................................................................................................................................ 2-52
clear config ....................................................................................................................................... 2-52
Using and Configuring WebView .................................................................................................................. 2-53
show webview .................................................................................................................................. 2-54
set webview ...................................................................................................................................... 2-54
show ssl............................................................................................................................................ 2-55
set ssl ............................................................................................................................................... 2-55
Gathering Technical Support Information ..................................................................................................... 2-56
Command ............................................................................................................................................... 2-56
show support .................................................................................................................................... 2-56

Chapter 3: Setting User Accounts and Passwords

show system login .............................................................................................................................. 3-1
set system login .................................................................................................................................. 3-2
clear system login ............................................................................................................................... 3-4
set password ...................................................................................................................................... 3-5
set system password-resetbutton ....................................................................................................... 3-6
show system password ...................................................................................................................... 3-7
set system password .......................................................................................................................... 3-9
clear system password ..................................................................................................................... 3-12
show system lockout ........................................................................................................................ 3-13
set system lockout ............................................................................................................................ 3-14

Chapter 4: Management Authentication Notification MIB Commands

show mgmt-auth-notify ....................................................................................................................... 4-1
set mgmt-auth-notify........................................................................................................................... 4-2
clear mgmt-auth-notify........................................................................................................................ 4-3

Chapter 5: Setting the Security Mode

set security profile............................................................................................................................... 5-1
clear security profile............................................................................................................................ 5-2
show security profile ........................................................................................................................... 5-2

Chapter 6: Configuring System Power and PoE

show inlinepower ................................................................................................................................ 6-1
set inlinepower threshold.................................................................................................................... 6-2
set inlinepower trap ............................................................................................................................ 6-3
set inlinepower detectionmode ........................................................................................................... 6-3
show port inlinepower ......................................................................................................................... 6-4
set port inlinepower ............................................................................................................................ 6-5

Chapter 7: Transmit Queue Monitoring Configuration

set txqmonitor ..................................................................................................................................... 7-1
set txqmonitor downtime..................................................................................................................... 7-2
set txqmonitor minrate ........................................................................................................................ 7-2
set txqmonitor threshold ..................................................................................................................... 7-3
clear txqmonitor .................................................................................................................................. 7-3
show txqmonitor ................................................................................................................................. 7-4
show txqmonitor flowcontrol ............................................................................................................... 7-5
show txqmonitor port .......................................................................................................................... 7-6

ix
Chapter 8: Discovery Protocol Configuration
Configuring CDP ............................................................................................................................................. 8-1
show cdp ............................................................................................................................................ 8-1
set cdp state ....................................................................................................................................... 8-3
set cdp auth ........................................................................................................................................ 8-3
set cdp interval ................................................................................................................................... 8-4
set cdp hold-time ................................................................................................................................ 8-4
clear cdp ............................................................................................................................................. 8-5
show neighbors .................................................................................................................................. 8-5
Configuring Cisco Discovery Protocol ............................................................................................................ 8-6
show ciscodp ...................................................................................................................................... 8-7
show ciscodp port info ........................................................................................................................ 8-7
set ciscodp status ............................................................................................................................... 8-8
set ciscodp timer................................................................................................................................. 8-9
set ciscodp holdtime ........................................................................................................................... 8-9
set ciscodp port ................................................................................................................................ 8-10
clear ciscodp..................................................................................................................................... 8-11
Configuring Link Layer Discovery Protocol and LLDP-MED ........................................................................ 8-12
show lldp........................................................................................................................................... 8-13
show lldp port status......................................................................................................................... 8-14
show lldp port trap ............................................................................................................................ 8-14
show lldp port tx-tlv........................................................................................................................... 8-15
show lldp port location-info ............................................................................................................... 8-15
show lldp port local-info .................................................................................................................... 8-16
show lldp port remote-info ................................................................................................................ 8-19
show lldp port network-policy ........................................................................................................... 8-20
set lldp tx-interval.............................................................................................................................. 8-21
set lldp hold-multiplier ....................................................................................................................... 8-22
set lldp trap-interval .......................................................................................................................... 8-22
set lldp med-fast-repeat .................................................................................................................... 8-23
set lldp port status ............................................................................................................................ 8-24
set lldp port trap................................................................................................................................ 8-24
set lldp port med-trap........................................................................................................................ 8-25
set lldp port location-info................................................................................................................... 8-25
set lldp port tx-tlv .............................................................................................................................. 8-26
set lldp port network-policy ............................................................................................................... 8-27
clear lldp ........................................................................................................................................... 8-29
clear lldp port status ......................................................................................................................... 8-30
clear lldp port trap ............................................................................................................................. 8-30
clear lldp port med-trap..................................................................................................................... 8-31
clear lldp port location-info................................................................................................................ 8-31
clear lldp port network-policy ............................................................................................................ 8-32
clear lldp port tx-tlv ........................................................................................................................... 8-33

Chapter 9: Port Configuration

Reviewing Port Status .................................................................................................................................... 9-1
show port ............................................................................................................................................ 9-2
show port status ................................................................................................................................. 9-2
show port counters ............................................................................................................................. 9-3
clear port counters.............................................................................................................................. 9-5
show port cablestatus......................................................................................................................... 9-5
Disabling / Enabling and Naming Ports .......................................................................................................... 9-6
set port disable ................................................................................................................................... 9-7
set port enable.................................................................................................................................... 9-7
show port alias.................................................................................................................................... 9-8

x
 set port alias ....................................................................................................................................... 9-8
Setting Speed and Duplex Mode .................................................................................................................... 9-9
show port speed ................................................................................................................................. 9-9
set port speed..................................................................................................................................... 9-9
show port duplex .............................................................................................................................. 9-10
set port duplex .................................................................................................................................. 9-10
Enabling / Disabling Jumbo Frame Support ................................................................................................. 9-12
show port jumbo ............................................................................................................................... 9-12
set port jumbo................................................................................................................................... 9-12
clear port jumbo ................................................................................................................................ 9-13
Setting Auto-Negotiation and Advertised Ability ........................................................................................... 9-14
show port negotiation ....................................................................................................................... 9-14
set port negotiation ........................................................................................................................... 9-14
show port advertise .......................................................................................................................... 9-15
set port advertise .............................................................................................................................. 9-16
clear port advertise ........................................................................................................................... 9-16
show port mdix ................................................................................................................................. 9-17
set port mdix ..................................................................................................................................... 9-18
Setting Flow Control ..................................................................................................................................... 9-19
show flowcontrol ............................................................................................................................... 9-19
set flowcontrol................................................................................................................................... 9-19
Setting Port Link Traps and Link Flap Detection .......................................................................................... 9-20
show port trap................................................................................................................................... 9-20
set port trap ...................................................................................................................................... 9-21
show linkflap ..................................................................................................................................... 9-21
set linkflap globalstate ...................................................................................................................... 9-24
set linkflap portstate.......................................................................................................................... 9-24
set linkflap interval ............................................................................................................................ 9-25
set linkflap action .............................................................................................................................. 9-25
clear linkflap action ........................................................................................................................... 9-26
set linkflap threshold......................................................................................................................... 9-27
set linkflap downtime ........................................................................................................................ 9-27
clear linkflap down ............................................................................................................................ 9-28
clear linkflap...................................................................................................................................... 9-28
show newaddrtrap ............................................................................................................................ 9-29
set newaddrtrap................................................................................................................................ 9-29
Configuring Broadcast Suppression ............................................................................................................. 9-30
show port broadcast ......................................................................................................................... 9-30
set port broadcast............................................................................................................................. 9-31
clear port broadcast.......................................................................................................................... 9-32
Port Mirroring ................................................................................................................................................ 9-33
show port mirroring........................................................................................................................... 9-33
set port mirroring .............................................................................................................................. 9-34
clear port mirroring ........................................................................................................................... 9-34
Link Aggregation Control Protocol (LACP) ................................................................................................... 9-35
show lacp.......................................................................................................................................... 9-36
set lacp ............................................................................................................................................. 9-37
set lacp asyspri................................................................................................................................. 9-38
set lacp aadminkey........................................................................................................................... 9-38
clear lacp .......................................................................................................................................... 9-39
set lacp static.................................................................................................................................... 9-39
clear lacp static ................................................................................................................................. 9-40
set lacp singleportlag........................................................................................................................ 9-41
clear lacp singleportlag..................................................................................................................... 9-41
show port lacp .................................................................................................................................. 9-42
set port lacp ...................................................................................................................................... 9-43

xi
 clear port lacp ................................................................................................................................... 9-45
set lacp groups ................................................................................................................................. 9-46
clear lacp groups .............................................................................................................................. 9-47
show lacp groups.............................................................................................................................. 9-48
Configuring Protected Ports ......................................................................................................................... 9-48
set port protected.............................................................................................................................. 9-49
show port protected .......................................................................................................................... 9-49
clear port protected........................................................................................................................... 9-50
set port protected name.................................................................................................................... 9-50
show port protected name ................................................................................................................ 9-51
clear port protected name................................................................................................................. 9-51

Chapter 10: SNMP Configuration

Reviewing SNMP Statistics .......................................................................................................................... 10-1
show snmp counters......................................................................................................................... 10-1
Configuring SNMP Users, Groups, and Communities .................................................................................. 10-4
show snmp user ............................................................................................................................... 10-5
set snmp user ................................................................................................................................... 10-6
clear snmp user ................................................................................................................................ 10-7
show snmp group ............................................................................................................................. 10-8
set snmp group ................................................................................................................................. 10-9
clear snmp group ............................................................................................................................ 10-10
show snmp community ................................................................................................................... 10-10
set snmp community....................................................................................................................... 10-11
clear snmp community.................................................................................................................... 10-12
Configuring SNMP Access Rights .............................................................................................................. 10-12
show snmp access ......................................................................................................................... 10-13
set snmp access............................................................................................................................. 10-14
clear snmp access.......................................................................................................................... 10-15
Configuring SNMP MIB Views .................................................................................................................... 10-16
show snmp view ............................................................................................................................. 10-16
show snmp context......................................................................................................................... 10-17
set snmp view................................................................................................................................. 10-18
clear snmp view.............................................................................................................................. 10-19
Configuring SNMP Target Parameters ....................................................................................................... 10-19
show snmp targetparams ............................................................................................................... 10-20
set snmp targetparams................................................................................................................... 10-21
clear snmp targetparams................................................................................................................ 10-22
Configuring SNMP Target Addresses ........................................................................................................ 10-22
show snmp targetaddr .................................................................................................................... 10-23
set snmp targetaddr........................................................................................................................ 10-24
clear snmp targetaddr..................................................................................................................... 10-25
Configuring SNMP Notification Parameters ............................................................................................... 10-25
show snmp notify ............................................................................................................................ 10-26
set snmp notify ............................................................................................................................... 10-27
clear snmp notify ............................................................................................................................ 10-28
show snmp notifyfilter ..................................................................................................................... 10-28
set snmp notifyfilter......................................................................................................................... 10-29
clear snmp notifyfilter...................................................................................................................... 10-30
show snmp notifyprofile .................................................................................................................. 10-30
set snmp notifyprofile...................................................................................................................... 10-31
clear snmp notifyprofile................................................................................................................... 10-31
Configuring the SNMP Management Interface ........................................................................................... 10-32
show snmp interface....................................................................................................................... 10-32
set snmp interface .......................................................................................................................... 10-33

xii
 clear snmp interface ....................................................................................................................... 10-34
Configuring the SNMP Engine ID ............................................................................................................... 10-34
show snmp engineid....................................................................................................................... 10-35
set snmp engineid .......................................................................................................................... 10-35
clear snmp engineid ....................................................................................................................... 10-37

Chapter 11: Spanning Tree Configuration

Configuring Spanning Tree Bridge Parameters ............................................................................................ 11-1
show spantree stats.......................................................................................................................... 11-3
set spantree...................................................................................................................................... 11-5
show spantree version...................................................................................................................... 11-5
set spantree version ......................................................................................................................... 11-6
clear spantree version ...................................................................................................................... 11-6
show spantree bpdu-forwarding ....................................................................................................... 11-7
set spantree bpdu-forwarding........................................................................................................... 11-7
show spantree bridgeprioritymode ................................................................................................... 11-8
set spantree bridgeprioritymode ....................................................................................................... 11-8
clear spantree bridgeprioritymode .................................................................................................... 11-9
show spantree mstilist ...................................................................................................................... 11-9
set spantree msti ............................................................................................................................ 11-10
clear spantree msti ......................................................................................................................... 11-10
show spantree mstmap .................................................................................................................. 11-11
set spantree mstmap ...................................................................................................................... 11-11
clear spantree mstmap ................................................................................................................... 11-12
show spantree vlanlist .................................................................................................................... 11-12
show spantree mstcfgid .................................................................................................................. 11-13
set spantree mstcfgid ..................................................................................................................... 11-14
clear spantree mstcfgid .................................................................................................................. 11-14
set spantree priority ........................................................................................................................ 11-15
clear spantree priority ..................................................................................................................... 11-15
set spantree hello ........................................................................................................................... 11-16
clear spantree hello ........................................................................................................................ 11-16
set spantree maxage ...................................................................................................................... 11-17
clear spantree maxage ................................................................................................................... 11-17
set spantree fwddelay..................................................................................................................... 11-18
clear spantree fwddelay.................................................................................................................. 11-18
show spantree backuproot ............................................................................................................. 11-19
set spantree backuproot ................................................................................................................. 11-19
clear spantree backuproot .............................................................................................................. 11-20
show spantree tctrapsuppress........................................................................................................ 11-21
set spantree tctrapsuppress ........................................................................................................... 11-21
clear spantree tctrapsuppress ........................................................................................................ 11-22
set spantree protomigration ............................................................................................................11-22
show spantree spanguard .............................................................................................................. 11-23
set spantree spanguard .................................................................................................................. 11-23
clear spantree spanguard ............................................................................................................... 11-24
show spantree spanguardtimeout .................................................................................................. 11-24
set spantree spanguardtimeout ...................................................................................................... 11-25
clear spantree spanguardtimeout ................................................................................................... 11-25
show spantree spanguardlock ........................................................................................................ 11-26
clear / set spantree spanguardlock................................................................................................. 11-26
show spantree spanguardtrapenable ............................................................................................. 11-27
set spantree spanguardtrapenable ................................................................................................. 11-27
clear spantree spanguardtrapenable .............................................................................................. 11-28
show spantree legacypathcost ....................................................................................................... 11-28

xiii
 set spantree legacypathcost........................................................................................................... 11-29
clear spantree legacypathcost ........................................................................................................ 11-29
show spantree autoedge ................................................................................................................ 11-30
set spantree autoedge.................................................................................................................... 11-30
clear spantree autoedge................................................................................................................. 11-31
show spantree debug ..................................................................................................................... 11-31
clear spantree debug...................................................................................................................... 11-32
Configuring Spanning Tree Port Parameters ............................................................................................. 11-33
set spantree portadmin................................................................................................................... 11-33
clear spantree portadmin................................................................................................................ 11-34
show spantree portadmin ............................................................................................................... 11-34
show spantree portpri ..................................................................................................................... 11-35
set spantree portpri......................................................................................................................... 11-35
clear spantree portpri...................................................................................................................... 11-36
show spantree adminpathcost ........................................................................................................ 11-36
set spantree adminpathcost ........................................................................................................... 11-37
clear spantree adminpathcost ........................................................................................................ 11-37
show spantree adminedge ............................................................................................................. 11-38
set spantree adminedge ................................................................................................................. 11-38
clear spantree adminedge .............................................................................................................. 11-39
show spantree operedge ................................................................................................................ 11-39
Configuring Spanning Tree Loop Protect Parameters ................................................................................ 11-40
set spantree lp ................................................................................................................................ 11-41
show spantree lp ............................................................................................................................ 11-41
clear spantree lp ............................................................................................................................. 11-42
show spantree lplock ...................................................................................................................... 11-42
clear spantree lplock....................................................................................................................... 11-43
set spantree lpcapablepartner ........................................................................................................ 11-44
show spantree lpcapablepartner .................................................................................................... 11-44
clear spantree lpcapablepartner ..................................................................................................... 11-45
set spantree lpthreshold ................................................................................................................. 11-45
show spantree lpthreshold.............................................................................................................. 11-46
clear spantree lpthreshold .............................................................................................................. 11-46
set spantree lpwindow .................................................................................................................... 11-47
show spantree lpwindow ................................................................................................................ 11-47
clear spantree lpwindow ................................................................................................................. 11-48
set spantree lptrapenable ............................................................................................................... 11-48
show spantree lptrapenable ........................................................................................................... 11-49
clear spantree lptrapenable ............................................................................................................11-49
set spantree disputedbpduthreshold .............................................................................................. 11-50
show spantree disputedbpduthreshold ........................................................................................... 11-51
clear spantree disputedbpduthreshold ...........................................................................................11-51
show spantree nonforwardingreason ............................................................................................. 11-52

Chapter 12: 802.1Q VLAN Configuration

Viewing VLANs ............................................................................................................................................. 12-1
show vlan.......................................................................................................................................... 12-1
Creating and Naming Static VLANs ............................................................................................................. 12-3
set vlan ............................................................................................................................................. 12-3
set vlan name ................................................................................................................................... 12-4
clear vlan .......................................................................................................................................... 12-4
clear vlan name ................................................................................................................................ 12-5
Assigning Port VLAN IDs (PVIDs) and Ingress Filtering .............................................................................. 12-5
show port vlan .................................................................................................................................. 12-5
set port vlan ...................................................................................................................................... 12-6

xiv
 clear port vlan ................................................................................................................................... 12-7
show port ingress-filter ..................................................................................................................... 12-7
set port ingress-filter ......................................................................................................................... 12-8
show port discard ............................................................................................................................. 12-9
set port discard ................................................................................................................................. 12-9
Configuring the VLAN Egress List .............................................................................................................. 12-10
show port egress ............................................................................................................................ 12-10
set vlan forbidden ........................................................................................................................... 12-11
set vlan egress ............................................................................................................................... 12-12
clear vlan egress ............................................................................................................................ 12-12
show vlan dynamicegress .............................................................................................................. 12-13
set vlan dynamicegress .................................................................................................................. 12-14
Setting the Host VLAN ................................................................................................................................ 12-15
Commands ........................................................................................................................................... 12-15
show host vlan................................................................................................................................ 12-15
set host vlan ................................................................................................................................... 12-15
clear host vlan ................................................................................................................................ 12-16
Enabling/Disabling GVRP (GARP VLAN Registration Protocol) ................................................................ 12-17
show gvrp ....................................................................................................................................... 12-17
show garp timer .............................................................................................................................. 12-18
set gvrp........................................................................................................................................... 12-19
clear gvrp ........................................................................................................................................ 12-19
set garp timer.................................................................................................................................. 12-20
clear garp timer............................................................................................................................... 12-20
Configuring VLAN Associations .................................................................................................................. 12-21
set vlan association ........................................................................................................................ 12-22
clear vlan association ..................................................................................................................... 12-22
show vlan association..................................................................................................................... 12-23

Chapter 13: Policy Classification Configuration

Configuring Policy Profiles ............................................................................................................................ 13-1
show policy profile ............................................................................................................................ 13-1
set policy profile ................................................................................................................................ 13-3
clear policy profile ............................................................................................................................. 13-4
Configuring Classification Rules ................................................................................................................... 13-5
show policy rule ................................................................................................................................ 13-5
show policy capability ....................................................................................................................... 13-7
set policy capability ipv6dest ............................................................................................................ 13-9
set policy rule.................................................................................................................................... 13-9
clear policy rule............................................................................................................................... 13-12
clear policy all-rules ........................................................................................................................ 13-14
Assigning Ports to Policy Profiles ............................................................................................................... 13-14
set policy port ................................................................................................................................. 13-14
clear policy port .............................................................................................................................. 13-15
show policy port.............................................................................................................................. 13-15
Configuring Policy Class of Service (CoS) ................................................................................................. 13-17
set cos state ................................................................................................................................... 13-18
show cos state................................................................................................................................ 13-18
clear cos state ................................................................................................................................ 13-19
set cos settings............................................................................................................................... 13-19
clear cos settings ............................................................................................................................ 13-20
show cos settings ........................................................................................................................... 13-21
set cos port-config .......................................................................................................................... 13-21
show cos port-config....................................................................................................................... 13-23
clear cos port-config ....................................................................................................................... 13-24

xv
 set cos port-resource irl .................................................................................................................. 13-24
set cos port-resource flood-ctrl ....................................................................................................... 13-26
show cos port-resource .................................................................................................................. 13-26
clear cos port-resource irl ............................................................................................................... 13-28
clear cos port-resource flood-ctrl .................................................................................................... 13-28
set cos reference ............................................................................................................................ 13-29
show cos reference ........................................................................................................................ 13-30
clear cos reference ......................................................................................................................... 13-31
show cos unit.................................................................................................................................. 13-31
clear cos all-entries......................................................................................................................... 13-32
show cos port-type ......................................................................................................................... 13-33

Chapter 14: Port Priority and Rate Limiting Configuration

Configuring Port Priority ............................................................................................................................... 14-1
show port priority .............................................................................................................................. 14-1
set port priority.................................................................................................................................. 14-2
clear port priority............................................................................................................................... 14-3
Configuring Priority to Transmit Queue Mapping ......................................................................................... 14-3
show port priority-queue ................................................................................................................... 14-4
set port priority-queue....................................................................................................................... 14-4
clear port priority-queue.................................................................................................................... 14-5
Configuring Port Transmit Queues ............................................................................................................... 14-6
show port txq .................................................................................................................................... 14-6
set port txq........................................................................................................................................ 14-7
clear port txq..................................................................................................................................... 14-8
ge.1.1 WRR 2 10 15 20 24 29 SP SP ................................................................................................. 14-9
Configuring Port Traffic Rate Limiting ........................................................................................................... 14-9
show port ratelimit ............................................................................................................................ 14-9
set port ratelimit .............................................................................................................................. 14-10
clear port ratelimit ........................................................................................................................... 14-11

Chapter 15: IGMP Configuration

Configuring IGMP Snooping at Layer 2 ........................................................................................................ 15-1
show igmpsnooping .......................................................................................................................... 15-2
show igmpsnooping port................................................................................................................... 15-3
set igmpsnooping adminmode.......................................................................................................... 15-4
set igmpsnooping interfacemode...................................................................................................... 15-5
set igmpsnooping groupmembershipinterval .................................................................................... 15-5
set igmpsnooping maxresponse ....................................................................................................... 15-6
set igmpsnooping mcrtrexpiretime.................................................................................................... 15-7
set igmpsnooping mrouter ................................................................................................................ 15-7
set igmpsnooping add-static ............................................................................................................. 15-8
set igmpsnooping remove-static ....................................................................................................... 15-9
set igmpsnooping fast-leave ............................................................................................................. 15-9
set igmpsnooping <vlan-id>............................................................................................................15-10
set igmpsnooping <vlan-id> fast-leave ........................................................................................... 15-10
set igmpsnooping <vlan-id> groupmembership-interval ................................................................. 15-11
set igmpsnooping <vlan-id> maxresponse ..................................................................................... 15-12
set igmpsnooping <vlan-id> mcrtrexpiretime .................................................................................. 15-13
show igmpsnooping static .............................................................................................................. 15-13
show igmpsnooping mfdb ............................................................................................................... 15-14
show igmpsnooping vlan ................................................................................................................ 15-14
show igmpsnooping mrouter .......................................................................................................... 15-15
clear igmpsnooping ........................................................................................................................ 15-16
clear igmpsnooping groupmembershipinterval............................................................................... 15-16

xvi
 clear igmpsnooping maxresponse .................................................................................................. 15-17
clear igmpsnooping mcrtexpiretime ................................................................................................ 15-17
clear igmpsnooping <vlan-id> groupmembership-interval .............................................................. 15-18
clear igmpsnooping <vlan-id> maxresponse .................................................................................. 15-18
clear igmpsnooping <vlan-id> mcrtexpiretime ................................................................................ 15-19
Configuring IGMP Snooping Querier .......................................................................................................... 15-19
show igmpsnooping querier............................................................................................................15-20
set igmpsnooping querier ............................................................................................................... 15-21
set igmpsnooping querier <vlan-id> ...............................................................................................15-21
set igmpsnooping querier address ................................................................................................. 15-22
set igmpsnooping querier <vlan-id> address.................................................................................. 15-23
set igmpsnooping querier election participate ................................................................................ 15-23
set igmpsnooping querier query-interval ........................................................................................15-24
set igmpsnooping querier timer expiry............................................................................................ 15-25
set igmpsnooping querier version................................................................................................... 15-25
clear igmpsnooping querier <vlan-id> ............................................................................................ 15-26
clear igmpsnooping querier ............................................................................................................15-26
Configuring IGMP on Routing Interfaces .................................................................................................... 15-27
ip igmp ............................................................................................................................................ 15-27
show ip igmp................................................................................................................................... 15-28
ip igmp enable ................................................................................................................................ 15-29
ip igmp version ............................................................................................................................... 15-29
show ip igmp interface .................................................................................................................... 15-30
show ip igmp groups....................................................................................................................... 15-31
ip igmp query-interval ..................................................................................................................... 15-31
ip igmp query-max-response-time .................................................................................................. 15-32
ip igmp startup-query-interval ......................................................................................................... 15-33
ip igmp startup-query-count ............................................................................................................15-33
ip igmp last-member-query-interval ................................................................................................ 15-34
ip igmp last-member-query-count ................................................................................................... 15-34
ip igmp robustness ......................................................................................................................... 15-35
show ip igmp interface membership ...............................................................................................15-36
show ip igmp interface stats ........................................................................................................... 15-37

Chapter 16: MLD Configuration

Configuring MLD Snooping at Layer 2 ......................................................................................................... 16-1
show mldsnooping............................................................................................................................ 16-2
show mldsnooping port..................................................................................................................... 16-3
set mldsnooping adminmode............................................................................................................ 16-4
set mldsnooping interfacemode........................................................................................................ 16-5
set mldsnooping groupmembershipinterval ...................................................................................... 16-5
set mldsnooping maxresponse ......................................................................................................... 16-6
set mldsnooping mcrtrexpiretime...................................................................................................... 16-7
set mldsnooping mrouter .................................................................................................................. 16-8
set mldsnooping add-static............................................................................................................... 16-8
set mldsnooping remove-static ......................................................................................................... 16-9
set mldsnooping <vlan-id>.............................................................................................................. 16-10
set mldsnooping <vlan-id> groupmembership-interval ................................................................... 16-10
set mldsnooping <vlan-id> maxresponse ....................................................................................... 16-11
set mldsnooping <vlan-id> mcrtrexpiretime .................................................................................... 16-11
show mldsnooping mfdb ................................................................................................................. 16-12
show mldsnooping vlan .................................................................................................................. 16-13
show mldsnooping mrouter ............................................................................................................16-13
show mldsnooping static ................................................................................................................ 16-14
clear mldsnooping .......................................................................................................................... 16-15

xvii
 clear mldsnooping groupmembershipinterval ................................................................................. 16-15
clear mldsnooping maxresponse .................................................................................................... 16-16
clear mldsnooping mcrtexpiretime .................................................................................................. 16-16
clear mldsnooping <vlan-id> groupmembership-interval ................................................................ 16-17
clear mldsnooping <vlan-id> maxresponse .................................................................................... 16-17
clear mldsnooping <vlan-id> mcrtexpiretime .................................................................................. 16-18
Configuring MLD Snooping Querier ........................................................................................................... 16-18
show mldsnooping querier.............................................................................................................. 16-19
set mldsnooping querier ................................................................................................................. 16-20
set mldsnooping querier <vlan-id> ................................................................................................. 16-21
set mldsnooping querier address ................................................................................................... 16-21
set mldsnooping querier <vlan-id> address.................................................................................... 16-22
set mldsnooping querier election participate .................................................................................. 16-23
set mldsnooping querier query-interval .......................................................................................... 16-24
set mldsnooping querier timer expiry.............................................................................................. 16-24
clear mldsnooping querier <vlan-id> address................................................................................. 16-25
clear mldsnooping querier .............................................................................................................. 16-25

Chapter 17: Network Management

Monitoring Network Events and Status ........................................................................................................ 17-1
history ............................................................................................................................................... 17-1
show history...................................................................................................................................... 17-2
set history ......................................................................................................................................... 17-2
ping................................................................................................................................................... 17-3
show users ....................................................................................................................................... 17-4
disconnect ........................................................................................................................................ 17-4
show netstat ..................................................................................................................................... 17-5
Managing Switch Network Addresses and Routes ....................................................................................... 17-6
show arp ........................................................................................................................................... 17-6
set arp............................................................................................................................................... 17-7
clear arp............................................................................................................................................ 17-8
traceroute ......................................................................................................................................... 17-8
show mac ......................................................................................................................................... 17-9
show mac agetime.......................................................................................................................... 17-10
set mac agetime ............................................................................................................................. 17-11
clear mac agetime .......................................................................................................................... 17-11
set mac algorithm ........................................................................................................................... 17-12
show mac algorithm........................................................................................................................ 17-13
clear mac algorithm ........................................................................................................................ 17-13
set mac multicast ............................................................................................................................ 17-14
clear mac address .......................................................................................................................... 17-14
show mac unreserved-flood ........................................................................................................... 17-15
set mac unreserved-flood ............................................................................................................... 17-15
Configuring Node Aliases ........................................................................................................................... 17-16
show nodealias config .................................................................................................................... 17-16
set nodealias .................................................................................................................................. 17-17
clear nodealias config ..................................................................................................................... 17-18

Chapter 18: Configuring System Logging

show logging server.......................................................................................................................... 18-1
set logging server ............................................................................................................................. 18-2
clear logging server .......................................................................................................................... 18-3
show logging default......................................................................................................................... 18-4
set logging default ............................................................................................................................ 18-4
clear logging default ......................................................................................................................... 18-5

xviii
 show logging application .................................................................................................................. 18-6
set logging application ...................................................................................................................... 18-7
clear logging application ................................................................................................................... 18-8
show logging local ............................................................................................................................ 18-9
set logging local................................................................................................................................ 18-9
clear logging local........................................................................................................................... 18-10
show logging buffer ........................................................................................................................ 18-11
show logging interface.................................................................................................................... 18-11
set logging interface ....................................................................................................................... 18-12
clear logging interface .................................................................................................................... 18-13

Chapter 19: Configuring SNTP

General SNTP Commands ........................................................................................................................... 19-1
show sntp ......................................................................................................................................... 19-2
set sntp client.................................................................................................................................... 19-3
clear sntp client................................................................................................................................. 19-4
set sntp server .................................................................................................................................. 19-4
clear sntp server ............................................................................................................................... 19-5
set sntp poll-interval.......................................................................................................................... 19-5
clear sntp poll-interval....................................................................................................................... 19-6
set sntp poll-retry .............................................................................................................................. 19-6
clear sntp poll-retry ........................................................................................................................... 19-7
set sntp poll-timeout ......................................................................................................................... 19-7
clear sntp poll-timeout ...................................................................................................................... 19-7
set timezone ..................................................................................................................................... 19-8
show sntp interface........................................................................................................................... 19-9
set sntp interface ............................................................................................................................ 19-10
clear sntp interface ......................................................................................................................... 19-11
SNTP Authentication Commands ............................................................................................................... 19-11
set sntp authenticate ...................................................................................................................... 19-11
set sntp authentication-key............................................................................................................. 19-12
clear sntp authentication-key.......................................................................................................... 19-13
set sntp trusted-key ........................................................................................................................ 19-13
clear sntp trusted-key ..................................................................................................................... 19-14

Chapter 20: RMON Configuration

Statistics Group Commands ......................................................................................................................... 20-1
show rmon stats ............................................................................................................................... 20-1
set rmon stats ................................................................................................................................... 20-2
clear rmon stats ................................................................................................................................ 20-3
History Group Commands ............................................................................................................................ 20-3
show rmon history ............................................................................................................................ 20-3
set rmon history ................................................................................................................................ 20-4
clear rmon history ............................................................................................................................. 20-5
Alarm Group Commands .............................................................................................................................. 20-5
show rmon alarm .............................................................................................................................. 20-6
set rmon alarm properties................................................................................................................. 20-7
set rmon alarm status ....................................................................................................................... 20-8
clear rmon alarm............................................................................................................................... 20-9
Event Group Commands .............................................................................................................................. 20-9
show rmon event .............................................................................................................................. 20-9
set rmon event properties ............................................................................................................... 20-10
set rmon event status ..................................................................................................................... 20-11
clear rmon event............................................................................................................................. 20-12
Filter Group Commands ............................................................................................................................. 20-12

xix
 show rmon channel ........................................................................................................................ 20-13
set rmon channel ............................................................................................................................ 20-14
clear rmon channel ......................................................................................................................... 20-14
show rmon filter .............................................................................................................................. 20-15
set rmon filter .................................................................................................................................. 20-16
clear rmon filter ............................................................................................................................... 20-16
Packet Capture Commands ....................................................................................................................... 20-17
show rmon capture ......................................................................................................................... 20-17
set rmon capture............................................................................................................................. 20-18
clear rmon capture.......................................................................................................................... 20-19

Chapter 21: DHCP Server Configuration

Configuring General DHCP Server Parameters ........................................................................................... 21-1
set dhcp ............................................................................................................................................ 21-2
set dhcp bootp .................................................................................................................................. 21-2
set dhcp conflict logging ................................................................................................................... 21-3
show dhcp conflict ............................................................................................................................ 21-3
clear dhcp conflict............................................................................................................................. 21-4
set dhcp exclude............................................................................................................................... 21-4
clear dhcp exclude............................................................................................................................ 21-5
set dhcp ping .................................................................................................................................... 21-5
clear dhcp ping ................................................................................................................................. 21-6
show dhcp binding............................................................................................................................ 21-6
clear dhcp binding ............................................................................................................................ 21-7
show dhcp server statistics............................................................................................................... 21-7
clear dhcp server statistics ............................................................................................................... 21-8
Configuring IP Address Pools ....................................................................................................................... 21-9
set dhcp pool .................................................................................................................................. 21-10
clear dhcp pool ............................................................................................................................... 21-10
set dhcp pool network..................................................................................................................... 21-11
clear dhcp pool network.................................................................................................................. 21-11
set dhcp pool hardware-address .................................................................................................... 21-12
clear dhcp pool hardware-address ................................................................................................. 21-13
set dhcp pool host .......................................................................................................................... 21-13
clear dhcp pool host ....................................................................................................................... 21-14
set dhcp pool client-identifier .......................................................................................................... 21-14
clear dhcp pool client-identifier ....................................................................................................... 21-15
set dhcp pool client-name............................................................................................................... 21-15
clear dhcp pool client-name............................................................................................................21-16
set dhcp pool bootfile...................................................................................................................... 21-16
clear dhcp pool bootfile................................................................................................................... 21-17
set dhcp pool next-server ............................................................................................................... 21-17
clear dhcp pool next-server ............................................................................................................21-18
set dhcp pool lease......................................................................................................................... 21-18
clear dhcp pool lease...................................................................................................................... 21-19
set dhcp pool default-router ............................................................................................................21-20
clear dhcp pool default-router......................................................................................................... 21-20
set dhcp pool dns-server ................................................................................................................ 21-21
clear dhcp pool dns-server ............................................................................................................. 21-21
set dhcp pool domain-name ........................................................................................................... 21-22
clear dhcp pool domain-name ........................................................................................................ 21-22
set dhcp pool netbios-name-server ................................................................................................ 21-23
clear dhcp pool netbios-name-server ............................................................................................. 21-23
set dhcp pool netbios-node-type .................................................................................................... 21-24
clear dhcp pool netbios-node-type ................................................................................................. 21-24

xx
 set dhcp pool option ....................................................................................................................... 21-25
clear dhcp pool option .................................................................................................................... 21-25
show dhcp pool configuration ......................................................................................................... 21-26

Chapter 22: DHCP Snooping and Dynamic ARP Inspection

DHCP Snooping Commands ........................................................................................................................ 22-1
set dhcpsnooping ............................................................................................................................. 22-2
set dhcpsnooping vlan...................................................................................................................... 22-2
set dhcpsnooping trust ..................................................................................................................... 22-3
set dhcpsnooping binding ................................................................................................................. 22-4
set dhcpsnooping verify .................................................................................................................... 22-4
set dhcpsnooping log-invalid ............................................................................................................ 22-5
set dhcpsnooping limit ...................................................................................................................... 22-6
show dhcpsnooping .......................................................................................................................... 22-7
show dhcpsnooping port................................................................................................................... 22-7
show dhcpsnooping binding ............................................................................................................. 22-8
show dhcpsnooping statistics ........................................................................................................... 22-9
clear dhcpsnooping binding ............................................................................................................22-10
clear dhcpsnooping statistics.......................................................................................................... 22-10
clear dhcpsnooping limit ................................................................................................................. 22-11
Dynamic ARP Inspection Commands ........................................................................................................ 22-11
set arpinspection vlan ..................................................................................................................... 22-12
set arpinspection trust .................................................................................................................... 22-12
set arpinspection validate ............................................................................................................... 22-13
set arpinspection limit ..................................................................................................................... 22-14
set arpinspection filter..................................................................................................................... 22-15
show arpinspection access-list ....................................................................................................... 22-16
show arpinspection ports................................................................................................................ 22-16
show arpinspection vlan ................................................................................................................. 22-17
show arpinspection statistics .......................................................................................................... 22-17
clear arpinspection validate ............................................................................................................22-18
clear arpinspection vlan .................................................................................................................. 22-19
clear arpinspection filter.................................................................................................................. 22-20
clear arpinspection limit .................................................................................................................. 22-21
clear arpinspection statistics........................................................................................................... 22-21

Chapter 23: IP Configuration

Configuring Routing Interface Settings ......................................................................................................... 23-1
show interface .................................................................................................................................. 23-2
interface............................................................................................................................................ 23-2
show ip interface............................................................................................................................... 23-4
ip address ......................................................................................................................................... 23-5
no shutdown ..................................................................................................................................... 23-6
no ip routing...................................................................................................................................... 23-6
show running-config ......................................................................................................................... 23-7
Reviewing and Configuring the ARP Table .................................................................................................. 23-8
show ip arp ....................................................................................................................................... 23-8
arp .................................................................................................................................................... 23-9
ip proxy-arp..................................................................................................................................... 23-10
arp timeout...................................................................................................................................... 23-11
clear arp-cache ............................................................................................................................... 23-11
Configuring Broadcast Settings .................................................................................................................. 23-12
ip directed-broadcast ...................................................................................................................... 23-12
ip forward-protocol.......................................................................................................................... 23-13
ip helper-address ............................................................................................................................ 23-14

xxi
 Reviewing IP Traffic and Configuring Routes ............................................................................................. 23-15
show ip route .................................................................................................................................. 23-15
ip route............................................................................................................................................ 23-16
ping................................................................................................................................................. 23-17
traceroute ....................................................................................................................................... 23-17
Configuring ICMP Redirects ....................................................................................................................... 23-18
ip icmp redirect enable ................................................................................................................... 23-18
show ip icmp redirect...................................................................................................................... 23-19

Chapter 24: IPv4 Basic Routing Protocol Configuration

Configuring RIP ............................................................................................................................................ 24-1
RIP Router Configuration Commands .................................................................................................... 24-1
router rip ........................................................................................................................................... 24-2
distance ............................................................................................................................................ 24-2
no auto-summary.............................................................................................................................. 24-3
split-horizon poison........................................................................................................................... 24-4
passive-interface .............................................................................................................................. 24-4
receive-interface ............................................................................................................................... 24-5
redistribute........................................................................................................................................ 24-6
default-information originate ............................................................................................................. 24-6
RIP Interface Configuration Commands ................................................................................................ 24-7
ip rip enable ...................................................................................................................................... 24-7
ip rip send version ............................................................................................................................ 24-8
ip rip receive version......................................................................................................................... 24-8
ip rip authentication-key.................................................................................................................... 24-9
ip rip message-digest-key................................................................................................................. 24-9
Configuring IRDP ........................................................................................................................................ 24-11
ip irdp enable .................................................................................................................................. 24-11
ip irdp maxadvertinterval ................................................................................................................ 24-12
ip irdp minadvertinterval ................................................................................................................. 24-12
ip irdp holdtime ............................................................................................................................... 24-13
ip irdp preference............................................................................................................................ 24-13
ip irdp broadcast ............................................................................................................................. 24-14
show ip irdp .................................................................................................................................... 24-14

Chapter 25: MGMD Proxy Configuration

Introduction ................................................................................................................................................... 25-1
IGMP Proxy Commands ............................................................................................................................... 25-1
ip igmp-proxy enable ........................................................................................................................ 25-2
ip igmp-proxy unsolicit-rprt-interval................................................................................................... 25-3
show ip igmp-proxy........................................................................................................................... 25-3
show ip igmp-proxy interface ............................................................................................................ 25-4
show ip igmp-proxy groups............................................................................................................... 25-5
clear ip igmp-proxy statistics ............................................................................................................ 25-5
MLD Proxy Commands ................................................................................................................................ 25-6
ipv6 mld-proxy enable ...................................................................................................................... 25-6
ipv6 mld-proxy unsolicit-rprt-interval ................................................................................................. 25-7
show ipv6 mld-proxy......................................................................................................................... 25-8
show ipv6 mld-proxy interface .......................................................................................................... 25-8
show ipv6 mld-proxy groups ............................................................................................................. 25-9
clear ipv6 mld-proxy statistics......................................................................................................... 25-10

xxii
Chapter 26: IPv6 Management
show ipv6 status ............................................................................................................................... 26-1
set ipv6 ............................................................................................................................................. 26-2
set ipv6 address ............................................................................................................................... 26-2
show ipv6 address............................................................................................................................ 26-3
clear ipv6 address ............................................................................................................................ 26-4
set ipv6 gateway............................................................................................................................... 26-5
clear ipv6 gateway............................................................................................................................ 26-6
show ipv6 neighbors......................................................................................................................... 26-6
show ipv6 netstat.............................................................................................................................. 26-7
ping ipv6 ........................................................................................................................................... 26-8
traceroute ipv6.................................................................................................................................. 26-9

Chapter 27: Authentication and Authorization Configuration

Configuring RADIUS ..................................................................................................................................... 27-1
show radius ...................................................................................................................................... 27-2
set radius .......................................................................................................................................... 27-3
set radius ipsec................................................................................................................................. 27-5
clear radius ....................................................................................................................................... 27-5
clear radius ipsec.............................................................................................................................. 27-6
show radius accounting .................................................................................................................... 27-7
set radius accounting........................................................................................................................ 27-7
clear radius accounting..................................................................................................................... 27-8
show radius interface........................................................................................................................ 27-9
set radius interface ........................................................................................................................... 27-9
clear radius interface ...................................................................................................................... 27-10
set radius attribute mgmt password................................................................................................ 27-11
show radius attribute mgmt password ............................................................................................27-12
Configuring 802.1X Authentication ............................................................................................................. 27-12
show dot1x ..................................................................................................................................... 27-13
show dot1x auth-config................................................................................................................... 27-14
set dot1x ......................................................................................................................................... 27-15
set dot1x auth-config ...................................................................................................................... 27-16
clear dot1x auth-config ................................................................................................................... 27-17
show eapol ..................................................................................................................................... 27-18
set eapol ......................................................................................................................................... 27-20
clear eapol ...................................................................................................................................... 27-20
Configuring MAC Authentication ................................................................................................................ 27-21
show macauthentication ................................................................................................................. 27-22
show macauthentication session .................................................................................................... 27-23
set macauthentication..................................................................................................................... 27-24
set macauthentication password .................................................................................................... 27-24
clear macauthentication password ................................................................................................. 27-25
set macauthentication port ............................................................................................................. 27-25
set macauthentication portinitialize................................................................................................. 27-26
set macauthentication portquietperiod............................................................................................ 27-26
clear macauthentication portquietperiod......................................................................................... 27-27
set macauthentication macinitialize ................................................................................................ 27-28
set macauthentication reauthentication .......................................................................................... 27-28
set macauthentication portreauthenticate.......................................................................................27-29
set macauthentication macreauthenticate ...................................................................................... 27-29
set macauthentication reauthperiod ...............................................................................................27-30
clear macauthentication reauthperiod ............................................................................................ 27-30
set macauthentication significant-bits ............................................................................................. 27-31
clear macauthentication significant-bits .......................................................................................... 27-31

xxiii
 Configuring Multiple Authentication Methods ............................................................................................. 27-32
show multiauth................................................................................................................................ 27-33
set multiauth mode ......................................................................................................................... 27-33
clear multiauth mode ...................................................................................................................... 27-34
set multiauth precedence ............................................................................................................... 27-34
clear multiauth precedence ............................................................................................................27-35
show multiauth port ........................................................................................................................ 27-35
set multiauth port ............................................................................................................................ 27-36
clear multiauth port ......................................................................................................................... 27-37
show multiauth station .................................................................................................................... 27-38
show multiauth session .................................................................................................................. 27-38
show multiauth idle-timeout ............................................................................................................27-39
set multiauth idle-timeout................................................................................................................ 27-40
clear multiauth idle-timeout............................................................................................................. 27-40
show multiauth session-timeout ..................................................................................................... 27-41
set multiauth session-timeout ......................................................................................................... 27-42
clear multiauth session-timeout ...................................................................................................... 27-42
show multiauth trap ........................................................................................................................ 27-43
set multiauth trap ............................................................................................................................ 27-44
clear multiauth trap ......................................................................................................................... 27-45
Configuring VLAN Authorization (RFC 3580) ............................................................................................. 27-45
set vlanauthorization....................................................................................................................... 27-45
set vlanauthorization egress ........................................................................................................... 27-46
clear vlanauthorization.................................................................................................................... 27-47
show vlanauthorization ................................................................................................................... 27-47
Configuring Policy Maptable Response ...................................................................................................... 27-48
show policy maptable ..................................................................................................................... 27-48
set policy maptable......................................................................................................................... 27-49
clear policy maptable...................................................................................................................... 27-50
Configuring MAC Locking ........................................................................................................................... 27-51
show maclock ................................................................................................................................. 27-52
show maclock stations.................................................................................................................... 27-53
set maclock enable......................................................................................................................... 27-54
set maclock disable ........................................................................................................................ 27-55
set maclock..................................................................................................................................... 27-55
clear maclock.................................................................................................................................. 27-56
set maclock static ........................................................................................................................... 27-57
clear maclock static ........................................................................................................................ 27-57
set maclock firstarrival .................................................................................................................... 27-58
clear maclock firstarrival ................................................................................................................. 27-58
set maclock agefirstarrival .............................................................................................................. 27-59
clear maclock agefirstarrival ........................................................................................................... 27-59
set maclock clearonlinkchange....................................................................................................... 27-60
clear maclock clearonlinkchange.................................................................................................... 27-60
set maclock move ........................................................................................................................... 27-61
set maclock trap ............................................................................................................................. 27-62
set maclock syslog ......................................................................................................................... 27-62
set maclock disable-port ................................................................................................................. 27-63
clear maclock disable-port .............................................................................................................. 27-64
clear maclock violation disabled-port.............................................................................................. 27-64
Configuring Port Web Authentication (PWA) .............................................................................................. 27-65
show pwa........................................................................................................................................ 27-65
set pwa ........................................................................................................................................... 27-67
show pwa banner ........................................................................................................................... 27-67
set pwa banner ............................................................................................................................... 27-68
clear pwa banner ............................................................................................................................ 27-68

xxiv
 set pwa displaylogo ........................................................................................................................ 27-69
set pwa ipaddress........................................................................................................................... 27-69
set pwa protocol ............................................................................................................................. 27-70
set pwa guestname ........................................................................................................................ 27-70
clear pwa guestname ..................................................................................................................... 27-71
set pwa guestpassword .................................................................................................................. 27-71
set pwa gueststatus........................................................................................................................ 27-72
set pwa initialize ............................................................................................................................. 27-72
set pwa quietperiod ........................................................................................................................ 27-73
set pwa maxrequest ....................................................................................................................... 27-73
set pwa portcontrol ......................................................................................................................... 27-74
show pwa session .......................................................................................................................... 27-74
set pwa enhancedmode ................................................................................................................. 27-75
Configuring Convergence End Points Phone Detection ............................................................................. 27-75
set cep ............................................................................................................................................ 27-76
set cep port..................................................................................................................................... 27-76
set cep policy.................................................................................................................................. 27-77
set cep initialize .............................................................................................................................. 27-78
show cep port ................................................................................................................................. 27-78
show cep policy .............................................................................................................................. 27-79
show cep connections .................................................................................................................... 27-80
clear cep all .................................................................................................................................... 27-80
clear cep policy ............................................................................................................................... 27-81
clear cep port.................................................................................................................................. 27-81
clear cep users ............................................................................................................................... 27-82

Chapter 28: Configuring IPsec

show ipsec........................................................................................................................................ 28-1
set ipsec authentication .................................................................................................................... 28-2
set ipsec encryption .......................................................................................................................... 28-2
set ipsec ike dh-group ...................................................................................................................... 28-3
set ipsec ike lifetime ......................................................................................................................... 28-3
set ipsec ike phase1 ......................................................................................................................... 28-4
set ipsec ike version ......................................................................................................................... 28-5

Chapter 29: Configuring Access Control Lists

About Access Control Lists ........................................................................................................................... 29-1
Rule Actions ........................................................................................................................................... 29-1
Commands ................................................................................................................................................... 29-2
show access-lists.............................................................................................................................. 29-2
access-list......................................................................................................................................... 29-3
access-list mac ................................................................................................................................. 29-4
access-list interface .......................................................................................................................... 29-6

Chapter 30: Configuring Service Access Control Lists

set system service-acl ...................................................................................................................... 30-1
show system service-acl................................................................................................................... 30-3
clear system service-acl ................................................................................................................... 30-3
set system service-class................................................................................................................... 30-4
show system service-class ............................................................................................................... 30-5
clear system service-class................................................................................................................ 30-5

xxv
Chapter 31: TACACS+ Configuration
show tacacs...................................................................................................................................... 31-2
set tacacs ......................................................................................................................................... 31-3
show tacacs server........................................................................................................................... 31-3
set tacacs server .............................................................................................................................. 31-4
clear tacacs server ........................................................................................................................... 31-5
show tacacs session......................................................................................................................... 31-6
set tacacs session ............................................................................................................................ 31-7
clear tacacs session ......................................................................................................................... 31-8
show tacacs command ..................................................................................................................... 31-9
set tacacs command......................................................................................................................... 31-9
show tacacs singleconnect............................................................................................................. 31-10
set tacacs singleconnect ................................................................................................................ 31-10
show tacacs interface ..................................................................................................................... 31-11
set tacacs interface......................................................................................................................... 31-11
clear tacacs interface...................................................................................................................... 31-12

Tables
2-1 Required CLI Setup Commands......................................................................................................... 2-2
2-2 Optional CLI Setup Commands.......................................................................................................... 2-2
2-3 show system Output Details ............................................................................................................... 2-8
2-4 show version Output Details ............................................................................................................. 2-21
3-1 show system password Output Details............................................................................................... 3-8
3-2 show system lockout Output Details................................................................................................. 3-14
6-1 show inlinepower Output Details ........................................................................................................ 6-2
6-2 show port inlinepower Output Details ................................................................................................. 6-5
8-1 show cdp Output Details..................................................................................................................... 8-2
8-2 show ciscodp Output Details .............................................................................................................. 8-7
8-3 show ciscodp port info Output Details ................................................................................................ 8-8
8-4 show lldp port local-info Output Details ............................................................................................ 8-17
8-5 show lldp port remote-info Output Display........................................................................................ 8-20
9-1 show port status Output Details.......................................................................................................... 9-3
9-2 show port counters Output Details ..................................................................................................... 9-4
9-3 show port cablestatus Output Details ................................................................................................. 9-6
9-4 show linkflap parameters Output Details .......................................................................................... 9-23
9-5 show linkflap metrics Output Details................................................................................................. 9-24
9-6 show lacp Output Details.................................................................................................................. 9-36
10-1 show snmp counters Output Details ................................................................................................. 10-2
10-2 show snmp user Output Details........................................................................................................ 10-6
10-3 show snmp group Output Details ..................................................................................................... 10-9
10-4 show snmp access Output Details ................................................................................................. 10-14
10-5 show snmp view Output Details ..................................................................................................... 10-17
10-6 show snmp targetparams Output Details ....................................................................................... 10-20
10-7 show snmp targetaddr Output Details ............................................................................................ 10-23
10-8 show snmp notify Output Details .................................................................................................... 10-26
10-9 show snmp engineid Output Details ............................................................................................... 10-35
11-1 show spantree Output Details .......................................................................................................... 11-4
12-1 show vlan Output Details.................................................................................................................. 12-2
12-2 show gvrp configuration Output Details .......................................................................................... 12-18
13-1 show policy profile Output Details .................................................................................................... 13-2
13-2 show policy rule Output Details ........................................................................................................ 13-7
13-3 Valid Values for Policy Classification Rules ................................................................................... 13-11
14-1 show port ratelimit Output Details................................................................................................... 14-10
17-1 show netstat Output Details.............................................................................................................. 17-6
17-2 show arp Output Details ................................................................................................................... 17-7

xxvi
17-3 show mac Output Details................................................................................................................ 17-10
17-4 show nodealias config Output Details ............................................................................................ 17-17
18-1 show logging server Output Details.................................................................................................. 18-2
18-2 show logging application Output Details........................................................................................... 18-7
18-3 Mnemonic Values for Logging Applications...................................................................................... 18-8
19-1 show sntp Output Details.................................................................................................................. 19-2
20-1 show rmon alarm Output Details ...................................................................................................... 20-6
20-2 show rmon event Output Details .................................................................................................... 20-10
23-1 show ip interface Output Details ....................................................................................................... 23-4
23-2 show ip arp Output Details ............................................................................................................... 23-9
26-1 show ipv6 netstat Output Display ................................................................................................... 26-8
27-1 show radius Output Details............................................................................................................... 27-3
27-2 show eapol Output Details.............................................................................................................. 27-19
27-3 show macauthentication Output Details ......................................................................................... 27-22
27-4 show macauthentication session Output Details ............................................................................ 27-24
27-5 show vlanauthorization Output Details ........................................................................................... 27-48
27-6 show maclock Output Details ......................................................................................................... 27-52
27-7 show maclock stations Output Details............................................................................................ 27-54
27-8 show pwa Output Details................................................................................................................ 27-66
29-1 ACL Rule Precedence ...................................................................................................................... 29-1
31-1 show tacacs Output Details .............................................................................................................. 31-2

xxvii
xxviii
 About This Guide

This manual explains how to access the device’s Command Line Interface (CLI) and how to use it
to configure A4 switch devices.

Important Notice
Depending on the firmware version used in your Extreme device, some features described in this
document may not be supported. Refer to the Release Notes shipped with your device to
determine which features are supported.

Using This Guide

A general working knowledge of basic network operations and an understanding of CLI
management applications is helpful before configuring the A4 device.
This manual describes how to do the following:
This manual describes the commands used to configure the switch. For detailed configuration
procedures, examples, and conceptual information about firmware features, refer to Fixed
Switching Configuration Guide located on the Enterasys Networks downloads site. See “Related
Documents” on page xxxi for more information.

Structure of This Guide

The guide is organized as follows:
Chapter 1, Configuring Switches in a Stack, provides information about how to configure and
manage stacked switches.
Chapter 2, Basic Configuration, provides how to set basic system properties, how to download a
firmware image, how to configure WebView and Telnet, how to manage configuration files, how
to set the login password, and how to exit the CLI.
Chapter 3, Setting User Accounts and Passwords, describes user account and password
management functionality.
Chapter 4, Management Authentication Notification MIB Commands, provides detailed
information for the management authentication notification MIB set of commands. Management
authentication notification MIB functionality includes enabling/disabling the sending of SNMP
notifications when a user login authentication event occurs for various authentication notification
types.
Chapter 5, Setting the Security Mode, describes how to configure the switch security mode.
Chapter 6, Configuring System Power and PoE, describes how to review and set system power
and PoE (Power over Ethernet) parameters.
Chapter 7, Transmit Queue Monitoring Configuration, describes the commands used to monitor
and manage transmit queues.
Chapter 8, Discovery Protocol Configuration provides how to configure discovery protocols
supported by the device.

Extreme A4 CLI Reference xxix

Structure of This Guide

Chapter 9, Port Configuration, describes how to review and configure console port settings, and
how to enable or disable switch ports and configure switch port settings, including port speed,
duplex mode, auto-negotiation, flow control, port mirroring, link aggegation and broadcast
suppression.
Chapter 10, SNMP Configuration, describes how to configure SNMP users and user groups,
access rights, target addresses, and notification parameters.
Chapter 11, Spanning Tree Configuration, describes how to review and set Spanning Tree bridge
parameters for the device, including bridge priority, hello time, maximum aging time and forward
delay; how to review and set Spanning Tree port parameters, including port priority and path
costs; and how to review and set Spanning Tree Loop Protect parameters.
Chapter 12, 802.1Q VLAN Configuration, describes how to create static VLANs, select the mode
of operation for each port, establish VLAN forwarding (egress) lists, route frames according to
VLAN ID, display the current ports and port types associated with a VLAN and protocol, create a
secure management VLAN, and configure ports on the device as GVRP-aware ports.
Chapter 13, Policy Classification Configuration, describes how to create, change or remove user
roles or profiles based on business-specific use of network services; how to permit or deny access
to specific services by creating and assigning classification rules which map user profiles to frame
filtering policies; how to classify frames to a VLAN or Class of Service (CoS); and how to assign or
unassign ports to policy profiles so that only ports activated for a profile will be allowed to
transmit frames accordingly.
Chapter 14, Port Priority and Rate Limiting Configuration, describes how to set the transmit
priority of each port and configure a rate limit for a given port and list of priorities.
Chapter 15, IGMP Configuration, describes how to configure Internet Group Management
Protocol (IGMP) settings for multicast filtering.
Chapter 16, MLD Configuration, describes the IPv6 Layer 2 Multicast Listener Discovery (MLD)
snooping configuration set of commands.
Chapter 17, Network Management, describes how to manage general switch settings, how to
monitor network events and status,and how to configure node aliases.
Chapter 18, Configuring System Logging, describes how to display and configure system
logging, including Syslog server settings, Syslog default settings, and the logging buffer. This
chapter also includes information about security audit logging.
Chapter 19, Configuring SNTP, describes how to use CLI commands to configure the Simple
Network Time Protocol (SNTP), which synchronizes device clocks in a network. Also included are
SNTP authentication commands.
Chapter 20, RMON Configuration, describes how to use RMON (Remote Network Monitoring),
which provides comprehensive network fault diagnosis, planning, and performance tuning
information and allows for interoperability between SNMP management stations and monitoring
agents.
Chapter 21, DHCP Server Configuration, describes how to review and configure DHCP server
parameters, how to review and configure DHCP address pools, and how to display DHCP server
information.
Chapter 22, DHCP Snooping and Dynamic ARP Inspection, describes DHCP snooping, which
monitors DHCP messages between a DHCP client and DHCP server to filter harmful DHCP
messages and to build a database of authorized address bindings, and Dynamic ARP inspection,
which uses the bindings database created by the DHCP snooping feature to reject invalid and
malicious ARP packets.
Chapter 23, IP Configuration, describes how to enable IP routing for router mode operation, how
to configure IP interface settings, how to review and configure the routing ARP table, how to
review and configure routing broadcasts, how to configure PIM, and how to configure IP routes.

xxx About This Guide

 Related Documents

Chapter 24, IPv4 Basic Routing Protocol Configuration, describes how to configure basic IPv4
routing and routing protocols, including RIP and IDRP.
Chapter 25, MGMD Proxy Configuration, describes the commands used to configure the
Multicast Group Membership Discovery Proxy (MGMD Proxy) feature. MGMD proxy is
implemented for IPv4 by IGMP proxy commands.
Chapter 26, IPv6 Management, describes the switch mode set of commands used to manage IPv6
Chapter 27, Authentication and Authorization Configuration, describes how to configure 802.1X
authentication using EAPOL, how to configure RADIUS server, Secure Shell server, MAC
authentication, MAC locking, and Port Web Authentication.
Chapter 28, Configuring IPsec, describes how to configure IPsec (IP Security) as specified in RFC
4301.
Chapter 29, Configuring Access Control Lists, describes how to configure and apply router mode
access control lists (ACLs) on the A4.
Chapter 30, Configuring Service Access Control Lists, describes how to configure and apply
switch mode Service Access Control Lists (ACLs).
Chapter 31, TACACS+ Configuration, provides information about the commands used to
configure and monitor TACACS+ (Terminal Access Controller Access-Control System Plus).

Related Documents
The following Extreme Networks documents may help you to set up, control, and manage the A4
device:
• Fixed Switching Configuration Guide
• A4 Installation Guide(s)
• Redundant Power Supply Quick References
Documents listed above, can be obtained from the World Wide Web in Adobe Acrobat Portable
Document Format (PDF) at the following web site:
http://www.extremenetworks.com/support/enterasys-support/

Conventions Used in This Guide

The following conventions are used in the text of this document:

Convention Description

Bold font Indicates mandatory keywords, parameters or keyboard keys.

italic font Indicates complete document titles.

Courier font Used for examples of information displayed on the screen.

Courier font in italics Indicates a user-supplied value, either required or optional.

[] Square brackets indicate an optional value.

{} Braces indicate required values. One or more values may be required.

| A vertical bar indicates a choice in values.

[x | y | z] Square brackets with a vertical bar indicate a choice of a value.

{x | y | z} Braces with a vertical bar indicate a choice of a required value.

Extreme A4 CLI Reference xxxi

Getting Help

Convention Description

[x {y | z} ] A combination of square brackets with braces and vertical bars indicates a

required choice of an optional value.

The following icons are used in this guide:

Note: Calls the reader’s attention to any item of information that may be of special importance.

Caution: Contains information essential to avoid damage to the equipment.

Precaución: Contiene información esencial para prevenir dañar el equipo.
Achtung: Verweißt auf wichtige Informationen zum Schutz gegen Beschädigungen.

Getting Help
For additional support related to this switch or document, contact Extreme Networks using one of
the following methods:

World Wide Web http://www.extremenetworks.com/support

Phone 1-800-872-8440 (toll-free in U.S. and Canada)
or 1-603-952-5000
For the Extreme Networks Support toll-free number in your country:
http://www.extremenetworks.com/support
Internet mail [email protected]
To expedite your message, type [A-SERIES] in the subject line.

Before calling Extreme Networks, have the following information ready:

• Your Extreme Networks service contract number
• A description of the failure
• A description of any action(s) already taken to resolve the problem (for example, changing
mode switches or rebooting the unit)
• The serial and revision numbers of all involved Extreme Networks products in the network
• A description of your network environment (for example, layout, cable type)
• Network load and frame size at the time of trouble (if known)
• The switch history (for example, have you returned the switch before, is this a recurring
problem?)
• Any previous Return Material Authorization (RMA) numbers

xxxii About This Guide

 1
Configuring Switches in a Stack

This chapter provides information about configuring A4 switches in a stack.

Note: A4 switches can be stacked only with other A4 switches. They cannot be stacked with
SecureStack A2 switches.

For information about ... Refer to page ...

About A4 Switch Operation in a Stack 1-1

Installing a New Stackable System of Up to Eight Units 1-2

Installing Previously-Configured Systems in a Stack 1-3

Adding a New Unit to an Existing Stack 1-3

Creating a Virtual Switch Configuration 1-3

Considerations About Using Clear Config in a Stack 1-4

Configuring Standalone A4 Stack Ports 1-4

Stacking Configuration and Management Commands 1-5

About A4 Switch Operation in a Stack

The A4 products are stackable switches that can be adapted and scaled to help meet your network
needs. These switches provide a management platform and uplink to a network backbone for a
stacked group of up to eight A4 switches.
Once installed in a stack, the switches behave and perform as a single switch product. As such,
you can start with a single unit and add more units as your network expands. You can also mix
different products in the family in a single stack to provide a desired combination of port types
and functions to match the requirements of individual applications. In all cases, a stack of units
performs as one large product, and is managed as a single network entity.
When switches are installed and connected as described in your A4 Installation Guide, the
following occurs during initialization:
• The switch that will manage the stack is automatically established. This is known as the
manager switch.
• All other switches are established as members in the stack.
• The hierarchy of the switches that will assume the function of backup manager is also
determined in case the current manager malfunctions, is powered down, or is disconnected
from the stack.

Extreme A4 CLI Reference 1-1

Installing a New Stackable System of Up to Eight Units

• The console port on the manager switch remains active for out-of-band (local) switch
management, but the console port on each member switch is deactivated. This enables you to
set the IP address and system password using a single console port. Now each switch can be
configured locally using only the manager’s console port, or inband using a remote device and
the CLI set of commands described in this section.
Once a stack is created (more than one switch is interconnected), the following procedure occurs:
1. By default, unit IDs are arbitrarily assigned on a first-come, first-served basis.
2. Unit IDs are saved against each module. Then, every time a board is power-cycled, it will
initialize with the same unit ID. This is important for port-specific information (for example:
ge.4.12 is the 12th Gigabit Ethernet port on Unit # 4).
3. The management election process uses the following precedence to assign a management
switch:
a. Previously assigned / elected management unit
b. Management assigned priority (values 1-15)
c. Hardware preference level
d. Highest MAC Address
Use the following recommended procedures when installing a new stackable system or adding a
new unit to an existing stack.

Important
The following procedures assume that all units have a clean configuration from manufacturing. When adding
a new unit to an already running stack, it is also assumed that the new unit is using the same firmware image
version as other units in the stack.

Installing a New Stackable System of Up to Eight Units

The A4 switches can be stacked only with other A4 switches. They cannot be stacked with
SecureStack A2 switches.
Use the following procedure for installing a new stack of up to eight units out of the box.
1. Before applying power, make all physical connections with the stack cables as described in
your A4 Installation Guide.
2. Once all of the stack cables have been connected, individually power on each unit from top to
bottom.

Notes: Ensure that each switch is fully operational before applying power to the next switch.
Since unit IDs are assigned on a first-come, first-served basis, this will ensure that unit IDs are
ordered sequentially.
Once unit IDs are assigned, they are persistent and will be retained during a power cycle to any or
all of the units.

3. (Optional) If desired, change the management unit using the set switch movemanagement
command as described in “set switch movemanagement” on page 1-10.
4. Once the desired master unit has been selected, reset the system using the reset command
(page 2-46).
5. After the stack has been configured, you can use the show switch unit command (page 1-5) to
physically identify each unit. When you enter the command with a unit number, the MGR
LED of the specified switch will blink for 10 seconds. The normal state of this LED is off for
member units and steady green for the manager unit.

1-2 Configuring Switches in a Stack

 Installing Previously-Configured Systems in a Stack

Installing Previously-Configured Systems in a Stack

If member units in a stack have been previous members of a different stack, you may need to
configure the renumbering of the stack as follows:
1. Stack the units in the method desired, and connect the stack cables.
2. Power up only the unit you wish to be manager.
3. Once the management unit is powered up, log into the CLI, and use the show switch
command as described in “show switch” on page 1-5 to display stacking information.
4. Clear any switches which are listed as “unassigned” using the clear switch member
command as described in “clear switch member” on page 1-11.
5. Power up the member of the stack you wish to become unit 2. Once the second unit is fully
powered, the COM session of the CLI will state that a new CPU was added.
6. Use the show switch command to redisplay stacking information.
a. If the new member displays as unit 2, you can proceed to repeat this step with the next
unit.
b. If the new member displays a different unit number, you must:
(1) Renumber the stack using the set switch renumber command as described in “set
switch” on page 1-9, then
(2) Clear the original unit number using the clear switch member command.
7. Repeat Step 6 until all members have been renumbered in the order you desire.
8. After the stack has been reconfigured, you can use the show switch unit command (“show
switch” on page 1-5) to physically confirm the identity of each unit. When you enter the
command with a unit number, the MGR LED of the specified switch will blink for 10 seconds.
The normal state of this LED is off for member units and steady green for the manager unit.

Adding a New Unit to an Existing Stack

Use the following procedure for installing a new unit to an existing stack configuration. This
procedure assumes that the new unit being added has a clean configuration from manufacturing
and is running the same firmware image version as other units in the stack.
1. Ensure that power is off on the new unit being installed.
2. Use one of the following methods to complete stack cable connections:
– If the running stack uses a daisy chain topology, make the stack cable connections from
the bottom of the stack to the new unit (that is, STACK DOWN port from the bottom unit
of the running stack to the STACK UP port on the new unit).
– If the running stack uses a ring stack topology, break the ring and make the stack cable
connections to the new unit to close the ring.
3. Apply power to the new unit.

Creating a Virtual Switch Configuration

You can create a configuration for a A4 switch before adding the actual physical device to a stack.
This preconfiguration feature includes configuring protocols on the ports of the “virtual switch.”

Extreme A4 CLI Reference 1-3

Considerations About Using Clear Config in a Stack

To create a virtual switch configuration in a stack environment:

1. Display the types of switches supported in the stack, using the show switch switchtype
command (page 1-6).
2. Using the output of the show switch switchtype command, determine the switch index (SID)
of the model of switch being configured.
3. Add the virtual switch to the stack using the set switch member command (page 1-11). Use
the SID of the switch model, determined in the previous step, and the unit ID that you want to
assign to this switch member.
4. Proceed to configure the ports of the virtual switch as you would do for physically present
devices.

Note: If you preconfigure a virtual switch and then add a physical switch of a different type to the
stack as that unit number, any configured functionality that cannot be supported on the physical
switch will cause a configuration mismatch status for that device and the ports of the new device will
join detached. You must clear the mismatch before the new device will properly join the stack.

Considerations About Using Clear Config in a Stack

When using the clear config command (page 2-48) to clear configuration parameters in a stack, it
is important to remember the following:
• Use clear config to clear config parameters without clearing stack unit IDs. This command
WILL NOT clear stack parameters or the IP address and avoids the process of renumbering
the stack.
• Use clear config all when it is necessary to clear all config parameters, including stack unit
IDs and switch priority values. This command will not clear the IP address nor will it remove
an applied advanced feature license.
• Use clear ip address to remove the IP address of the stack.
• Use clear license to remove an applied license from a switch.
Configuration parameters and stacking information can also be cleared on the master unit only
by selecting the “restore configuration to factory defaults” option from the boot menu on switch
startup. This selection will leave stacking priorities on all other units.

Configuring Standalone A4 Stack Ports

It is possible on a standalone A4 switch to configure the two stack ports as standard gigabit
Ethernet ports. For more information, refer to the set switch stack-port command described on
page 1-8.

When Uplink Ports are Configured as Ethernet Ports

When using the clear config command (page 2-48) to clear configuration parameters on a
standalone A4 switch with the uplink ports configured as standard Ethernet ports, it is important
to remember the following:
• The clear config command WILL NOT set the front panel uplink ports back to stack ports.
• The clear config all command WILL set the front panel uplink ports back to stack ports.

1-4 Configuring Switches in a Stack

 Stacking Configuration and Management Commands

Stacking Configuration and Management Commands

Purpose
To review, individually configure and manage switches in a A4 stack.

Commands

For information about... Refer to page...

show switch 1-5

show switch switchtype 1-6

show switch stack-ports 1-7

set switch stack-port 1-8

set switch 1-9

set switch copy-fw 1-9

set switch description 1-10

set switch movemanagement 1-10

set switch member 1-11

clear switch member 1-11

show switch
Use this command to display information about one or more units in the stack.

Syntax
show switch [status] [unit]

Parameters
status (Optional) Displays power and administrative status information for one
or more units in the stack.
unit (Optional) Specifies the unit(s) for which information will display.

Defaults
If not specified, status and other configuration information about all units will be displayed.

Mode
Switch command, read-only.

Usage
After a stack has been configured, you can use this command to physically confirm the identity of
each unit. When you enter the command with a unit number, the MGR LED of the specified
switch will blink for 10 seconds. The normal state of this LED is off for member units and steady
green for the manager unit.

Extreme A4 CLI Reference 1-5

show switch switchtype

Examples
This example shows how to display information about all switch units in the stack:
A4(su)->show switch
Management Preconfig Plugged-in Switch Code
Switch Status Model ID Model ID Status Version
------ ------------ ------------- ------------- --------------------- -----------
1 Mgmt Switch A4H124-24FX A4H124-24FX OK 03.01.01.0002
2 Stack Member A4H254-8F8T A4H254-8F8T OK 03.01.01.0002
3 Stack Member A4H124-24FX A4H124-24FX OK 03.01.01.0002
This example shows how to display information about switch unit 1 in the stack:
A4(ro)->show switch 1
Switch 1
Management Status Management Switch
Hardware Management Preference Unassigned
Admin Management Preference Unassigned
Switch Type A4H124-24FX
Preconfigured Model Identifier A4H124-24FX
Plugged-in Model Identifier A4H124-24FX
Switch Status OK
Switch Family XGS2
Switch Description Extreme Networks, Inc. A4 -- Model
A4H124-24FX
Detected Code Version 06.81.xx
Detected Code in Flash 03.01.01.0002
Detected Code in Back Image 03.01.01.0001
Up Time 13 days 2 hrs 52 mins 4 secs
This example shows how to display status information for switch unit 1 in the stack:
A4(su)->show switch status 1
Switch 1
Switch Status Full
Admin State
Power State
Inserted Switch:
Model Identifier A4H124-24FX
Description Extreme Networks, Inc. A4 -- Model
A4H124-24FX
Configured Switch:
Model Identifier A4H124-24FX
Description Extreme Networks, Inc. A4 -- Model
A4H124-24FX

show switch switchtype

Use this command to display information about supported switch types in the stack.

Syntax
show switch switchtype [switchindex]

Parameters
switchindex (Optional) Specifies the switch index (SID) of the switch type to display.

1-6 Configuring Switches in a Stack

 show switch stack-ports

Defaults
None.

Mode
Switch command, read-only.

Examples
This example shows how to display switch type information about all switches in the stack:
A4(su)->show switch switchtype
Mgmt Code
SID Switch Model ID Pref Version
--- -------------------------------- ---- ---------
1 A4H254-8F8T 1 0xa08245
2 A4H124-24FX 1 0xa08245
3 A4H124-24TX 1 0xa08245
4 A4H124-24 1 0xa08245
5 A4H124-24P 1 0xa08245
6 A4H124-48 1 0xa08245
7 A4H124-48P 1 0xa08245
This example shows how to display switch type information about SID1:
A4(su)->show switch switchtype 1
Switch Type 0x56540044
Model Identifier A4H254-8F8T
Switch Description Extreme Networks, Inc. A4 -- Model
A4H254-8F8T
Management Preference 1
Expected Code Version 0xa08245

Supported Cards:

Slot 0
Card Index (CID) 1
Model Identifier A4H254-8F8T

show switch stack-ports

Use this command to display various data flow and error counters on stack ports.

Syntax
show switch stack-ports [unit]

Parameters
unit (Optional) Specifies the switch unit ID, an integer ranging from 1 to 8.

Defaults
None.

Mode
Switch command, read-only.

Extreme A4 CLI Reference 1-7

set switch stack-port

Example
This example shows how to display data and error information on stack ports:
A4(ro)->show switch stack-ports
------------TX-------------- ------------RX-----------
Data Error Data Error
Stacking Rate Rate Total Rate Rate Total
Switch Port (Mb/s) (Errors/s) Errors (Mb/s) (Errors/s) Errors
------ ---------- ------ ---------- ---------- ------ ---------- --------
1 Up 0 0 0 0 0 0
Down 0 0 0 0 0 0

set switch stack-port

Use this command to configure the two front panel uplink ports as standard Gigabit Ethernet
ports or stack ports.

Syntax
set switch stack-port {ethernet | stack}

Parameters
ethernet Change the two front panel stack ports to Ethernet mode.
stack Change the two front panel stack ports to Stacking mode.

Defaults
By default, the front panel uplink ports are in stack mode.

Mode
Switch mode, read-write.

Usage
Use this command only on standalone (non-stacked) A4 switches.
Using this command will cause a switch reset.
Do not stack A4 switches with uplink ports that are in Ethernet mode.

Example
This example shows how to set the front panel stacking ports as Gigabit Ethernet ports.
A4(su)->set switch stack-port ethernet
This command will reset the entire system.
Do you want to continue (y/n) [n]?y

1-8 Configuring Switches in a Stack

 set switch

set switch
Use this command to assign a switch ID, to set a switch’s priority for becoming the management
switch if the previous management switch fails, or to change the switch unit ID for a switch in the
stack.

Syntax
set switch {unit [priority value | renumber newunit]}

Parameters
unit Specifies a unit number for the switch. Value can range from 1 to 8.
priority value Specifies a priority value for the unit. Valid values are 1 to 15 with higher
values assigning higher priority.
renumber newunit Specifies a new number for the unit.
Note: This number must be a previously unassigned unit ID number.

Defaults
None.

Mode
Switch command, read-write.

Examples
This example shows how to assign priority 3 to switch 5:
A4(su)->set switch 5 priority 3
This example shows how to renumber switch 5 to switch 7:
A4(su)->set switch 5 renumber 7

set switch copy-fw

Use this command to replicate the code image file from the management switch to other
switch(es) in the stack.

Syntax
set switch copy-fw [destination-system unit]

Parameters
destination-system (Optional) Specifies the unit number of unit on which to copy the
unit management image file.

Defaults
If destination-system is not specified, the management image file will be replicated to all switches
in the stack.

Extreme A4 CLI Reference 1-9

set switch description

Mode
Switch command, read-write.

Example
This example shows how to replicate the management image file to all switches in the stack:
A4(su)->set switch copy-fw
Are you sure you want to copy firmware? (y/n) y

Code transfer completed successfully.

set switch description

Use this command to assign a name to a switch in the stack.

Syntax
set switch description unit description

Parameters
unit Specifies a unit number for the switch.
description Specifies a text description for the unit.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to assign the name “FirstUnit” to switch unit 1 in the stack:
A4(su)->set switch description 1 FirstUnit

set switch movemanagement

Use this command to move management switch functionality from one switch to another.

Syntax
set switch movemanagement fromunit tounit

Parameters
fromunit Specifies the unit number of the current management switch.
tounit Specifies the unit number of the newly-designated management switch.

Defaults
None.

1-10 Configuring Switches in a Stack

 set switch member

Mode
Switch command, read-write.

Example
This example shows how to move management functionality from switch 1 to switch 2:
A4(su)->set switch movemenagement 1 2
Moving stack management will unconfigure entire stack including all interfaces.
Are you sure you want to move stack management? (y/n) y

set switch member

Use this command to add a virtual member to a stack. This allows you to preconfigure a switch
before the physical device is actually added to the stack.

Syntax
set switch member unit switch-id

Parameters
unit Specifies a unit number for the switch.
switch-id Specifies a switch ID (SID) for the switch. SIDs can be displayed with the
show switch switchtype command.

Defaults
None.

Mode
Switch command, read-write.

Usage
Refer to “Creating a Virtual Switch Configuration” on page 1-3 for more information about how to
add a virtual switch to a stack.

Example
This example shows how to specify a switch as unit 1 with a switch ID of 1:
A4(su)->set switch member 1 1

clear switch member

Use this command to remove a member entry from the stack.

Syntax
clear switch member unit

Parameters
unit Specifies the unit number of the switch.

Extreme A4 CLI Reference 1-11

clear switch member

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to remove the switch 5 entry from the stack:
A4(su)->clear switch member 5

1-12 Configuring Switches in a Stack

 2
Basic Configuration

At startup, the A4 switch is configured with many defaults and standard features. This chapter
describes the commands used to customize basic system settings to adapt to your work
environment.
Refer to the Fixed Switching Configuration Guide for basic and advanced configuration procedures
using these commands.

For information about... Refer to page...

Quick Start Setup Commands 2-1

Setting Basic Switch Properties 2-2

Downloading a Firmware Image 2-27

Reviewing and Selecting a Boot Firmware Image 2-31

Setting the Authentication Login Method 2-32

Starting and Configuring Telnet 2-34

Configuring Secure Shell (SSH) 2-37

Managing Switch Configuration and Files 2-38

Clearing and Closing the CLI 2-48

Resetting the Switch 2-49

Using and Configuring WebView 2-53

Gathering Technical Support Information 2-56

Quick Start Setup Commands

The tables in this section provide a quick reference for the CLI commands needed to begin basic
A4 switch operation. Table 2-1 lists tasks and their associated CLI commands required for setting
up the switch with the latest firmware. Table 2-2 lists optional CLI commands that will help you
perform additional basic configuration on the switch. Refer to the pages listed for more
information about each command.
Refer to Chapter 1, “Setting Up a Switch for the First Time,” in the Fixed Switching Configuration
Guide, for more complete procedures and information.

Extreme A4 CLI Reference 2-1

Setting Basic Switch Properties

Table 2-1 Required CLI Setup Commands

Refer to
Step Task CLI commands page...
1 Set a new password. set password [username] 3-5
2 Set the switch IP address. set ip address ip-address [mask 2-4
ip-mask] [gateway ip-gateway]
3 Download, activate, and verify new copy tftp://tftp_server_ip_address/ 2-45
firmware on the switch using TFTP filename system:image
copy. set boot system filename 2-31
show version 2-21

Table 2-2 Optional CLI Setup Commands

Refer to
Task CLI commands page...
Save the active configuration. save config 2-40
Enable or disable SSH. set ssh enable | disable 2-37
Enable or disable Telnet. set telnet {enable | disable} [inbound | 2-35
outbound | all]
Enable or disable HTTP set webview {enable | disable} 2-54
management (WebView).
Enable or disable SNMP port link set port trap port-string {enable | disable} 9-21
traps.
Set the per port broadcast limit set port broadcast port-string threshold-value 9-31
Configure a VLAN. set vlan create vlan-id 12-3
set port vlan port-string vlan-id modify-egress 12-6
Set a Syslog server IP and set logging server index ip-addr ip-addr 18-2
severity severity severity state enable
Configure and enable a RADIUS set radius server index ip-addr 27-3
server. port [secret-value]{realm {management-access |
any | network-access}
set radius enable 27-3

Setting Basic Switch Properties

Use the following commands to display and set the system IP address and other basic system
(switch) properties.

For information about... Refer to page...

show ip address 2-3

set ip address 2-4

clear ip address 2-5

show ip protocol 2-5

set ip protocol 2-6

show ip route 2-6

show system 2-7

show system hardware 2-8

show system utilization 2-9

2-2 Basic Configuration

 show ip address

For information about... Refer to page...

set system utilization 2-10

clear system utilization 2-11

show system enhancedbuffermode 2-12

set system enhancedbuffermode 2-12

set system temperature 2-13

clear system temperature 2-13

show time 2-14

set time 2-15

show summertime 2-15

set summertime 2-16

set summertime date 2-16

set summertime recurring 2-17

clear summertime 2-18

set prompt 2-18

show banner 2-19

set banner 2-19

clear banner 2-20

show version 2-21

set system name 2-22

set system location 2-22

set system contact 2-23

set width 2-23

set length 2-24

show logout 2-24

set logout 2-25

show console 2-25

set console baud 2-26

set console vt100 2-26

show ip address
Use this command to display the system IP address and subnet mask.

Syntax
show ip address

Parameters
None.

Extreme A4 CLI Reference 2-3

set ip address

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the system IP address and subnet mask:
A4(su)->show ip address
Name Address Mask
---------------- ---------------- ----------------
host 10.42.13.20 255.255.0.0

set ip address
Use this command to set the system IP address, subnet mask and default gateway.

Note: The A4 does not support the ability for a user to configure the host's gateway to be a local
routed interface IP. The host's gateway must exist on a different device in the network if one is
configured.

Syntax
set ip address ip-address [mask ip-mask] [gateway ip-gateway]

Parameters
ip-address Sets the IP address for the system. For A4 systems, this is the IP address of
the management switch as described in “About A4 Switch Operation in a
Stack” on page 1-1.
mask ip-mask (Optional) Sets the system’s subnet mask.
gateway ip-gateway (Optional) Sets the system’s default gateway (next-hop device).

Defaults
If not specified, ip-mask will be set to the natural mask of the ip-address and ip-gateway will be set to
the ip-address.

Mode
Switch command, read-write.

Usage
Parameters must be entered in the order shown (host IP, then mask, then gateway) for the
command to be accepted.

Example
This example shows how to set the system IP address to 10.1.10.1 with a mask of 255.255.128.0:
A4(su)->set ip address 10.1.10.1 mask 255.255.128.0

2-4 Basic Configuration

 clear ip address

clear ip address
Use this command to clear the system IP address.

Syntax
clear ip address

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the system IP address:
A4(rw)->clear ip address

show ip protocol
Use this command to display the method used to acquire a network IP address for switch
management.

Syntax
show ip protocol

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the method used to acquire a network IP address:
A4(su)->show ip protocol
System IP address acquisition method: dhcp

Extreme A4 CLI Reference 2-5

set ip protocol

set ip protocol
Use this command to specify the protocol used to acquire a network IP address for switch
management.

Syntax
set ip protocol {bootp | dhcp | none}

Parameters
bootp Selects BOOTP as the protocol to use to acquire the system IP address.
dhcp Selects DHCP as the protocol to use to acquire the system IP address.
none No protocol will be used to acquire the system IP address.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the method used to acquire a network IP address to DHCP.
A4(su)->set ip protocol dhcp

show ip route
Use this command to display the IP route table.

Syntax
show ip route

Parameters
None.

Defaults
None.

Mode
Switch command, read only.

Example
This example shows the output of this command.
A4(ro)->show ip route

INET route table

Destination Gateway Flags Use If Metric
0.0.0.0/0 61.200.10.1 UG 5112086 host 5
61.200.10.0/24 61.200.10.10 UC 59 host 5

2-6 Basic Configuration

 show system

61.200.10.10 61.200.10.10 UH 38 lo0 5

127.0.0.1 127.0.0.1 UH 0 lo0 5

INET6 route table

Destination Gateway Flags Use If Metric
::/0 FE80::21F:45FF:FE09:E757%dtl0 UG 339 host 10
::1 ::1 UH 0 lo0 5
2001:FF:7010:FF::/64 2001:FF:7010:FF::FFFF UmC 0 host 5
2001:FF:7010:FF::FFFF 2001:FF:7010:FF::FFFF UH 0 lo0 5
FE80::21F:45FF:FEB2:B89C%host 2001:FF:7010:FF::FFFF UH 0 lo0 5

show system
Use this command to display system information, including contact information, power and fan
tray status and uptime.

Syntax
show system

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display system information:
A4(su)->show system
System contact:
System location:
System name:

Switch 1
--------
PS1-Status PS2-Status
---------- ----------
Ok Not Installed and/or Not Operating

Fan1-Status Fan2-Status
----------- -----------
Ok Ok

Temp-Alarm
-----------
off
Thermal Threshold: 58%
Temp alarm max threshold: 100%
Temp alarm trap: disabled
Temp alarm syslog: disabled

Uptime d,h:m:s Logout

Extreme A4 CLI Reference 2-7

show system hardware

-------------- -------
0,20:36:49 0 min
The following table provides an explanation of the command output.

Table 2-3 show system Output Details

Output What It Displays...

System contact Contact person for the system. Default of a blank string can be changed with the
set system contact command (“set system contact” on page 2-23).

System location Where the system is located. Default of a blank string can be changed with the
set system location command (“set system location” on page 2-22).

System name Name identifying the system. Default of a blank string can be changed with the
set system name command (“set system name” on page 2-22).

Switch x Indicates the switch position in the stack. When multiple switches are in a stack,
information for each switch is displayed.

PS1-Status Operational status for the primary power supply.

PS2-Status Operational status for the secondary power supply, if installed.

Fanx-Status Operational status of the fan(s).

Temp-Alarm Indicates status of temperature alarm — on, off. The status will show NA (not
available) on switches that do not support this functionality.

Thermal Threshold Percentage of thermal threshold reached. The status will show NA (not available)
on switches that do not support this functionality.

Temp alarm max The temperature alarm threshold expressed as a percentage of the maximum
threshold rated. The default value is 100%.

Temp alarm trap Indicates whether the sending of temperature alarm traps is enabled or disabled.
The default is disabled.

Temp alarm syslog Indicates whether temperature alarm syslog messages are enabled or disabled.
The default is disabled.

Uptime d,h:m:s System uptime.

Logout Time an idle console or Telnet CLI session will remain connected before timing
out. Default of 5 minutes can be changed with the set logout command (“set
logout” on page 2-25).

show system hardware

Use this command to display the system’s hardware configuration.

Syntax
show system hardware

Parameters
None.

2-8 Basic Configuration

 show system utilization

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the system’s hardware configuration. Please note that the
information you see displayed may differ from this example.
A4(su)->show system hardware
UNIT 1 HARDWARE INFORMATION
---------------------------
Model: <platform specific>
Serial Number: <switch specific>
Vendor ID: 0xbc00
Base MAC Address: 00:11:88:B1:76:C0
Hardware Version: BCM56514 REV 1
FirmWare Version: 06.81.00.0052
Boot Code Version: 01.00.52
CPLD Version: 2.0

show system utilization

Use this command to display detailed information about the processor running on the switch, or
the overall memory usage of the Flash and SDRAM storage devices on the unit, or the processes
running on the switch. Only the memory usage in the master unit of a stack is shown.

Syntax
show system utilization {cpu | storage | process}

Parameters
cpu Display information about the processor running on the switch.
storage Display information about the overall memory usage on the switch.
process Display information about the processes running on the switch.

Defaults
None.

Mode
Switch command, read-only.

Examples
This example shows how to display the system’s CPU utilization:
A4(ro)->show system utilization cpu

CPU Utilization Threshold Traps enable: Threshold = 80.0%

Total CPU Utilization:

Extreme A4 CLI Reference 2-9

set system utilization

Switch CPU 5 sec 1 min 5 min

-----------------------------------------------
1 1 50% 49% 49%

This example shows how to display the system’s overall memory usage:
A4(ro)->show system utilization storage
Storage Utilization:
Type Description Size(Kb) Available (Kb)
---------------------------------------------------------------
RAM RAM device 262144 97173
Flash Images, Config, Other 31095 8094

This example shows how to display information about the processes running on the system. Only
partial output is shown.
A4(ro)->show system utilization process
Switch:1 CPU:1

TID Name 5Sec 1Min 5Min

----------------------------------------------------------
c157930 ipMapForwardingTask 3.60% 3.02% 3.48%
cc70000 RMONTask 0.00% 0.00% 0.00%
ccb0b60 SNMPTask 34.80% 34.06% 31.78%
d4847a0 tEmWeb 0.00% 0.03% 0.01%
d4ca360 hapiRxTask 3.20% 4.80% 5.00%
dec8600 lvl7TaskUtilMonitorTas 0.40% 0.40% 0.40%
eb74120 bcmRX 2.00% 2.91% 4.48%
eb7fbc8 bcmLINK.0 0.40% 0.22% 0.32%
f00c9a0 bcmTX 0.00% 0.33% 0.53%
f027648 bcmCNTR.0 0.00% 0.00% 0.03%
f034858 bcmL2X.0 0.00% 0.02% 0.04%

set system utilization

Use this command to set the threshold for sending CPU utilization notification messages.

Syntax
set system utilization threshold threshold

Parameters
threshold threshold Specifies a threshold value in 1/10 of a percent. Valid range is 1 to 1000.
A value of 0 disables utilization notification messages.

Defaults
The default threshold value is 80%.

Mode
Switch command, read-write.

2-10 Basic Configuration

 clear system utilization

Usage
This command sets the percentage of system CPU utilitization that will cause a trap notification to
be sent. After the threshold has been exceeded, additional notifications will be sent once a minute
until the utilization has dropped back below the threshold.

Example
This example sets the CPU utilization threshold to 75%.
A4(rw)->set system utilization threshold 750

clear system utilization

Use this command to reset the CPU utilization threshold to the default of 80%.

Syntax
clear system utilization

Parameters
None.

Defaults
The default threshold value is 80%.

Mode
Switch command, read-write.

Example
This example resets the CPU utilization threshold to the default.
A4(rw)->show system utilization cpu

CPU Utilization Threshold Traps enable: Threshold = 75.0%

Total CPU Utilization:

Switch CPU 5 sec 1 min 5 min

-------------------------------------------------
1 1 10% 10% 10%

A4(rw)->clear system utilization

A4(rw)->show system utilization cpu

CPU Utilization Threshold Traps enable: Threshold = 80.0%

Total CPU Utilization:

Switch CPU 5 sec 1 min 5 min

-------------------------------------------------
1 1 14% 11% 10%

Extreme A4 CLI Reference 2-11

show system enhancedbuffermode

show system enhancedbuffermode

Use this command to display the status of enhanced buffer mode, which optimizes buffer
distribution into a single CoS queue operation for standalone switches or non-stacked switches.

Syntax
show system enhancedbuffermode

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to display enhanced buffer mode status:
A4(su)->show system enhancedbuffermode enable
Optimized system buffer distribution Disable

set system enhancedbuffermode

Use this command to enable or disable enhanced buffer mode, which optimizes buffer
distribution into a single CoS queue operation for standalone switches or non-stacked switches.
Executing this command will reset the switch, so the system prompts you to confirm whether you
want to proceed.

Syntax
set system enhancedbuffermode {enable | disable}

Parameters
enable | disable Enables or disables enhanced buffer mode.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to enable enhanced buffer mode:
A4(su)->set system enhancedbuffermode enable

Changes in the enhanced buffer mode will require resetting this unit.
Are you sure you want to continue? (y/n)

2-12 Basic Configuration

 set system temperature

set system temperature

Use this command to set the system high temperature threshold limit and the high temperature
alert parameters, on the platforms that support this feature.

Syntax
set system temperature {[syslog enable | disable] [trap enable | disable]
[overtemp-threshold value]}

Parameters
syslog enable | Enables or disables logging high temperature alerts to the system log
disable when the system transitions into an alarm state.
trap enable | disable Enables or disables sending high temperature alerts by means of SNMP
traps when the system transitions into an alarm state.
overtemp-threshold Sets the thermal threshold as a percentage of the maximum rated for the
value specific platform. Value can range from 0 to 100%.

Defaults
Syslog alerts are disabled by default.
Trap alerts are disabled by default.
Overtemp threshold is 100% by default.

Mode
Switch command, read-write.

Usage
On the platforms that support this feature, temperature sensors are located in several different
locations within the device. Threshold calibrations have been calculated separately for each
platform. The thermal overtemp threshold is the high-water mark that, when reached, triggers an
alert to warn the system administrator that the device is operating at high temperatures.
When a high temperature alert condition occurs, the CPU LED on the front panel of the switch
will flash red. In addition, if enabled, a syslog message will be logged and/or an SNMP trap will
be sent.
The values set with this command can be viewed with the show system command.

Note: Refer to the Release Note for your platform to determine if the High-Temperature Alert
feature is supported on your platform.

Example
The following example enables sending SNMP traps and sets the overtemp threshold to 60%.
A4(su)->set system temperature trap enable overtemp-threshold 60

clear system temperature

Use this command to reset system high temperature parameters to their default values, on the
platforms that support this feature.

Extreme A4 CLI Reference 2-13

show time

Syntax
clear system temperature

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Usage
This command resets all the high temperature parameters to their default values:
• Syslog alerts are disabled by default.
• Trap alerts are disabled by default.
• Overtemp threshold is 100% by default.

Example
This example resets all high temperature parameters to their defaults.
A4(su)->clear system temperature

show time
Use this command to display the current time of day in the system clock.

Syntax
show time

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the current time. The output shows the day of the week,
month, day, and the time of day in hours, minutes, and seconds and the year:
A4(su)->show time
THU SEP 05 09:21:57 2002

2-14 Basic Configuration

 set time

set time
Use this command to change the time of day on the system clock.

Syntax
set time [mm/dd/yyyy] [hh:mm:ss]

Parameters
[mm/dd/yyyy] Sets the time in:
[hh:mm:ss]
month, day, year and/or
24-hour format
At least one set of time parameters must be entered.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the system clock to 7:50 a.m:
A4(su)->set time 7:50:00

show summertime
Use this command to display daylight savings time settings.

Syntax
show summertime

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display daylight savings time settings:
A4(su)->show summertime
Summertime is Enabled and set to ''
Start : SUN MAR 14 02:00:00
End : SUN NOV 7 02:00:00
Offset: 60 minutes (1 hours 0 minutes)

Extreme A4 CLI Reference 2-15

set summertime

Recurring: yes, starting at 2:00 of the second Sunday of March and ending at 2:00
of the first Sunday of November

set summertime
Use this command to enable or disable the daylight savings time function.

Syntax
set summertime {enable | disable} [zone]

Parameters
enable | disable Enables or disables the daylight savings time function.
zone (Optional) Applies a name to the daylight savings time settings.

Defaults
If a zone name is not specified, none will be applied.

Mode
Switch command, read-only.

Example
This example shows how to enable daylight savings time function:
A4(su)->set summertime enable

set summertime date

Use this command to configure specific dates to start and stop daylight savings time. These
settings will be non-recurring and will have to be reset annually.

Syntax
set summertime date start_month start_date start_year start_hr_min end_month
end_date end_year end_hr_min [offset_minutes]

Parameters
start_month Specifies the month of the year to start daylight savings time.
start_date Specifies the day of the month to start daylight savings time.
start_year Specifies the year to start daylight savings time.
start_hr_min Specifies the time of day to start daylight savings time. Format is hh:mm.
end_month Specifies the month of the year to end daylight savings time.
end_date Specifies the day of the month to end daylight savings time.
end_year Specifies the year to end daylight savings time.
end_hr_min Specifies the time of day to end daylight savings time. Format is hh:mm.
offset_minutes (Optional) Specifies the amount of time in minutes to offset daylight
savings time from the non-daylight savings time system setting. Valid
values are 1 - 1440.

2-16 Basic Configuration

 set summertime recurring

Defaults
If an offset is not specified, none will be applied.

Mode
Switch command, read-write.

Example
This example shows how to set a daylight savings time start date of April 4, 2004 at 2 a.m. and an
ending date of October 31, 2004 at 2 a.m. with an offset time of one hour:
A4(su)->set summertime date April 4 2004 02:00 October 31 2004 02:00 60

set summertime recurring

Use this command to configure recurring daylight savings time settings. These settings will start
and stop daylight savings time at the specified day of the month and hour each year and will not
have to be reset annually.

Syntax
set summertime recurring start_week start_day start_month start_hr_min end_week
end_day end_month end_hr_min [offset_minutes]

Parameters
start_week Specifies the week of the month to restart daylight savings time. Valid
values are: first, second, third, fourth, and last.
start_day Specifies the day of the week to restart daylight savings time.
start_hr_min Specifies the time of day to restart daylight savings time. Format is
hh:mm.
end_week Specifies the week of the month to end daylight savings time.
end_day Specifies the day of the week to end daylight savings time.
end_hr_min Specifies the time of day to end daylight savings time. Format is hh:mm.
offset_minutes (Optional) Specifies the amount of time in minutes to offset daylight
savings time from the non-daylight savings time system setting. Valid
values are 1 - 1440.

Defaults
If an offset is not specified, none will be applied.

Mode
Switch command, read-write.

Example
This example shows how set daylight savings time to recur starting on the first Sunday of April at
2 a.m. and ending the last Sunday of October at 2 a.m. with an offset time of one hour:
A4(su)->set summertime recurring first Sunday April 02:00 last Sunday October
02:00 60

Extreme A4 CLI Reference 2-17

clear summertime

clear summertime
Use this command to clear the daylight savings time configuration.

Syntax
clear summertime

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the daylight savings time configuration:
A4(su)->clear summertime

set prompt
Use this command to modify the command prompt.

Syntax
set prompt prompt_string

Parameters
prompt_string Specifies a text string for the command prompt.
Note: A prompt string containing a space in the text must be enclosed in quotes as
shown in the example below.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the command prompt to Switch 1:
A4(su)->set prompt “Switch 1”
Switch 1(su)->

2-18 Basic Configuration

 show banner

show banner
Use this command to show the login banner or message of the day banner. The login banner
displays before session login, and the message of the day banner displays after session login.

Syntax
show banner {login | motd}

Parameters
login Show the message banner displayed before session login.
motd Show the message of the day banner displayed after session login.

Defaults
None.

Mode
Switch command, read-only.

Usage
A login banner causes a prompt to display when a user logs in to the system, requiring the user to
verify y/n before the login will continue. The acknowledgement is logged in the audit log in
association with the user’s login name. For more information, see “set banner” on page 2-19.
A message of the day banner is displayed after a user has logged in.

Example
This example shows how to display the message of the day banner:
A4(rw)->show banner motd
This system belongs to XYZ Corporation.
Use of this system is strictly limited to authorized personnel.

set banner
Use this command to set a login banner or message of the day banner.

Syntax
set banner {login | motd} message

Parameters
login Specifies that the banner message being configured is a login banner.
motd Specifies that the banner message being configured is a message of the
day banner.
message Specifies a message of the day. This is a text string that needs to be in
double quotes if any spaces are used. Use a \n for a new line and \t for a
tab (eight spaces). The message can be up to 2048 characters in length.

Extreme A4 CLI Reference 2-19

clear banner

Defaults
None.

Mode
Switch command, read-write

Usage
A login banner is displayed prior to session login. When configured, a login banner will cause a
prompt to display which requires the user to verify y/n before the login will continue. These
acknowledgements are recoded in the audit log in association with the user’s login name.
For example, if the login banner is configured as "By proceeding with this login you are verifying
that you are an Extreme employee and authorized to use this system.", the following will display
prior to entering the login password:
By proceeding with this login you are verifying that you are an Extreme employee
and authorized to use this system.
Proceed to login? (y/n) [n]?
For SSH sessions which do not allow for an acceptance prompt, the following message will be
added after the banner display and before the login prompt:
Entering a password constitutes your understanding of, and compliance with,the
preceding banner message.
A message of the day banner is displayed after session login.
Banner message text must be enclosed in beginning and ending double quotation marks. The
message itself cannot contain any additional double quotation marks. Use the \? Escape sequence
when ending a banner with a question mark to avoid the question mark being treated as a help
request.

Example
This example shows how to set the message of the day banner to read: “This system belongs to
XYZ Corporation. Use of this system is strictly limited to authorized personnel.”
A4(rw)->set banner motd "\tThis system belongs to XYZ Corporation.\nUse of this
system is strictly limited to authorized personnel."

clear banner
Use this command to clear the login banner or message of the day banner. to a blank string.

Syntax
clear banner {login | motd}

Parameters
login Specifies that the pre-session login message should be cleared.
motd Specifies that the message of the day banner should be cleared.

Defaults
None.

2-20 Basic Configuration

 show version

Mode
Switch command, read-write.

Example
This example shows how to clear the message of the day banner to a blank string:
A4(rw)->clear banner motd

show version
Use this command to display hardware and firmware information. Refer to “Downloading a
Firmware Image” on page 2-27 for instructions on how to download a firmware image.

Syntax
show version

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display version information. Please note that you may see different
information displayed, depending on the type of hardware.

A4(su)->show version

Copyright (c) 2005 by Extreme Networks, Inc.

Model Serial # Versions

-------------- ----------------- -------------------
A4H254-8F8T 102103409001 Hw:BCM5650 REV 33
Bp:01.00.45
Fw:03.01.01.0002
BuFw:03.01.01.0001
A4H124-24FX 102103299001 Hw:BCM5650 REV 33
Bp:01.00.45
Fw:03.01.01.0002
BuFw:03.01.01.0001
Table 2-4 provides an explanation of the command output.

Table 2-4 show version Output Details

Output Field What It Displays...

Model Switch’s model number.

Extreme A4 CLI Reference 2-21

set system name

Table 2-4 show version Output Details (Continued)

Output Field What It Displays...

Serial # Serial number of the switch.

Versions • Hw: Hardware version number.

• Bp: BootPROM version.
• Fw: Current firmware version number.
• BuFw: Backup firmware version number.
• PoE: Power over Ethernet driver version. (Displays only for PoE switches.)

set system name

Use this command to configure a name for the system.

Syntax
set system name [string]

Parameters
string (Optional) Specifies a text string that identifies the system.
Note: A name string containing a space in the text must be enclosed in quotes as
shown in the example below.

Defaults
If string is not specified, the system name will be cleared.

Mode
Switch command, read-write.

Example
This example shows how to set the system name to Information Systems:
A4(su)->set system name “Information Systems”

set system location

Use this command to identify the location of the system.

Syntax
set system location [string]

Parameters
string (Optional) Specifies a text string that indicates where the system is
located.
Note: A location string containing a space in the text must be enclosed in quotes
as shown in the example below.

2-22 Basic Configuration

 set system contact

Defaults
If string is not specified, the location name will be cleared.

Mode
Switch command, read-write.

Example
This example shows how to set the system location string:
A4(su)->set system location “Bldg N32-04 Closet 9”

set system contact

Use this command to identify a contact person for the system.

Syntax
set system contact [string]

Parameters
string (Optional) Specifies a text string that contains the name of the person to
contact for system administration.
Note: A contact string containing a space in the text must be enclosed in quotes as
shown in the example below.

Defaults
If string is not specified, the contact name will be cleared.

Mode
Switch command, read-write.

Example
This example shows how to set the system contact string:
A4(su)->set system contact “Joe Smith”

set width
Use this command to set the number of columns for the terminal connected to the switch’s console
port.

Syntax
set width screenwidth [default]

Parameters
screenwidth Sets the number of terminal columns. Valid values are 50 to 150.
default (Optional) Makes this setting persistent for all future sessions (written to
NV-RAM).

Extreme A4 CLI Reference 2-23

set length

Defaults
None.

Mode
Switch command, read-write.

Usage
The number of rows of CLI output displayed is set using the set length command as described in
“set length” on page 2-24.

Example
This example shows how to set the terminal columns to 50:
A4(su)->set width 50

set length
Use this command to set the number of lines the CLI will display. This command is persistent
(written to NV-RAM).

Syntax
set length screenlength

Parameters
screenlength Sets the number of lines in the CLI display. Valid values are 0, which
disables the scrolling screen feature, and from 5 to 512.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the terminal length to 50:
A4(su)->set length 50

show logout
Use this command to display the time (in seconds) an idle console, Telnet, or SSH CLI session will
remain connected before timing out.

Syntax
show logout

Parameters
None.

2-24 Basic Configuration

 set logout

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the CLI logout setting:
A4(su)->show logout
Logout currently set to: 10 minutes.

set logout
Use this command to set the time (in minutes) an idle console or Telnet CLI session will remain
connected before timing out.

Syntax
set logout timeout

Parameters
timeout Sets the number of minutes the system will remain idle before timing out.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the system timeout to 10 minutes:
A4(su)->set logout 10

show console
Use this command to display console settings.

Syntax
show console [baud] [bits] [flowcontrol] [parity] [stopbits] [vt100]

Parameters
baud (Optional) Displays the input/output baud rate.
bits (Optional) Displays the number of bits per character.
flowcontrol (Optional) Displays the type of flow control.

Extreme A4 CLI Reference 2-25

set console baud

parity (Optional) Displays the type of parity.

stopbits (Optional) Displays the number of stop bits.
vt100 (Optional) Displays the state of VT100 mode.

Defaults
If no parameters are specified, all settings will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display all console settings:
A4(su)->show console
vt100 terminal mode disabled
Baud Flow Bits StopBits Parity
------ ------- ---- ---------- ------
9600 Disable 8 1 none

set console baud

Use this command to set the console port baud rate.

Syntax
set console baud rate

Parameters
rate Sets the console baud rate. Valid values are: 1200, 2400, 4800, 9600, 19200, 38400,
57600, and 115200.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the console port baud rate to 19200:
A4(su)->set console baud 19200

set console vt100

Use this command to enable or disable VT100 terminal mode.

Syntax
set console vt100 {enable | disable)

2-26 Basic Configuration

 Downloading a Firmware Image

Parameters
enable Enables VT100 terminal mode.
disable Disables VT100 terminal mode.

Defaults
VT100 terminal mode is disabled by default.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.
Refer to Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration Guide for
more information about security profile configuration.

Usage
VT100 mode is required to support automatic console session termination on removal of the serial
connection (vs. timeout). This mode requires that the attached console device be running VT100
terminal emulation.
In VT100 mode, the switch polls for device status (using the appropriate VT100 escape sequence)
to detect an attached device, which requires that the attached device be running VT100 terminal
emulation. At any time, if the switch fails to get a status reply, an existing console session is
terminated.
On receipt of the first polled status response, the login banner is displayed if it is configured.

Example
This example enables VT100 mode.
A4(su)->set console vt100 enable

Downloading a Firmware Image

Refer to Chapter 1, “Setting Up a Switch for the First Time” and Chapter 6, “Firmware Image and
File Management,” in the Fixed Switching Configuration Guide for more detailed information and
procedures.
You can upgrade the operational firmware in the A4 switch without physically opening the switch
or being in the same location. There are two ways to download firmware to the switch:
• Via TFTP or SFTP download. This procedure uses a TFTP or SFTP server connected to the
network and downloads the firmware using the TFTP or SFTP protocol. For details on how to
perform a TFTP or SFTP download using the copy command, refer to “copy” on page 2-45.
For information on setting TFTP timeout and retry parameters, refer to “set tftp timeout” on
page 2-46 and “set tftp retry” on page 2-47.
• Via the serial (console) port. This procedure is an out-of-band operation that copies the
firmware through the serial port to the switch. It should be used in cases when you cannot
connect the switch to perform the in-band copy download procedure via TFTP. Serial console
download has been successfully tested with the following applications:
– HyperTerminal Copyright 1999
– Tera Term Pro Version 2.3

Extreme A4 CLI Reference 2-27

Downloading a Firmware Image

Any other terminal applications may work but are not explicitly supported.
The A4 switch allows you to download and store dual images. The backup image can be
downloaded and selected as the startup image by using the commands described in this section.

Downloading from a TFTP or SFTP Server

To perform a TFTP or SFTP download, proceed as follows:
1. If you have not already done so, set the switch’s IP address using the set ip address command
as detailed in “set ip address” on page 2-4.
2. Download a new image file using the copy command as detailed in “copy” on page 2-45.

Downloading via the Serial Port

To download switch firmware via the serial (console) port, proceed as follows:
1. With the console port connected, power up the switch. A message similar to the following
displays.
Within 2 seconds, type 2 to select “Start Boot Menu”. Use “administrator” for the Password.
Version 06.81.xx 05-09-2014

Computing MD5 Checksum of operational code...

Select an option. If no selection in 2 seconds then
operational code will start.

1 - Start operational code.

2 - Start Boot Menu.
Select (1, 2):2

Password: *************

Note: The “Boot Menu” password “administrator” can be changed using boot menu option 11.

Boot Menu Version 06.81.xx 05-09-2014

Options available
1 - Start operational code
2 - Change baud rate
3 - Retrieve event log using XMODEM (64KB).
4 - Load new operational code using XMODEM
5 - Display operational code vital product data
6 - Run Flash Diagnostics
7 - Update Boot Code
8 - Delete operational code
9 - Reset the system
10 - Restore Configuration to factory defaults (delete config files)
11 - Set new Boot Code password
[Boot Menu] 2

2. Type 2. The following baud rate selection screen displays:

1 - 1200

2-28 Basic Configuration

 Downloading a Firmware Image

2 - 2400
3 - 4800
4 - 9600
5 - 19200
6 - 38400
7 - 57600
8 - 115200
0 - no change

3. Type 8 to set the switch baud rate to 115200. The following message displays:
Setting baud rate to 115200, you must change your terminal baud rate.
4. Set your terminal emulation baud rate to 115200. For example:
– HyperTerminal: File > Properties > Configure > Bits per Second > Apply > OK > OK
– TeraTerm: Setup > Serial port > Baud rate > OK
5. Press ENTER. The switch will complete the baud rate change, displaying a new boot menu
prompt.
6. From the boot menu options screen, type 4 to load new operational code using XMODEM.
7. Set up for XMODEM file transmission. For example:
– HyperTerminal: Transfer > Send File > Browse > Open > Protocol Xmodem > Send > bps/
cps
– TeraTerm: File > Transfer > XMODEM > Send > Browse > Open
8. Progress messages will indicate the status of the file transfer.
[Boot Menu] 4
Ready to receive the file with XMODEM/CRC....
Ready to RECEIVE File xcode.bin in binary mode
Send several Control-X characters to cCKCKCKCKCKCKCK

XMODEM transfer complete, checking CRC....

Verified operational code CRC.

The following Extreme Header is in the image:

MD5 Checksum....................fe967970996c4c8c43a10cd1cd7be99a
Boot File Identifier............0x0517
Header Version..................0x0100
Image Type......................0x82
Image Offset....................0x004d
Image length....................0x006053b3
Ident Strings Length............0x0028
Ident Strings...................
<platform specific>

Image Version Length............0x7

Image Version Bytes.............0x30 0x2e 0x35 0x2e 0x30 0x2e 0x34 (x.xx.xx)

...

Operational code update completed successfully.

Verifying Operational Code CRC..... CRC is OK.

9. Press ENTER so the switch will complete the file transfer operation, displaying a fresh
prompt.

Extreme A4 CLI Reference 2-29

Downloading a Firmware Image

[Boot Menu] 2
10. Type 2 to display the baud rate selection screen again.
11. Type 4 set the switch baud rate to 9600. The following message displays:
Setting baud rate to 9600, you must change your terminal baud rate.

12. In your teminal emulation program, set the terminal baud rate to 9600.
– HyperTerminal: File > Properties > Configure > Bits per Second > Apply > OK > OK
– TeraTerm: Setup > Serial port > Baud rate > OK
13. Press ENTER so the switch will complete the baud rate change and display a fresh prompt.
[Boot Menu] 1
14. Type 1 to start the new operational code. A message similar to the following displays:
Operational Code Date: Tue Jun 29 08:34:05 2014
Uncompressing.....
15. After the switch comes back up, log in and confirm that the new image has been detected and
is now running. You can use either the “show boot system” command or the “dir” command.
C5(rw)->show boot system
Current system image to boot: c5-series_06.61.xx
C5(rw)->

Reverting to a Previous Image

In the event that you need to downgrade to a previous version of code, you can do so by
completing the following steps.

Caution: Before reverting to a previous image, always back up your configuration by saving it to a
file (show config outfile on page 2-43). You can then copy the file to a remote location (copy on
page 2-45).

Note: You will not be able to peform these steps remotely unless you have remote console support.

1. Save your running configuration with the save config command.

2. Make a copy of the current configuration with the show config outfile configs/filename
command. Use the dir command to confirm that the file was created.
3. If desired, copy the file to a remote TFTP server with the copy command:
copy configs/filename tftp://server_ipaddr/filename
4. Load your previous version of code on the device, as described in “Downloading a Firmware
Image” (page 2-27).
5. Set this older version of code to be the boot code with the set boot system command (page 2-
31). When the system asks if you want to reset the device, specify no (n).
6. Reload the saved configuration onto the device with the configure command, described on
page 2-44.
7. Reboot the system using the reset command (page 2-50).

2-30 Basic Configuration

 Reviewing and Selecting a Boot Firmware Image

Caution: If you do not follow the steps above, you may lose remote connectivity to the switch.

Reviewing and Selecting a Boot Firmware Image

Use the following commands to display and set the image file the switch loads at startup. The C5
switch allows you to download and store a backup image, which can be selected as the startup
image by using these commands.

For information about... Refer to page...

show boot system 2-31

set boot system 2-31

show boot system

Use this command to display the firmware image the switch loads at startup.

Syntax
show boot system

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the switch’s boot firmware image:
A4(su)->show boot system
Current system image to boot: bootfile

set boot system

Use this command to set the firmware image the switch loads at startup.

Syntax
set boot system filename

Parameters
filename Specifies the name of the firmware image file.

Extreme A4 CLI Reference 2-31

Setting the Authentication Login Method

Defaults
None.

Mode
Switch command, read-write.

Usage
This command allows you to set the firmware image to be loaded at startup. You can choose to
reset the system to use the new firmware image immediately, or you can choose to only specify the
new image to be loaded the next time the switch is rebooted.
You can use the dir command to display the “Active” image and the “Boot” image, which will be
the image loaded at the next system reboot.

Note: If you are changing the firmware image to a version earlier than the current version, refer to
“Reverting to a Previous Image” on page 2-30 for the correct steps to follow.

Example
This example shows how to set the boot firmware image file to be used at the next reboot of the
system, by answering “n” to the prompt. The dir command is then executed to display the Active
and Boot images.
A4(su)->set boot system a4_06.81.03.0007
This command can optionally reset the system to boot the new image.
Do you want to reset now (y/n) [n]?n

A4(su)->dir
Images:
==================================================================
Filename: a4-series_06.81.00.0026 (Active)
Version: 06.81.00.0026
Size: 9405440 (bytes)
Date: Fri Jul 18 12:48:35 2008
CheckSum: f1626ccf10d8f48cd6c3e79ab602342a
Compatibility: <platform specific>

Filename: a4-series_06.81.03.0007 (Boot)

Version: 06.81.03.0007
Size: 8290304 (bytes)
Date: Fri May 9 11:35:27 2008
CheckSum: 9f820d79239f10890442f8ff1f2bc914
Compatibility: <platform specific>

Setting the Authentication Login Method

The commands used to configure the authentication login method are listed below.

For information about... Refer to page...

show authentication login 2-33

set authentication login 2-33

clear authentication login 2-34

2-32 Basic Configuration

 show authentication login

show authentication login

Use this command to display the current authentication login method for management.

Syntax
show authentication login

Parameters
None.

Defaults
None.

Mode
Switch command, Read-Only.

Example
This example shows how to display the current authentication login method.
A4(rw)->show authentication login

Authentication Login List Method 1 Method 2 Method 3

------------------------- -------- -------- --------
any tacacs radius local

set authentication login

Use this command to set the authentication login method.

Syntax
set authentication login {any | local | radius | tacacs}

Parameters
any Specifies that the authentication protocol will be selected using the
following precedence order:
• TACACS+
• RADIUS
• Local
local Specifies that the local network password settings will be used for
authentication login.
radius Specifies that RADIUS will be used for authentication login.
tacacs Specifies that TACACS+ will be used for authentication login.

Defaults
If this command is not executed, the default login method is “any.”

Extreme A4 CLI Reference 2-33

clear authentication login

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2
Refer to Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration Guide for
more information about security profile configuration.

Example
This example shows how to set the authentication login method to use the local password settings:
A4(rw)->set authentication login local

clear authentication login

Use this command to reset the authentication login method to the default setting of “any”.

Syntax
clear authentication login

Parameters
None.

Defaults
None.

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2
Refer to Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration Guide for
more information about security profile configuration.

Example
This example shows how to reset the authentication login method.
A4(rw)->clear authentication login

Starting and Configuring Telnet

Use the following commands to enable or disable Telnet, and to start a Telnet session to a remote
host. The A4 switch allows a total of four inbound and / or outbound Telnet session to run
simultaneously.

For information about... Refer to page...

show telnet 2-35

set telnet 2-35

telnet 2-36

2-34 Basic Configuration

 show telnet

show telnet
Use this command to display the status of Telnet on the switch.

Syntax
show telnet

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display Telnet status:
A4(su)->show telnet
Telnet inbound is currently: ENABLED
Telnet outbound is currently: ENABLED

set telnet
Use this command to enable or disable Telnet on the switch.

Syntax
set telnet {enable | disable} [inbound | outbound | all]

Parameters
enable | disable Enables or disables Telnet services.
inbound | (Optional) Specifies inbound service (the ability to Telnet to this switch),
outbound | all outbound service (the ability to Telnet to other devices), or all (both
inbound and outbound).

Defaults
If not specified, both inbound and outbound Telnet service will be enabled.

Mode
Switch command, read-write.

Example
This example shows how to disable inbound and outbound Telnet services:
A4(su)->set telnet disable all
Disconnect all telnet sessions and disable now (y/n)? [n]: y
All telnet sessions have been terminated, telnet is now disabled.

Extreme A4 CLI Reference 2-35

telnet

telnet
Use this command to start a Telnet connection to a remote host. The A4 switch allows a total of
four inbound and / or outbound Telnet session to run simultaneously.

Syntax
telnet host [port]

Parameters
host Specifies the name or IP address of the remote host.
port (Optional) Specifies the server port number.

Defaults
If not specified, the default port number 23 will be used.

Mode
Switch command, read-write.

Example
This example shows how to start a Telnet session to a host at 10.21.42.13:
A4(su)->telnet 10.21.42.13

2-36 Basic Configuration

 Configuring Secure Shell (SSH)

Configuring Secure Shell (SSH)

Use these commands to review, enable, disable, and configure the Secure Shell (SSH) protocol,
which provides secure Telnet. The switch can support up to two concurrent SSH sessions.

For information about... Refer to page...

show ssh status 2-37

set ssh 2-37

set ssh hostkey 2-38

show ssh status

Use this command to display the current status of SSH on the switch.

Syntax
show ssh status

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display SSH status on the switch:
A4(su)->show ssh status
SSH Server status: Disabled

set ssh
Use this command to enable, disable or reinitialize SSH server on the switch. By default, the SSH
server is disabled. The switch can support up to two concurrent SSH sessions.

Syntax
set ssh {enabled | disabled | reinitialize}

Parameters
enabled | disabled Enables or disables SSH, or reinitializes the SSH server.
reinitialize Reinitializes the SSH server.

Defaults
None.

Extreme A4 CLI Reference 2-37

set ssh hostkey

Mode
Switch command, read-write.

Example
This example shows how to disable SSH:
A4(su)->set ssh disable

set ssh hostkey

Use this command to reinitialize new SSH authentication keys.

Syntax
set ssh hostkey reinitialize

Parameters
reinitialize Reinitializes the server host authentication keys.

Defaults
None

Mode
Switch command, read-write.

Example
This example shows how to regenerate SSH keys:
A4(su)->set ssh hostkey reinitialize

Managing Switch Configuration and Files

Use these commands to set and view the persistence mode for CLI configuration commands,
manually save the running configuration, view, manage, and execute configuration files and
image files, and set and view TFTP parameters.
Refer to Chapter 6, “Firmware Image and File Management,” in the Fixed Switching Configuration
Guide for information about configuration persistence mode and other image and file
management information.

For information about... Refer to page...

show snmp persistmode 2-39

set snmp persistmode 2-39

save config 2-40

dir 2-41

show file 2-42

show config 2-43

configure 2-44

2-38 Basic Configuration

 show snmp persistmode

For information about... Refer to page...

copy 2-45

delete 2-45

show tftp settings 2-46

set tftp timeout 2-46

clear tftp timeout 2-47

set tftp retry 2-47

clear tftp retry 2-48

show snmp persistmode

Use this command to display the configuration persistence mode setting.

Syntax
show snmp persistmode

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Usage
By default, the mode is set to “auto save,” which automatically saves configuration changes at
specific intervals. If the mode is set to “manual,” configuration commands are never automatically
saved. In order to make configuration changes persistent when the mode is manual, the save
config command must be issued as described in Chapter 6, “Firmware Image and File
Management,” in the Fixed Switching Configuration Guide.

Example
This example shows how to display the configuration persistence mode setting. In this case,
persistence mode is set to “manual”, which means configuration changes are not being
automatically saved.
A4(su)->show snmp persistmode
persistmode is manual

set snmp persistmode

Use this command to set the configuration persistence mode, which determines whether user-
defined configuration changes are saved automatically, or require issuing the save config

Extreme A4 CLI Reference 2-39

save config

command. See Chapter 6, “Firmware Image and File Management,” in the Fixed Switching
Configuration Guide for more information.

Syntax
set snmp persistmode {auto | manual}

Parameters
auto Sets the configuration persistence mode to automatic. This is the default
state.
manual Sets the configuration persistence mode to manual. In order to make
configuration changes persistent, the save config command must be
issued as described in “save config” on page 2-40. This mode is useful for
reverting back to old configurations.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the configuration persistence mode to manual:
A4(su)->set snmp persistmode manual

save config
Use this command to save the running configuration. If applicable, this command will save the
configuration to all switch members in a stack.

Syntax
save config

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to save the running configuration:
A4(su)->save config

2-40 Basic Configuration

 dir

dir
Use this command to list configuration and image files stored in the file system.

Syntax
dir [filename]

Parameters
filename (Optional) Specifies the file name or directory to list.

Defaults
If filename is not specified, all files in the system will be displayed.

Mode
Switch command, read-only.

Usage
The “secure” directory is only visible to and accessible by super-user accounts. Super-users can
create, edit, and delete files in the secure directory, and can copy files to and from the secure
directory. Up to 10 files are allowed in the secure directory, with a total size of 512 KB.
The secure.log file stored in the “secure/logs” directory cannot be deleted, edited, or renamed.
Super-users can copy the secure.log file using SCP, SFTP. or TFTP. Refer to Chapter 14,
“Configuring Syslog,” in the Fixed Switching Configuration Guide for more information about the
secure.log file.

Example
This example shows how to list all the configuration and image files in the system. The display
indicates which image file is the Active file and which image file is the Boot file that will be used
the next time the system reboots.
A4(su)->dir
Images:
==================================================================
Filename: a4-series_06.81.00.0029 (Active)
Version: 06.81.00.0029
Size: 9411584 (bytes)
Date: Fri Aug 1 06:55:23 2014
CheckSum: 6126a7aadfdf05150afb6eca51982302
Compatibility: <platform specific>

Filename: a4-series_06.81.00.0030 (Boot)

Version: 06.81.00.0030
Size: 9411584 (bytes)
Date: Fri Aug 8 08:44:04 2014
CheckSum: 627938b785fa7fdb8eed74672af1edcc
Compatibility: <platform specific>

Files: Size
================================ ========
configs:
Master 12509
Master2 10441
logs:

Extreme A4 CLI Reference 2-41

show file

current.log 190481
secure:
Master 14577
secure/logs:
secure.log 256017

show file
Use this command to display the contents of a file.

Syntax
show file filename

Parameters
filename Specifies the name of the file to display.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display a text file named “myconfig” in the configs/ directory. Note
that only a portion of the file is shown in this example.
A4(rw)->show file configs/myconfig
...
17 : #snmp
18 :
19 : set snmp access ro security-model v1 exact read All notify All nonvolatile
20 :
21 : set snmp access ro security-model v2c exact read All notify All nonvolatile
22 :
23 : set snmp access public security-model v1 exact read All write All notify All
nonvolatile
24 :
25 : set snmp access public security-model v2c exact read All write All notify All
nonvolatile
26 :
27 : set snmp access public security-model usm exact read All write All notify All
nonvolatile
28 :
29 : set snmp community :xxxxxxxxxxx:
30 :
31 : set snmp group ro user ro security-model v1
32 :
33 : set snmp group public user public security-model v1
34 :
35 : set snmp group ro user ro security-model v2c
36 :
37 : set snmp group public user public security-model v2c
38 :
39 : set snmp group public user public security-model usm

2-42 Basic Configuration

 show config

40 :
41 : set snmp user public authentication md5 :xxxxxxxxx: encryption des privacy
:xxxxxxxxxx:
42 :
43 : set snmp view viewname All subtree 1
44 :
45 : !

show config
Use this command to display the system configuration or write the configuration to a file.

Syntax
show config [all | facility] [outfile {configs/filename}]

Parameters
all (Optional) Displays default and non-default configuration settings.
facility (Optional) Specifies the exact name of one facility for which to show
configuration. For example, enter “port” to show only port configuration.
outfile (Optional) Specifies that the current configuration will be written to a text
file in the configs/ directory.
configs/filename Specifies a filename in the configs/ directory to display.

Defaults
By default, show config will display all non-default configuration information for all facilities.

Mode
Switch command, read-only.

Usage
The separate facilities that can be displayed by this command are identified in the display of the
current configuration by a # preceding the facility name. For example, “#port” indicates the facility
name “port.”
The output of this command obfuscates user passwords for all access modes, when the security
profile = normal. When the security profile = C2, user passwords are obfuscated for super-user
access, but redacted entirely for read-write and read-only access. The line containing the password
is also commented out in the output.

Examples
This example shows how to write the current configuration to a file named save_config2:
A4(rw)->show config all outfile configs/save_config2

This example shows how to display configuration for the facility “port”.
A4(rw)->show config port
This command shows non-default configurations only.
Use 'show config all' to show both default and non-default configurations.

begin
!

Extreme A4 CLI Reference 2-43

configure

#***** NON-DEFAULT CONFIGURATION *****

!
!

#port
set port jumbo disable ge.1.1

!
end

configure
Use this command to execute a previously downloaded configuration file stored on the switch.

Syntax
configure filename [append]

Parameters
filename Specifies the path and file name of the configuration file to execute.
append (Optional) Appends the configuration file contents to the current
configuration. This is equivalent to typing the contents of the config file
directly into the CLI and can be used, for example, to make incremental
adjustments to the current configuration.

Defaults
If append is not specified, the current running configuration will be replaced with the contents of
the configuration file, which will require an automated reset of the chassis.

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2
Refer to Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration Guide for
more information about security profile configuration.

Examples
This example shows how to execute the “Jan1_2004.cfg” configuration file. If you respond yes (y)
to the prompt, the system will reset. If you respond no (n), the new configuration will not be
applied.
A4(su)->configure configs/Jan1_2004.cfg
This command will reset the system and clear current configuration.
Are you sure you want to continue (y/n) [n]?
This example shows how to append a configuration file to the existing running config and will not
reset the switch.
A4(su)->configure configs/myconfig append

2-44 Basic Configuration

 copy

copy
Use this command to upload or download an image or a CLI configuration file.

Syntax
copy source {destination | system:image}

Parameters
source Specifies location and name of the source file to copy. Options are a local file
path in the configs or logs directory, or the URL of a TFTP, Secure FTP (SFTP),
or Secure Copy (SCP) server.
destination Specifies location and name of the destination where the file will be copied.
Options are a local file path in the configs directory, or the URL of a TFTP,
SFTP, or SCP server.
system:image The required destination of an image file.
Note: Only TFTP can be used to download an image file.

Defaults
None.

Mode
Switch command, read-write.

Usage
SCP can only be used to transfer configuration files or the logs/current.log file. You cannot use
SCP to download images (system:image).

Examples
This example shows how to download an image via TFTP:
A4(su)->copy tftp://10.1.192.34/version01000 system:image
This example shows how to download a configuration file to the configs directory:
A4(su)->copy tftp://10.1.192.1/Jan1_2004.cfg configs/Jan1_2004.cfg
This example shows how to upload a configuration file from the configs directory using SFTP.
A4(su)->copy configs/Jan1_2009.cfg sftp://user:[email protected]/Jan1_2009.cfg

delete
Use this command to remove an image or a CLI configuration file from the switch.

Syntax
delete filename

Parameters
filename Specifies the local path name to the file. Valid directories are /images and
/configs.

Extreme A4 CLI Reference 2-45

show tftp settings

Defaults
None.

Mode
Switch command, read-write.

Usage
Use the dir command (page 2-41) to display current image and configuration file names.

Example
This example shows how to delete the “Jan1_2004.cfg” configuration file:
A4(su)->delete configs/Jan1_2004.cfg

show tftp settings

Use this command to display TFTP settings used by the switch during data transfers using TFTP.

Syntax
show tftp settings

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Usage
The TFTP timeout value can be set with the set tftp timeout command. The TFTP retry value can
be set with the set tftp retry command.

Example
This example shows the output of this command.
A4(ro)->show tftp settings
TFTP packet timeout (seconds): 2
TFTP max retry: 5

set tftp timeout

Use this command to configure how long TFTP will wait for a reply of either an acknowledgement
packet or a data packet during a data transfer.

Syntax
set tftp timeout seconds

2-46 Basic Configuration

 clear tftp timeout

Parameters
seconds Specifies the number of seconds to wait for a reply. The valid range is
from 1 to 30 seconds. Default value is 2 seconds.

Defaults
None.

Mode
Switch command, read-write.

Example
This example sets the timeout period to 4 seconds.
A4(rw)->set tftp timeout 4

clear tftp timeout

Use this command to reset the TFTP timeout value to the default value of 2 seconds.

Syntax
clear tftp timeout

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the timeout value to the default of 2 seconds.
A4(rw)-> clear tftp timeout

set tftp retry

Use this command to configure how many times TFTP will resend a packet, either an
acknowledgement packet or a data packet.

Syntax
set tftp retry retry

Parameters
retry Specifies the number of times a packet will be resent. The valid range is
from 1 to 1000. Default value is 5 retries.

Extreme A4 CLI Reference 2-47

clear tftp retry

Defaults
None.

Mode
Switch command, read-write.

Example
This example sets the retry count to 3.
A4(rw)->set tftp retry 3

clear tftp retry

Use this command to reset the TFTP retry value to the default value of 5 retries.

Syntax
clear tftp retry

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the retry value to the default of 5 retries.
A4(rw)-> clear tftp retry

Clearing and Closing the CLI

Use the following commands to clear the CLI screen or to close your CLI session.

For information about... Refer to page...

cls 2-48

exit 2-49

cls (clear screen)

Use this command to clear the screen for the current CLI session.

Syntax
cls

2-48 Basic Configuration

 exit

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to clear the CLI screen:
A4(su)->cls

exit
Use this command to leave a CLI session.

Syntax
exit

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Usage
By default, switch timeout occurs after 15 minutes of user inactivity, automatically closing your
CLI session. Use the set logout command (page 2-25) to change this default.

Example
This example shows how to exit a CLI session:
A4(su)->exit

Resetting the Switch

Use the following commands to reset one or more switches, and to clear the user-defined
configuration parameters.

For information about... Refer to page...

reset 2-50

reset at 2-51

Extreme A4 CLI Reference 2-49

reset

For information about... Refer to page...

reset in 2-51

show reset 2-52

clear config 2-52

reset
Use this command to reset the switch without losing any user-defined configuration settings.

Syntax
reset [unit | cancel]

Parameters
unit (Optional) Specifies a unit to be reset.
cancel (Optional) Cancels a reset scheduled using the reset at or reset in
commands.

Defaults
If no unit ID is specified, the entire system will be reset.
If cancel is not specified, the system will be reset.

Mode
Switch command, read-write.

Usage
A A4 switch can also be reset with the RESET button located on its front panel. For information on
how to do this, refer to the A4 Installation Guide shipped with your switch.
See the command “reset at” on page 2-51 for information about scheduling a reset.

Examples
This example shows how to reset the system:
A4(su)->reset
Are you sure you want to reload the stack? (y/n) y

Saving Configuration to stacking members

Reloading all switches.
This example shows how to reset unit 1:
A4(su)->reset 1
Are you sure you want to reload the switch? (y/n) y

Reloading switch 1.
This switch is manager of the stack.
STACK: detach 3 units
This example shows how to cancel a scheduled system reset:
A4(su)->reset cancel
Reset cancelled

2-50 Basic Configuration

 reset at

reset at
Use this command to schedule a system reset at a specific future time. This feature is useful for
scheduling resets at a time when the switch will be less busy.

Syntax
reset at hh:mm [mm/dd] [reason]

Parameters
hh:mm Schedules the hour and minute of the reset using the 24-hour system.
mm/dd (Optional) Schedules the month and day of the reset.
reason (Optional) Specifies a text string that indicates the reason for the reset.

Defaults
If month and day are not specified, the reset will be scheduled for the first occurrence of the
specified time.
If a reason is not specified, none will be applied..

Mode
Switch command, read-write.

Example
This example shows how to schedule a reset at 11 p.m. on November 14, with a reason of
“testing.”
A4(su)->reset at 23:00 11/14 testing
Reset scheduled at 23:00:00, MON NOV 14 2011
Reset reason: testing
Proceed with scheduled reset? (y/n) [n]? y

Reset scheduled for 23:00:00, MON NOV 14 2011 (in 0 days 5 hours 58 minutes)

reset in
Use this command to schedule a system reset after a specific time. This feature is useful for
loading a new boot image.

Syntax
reset in hh:mm [reason]

Parameters
hh:mm Specifies the number of hours and minutesinto the future to perform the
reset.
reason (Optional) Specifies a text string that indicates the reason for the reset.

Defaults
If a reason is not specified, none will be applied.

Extreme A4 CLI Reference 2-51

show reset

Mode
Switch command, read-write.

Example
This example shows how to schedule a reset in 5 hours and 20 minutes.
A4(su)->reset in 05:20
Reset scheduled in 5 hours and 20 minutes
Proceed with scheduled reset? (y/n) [n]? y

Reset scheduled for 19:56:01, MON NOV 14 2011 (in 5 hours 20 minutes)

show reset
Use this command to display information about scheduled device resets.

Syntax
show reset

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display reset information.
A4(su)->show reset
Reset scheduled for MON NOV 14 2011, 23:00:00 (in 0 days 5 hours 57 minutes 51
seconds).
Reset reason: testing

clear config
Use this command to clear the user-defined configuration parameters.

Syntax
clear config [all]

Parameters
all (Optional) Clears user-defined configuration parameters (and stack unit
numbers and priorities, if applicable).

Defaults
If all is not specified, stacking configuration parameters will not be cleared.

2-52 Basic Configuration

 Using and Configuring WebView

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2
Refer to Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration Guide for
more information about security profile configuration.

Usage
When using the clear config command to clear configuration parameters in a stack, it is important
to remember the following:
• Use clear config to clear configuration parameters without clearing stack unit IDs. This
command WILL NOT clear stack parameters and avoids the process of re-numbering the
stack.
• Use clear config all when it is necessary to clear all configuration parameters, including stack
unit IDs (if applicable) and switch priority values.
• Use the clear ip address command to clear the IP address.
Configuration parameters and stacking information can also be cleared on the master unit only by
selecting option 10 (restore configuration to factory defaults) from the boot menu on switch
startup. This selection will leave stacking priorities on all other units, if applicable.

Example
This example shows how to clear configuration parameters (including stacking parameters, if
applicable):
A4(su)->clear config all

Using and Configuring WebView

By default, WebView (The Extreme Networks embedded web server for switch configuration and
management tasks) is enabled on TCP port number 80 on the A4 switch. You can verify WebView
status, and enable or disable WebView using the commands described in this section. WebView
can also be securely used over SSL port 443, if SSL is enabled on the switch. By default, SSL is
disabled.
To use WebView, type the IP address of the switch in your browser. To use WebView over SSL,
type in https:// then the IP address of the switch. For example, https://172.16.2.10.

For information about... Refer to page...

show webview 2-54

set webview 2-54

show ssl 2-55

set ssl 2-55

Extreme A4 CLI Reference 2-53

show webview

show webview
Use this command to display WebView status.

Syntax
show webview

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display WebView status:
A4(rw)->show webview
WebView is Enabled.

set webview
Use this command to enable or disable WebView on the switch.

Syntax
set webview {enable [ssl-only] | disable}

Parameters
enable | disable Enable or disable WebView on the switch.
ssl-only (Optional)Enables WebView with SSL only.

Defaults
None.

Mode
Switch command, read-write.

Usage
When you enable WebView without using the ssl-only option, HTTP can be used to access
WebView. If you enable with the ssl-only option, only HTTPS can be used to access WebView. Use
the set ssl command to enable SSL (and HTTPS) on the switch.
Refer to “set ssl” on page 2-55 for information about enabling and disabling SSL on the switch.
It is good practice for security reasons to disable HTTP access on the switch when finished
configuring with WebView, and then to only enable WebView on the switch when changes need to
be made.

2-54 Basic Configuration

 show ssl

Example
This example shows how to disable WebView on the switch:ssl
A4(rw)->set webview disable

show ssl
Use this command to display SSL status.

Syntax
show ssl

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display SSL status:
A4(rw)->show ssl
SSL status: Enabled

set ssl
Use this command to enable or disable the use of WebView over SSL port 443. By default, SSL is
disabled on the switch. This command can also be used to reinitialize the hostkey that is used for
encryption.

Syntax
set ssl {enabled | disabled | reinitialize | hostkey reinitialize}

Parameters
enabled | disabled Enables or disables the ability to use WebView over SSL.
reinitialize Stops and then restarts the SSL process.
hostkey reinitialize Stops SSL, regenerates new keys, and then restarts SSL.

Defaults
By default, SSL is disabled on the switch.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 2-55

Gathering Technical Support Information

Example
This example shows how to enable SSL:
A4(rw)->set ssl enabled

Gathering Technical Support Information

Use this command to gather common technical support information.

Command

For information about... Refer to page...

show support 2-56

show support
Use this command to display switch information for troubleshooting.

Syntax
show support

Parameters
None.

Defaults
None.

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2
Refer to Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration Guide for
more information about security profile configuration.

Usage
This command initiates a number of show commands to easily gather basic information from an
installed device. To use this command, set your console to capture the output to a file first, before
executing the command, since the output is extensive.
This command gathers the output from many “show” commands, including:
• show version
• show logging buffer
• show port status
• show system utilization process
• show system utilization storage
• show config

2-56 Basic Configuration

 show support

• show spantree stats active

Note that if the output of “show spantree stats active” includes an asterisk (*) following the
word “Discarding,” that indicates that the port is in discarding state because of Loop Protect.

Example
There is no display example because the output of this command is quite lengthy.

Extreme A4 CLI Reference 2-57

show support

2-58 Basic Configuration

 3
Setting User Accounts and Passwords

This chapter describes the commands used to configure user account and password management
functionality on the A4 switches.
Refer to Chapter 5, “User Account and Passsword Management,” in the Fixed Switching
Configuration Guide for configuration procedures and more information.

For information about... Refer to page...

show system login 3-1

set system login 3-2

clear system login 3-4

set password 3-5

set system password-resetbutton 3-6

show system password 3-7

set system password 3-9

clear system password 3-12

show system lockout 3-13

set system lockout 3-14

show system login

Use this command to display local login account information.

Syntax
show system login

Parameters
None.

Defaults
None.

Mode
Switch command, super user.

Extreme A4 CLI Reference 3-1

set system login

Example
This example shows how to display login account information. In this case, switch defaults have
not been changed:
A4(su)->show system login
Username Access State Aging Simul Local Login Access Allowed
Login Only? Start End Days

admin super-user enabled 0 0 no ***access always allowed***

ro read-only enabled 0 0 no ***access always allowed***
rw read-write enabled 0 0 no ***access always allowed***
guest read-only enabled 0 0 no 00:00 24:00 mon tue wed thu fri
Table 3-1 provides an explanation of the command output.

Table 3-1 show system login Output Details

Output Field What It Displays...
Username Login user names.
Access Access assigned to this user account: super-user, read-write or read-only.
State Whether this user account is enabled or disabled.
Aging Number of days user passwords will remain valid before aging out. Configured
with the set system login command.
Simul Login The number of simultaneous logins allowed for that user. A value of 0 means the
number is limited only to the number of sessions supported by the platform.
Configured with the set system login command.
Local only? Specifies the authentication scope for this user. “yes” specifies that
authentication is only by way of the local user database even with RADIUS or
TACACS+ configured. “no” specifies that authentication is by way of configured
methods.
Configured with the set system login command.
Login Start Specifies the start hour HH and minute MM time period (based upon 24 hour
time) for which access is allowed for this user, if this feature has been configured
for this user. Not applicable for super user.
Configured with the set system login command.
Access End Specifies the end hour HH and minute MM time period (based upon 24 hour
time) for which access is allowed for this user, if this feature has been configured
for this user. Not applicable for super user.
Configured with the set system login command.
Allowed Days Specifies the days of the week for which access is allowed for this user, if this
feature has been configured for this user. Not applicable for super user.
Configured with the set system login command.

set system login

Use this command to create a new user login account, or to disable or enable an existing account.
The A4 switch supports up to 16 user accounts, including the admin account.

Syntax
set system login username {super-user | read-write | read-only} {enable | disable}
[allowed-interval HH:MM HH:MM] [allowed-days {[Sun] [Mon] [Tue] [Wed] [Thu] [Fri]
[Sat]}] [local-only {yes|no}] [aging days] [simultaneous-logins logins] [password
password]

3-2 Setting User Accounts and Passwords

 set system login

Parameters
username Specifies a login name for a new or existing user. This string can be a
maximum of 80 characters, although a maximum of 16 characters is
recommended for proper viewing in the show system login display.
super-user | Specifies the access privileges for this user.
read-write |
read-only
enable | disable Enables or disables the user account.
allowed-interval (Optional) Specifies the start and end hour HH and minute MM time
HH:MM HH:MM period for which access will be allowed for this user based upon 24 hour
time. Not applicable for super user.
If no values are configured with this parameter, no start or end times are
applied,
allowed-days [Sun] (Optional) Specifies at least 1 and up to 7 days of the week for which
[Mon] [Tue] [Wed] access will be allowed for this user. Not applicable for super user.
[Thu] [Fri] [Sat]
If no values are configured with this parameter, all days are allowed. If
any value is configured, access is allowed only for the configured days.
local-only yes|no (Optional) Specifies the authentication scope for this user. Valid values:
• yes — specifies that authentication is only by way of the local user
database even with RADIUS or TACACS+ configured.
• no — specifies that authentication is by way of configured methods.
This is the default value.
aging days (Optional) Specifies the number of days to age the password. A non-zero
value supercedes the aging configured in set system password, for this
user. Valid values for days are 0 to 365. Default value is 0.
simultaneous- (Optional) Limits the number of simultaneous logins from the user. Valid
logins logins range for logins is 0 to 3. 0 = limited only to the number of sessions
supported by the platform. A value of 1 specifies the user may have only
one login session.
password password (Optional) This parameter is intended for use only in configurations
generated by the show config outfile command. Since the value of
password must be an encrypted string, you cannot enter a valid value
using the CLI.
Use the set password command (page 3-5) to configure user account
passwords.

Defaults
If an optional parameter is not specified, the default value for that parameter as described above is
applied.

Mode
Switch command, super user.

Extreme A4 CLI Reference 3-3

clear system login

Usage
Login accounts, including super-user accounts, can be locked out after multiple failed attempts to
log in to the system. Refer to “show system lockout” on page 3-13 and “set system lockout” on
page 3-14 for more information about lockout parameters.
If the password reset button functionality is enabled, if the admin user account has been locked
out, pressing the reset button on the switch will re-enable the admin user account with all its
default values. (Refer to “set system password-resetbutton” on page 3-6 for more information.)

Examples
This example shows how to enable a new user account with the login name “netops” with super
user access privileges:
A4(su)->set system login netops super-user enable
This example enables a new user account named “guest” with read-only privileges and allows
access only on Mondays through Fridays.
A4(su)->set system login guest read-only enable allowed-days Mon Tue Wed Thu Fri

clear system login

Use this command to remove a local login user account.

Syntax
clear system login username [allowed-interval] [allowed-days] [local-only]
[aging] [simultaneous-logins]

Parameters
username Specifies the login name of the account to be cleared.
Note: The default admin (su) account can be deleted only if another super-user
account has already been created. If security mode is C2, the additional super-
user account must also be set as the emergency access user with the set system
lockout command.
allowed-interval (Optional) Return the allowed interval to the default value of 0, meaning
no interval is applied to the specified user account.
allowed-days (Optional) Return the allowed days to the default value of 0, meaning all
days are allowed for the specified user account.
local-only (Optional) Return the authentication scope for this user to the default
value of no, meaning that authentication is by way of configured
methods.
aging (Optional) Returns the number of days to age the password to 0.
simultaneous- (Optional) Returns the number of simultaneous logins by the specified
logins user account to the default of 0, meaning that the number is limited only
to the number of sessions supported by the platform.

Defaults
The user account is removed if no optional parameters are specified.

3-4 Setting User Accounts and Passwords

 set password

Mode
Switch command, super user.

Usage
This command supports the deletion of the default admin account, but prevents the deletion of
the last remaining super-user account (that is, a super-user account must be created before the
admin account can be deleted).
If the security mode is C2, the last remaining super-user account must also be set as the emergency
access user in order to allow the default admin account to be deleted. See “set system lockout” on
page 3-14 for information about setting the emergency access user.

Example
This example shows how to remove the “netops” user account:
A4(su)->clear system login netops

set password
Use this command to change system default passwords or to set a new login password on the CLI.

Syntax
set password [username]

Parameters
username (Only available to users with super-user access.) Specifies a system
default or a user-configured login account name. By default, the A4
switch provides the following account names:
ro for Read-Only access.
rw for Read-Write access.
admin for Super User access. (This access level allows Read-Write
access to all modifiable parameters, including user accounts.)

Defaults
If security profile = C2, username is required.
Refer to Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration Guide for
information about setting the security profile.

Mode
Switch command, read-write.
Switch command, super-user.

Usage
Read-Write users can change their own passwords.
Super Users (Admin) can change any password on the system.
If you forget the password for the admin user account, you can reset the password to the default
password value by pressing the password reset button on the switch.

Extreme A4 CLI Reference 3-5

set system password-resetbutton

Passwords must conform to the configured system password rules.

Examples
This example shows how a super-user would change the Read-Write password from the system
default (blank string):
A4(su)->set password rw
Please enter new password: ********
Please re-enter new password: ********
Password changed.
A4(su)->
This example shows how a user with Read-Write access would change their own password:
A4(rw)->set password
Please enter old password: ********
Please enter new password: ********
Please re-enter new password: ********
Password changed.
A4(rw)->

set system password-resetbutton

Use this command to enable or disable the password reset button functionality.

Syntax
set system password-resetbutton {enable | disable}

Parameters
enable Enable the password reset button functionality. This is the default
condition.
disable Disable the password reset button functionality.

Defaults
By default, the password reset button functionality is enabled.

Mode
Switch command, super-user.

Usage
This command allows you to administratively disable or enable the password reset button
functionality, which includes:
• The switch, when operational, shall detect when the password reset button is pressed and
held (this allows for polling).
• When the password reset button functionality is enabled, pressing the password reset button
causes the admin account, with its default values, to be restored on the switch.
– If the admin account has been disabled, it will be re-enabled.
– If the admin account has been deleted, it will be restored on the switch with default
values.

3-6 Setting User Accounts and Passwords

 show system password

• When the password reset button functionality is disabled by means of this command, pressing
the reset button will have no effect.
• The password reset button is enabled by default.
• The configuration of the password reset button is persistent and is shown in the running
configuration.

Example
This example disables the password reset button functionality.
A4(su)->set system password-resetbutton disable

show system password

Use this command to display current password configuration settings.

Syntax
show system password

Parameters
None.

Defaults
None,.

Mode
Switch command, read-only.

Example
This example shows how to display password configuration settings. In this case, the settings
displayed are the default settings for Normal security mode. Table 3-1 describes the output fields.
Refer to Chapter 5, “User Account and Password Management,” in the Fixed Switching
Configuration Guide for a list of the default settings for both Normal and C2 security modes.
A4(su)->show system password
Password history size: 0
Password aging : disabled
Password minimum length: 8
Password minimum character requirements:
Uppercase: 0
Lowercase: 0
Numeric: 0
Special: 0
Password warning period: 20
Password grace period: 0
Password grace limit: 0
Password assignment required at account creation : no
Allow multiple accounts to share same password : yes
Length of substrings in previous password(s) not allowed in new password: 0
Allow the same character to appear consecutively in a password : yes
Require non-superusers to change password at first login : no
Minimum interval between password changes by non-superusers : 0 minutes

Extreme A4 CLI Reference 3-7

show system password

Table 3-1 show system password Output Details

Output... What it displays...

Password history size Number of previously used user login passwords that will be
checked for duplication when the set password command is
executed. Range is from 0 to 10.
Configured with set system password history command.
Password aging Number of days user passwords will remain valid before aging out.
Valid values are a number of days in the range from 1 to 365 days,
or disabled.
Configured with set system password aging command.

Password minimum length The minimum length of user passwords. Configured with the set
system password length command.

Password minimum character The minimum number of characters of the specified type needed
requirements: in the password. The range for each type of character is 0 to 40,
Uppercase: 0 with a default of 0.

Lowercase: 0 Configured with the set system password min-required-chars

command.
Numeric: 0
Special: 0

Password warning period Period of time prior to password expiration when user will be
notified. The range is from 1 to 30 days with a default of 20 days.
Configured with the set system password warning-period
command.

Password grace period The number of days after password expiration during which the
password will still be honored. The range is from 0 to 30 days, with
a default of 0.
Configured with the set system password grace-period
command.

Password grace limit The maximum number of logins that will still be honored after a
password has expired. The range is from 0 to 3, with a default of 3.
Configured with the set system password grace-limit command.

Password assignment required at Specifies whether a password is required at the time of user
account creation account creation:
yes — Password is required when creating a user account.
no — Password is not required when creating a user account.
Configured with the set system password require-at-creation
command.

Allow multiple accounts to share same Specifies whether multiple accounts can share the same
password password:
yes - Specifies that multiple accounts may share the same
password. Default value.
no - Specifies that multiple accounts may not share the same
password.
Configured with the set system password allow-duplicates
command.

3-8 Setting User Accounts and Passwords

 set system password

Table 3-1 show system password Output Details (Continued)

Output... What it displays...

Length of substrings in previous Specifies the length of any substring present in a previous
password(s) not allowed in new password(s) for this account that may not be used in a new
password password. Valid values are 0 to 40, default is 0.
Configured with the set system password substring-match-len
command.

Allow the same character to appear Specifies whether the same character may appear consecutively
consecutively in a password in the same password:
yes - specifies that the same character may appear
consecutively. Default value.
num - specifies the number of characters that may be repeated
consecutively. Valid values are 0 to 39.
Configured with the set system password allow-repeating-
chars command.

Require non-superusers to change Specifies whether new users are required to change their
password at first login password upon first login:
yes — specifies that new users must change the password for
this account upon first login.
no — specifies that new users are not required to change the
password for this account upon first login.
Configured with the set system password change-first-login
command.

Minimum interval between password Specifies a minimum interval in minutes between password
changes by non-superusers changes allowed for non-superusers. Valid values are 0 to 65535
minutes.
Configured with the set system password change-frequency
command.

set system password

Use this command to configure system password parameters.

Syntax
set system password [aging {days | disable}] [allow-duplicates {yes | no}] [allow-
repeating-chars {num | yes}] [change-first-login {yes | no}] [change-frequency
minutes] [grace-limit {logins}] [grace-period {days}] [history {size}] [length
{#ofChars}] [min-required-chars {[uppercase #ofChars] [lowercase #ofChars]
[numeric #ofChars] [special #ofChars]}] [require-at-creation {yes | no}]
[substring-match-len #ofChars] [warning-period {days}]

Parameters
aging days | disable (Optional) Specifies the number of days user passwords will remain valid
before aging out, or disables password aging. Value of days can range
from 1 to 365 days.
Default values are:
• If the security profile = C2, default aging is 90 days.
• If the security profile = normal, aging is disabled.

Extreme A4 CLI Reference 3-9

set system password

allow-duplicates (Optional) Specifies whether multiple accounts can share the same
yes|no password:
• yes - Specifies that multiple accounts may share the same password.
Default value is yes.
• no - Specifies that multiple accounts may not share the same
password.
allow-repeating- (Optional) Specifies whether the same character may appear
chars num|yes consecutively in the same password:
• num - specifies the number of characters that may be repeated
consecutively. Valid values are 0 to 39.
• yes - specifies that the same character may appear consecutively.
Default values are:
• If the security profile = C2, default is 2.
• If the security profile = normal, default is yes.
change-first-login (Optional) Specifies whether new users are required to change their
yes|no password upon first login:
• yes — specifies that new users must change the password for this
account upon first login.
• no — specifies that new users are not required to change the
password for this account upon first login.
Default values are:
• If the security profile = C2, default is yes.
• If the security profile = normal, the default is no.
change-frequency (Optional) Specifies a minimum interval in minutes between password
minutes changes allowed for non-superusers. Valid values for minutes range from
0 to 65535.
Default values are:
• If the security profile = C2, default is 1440 (24 hours).
• If the security profile = normal, default is 0.
grace-limit logins (Optional) The maximum number of logins that will still be honored after
a password has expired. The range for logins is from 0 to 3, with a default
of 3.
grace-period days (Optional) The number of days after password expiration during which
the password will still be honored. The range for days is from 0 to 30 days,
with a default of 0.
history size (Optional) Number of previously used user login passwords that will be
checked for duplication when the set password command is executed.
Valid values for size range from 0 to 10.
Default values are:
• If the security profile = C2, default history is 8.
• If the security profile = normal, default history is 0.

3-10 Setting User Accounts and Passwords

 set system password

length #ofChars (Optional) The minimum length of user passwords. Default values are:
• If the security profile = C2, default is 9 characters.
• If the security profile = normal, default is 8 characters.
min-required-chars (Optional) The minimum number of characters of the specified type
needed in the password. The range for #ofChars for each type of character
[uppercase #ofChars]
is 0 to 40, with a default of 0.
[lowercase #ofChars]
[numeric #ofChars] The set of special characters recognized by this command is: ! @ # $ % ^ &
[special #ofChars] * ( ) ? = [ ] \ ; ? , ./ `
require-at-creation (Optional) Specifies whether a password is required at the time of user
yes | no account creation:
• yes — Password is required when creating a user account.
• no — Password is not required when creating a user account.
Default values are:
• If the security profile = C2, default is yes.
• If the security profile = normal, the default is no.
substring-match- (Optional) Specifies the length of any substring present in a previous
len #ofChars password(s) for this account that may not be used in a new password.
Valid values for #ofChars are 0 to 40. Default is 0.
warning-period (Optional) Period of time prior to password expiration when user will be
days notified. The range for days is from 1 to 30 days with a default of 20 days.

Defaults
All the parameters are optional, but at least one must be entererd with the command.
Refer to Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration Guide for
information about setting the security profile.

Mode
Switch command, super user.

Usage
If the require-at-creation option is enabled with this command, the set system login command
will interactively prompt for a password upon creation of a new user account. It will be as if a set
password username command was implicitly executed. The new account will not be successfully
created until a valid password has been specified. A password will not be solicited if an encrypted
password is already specified by way of the set system login command's password option.
If the substring-match-len option is set to zero, no substring matching will be performed when
validating new passwords. If the substring-match-len option is configured with a nonzero length,
any substring of the specified length appearing in the current password for this user may not
appear in a new password.
If the configured history size is nonzero, then all historical passwords up to that size will also be
compared with the input of the new password. Any substring of the configured length appearing
in any of the historical passwords may not be used in the new password.
A password change-frequency interval of zero means there is no restriction on the frequency of
password changes.

Extreme A4 CLI Reference 3-11

clear system password

Examples
This example shows how to set the minimum system password length to 10 characters:
A4(su)->set system password length 10
This example shows how to set the system password age time to 45 days:
A4(su)->set system password aging 45
This example shows how to configure the system to check the last 10 passwords for duplication
A4(su)->set system password history 10

clear system password

Use this command to reset the system password parameters to default values.

Syntax
clear system password [aging] [allow-duplicates] [allow-repeating-chars] [change-
first-login] [change-frequency] [grace-limit] [grace-period] [history] [length]
[min-required-chars {[uppercase] [lowercase] [numeric] [special]}] [require-at-
creation] [substring-match-len] [warning-period]

Parameters
aging (Optional) Resets aging to the default of disable.
allow-duplicates (Optional) Resets allow-duplicates to the default value of yes.
allow-repeating- (Optional) Resets allow-repeating-chars to the default value of yes.
chars
change-first-login (Optional) Resets changing uer passwords upon first login to the default
value of no.
change-frequency (Optional) Resets the minimum interval in minutes between password
changes allowed for non-superusers to the default of 0 minutes.
grace-limit (Optional) Resets the maximum number of logins that will still be
honored after a password has expired to the default of 3.
grace-period (Optional) Resets the number of days after password expiration during
which the password will still be honored to the default of 0.
history (Optional) Resets the number of previously used user login passwords
that will be checked for duplication when the set password command is
executed to the default of 0.
length (Optional) Resets the minimum length of user passwords to the default of
8 characters.
min-required-chars (Optional) Resets the minimum number of characters of the specified type
needed in the password to the default of 0.
[uppercase]
[lowercase]
[numeric] [special]
require-at-creation (Optional) Resets whether a password is required at the time of user
account creation to the default of no.
substring-match- (Optional) Resets the length of any substring present in a previous
len password(s) for this account that may not be used in a new password to
the default of 0.

3-12 Setting User Accounts and Passwords

 show system lockout

warning-period (Optional) Resets the period of time prior to password expiration when
user will be notified to the default of 20 days.

Defaults
If no optional parameters are entered, all parameters are reset to their default values.

Mode
Switch command, super-user.

Example
This example resets all system password parameters to their default values.
A4(su)->clear system password

show system lockout

Use this command to display settings for locking out users after failed attempts to log in to the
system.

Syntax
show system lockout

Parameters
None.

Defaults
None.

Mode
Switch command, super user.

Example
This example shows how to display user lockout settings. In this case, switch defaults have not
been changed:
A4(su)->show system lockout
Unsuccessful login attempts before lockout : 3
Duration of lockout : 1 minutes.
Period of inactivity before account lockout : 90 days
Lockout entire port upon failed logins : enabled
Ports currently locked out due to failed logins : none
Account assigned emergency-access from the console: admin
Table 3-2 provides an explanation of the command output. These settings are configured with the
set system lockout command (page 3-14).

Extreme A4 CLI Reference 3-13

set system lockout

Table 3-2 show system lockout Output Details

Output Field What It Displays...

Unsuccessful login attempts before Number of failed login attempts allowed before a read-write or
account lockout read-only user’s account will be disabled or a super-user account
will be locked out for a period of time.

Duration of lockout Number of minutes super-user accounts will be locked out after
the maximum failed login attempts or period of inactivity.
Period of inactivity before account Number of days of inactivity before a read-write or read-only
lockout user’s account will be disabled or a super-user account will be
locked out for a period of time. Zero indicates that no lockout will
occur for inactivity.

Lockout entire port upon failed logins Enabled or disabled.

Ports currently locked out due to failed Ports currently locked out due to failed logins will show network
logins and/or console if engaged.

Account assigned emergency-access The user account allowed emergency access through the console
from the console port.

set system lockout

Use this command to set the number of failed login attempts allowed before disabling a read-write
or read-only user account or locking out a super-user account, the number of minutes to lock out a
super-user account after maximum login attempts or inactivity, and the number of inactive days
before a read-write or read-only account is disabled or a super-user account is locked out. You can
also enable or disable the port lockout feature and identify an emergency access user.

Syntax
set system lockout {[attempts attempts] [time minutes] [inactive days] [emergency-
access username] [port {enable | disable}]}

Parameters
attempts attempts (Optional) Specifies the number of failed login attempts allowed before a
read-write or read-only user’s account will be disabled or a super-user
account will be locked out for a period of time.
Valid ranges are:
• If the security profile = C2, range is from 2 to 5.
• If the security profile = normal, range is from 1 to 15.
The default value is 3 attempts.
time minutes (Optional) Specifies the number of minutes a super-user account will be
locked out after the maximum failed login attempts or period of inactivity.
Valid values are 0 to 65535.
Defaults are:
• If the security profile = C2, default is one minute.
• If the security profile = normal, default is 15 minutes.

3-14 Setting User Accounts and Passwords

 set system lockout

inactive days (Optional) Specifies the period of inactivity in days after which a non-
super-user account will be disabled or a super-user account will be locked
out for a period of time. Valid values are 0 to 65535. A value of 0 means
that no inactivity checking will be done.
Defaults are:
• If the security profile = C2, default is 90 days.
• If the security profile = normal, default is 0, accounts will not be
disabled or locked out due to inactivity.
emergency-access (Optional) Specifies the user account that is allowed emergency access to
username the switch through the console port.
port enable | (Optional) Enables or disables the lockout feature on SSH/Telnet (network
disable access) and the console port interface. When enabled, any sequential
number of failed logins that meet the configured attempts limit will
lockout all logins through those applications.

Defaults
At least one of the optional parameters must be specified.
Refer to Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration Guide for
information about setting the security profile.

Mode
Switch command, super user.

Usage
Once a read-write or read-only user account is locked out (that is, disabled), it can only be re-
enabled by a super user with the set system login command (page 3-2).
Super-user accounts are locked out only for a configured period of time.
If the default admin super user account has been locked out, and if the password reset button
functionality is enabled, you can press the reset button on the switch to re-enable the admin
account with its default values. The emergency-access user is restored as the default, the admin
account.
If the password reset button functionality has been disabled, you can wait until the lock out time
has expired or you can reboot the switch in order to re-enable the admin account.
Refer to “set system password-resetbutton” on page 3-6 for more information about password
reset button functionality.

Example
This example shows how to set failed login attempts to 5 and lockout time for super-users
accounts to 30 minutes:
A4(su)->set system lockout attempts 5 time 30

Extreme A4 CLI Reference 3-15

set system lockout

3-16 Setting User Accounts and Passwords

 4
Management Authentication Notification
MIB Commands

This chapter provides detailed information for the management authentication notification MIB
set of commands. Management authentication notification MIB functionality includes enabling/
disabling the sending of SNMP notifications when a user login authentication event occurs for
various authentication notification types.
Refer to Chapter 5, “User Account and Password Management,” in the Fixed Switching
Configuration Guide for more information.

For information about... Refer to page...

show mgmt-auth-notify 4-1

set mgmt-auth-notify 4-2

clear mgmt-auth-notify 4-3

Note: Ensure that SNMP is correctly configured in order to send these notifications.

show mgmt-auth-notify
Use this command to display the current settings for the Management Authentication Notification
MIB.

Syntax
show mgmt-auth-notify

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Extreme A4 CLI Reference 4-1

set mgmt-auth-notify

Example
This example shows how to display the current settings for Management Authentication
Notifications:
A4(su)->show mgmt-auth-notify

Management Type Status

--------------- --------
console Enabled
ssh Enabled
telnet Enabled
webview Enabled
inactiveUser Enabled
maxUserAttempt Enabled
maxUserFail Enabled

set mgmt-auth-notify
Use this command to enable or disable notifications for the authentication notification types
specified in the Extreme Management Authentication Notification MIB.

Syntax
set mgmt-auth-notify {enable | disable} [console] [ssh] [telnet] [webview]
[inactiveUser] [maxUserAttempt] [maxUserFail]

Parameters
enable Enables selected or all notification types.
disable Disables selected or all notification types.
console (Optional) console authentications.
ssh (Optional) SSH authentications.
telnet (Optional) TELNET authentications.
webview (Optional) Webview connection authentications.
inactiveUser (Optional) Username unused for specified interval.
maxUserAttempt (Optional) A user has attempted to simultaneously access the device too
many times (console/telnet/SSH).
maxUserFail (Optional) A user has entered too many bad passwords.

Defaults
If none of the optional Management Authentication access types are entered, then authentication
notifications for all authentications types listed above will either be enabled or disabled.

Mode
Switch command, read-write.

Usage
You can specifically enable or disable a single authentication notification type, multiple
authentication notification types or all the authentication notification types. The default setting is
that all Management Authentication Notification types are enabled for authentication notifcations.

4-2 Management Authentication Notification MIB Commands

 clear mgmt-auth-notify

When enabled for console, SSH, Telnet, or Webview, the switch will send an SNMP notification for
every successful and failed login attempt.
Ensure that SNMP is correctly configured on the module in order to send these notifications.

Examples
This example shows how to set all the authentication types to be disabled on the Management
Authentication Notification MIB. That information is then displayed with the show command:
A4(su)->set mgmt-auth-notify disable
A4(su)->show mgmt-auth-notify

Management Type Status

--------------- --------
console Disabled
ssh Disabled
telnet Disabled
webview Disabled
inactiveUser Disabled
maxUserAttempt Disabled
maxUserFail Disabled
This example shows how to set only the console and telnet authentication access types to be
enabled on the Management Authentication Notification MIB. That information is then displayed
with the show command:
A4(su)->set mgmt-auth-notify enable console telnet
A4(su)->show mgmt-auth-notify

Management Type Status

--------------- --------
console Enabled
ssh Disabled
telnet Enabled
webview Disabled
inactiveUser Disabled
maxUserAttempt Disabled
maxUserFail Disabled

clear mgmt-auth-notify
Use this command to set the current setting for the Management Authentication Notification
access types to the default setting of enabled.

Syntax
clear mgmt-auth-notify

Parameters
None.

Defaults
None.

Extreme A4 CLI Reference 4-3

clear mgmt-auth-notify

Mode
Switch command, read-write.

Usage
Ensure that SNMP is correctly configured on the module in order to send these notifications.

Example
This example displays the state of Management Authentication Notification access types prior to
using the clear command, then displays the same information after using the clear command:
A4(su)->show mgmt-auth-notify

Management Type Status

--------------- --------
console Enabled
ssh Disabled
telnet Enabled
webview Disabled
inactiveUser Disabled
maxUserAttempt Disabled
maxUserFail Disabled

A4(su)->clear mgmt-auth-notify

A4(su)->show mgmt-auth-notify

Management Type Status

--------------- --------
console Enabled
ssh Enabled
telnet Enabled
webview Enabled
inactiveUser Enabled
maxUserAttempt Enabled
maxUserFail Enabled

4-4 Management Authentication Notification MIB Commands

 5
Setting the Security Mode

This chapter describes the commands used to configure the switch security mode. Refer to
Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration Guide for more
information about security mode.

For information about... Refer to page...

set security profile 5-1

clear security profile 5-2

show security profile 5-2

set security profile

Use this command to set the switch’s security profile.

Syntax
set security profile {c2 | normal}

Parameters
c2 Sets the security profile to c2, which puts the switch into FIPS mode.
normal Sets the security profile to normal, which means that all supported
cryptographic algorithms are available to be selected and used

Defaults
Default security mode is normal.

Mode
Switch mode, super-user.

Usage
Changing the security mode of the switch requires a system reset.

Example
This example changes the security profile to c2.
A4(su)->set security profile c2

Warning: Changing security profile requires system reset.

Extreme A4 CLI Reference 5-1

clear security profile

Do you want to continue (y/n) [n]? y

Saving Configuration to stacking members

Resetting system ...

clear security profile

Use this command to clear the switch’s security profile to the default of normal.

Syntax
clear security profile

Parameters
None.

Defaults
None.

Mode
Switch command, super-user.

Usage
Changing the security mode of the switch requires a system reset.

Example
This example returns the switch to normal security mode from FIPS mode.
A4(su)->clear security profile

Warning: Changing security profile requires system reset.

Do you want to continue (y/n) [n]?

show security profile

Use this command to display the current security profile setting.

Syntax
show security profile

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

5-2 Setting the Security Mode

 show security profile

Example
This example shows how to display the current security profile setting.
A4(su)->show security profile
Security Profile Normal

Extreme A4 CLI Reference 5-3

show security profile

5-4 Setting the Security Mode

 6
Configuring System Power and PoE

Important Notice
The commands in this section apply only to PoE-equipped devices. Consult the Installation Guide for your
product to determine if it is PoE-equipped.

The commands in this chapter allow you to review and set system power and PoE (Power over
Ethernet) parameters, including the power available to the system, the usage threshold for each
module, whether or not SNMP trap messages will be sent when power status changes, and per-
port PoE settings.
For more extensive configuration information, refer to Chapter 7, “Configuring System Power and
PoE,” in the Fixed Switching Configuration Guide.

For information about... Refer to page...

show inlinepower 6-1

set inlinepower threshold 6-2

set inlinepower trap 6-3

set inlinepower detectionmode 6-3

show port inlinepower 6-4

set port inlinepower 6-5

show inlinepower
Use this command to display system power properties.

Syntax
show inlinepower

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Extreme A4 CLI Reference 6-1

set inlinepower threshold

Example
This example shows how to display system power properties:
A4(su)->show inlinepower
Detection Mode : auto

Unit Status Power(W) Consumption(W) Usage(%) Threshold(%) Trap

---- ------ ------- ------------- -------- ------------ ----
1 auto 375 0.00 0.00 80 enable
Table 6-1 provides an explanation of the command output.

Table 6-1 show inlinepower Output Details

Output What It Displays...

Detection Mode Displays the PD detection mode used by the switch. The detection mode can be
configured with the command “set inlinepower detectionmode” (page 6-3).

Unit Number of PoE-capable module.

Status Whether the PoE administrative state is off (disabled) or auto (on). This state is not
configurable.

Power (W) Unit’s available power wattage.

Consumption (W) Unit’s power wattage consumed.

Usage (%) Unit’s percentage of total system PoE power usage.

Threshold (%) Unit’s alloted percentage of total PoE power available in the system. The threshold
can be configured with the command “set inlinepower threshold” (page 6-2).

Trap Whether PoE trap messaging is enabled or disabled on this unit. Trap messaging
can be configured with the command “set inlinepower trap” (page 6-3).

set inlinepower threshold

Use this command to set the power usage threshold on a specified unit or module.

Syntax
set inlinepower threshold usage-threshold module-number

Parameters
usage-threshold Specifies a power threshold as a percentage of available system power.
Valid values are 11 to 100.
module-number Specifies the module or unit on which to set the power threshold.

Defaults
None.

Mode
Switch command, read-write.

6-2 Configuring System Power and PoE

 set inlinepower trap

Usage
The threshold is expressed as a percentage of the available PoE power. When this threshold is
reached, a trap will be sent if traps are enabled with the set inlinepower trap command.

Example
This example shows how to set the power threshold to 90 on module/unit 1:
A4(su)->set inlinepower threshold 90 1

set inlinepower trap

Use this command to enable or disable the sending of an SNMP trap message for a unit or module
whenever the status of its ports changes, or whenever the unit’s power usage threshold is crossed.

Syntax
set inlinepower trap {disable | enable} module-number

Parameters
disable | enable Disables or enables inline power trap messaging.
module-number Specifies the module or unit on which to disable or enable trap messaging.

Defaults
Sending of traps is disabled by default.

Mode
Switch command, read-write.

Usage
The module’s or unit’s power usage threshold must be set using the set inlinepower threshold
command as described on page 6-2.

Example
This example shows how to enable inline power trap messaging on module 1:
A4(su)->set inlinepower trap enable 1

set inlinepower detectionmode

Use this command to specify the method the switch will use to detect PDs (powered devices)
connected to its ports.

Syntax
set inlinepower detectionmode {auto | ieee)

Extreme A4 CLI Reference 6-3

show port inlinepower

Parameters
auto Specifies that the switch will use the standard IEEE 802.3 PoE detection
method first. If that fails, then the switch will use the legacy (pre-IEEE
802.3 PoE standard) capacitance method of detection.
ieee Specifies that the switch will only use the standard IEEE 802.3 PoE
detection method. (Refer to the Release Notes for your product for the
specific IEEE 802.3 PoE standards supported by your product.)

Defaults
Default detection mode is auto.

Mode
Switch command, read-write.

Usage
This command is used to specify how the switch should detect PDs connected to its ports. The PoE
hardware in the switches can use the IEEE 802.3 PoE standard (resistor-based) method or a
proprietary method using capacitor detection.
If auto is configured, the switch will first use the IEEE resistor-based detection method, and if that
fails, the switch will use the capacitor-based detection method. If ieee is configured, only the IEEE
resistor-based detection method will be used.

Example
This example sets the switch’s PD detection mode to the IEEE 802.3 PoE standard only.
A4(su)->set inlinepower detectionmode ieee

show port inlinepower

Use this command to display information about ports on the switch supporting PoE.

Syntax
show port inlinepower [port-string]

Parameters
port-string (Optional) Displays information for specific PoE port(s).

Defaults
If no port string is specified, information for all PoE ports will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display PoE information for port fe.2.1. In this case, the port’s
administrative state, PoE priority and class have not been changed from default values:

6-4 Configuring System Power and PoE

 set port inlinepower

A4(su)->show port inlinepower fe.2.1

Port Type Admin Oper Priority Class Power(W)
---- ---- ----- ---- -------- ----- --------
fe.2.1 wireless auto searching low 0 15.4

Table 6-2 show port inlinepower Output Details

Output Field What it Displays

Port The port being displayed in this row.

Type A text string describing the type of device connected to the port, set with the set
port inlinepower command.

Admin The port’s PoE administrative state, off (disabled) or auto (on). Can be set with
the set port inlinepower command.

Oper The operational mode of the port. Values displayed can be:
• Searching — no device is connected to the port.
• Delivering Power — power being delivered to connected device.
• Over Budget — connected device requires more power than the switch can
allocate to that port.
• Overload — connected device consumed more power than it was allowed.
• Other Fault — another PoE error has been detected, such as a short on the
PoE load, error with PoE signaling, general error detection.

Priority The port’s priority for PoE allocation. Values can be critical (highest), high or
low. Can be set with the set port inlinepower command.

Class The PoE class of the connected powered device.

Power (W) The amount of power being delivered to the port.

set port inlinepower

Use this command to configure PoE parameters on one or more ports.

Syntax
set port inlinepower port-string {[admin {off | auto}] [priority {critical | high
| low}] [type type]}

Parameters
port-string Specifies the port(s) on which to configure PoE.
admin off | auto (Optional) Sets the PoE administrative state to off (disabled) or auto (on).
When you set the admin state to off, PoE power is disabled on that port.
priority critical | (Optional) Sets the port(s) priority for the PoE allocation algorithm to
high | low critical (highest), high or low.
type type (Optional) Specifies a string describing the type of device connected to a
port. The string can be a maximum of 20 characters.

Defaults
At least one of the optional parameters must be entered.

Extreme A4 CLI Reference 6-5

set port inlinepower

Mode
Switch command, read-write.

Example
This example shows how to enable PoE on port fe.3.1 with critical priority:
A4(su)->set port inlinepower fe.3.1 admin auto priority critical

6-6 Configuring System Power and PoE

 7
Transmit Queue Monitoring Configuration

This chapter describes the commands used to monitor and manage transmit queues. Refer to
Chapter 8, “Port Configuration,” in the Fixed Switching Configuration Guide for more information.

For information about... Refer to page...

set txqmonitor 7-1

set txqmonitor downtime 7-2

set txqmonitor minrate 7-2

set txqmonitor threshold 7-3

clear txqmonitor 7-3

show txqmonitor 7-4

show txqmonitor flowcontrol 7-5

show txqmonitor port 7-6

set txqmonitor
Use this command to enable or disable transmit queue monitoring on the switch. Transmit queue
monitoring is enabled by default.

Syntax
set txqmonitor {enable | disable}

Parameters
enable | disable Enables or disables transmit queue monitoring on the switch.
Monitoring is enabled by default.

Defaults
Monitoring is enabled by default.

Mode
Switch command, read-write.

Example
This example disables transmit queue monitoring on the switch.
A4(su)-> set txqmonitor disable

Extreme A4 CLI Reference 7-1

Transmit Queue Monitoring Configuration set txqmonitor downtime

set txqmonitor downtime

Use this command to configure the time interval, in seconds, that ports disabled by the transmit
queue monitoring feature remain disabled.

Syntax
set txqmonitor downtime seconds

Parameters
seconds Specifies the downtime in seconds. A value of 0 will set the downtime to
forever, meaning that disabled ports will remain disabled until cleared
manually or until their next link state transition.
The default value is 0.

Defaults
The default value is 0, meaning that disabled ports will remain disabled until cleared manually or
until their next link state transition.

Mode
Switch command, read-write.

Usage
When the downtime is configured as 0, disabled ports can be manually enabled using the clear
txqmonitor down command (page 7-3).

Example
This example sets the downtime to 3600 seconds.
A4(su)-> set txqmonitor downtime 3600

set txqmonitor minrate

Use this command to set the minimum rate (in packets per second) of transmitted packets in a
sampling interval.

Syntax
set txqmonitor minrate rate

Parameters
rate The number of packets per second that must be transmitted per
sampling interval, if packets exist on the port’s transmit queues.
The default value is 1 packet per second.

Defaults
One packet per second.

7-2
set txqmonitor threshold Transmit Queue Monitoring Configuration

Mode
Switch command, read-write.

Example
This example sets the minimum rate of packets per second per sampling interval to 6.
A4(su)-> set txqmonitor minrate 6

set txqmonitor threshold

Use this command to set the transmit queue monitoring threshold levels for triggering actions
applied to a stalled port.

Syntax
set txqmonitor threshold { [logging | ignorepause | disableinterface] value }

Parameters
logging Specifies the logging trigger level.
ignorepause Specifies the discard received pause frames trigger level.
disableinterface Specifies the port disable trigger level.
value The number of successive failed sample intervals that will trigger an
action. A value of 0 disables the associated action.

Defaults
logging: 2 sequential failures
ignorepause: 5 sequential failures
disableinterface: 10 sequential failures

Mode
Switch command, read-write.

Example
This example sets the disable interface threshold to 6 sequential failed sample intervals.
A4(su)-> set txqmonitor threshold disableinterface 6

clear txqmonitor
Use this command to restore all transmit queue monitoring options to their default values.

Syntax
clear txqmonitor { all | globalstate | ignorepause [port-string] |
down [port-string] | threshhold | downtime | minrate }

Parameters
all Clear all transmit queue monitoring options to their default values.

Extreme A4 CLI Reference 7-3

Transmit Queue Monitoring Configuration show txqmonitor

globalstate Clear the global state to the default of enabled.

ignorepause Restore ports in the discarding pause frame state to the default of not
[port-string] discarding pause frames.
Optionally, restore only specified port or ports.
down [port-string] Re-enable ports disabled by transmit queue monitoring.
Optionally, enable only specified port or ports.
threshold Clear all trigger thresholds to default values. See set txqmonitor
threshold for default values.
downtime Clear the downtime value to the default of 0, meaning that disabled
ports will remain disabled until cleared manually or until their next link
state transition.
minrate Clear the number of packets per second that must be transmitted per
sampling interval to the default value of 1 packet per second.

Defaults
If port-string is not specified with the ignorepause or down parameters, all ports will be cleared.

Mode
Switch command, read-write.

Example
This example re-enables port fe.1.1 that was disabled by transmit queue monitoring.
A4(su)-> clear txqmonitor down fe.1.1

show txqmonitor
Use this command to display information about transmit queue monitoring.

Syntax
show txqmonitor [ downports | downtime | globalstate | ignorepause | minrate |
operstatus | threshold ]

Parameters
downports (Optional) Lists the ports disabled by transmit queue monitoring.
downtime (Optional) Displays the currently configured downtime interval in
seconds.
globalstate (Optional) Displays the global state of transmit queue monitoring,
either enabled or disabled.
ignorepause (Optional) Displays the ports currently discarding received pause
frames.
minrate (Optional) Displays the currently configured minimum acceptable
transmit rate per sampling period.
operstatus (Optional) Displays the operational status of all ports relative to
transmit queue monitoring. Ports are either operational or disabled.

7-4
show txqmonitor flowcontrol Transmit Queue Monitoring Configuration

threshold (Optional) Display the currently configured trigger values for transmit
queue monitoring corrective actions.

Defaults
If no parameter is specified, all transmit queue monitoring information is displayed.

Mode
Switch mode, read-only.

Examples
This example displays the global state of transmit queue monitoring.
A4(su)-> show txqmonitor globalstate
txqmonitor enabled
This example displays the currently configured trigger values.
A4(su)->show txqmonitor threshold
logging 2
ignorepause 5
disableinterface 10

show txqmonitor flowcontrol

Use this command to display the flow control information for one or more ports.

Syntax
show txqmonitor flowcontrol [port-string]

Parameters
port-string (Optional) Specifies the port or ports for which to display flow control
information.

Defaults
If no port-string is specified, flow control information for all ports is displayed.

Mode
Switch mode, read-only.

Usage
This command displays counters for transmitted and received pause frames per port.

Example
This example shows the the pause frame counts for ports 1 through 3.
A4(su)->show txqmonitor flowcontrol fe.1.1-3
port TX Pause Count RX Pause Count
-------- --------------- --------------
ge.1.1 0 0
ge.1.2 0 0
ge.1.3 0 146

Extreme A4 CLI Reference 7-5

Transmit Queue Monitoring Configuration show txqmonitor port

show txqmonitor port

Use this command to display transmit queue monitoring information for one or more ports.

Syntax
show txqmonitor port [port-string]

Parameters
port-string (Optional) Specifies the ports for which to display information.

Defaults
If port-string is not specified, information for all ports is displayed.

Mode
Switch mode, read-only.

Usage
This command displays transmit queue monitoring information about ports, including:
• Status — whether the port is operating normally, or ignoring received pause frames, or
disabled due to transmit queue monitoring corrective action
• Transmit queue sampling counts — the number of consecutive samples showing stalled
transmit queues, and the total number of samples showing stalled queues.

Examples
This example displays transmit queue monitoring information for ports 1 through 3. The output
shows that port fe.1.2 is currently ignoring received pause frames and port fe.1.3 is disabled due to
10 consecutive monitoring samples showing a stalled transmit queue.
A4(su)->show txqmonitor port fe.1.1-3
port status consecutive total
samples stalled samples stalled
-------- -------- ----------------- ------------------
ge.1.1 normal 0 0
ge.1.2 ignorepause 0 5
ge.1.3 down 10 10

7-6
 8
Discovery Protocol Configuration

This chapter describes describes the commands used to configure discovery protocols. For more
extensive configuration information, refer to Chapter 13, “Configuring Neighbor Discovery,” in
the Fixed Switching Configuration Guide.

For information about... Refer to page...

Configuring CDP 8-1

Configuring Cisco Discovery Protocol 8-6

Configuring Link Layer Discovery Protocol and LLDP-MED 8-12

Configuring CDP
Use the following commands to review and configure the Enterasys CDP discovery protocol. This
protocol is used to discover network topology. When enabled, this protocol allows Extreme
devices to send periodic PDUs about themselves to neighboring devices.

For information about... Refer to page...

show cdp 8-1

set cdp state 8-3

set cdp auth 8-3

set cdp interval 8-4

set cdp hold-time 8-4

clear cdp 8-5

show neighbors 8-5

show cdp
Use this command to display the status of the CDP discovery protocol and message interval on
one or more ports.

Syntax
show cdp [port-string]

Parameters
port-string (Optional) Displays CDP status for a specific port.

Extreme A4 CLI Reference 8-1

show cdp

Defaults
If port-string is not specified, all CDP information will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display CDP information for ports fe.1.1 through fe.1.9:
A4(su)->show cdp fe.1.1-9
CDP Global Status :auto-enable
CDP Version Supported :30 hex
CDP Hold Time :180
CDP Authentication Code :00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 hex
CDP Transmit Frequency :60

Port Status
-----------------
fe.1.1 auto-enable
fe.1.2 auto-enable
fe.1.3 auto-enable
fe.1.4 auto-enable
fe.1.5 auto-enable
fe.1.6 auto-enable
fe.1.7 auto-enable
fe.1.8 auto-enable
fe.1.9 auto-enable
Table 8-1 provides an explanation of the command output.

Table 8-1 show cdp Output Details

Output Field What It Displays...

CDP Global Status Whether CDP is globally auto-enabled, enabled or disabled. The default state of
auto-enabled can be reset with the set cdp state command. For details, refer to “set
cdp state” on page 8-3.

CDP Versions CDP version number(s) supported by the switch.

Supported

CDP Hold Time Minimum time interval (in seconds) at which CDP configuration messages can be
set. The default of 180 seconds can be reset with the set cdp hold-time command.
For details, refer to “set cdp hold-time” on page 8-4.

CDP Authentication Authentication code for CDP discovery protocol. The default of 00-00-00-00-00-00-
Code 00-00 can be reset using the set cdp auth command. For details, refer to “set cdp
auth” on page 8-3.

CDP Transmit Frequency (in seconds) at which CDP messages can be transmitted. The default of
Frequency 60 seconds can be reset with the set cdp interval command. For details, refer to “set
cdp interval” on page 8-4.

Port Port designation.

Status Whether CDP is enabled, disabled or auto-enabled on the port.

8-2 Discovery Protocol Configuration

 set cdp state

set cdp state

Use this command to enable or disable the CDP discovery protocol on one or more ports.

Syntax
set cdp state {auto | disable | enable} [port-string]

Parameters
auto | disable | Auto-enables, disables or enables the CDP protocol on the specified port(s).
enable In auto-enable mode, which is the default mode for all ports, a port
automatically becomes CDP-enabled upon receiving its first CDP message.
port-string (Optional) Enables or disables CDP on specific port(s).

Defaults
If port-string is not specified, the CDP state will be globally set.

Mode
Switch command, read-write.

Examples
This example shows how to globally enable CDP:
A4(su)->set cdp state enable
This example shows how to enable the CDP for port fe.1.2:
A4(su)->set cdp state enable fe.1.2
This example shows how to disable the CDP for port fe.1.2:
A4(su)->set cdp state disable fe.1.2

set cdp auth

Use this command to set a global CDP authentication code.

Syntax
set cdp auth auth-code

Parameters
auth-code Specifies an authentication code for the CDP protocol. This can be up to 16
hexadecimal values separated by commas.

Defaults
None.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 8-3

set cdp interval

Usage
The authentication code value determines a switch’s CDP domain. If two or more switches have
the same CDP authentication code, they will be entered into each other’s CDP neighbor tables. If
they have different authentication codes, they are in different domains and will not be entered
into each other’s CDP neighbor tables.
A switch with the default authentication code (16 null characters) will recognize all switches, no
matter what their authentication code, and enter them into its CDP neighbor table.

Example
This example shows how to set the CDP authentication code to 1,2,3,4,5,6,7,8:
A4(su)->set cdp auth 1,2,3,4,5,6,7,8:

set cdp interval

Use this command to set the message interval frequency (in seconds) of the CDP discovery
protocol.

Syntax
set cdp interval frequency

Parameters
frequency Specifies the transmit frequency of CDP messages in seconds.Valid values
are from 5 to 900 seconds.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the CDP interval frequency to 15 seconds:
A4(su)->set cdp interval 15

set cdp hold-time

Use this command to set the hold time value for CDP discovery protocol configuration messages.

Syntax
set cdp hold-time hold-time

Parameters
hold-time Specifies the hold time value for CDP messages in seconds.Valid values are
from 15 to 600.

Defaults
None.
8-4 Discovery Protocol Configuration
 clear cdp

Mode
Switch command, read-write.

Example
This example shows how to set CDP hold time to 60 seconds:
A4(su)->set cdp hold-time 60

clear cdp
Use this command to reset CDP discovery protocol settings to defaults.

Syntax
clear cdp {[state] [port-state port-string] [interval] [hold-time] [auth-code]}

Parameters
state (Optional) Resets the global CDP state to auto-enabled.
port-state port-string (Optional) Resets the port state on specific port(s) to auto-enabled.
interval (Optional) Resets the message frequency interval to 60 seconds.
hold-time (Optional) Resets the hold time value to 180 seconds.
auth-code (Optional) Resets the authentication code to 16 bytes of 00 (00-00-00-
00-00-00-00-00).

Defaults
At least one optional parameter must be entered.

Mode
Switch command, read-write.

Example
This example shows how to reset the CDP state to auto-enabled:
A4(su)->clear cdp state

show neighbors
This command displays Neighbor Discovery information for either the CDP or Cisco DP
protocols.

Syntax
show neighbors [port-string]

Parameters
port-string (Optional) Specifies the port or ports for which to display Neighbor
Discovery information.

Extreme A4 CLI Reference 8-5

Configuring Cisco Discovery Protocol

Defaults
If no port is specified, all Neighbor Discovery information is displayed.

Mode
Switch command, read-only.

Usage
This command displays information discovered by both the CDP and the Cisco DP protocols.

Example
This example displays Neighbor Discovery information for all ports.
A4(su)->show neighbors

Port Device ID Port ID Type Network Address

------------------------------------------------------------------------------
fe.1.1 00036b8b1587 12.227.1.176 ciscodp 12.227.1.176
fe.1.6 0001f496126f 140.2.3.1 ciscodp 140.2.3.1
fe.1.6 00-01-f4-00-72-fe 140.2.4.102 cdp 140.2.4.102
fe.1.6 00-01-f4-00-70-8a 140.2.4.104 cdp 140.2.4.104
fe.1.6 00-01-f4-c5-f7-20 140.2.4.101 cdp 140.2.4.101
fe.1.6 00-01-f4-89-4f-ae 140.2.4.105 cdp 140.2.4.105
fe.1.6 00-01-f4-5f-1f-c0 140.2.1.11 cdp 140.2.1.11
fe.1.19 0001f400732e 165.32.100.10 ciscodp 165.32.100.10

Configuring Cisco Discovery Protocol

Use these commands to review and configure the Cisco discovery protocol. Discovery protocols
are used to discover network topology. When enabled, they allow Cisco devices to send periodic
PDUs about themselves to neighboring devices. Specifically, this feature enables recognizing
PDUs from Cisco phones. A table of information about detected phones is kept by the switch and
can be queried by the network administrator.
The commands used to review and configure the Cisco discovery protocol are listed below. Refer
also to “show neighbors” on page 8-5.

For information about... Refer to page...

show ciscodp 8-7

show ciscodp port info 8-7

set ciscodp status 8-8

set ciscodp timer 8-9

set ciscodp holdtime 8-9

set ciscodp port 8-10

clear ciscodp 8-11

8-6 Discovery Protocol Configuration

 show ciscodp

show ciscodp
Use this command to display global Cisco discovery protocol information.

Syntax
show ciscodp

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display global Cisco DP information.
A4(su)->show ciscodp
CiscoDP :Enabled
Timer :5
Holdtime (TTl): 180
Device ID : 001188554A60
Last Change : WED NOV 08 13:19:56 2006
Table 8-2 provides an explanation of the command output.

Table 8-2 show ciscodp Output Details

Output Field What It Displays...

CiscoDP Whether Cisco DP is globally enabled or disabled. Auto indicates that Cisco DP will
be globally enabled only if Cisco DP PDUs are received.
Default setting of auto-enabled can be reset with the set ciscodp status command.

Timer The number of seconds between Cisco discovery protocol PDU transmissions. The
default of 60 seconds can be reset with the set ciscodp timer command.

Holdtime Number of seconds neighboring devices will hold PDU transmissions from the
sending device. Default value of 180 can be changed with the set ciscodp holdtime
command.

Device ID The MAC address of the switch.

Last Change The time that the last Cisco DP neighbor was discovered.

show ciscodp port info

Use this command to display summary information about the Cisco discovery protocol on one or
more ports.

Syntax
show ciscodp port info [port-string]

Extreme A4 CLI Reference 8-7

set ciscodp status

Parameters
port-string (Optional) Displays Cisco DP information for a specific port.

Defaults
If port-string is not specified, Cisco DP information for all ports will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display Cisco DP information for port 1 in unit 1.
A4(su)->show ciscodp port info fe.1.1

port state vvid trusted cos

----------------------------------------------
fe.1.1 enable none yes 0
Table 8-3 provides an explanation of the command output.

Table 8-3 show ciscodp port info Output Details

Output Field What It Displays...

Port Port designation.

State Whether Cisco DP is enabled, disabled or auto-enabled on the port. Default state of
enabled can be changed using the set ciscodp port command.

vvid Whether a voice VLAN ID has been set on this port. Default of none can be changed
using the set ciscodp port command.

trusted The trust mode of the port. Default of trusted can be changed using the set ciscodp
port command.

cos The Class of Service priority value for untrusted traffic. The default of 0 can be
changed using the set ciscodp port command.

set ciscodp status

Use this command to enable or disable the Cisco discovery protocol globally on the switch.

Syntax
set ciscodp state {auto | disable | enable}

Parameters
auto Globally enable only if Cisco DP PDUs are received.
disable Globally disable Cisco discovery protocol.
enable Globally enable Cisco discovery protocol.

Defaults
None.

8-8 Discovery Protocol Configuration

 set ciscodp timer

Mode
Switch command, read-write.

Example
This example shows how to globally enable CiscoDP:
A4(su)->set ciscodp state enable

set ciscodp timer

Use this command to set the number of seconds between Cisco discovery protocol PDU
transmissions.

Syntax
set ciscodp timer seconds

Parameters
seconds Specifies the number of seconds between Cisco DP PDU transmissions.
Valid values are from 5 to 254 seconds.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the Cisco DP timer to 120 seconds.
A4(su)->set ciscodp timer 120

set ciscodp holdtime

Use this command to set the time to live (TTL) for Cisco discovery protocol PDUs. This is the
amount of time, in seconds, neighboring devices will hold PDU transmissions from the sending
device.

Syntax
set ciscodp holdtime hold-time

Parameters
hold-time Specifies the time to live for Cisco DP PDUs. Valid values are from 10 to 255
seconds.

Defaults
None.

Extreme A4 CLI Reference 8-9

set ciscodp port

Mode
Switch command, read-write.

Example
This example shows how to set Cisco DP hold time to 180 seconds:
A4(su)->set ciscodp hold-time 180

set ciscodp port

Use this command to set the status, voice VLAN, extended trust mode, and CoS priority for
untrusted traffic for the Cisco Discovery Protocol on one or more ports.

Syntax
set ciscodp port {[status {disable | enable}] [vvid {vlan-id | none | dot1p |
untagged}] [trusted {yes | no}] [cos value]} port-string

Parameters
status Sets the CiscoDP port operational status.
disable Does not transmit or process CiscoDP PDUs.
enable Transmits and processes CiscoDP PDUs.
vvid Sets the port voice VLAN for CiscoDP PDU transmission.
vlan-id Specifies the VLAN ID, range 1-4093.
none No voice VLAN will be used in CiscoDP PDUs. This is the default.
dot1p Instructs attached phone to send 802.1p tagged frames.
untagged Instructs attached phone to send untagged frames.
trusted Sets the extended trust mode on the port.
yes Instructs attached phone to allow the device connected to it to transmit
traffic containing any CoS or Layer 2 802.1p marking. This is the default
value.
no Instructs attached phone to overwrite the 802.1p tag of traffic
transmitted by the device connected to it to 0, by default, or to the value
configured with the cos parameter.
cos value Instructs attached phone to overwrite the 802.1p tag of traffic
transmitted by the device connected to it with the specified value, when
the trust mode of the port is set to untrusted. Value can range from 0 to
7, with 0 indicating the lowest priority.
port-string Specifies the port(s) on which status will be set.

Defaults
• Status: enabled
• Voice VLAN: none
• Trust mode: trusted
• CoS value: 0

8-10 Discovery Protocol Configuration

 clear ciscodp

Mode
Switch mode, read-write.

Usage
The following points describe how the Cisco DP extended trust settings work on the switch.
• A Cisco DP port trust status of trusted or untrusted is only meaningful when a Cisco IP phone
is connected to a switch port and a PC or other device is connected to the back of the Cisco IP
phone.
• A Cisco DP port state of trusted or untrusted only affects tagged traffic transmitted by the
device connected to the Cisco IP phone. Untagged traffic transmitted by the device connected
to the Cisco IP phone is unaffected by this setting.
• If the switch port is configured to a Cisco DP trust state of trusted (with the trusted yes
parameter of this command), this setting is communicated to the Cisco IP phone instructing it
to allow the device connected to it to transmit traffic containing any CoS or Layer 2 802.1p
marking.
• If the switch port is configured to a Cisco DP trust state of untrusted (trusted no), this setting
is communicated to the Cisco IP phone instructing it to overwrite the 802.1p tag of traffic
transmitted by the device connected to it to 0, by default, or to the value specified by the cos
parameter of this command.
• There is a one-to-one correlation between the value set with the cos parameter and the 802.1p
value assigned to ingressed traffic by the Cisco IP phone. A value of 0 equates to an 802.1p
priority of 0. Therefore, a value of 7 is given the highest priority.

Note: The Cisco Discovery Protocol must be globally enabled using the set ciscodp status
command before operational status can be set on individual ports.

Examples
This example shows how to set the Cisco DP port voice VLAN ID to 3 on port fe.1.6 and enable the
port operational state.
A4(rw)->set ciscodp port status enable vvid 3 fe.1.6
This example shows how to set the Cisco DP extended trust mode to untrusted on port fe.1.5 and
set the CoS priority to 1.
A4(rw)->set ciscodp port trusted no cos 1 fe.1.5

clear ciscodp
Use this command to clear the Cisco discovery protocol back to the default values.

Syntax
clear ciscodp [status | timer | holdtime | {port {status | vvid | trust | cos}
[port-string]}]

Parameters
status Clears global CiscoDP enable status to default of auto.
timer Clears the time between CiscoDP PDU transmissions to default of 60
seconds.

Extreme A4 CLI Reference 8-11

Configuring Link Layer Discovery Protocol and LLDP-MED

holdtime Clears the time-to-live for CiscoDP PDU data to default of 180 seconds.
port Clears the CiscoDP port configuration.
status Clears the individual port operational status to the default of enabled.
vvid Clears the individual port voice VLAN for CiscoDP PDU transmission
to 0.
trust Clears the trust mode configuration of the port to trusted.
cos Clears the CoS priority for untrusted traffic of the port to 0.
port-string (Optional) Specifies the port(s) on which status will be set.

Defaults
If no parameters are entered, all Cisco DP parameters are reset to the defaults globally and for all
ports.

Mode
Switch mode, read-write.

Examples
This example shows how to clear all the Cisco DP parameters back to the default settings.
A4(rw)->clear ciscodp
This example shows how to clear the Cisco DP status on port fe.1.5.
A4(rw)->clear ciscodp port status fe.1.5

Configuring Link Layer Discovery Protocol and LLDP-MED

Refer to Chapter 13, “Configuring Neighbor Discovery,” in the Fixed Switching Configuration Guide
for a detailed discussion of configuring LLDP and LLDP-MED.
The commands used to review and configure the CDP discovery protocol are listed below.

For information about... Refer to page...

show lldp 8-13

show lldp port status 8-14

show lldp port trap 8-14

show lldp port tx-tlv 8-15

show lldp port location-info 8-15

show lldp port local-info 8-16

show lldp port remote-info 8-19

show lldp port network-policy 8-20

set lldp tx-interval 8-21

set lldp hold-multiplier 8-22

set lldp trap-interval 8-22

set lldp med-fast-repeat 8-23

set lldp port status 8-24

8-12 Discovery Protocol Configuration

 show lldp

For information about... Refer to page...

set lldp port trap 8-24

set lldp port med-trap 8-25

set lldp port location-info 8-25

set lldp port tx-tlv 8-26

set lldp port network-policy 8-27

clear lldp 8-29

clear lldp port status 8-30

clear lldp port trap 8-30

clear lldp port med-trap 8-31

clear lldp port location-info 8-31

clear lldp port network-policy 8-32

clear lldp port tx-tlv 8-33

show lldp
Use this command to display LLDP configuration information.

Syntax
show lldp

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display LLDP configuration information.
A4(ro)->show lldp
Message Tx Interval : 30
Message Tx Hold Multiplier : 4
Notification Tx Interval : 5
MED Fast Start Count : 3

Tx-Enabled Ports : fe.1.1-60; fe.2.1-24; fe.3.1-30; fe.4.1-12;

Rx-Enabled Ports : fe.1.1-60; fe.2.1-24; fe.3.1-30; fe.4.1-12;

Trap-Enabled Ports : fe.1.1-60; fe.2.1-24; fe.3.1-30; fe.4.1-12;

MED Trap-Enabled Ports : fe.1.1-60; fe.2.1-24; fe.3.1-30; fe.4.1-12;

Extreme A4 CLI Reference 8-13

show lldp port status

show lldp port status

Use this command to display the LLDP status of one or more ports. The command lists the ports
that are enabled to send and receive LLDP PDUs. Ports are enabled or disabled with the set lldp
port status command.

Syntax
show lldp port status [port-string]

Parameters
port-string (Optional) Displays LLDP status for one or a range of ports.

Defaults
If port-string is not specified, LLDP status information will be displayed for all ports.

Mode
Switch command, read-only.

Example
This example shows how to display LLDP port status information for all ports.
A4(ro)->show lldp port status

Tx-Enabled Ports : fe.1.1-60; fe.2.1-24; fe.3.1-30; fe.4.1-12

Rx-Enabled Ports : fe.1.1-60; fe.2.1-24; fe.3.1-30; fe.4.1-12

show lldp port trap

Use this command to display the ports that are enabled to send an LLDP notification when a
remote system change has been detected or an LLDP-MED notification when a change in the
topology has been sensed. Ports are enabled to send LLDP notifications with the set lldp port trap
command and to send LLDP-MED notifications with the set lldp port med-trap command.

Syntax
show lldp port trap [port-string]

Parameters
port-string (Optional) Displays the port or range of ports that have been enabled
to send LLDP and/or LLDP-MED notifications.

Defaults
If port-string is not specified, LLDP port trap information will be displayed for all ports.

Mode
Switch command, read-only.

8-14 Discovery Protocol Configuration

 show lldp port tx-tlv

Example
This example shows how to display LLDP port trap information for all ports.
A4(ro)->show lldp port trap

Trap-Enabled Ports :
MED Trap-Enabled Ports:

show lldp port tx-tlv

Use this command to display information about which optional TLVs have been configured to be
transmitted on ports. Ports are configured to send optional TLVs with the set lldp port tx-tlv
command.

Syntax
show lldp port tx-tlv [port-string]

Parameters
port-string (Optional) Displays information about TLV configuration for one or a
range of ports.

Defaults
If port-string is not specified, TLV configuration information will be displayed for all ports.

Mode
Switch command, read-only.

Example
This example shows how to display transmit TLV information for three ports.
A4(ro)->show lldp port tx-tlv fe.1.1-3

* Means TLV is supported and enabled on this port

o Means TLV is supported on this port
Means TLV is not supported on this port
Column Pro Id uses letter notation for enable: s-stp, l-lacp, g-gvrp

Ports Port Sys Sys Sys Mgmt Vlan Pro MAC PoE Link Max MED MED MED MED
Desc Name Desc Cap Addr Id Id PHY Aggr Frame Cap Pol Loc PoE
------- ---- ---- ---- --- ---- ---- ---- --- --- ---- ---- --- --- --- ---
fe.1.1 * * * * * * slg * * * * *
fe.1.2 * * * * * * slg * * *
fe.1.3 * * * * * * slg * * * * *

show lldp port location-info

Use this command to display configured location information for one or more ports. Ports are
configured with a location value using the set lldp port location-info command.

Syntax
show lldp port location-info [port-string]

Extreme A4 CLI Reference 8-15

show lldp port local-info

Parameters
port-string (Optional) Displays port location information for one or a range of
ports.

Defaults
If port-string is not specified, port location configuration information will be displayed for all
ports.

Mode
Switch command, read-only.

Example
This example shows how to display port location information for three ports.
A4(ro)->show lldp port location-info fe.1.1-3

Ports Type Location

-------- ------------- -------------------------
fe.1.1 ELIN 1234567890
fe.1.2 ELIN 1234567890
fe.1.3 ELIN 1234567890

show lldp port local-info

Use this command to display the local system information stored for one or more ports. You can
use this information to detect misconfigurations or incompatibilities between the local port and
the attached endpoint device (remote port).

Syntax
show lldp port local-info [port-string]

Parameters
port-string (Optional) Displays local system information for one or a range of
ports.

Defaults
If port-string is not specified, local system information will be displayed for all ports.

Mode
Switch command, read-only.

Example
This example shows how to display the local system information stored for port fe.4.1. Table 8-4
describes the output fields of this command.
A4(rw)->show lldp port local-info fe.4.1

Local Port : fe.4.1 Local Port Id: fe.4.1

--------------------
Port Desc : ... 1000BASE-TX RJ45 Gigabit Ethernet Frontpanel Port

8-16 Discovery Protocol Configuration

 show lldp port local-info

Mgmt Addr : 10.21.64.100

Chassis ID : 00-E0-63-93-74-A5
Sys Name : LLDP PoE test Chassis
Sys Desc : Extreme Networks, Inc.
Sys Cap Supported/Enabled : bridge,router/bridge

Auto-Neg Supported/Enabled : yes/yes

Auto-Neg Advertised : 10BASE-T, 10BASE-TFD,
100BASE-TX, 100BASE-TXFD,
1000BASE-TFD,
Bpause
Operational Speed/Duplex/Type : 100 full tx
Max Frame Size (bytes) : 1522

Vlan Id : 1
LAG Supported/Enabled/Id : no/no/0
Protocol Id : Spanning Tree v-3 (IEEE802.1s)
LACP v-1
GVRP

Network Policy
(app/tag/vlanId/cos/dscp) : voice/tagged/10/3/5
voice signaling/tagged/10/3/5
guest voice/tagged/10/3/5
guest voice signaling/tagged/10/3/5
softphone voice/tagged/10/3/5
video conferencing/tagged/10/3/5
streaming video/tagged/10/3/5
video signaling/tagged/10/3/5
ECS ELIN : 1234567890123456789012345

PoE Device : PSE device

PoE Power Source : primary
PoE MDI Supported/Enabled : yes/yes
PoE Pair Controllable/Used : false/spare
PoE Power Class : 2
PoE Power Limit (mW) : 15400
PoE Power Priority : high
Table 8-4 describes the information displayed by the show lldp port local-info command.

Table 8-4 show lldp port local-info Output Details

Output Field What it Displays...
Local Port Identifies the port for which local system information is displayed.
Local Port Id Mandatory basic LLDP TLV that identifies the port transmitting the
LLDPDU. Value is ifName object defined in RFC 2863.
Port Desc Optional basic LLDP TLV. Value is ifDescr object defined in RFC 2863.
Mgmt Addr Optional basic LLDP TLV. IPv4 address of host interface.
Chassis ID Mandatory basic LLDP TLV that identifies the chassis transmitting the
LLDPDU. Value is MAC address of chassis.
Sys Name Optional basic LLDP TLV. Value is the administratively assigned name for
the system.
Sys Desc Optional basic LLDP TLV. Value is sysDescr object defined in RFC 3418.
Sys Cap Supported/Enabled Optional basic LLDP TLV. System capabilities, value can be bridge and/or
router.

Extreme A4 CLI Reference 8-17

show lldp port local-info

Table 8-4 show lldp port local-info Output Details (Continued)

Output Field What it Displays...
Auto-Neg Supported/Enabled IEEE 802.3 Extensions MAC-PHY Configuration/Status TLV. Auto-
negotiation supported and enabled settings should be the same on the
two systems attached to the same link.
Auto-Neg Advertised IEEE 802.3 Extensions MAC-PHY Configuration/Status TLV. Lists the
configured advertised values on the port.
Operational Speed/Duplex/ IEEE 802.3 Extensions MAC-PHY Configuration/Status TLV. Lists the
Type operational MAU type, duplex, and speed of the port. If the received TLV
indicates that auto-negotiation is supported but not enabled, these values
will be used by the port.
Max Frame Size (bytes) IEEE 802.3 Extensions Maximum Frame Size TLV. Value indicates
maximum frame size capability of the device’s MAC and PHY. In normal
mode, max frame size is 1522 bytes. In jumbo mode, max frame size is
10239 bytes.
Vlan Id IEEE 802.1 Extensions Port VLAN ID TLV. Value is port VLAN ID (pvid).
LAG Supported/Enabled/Id IEEE 802.3 Extensions Link Aggregation TLV. Values indicate whether the
link associated with this port can be aggregated, whether it is currently
aggregated, and if aggregated, the aggregated port identifier.
Protocol Id IEEE 802.1 Extensions Protocol Identity TLV. Values can include
Spanning tree, LACP, and GARP protocols and versions. Only those
protocols enabled on the port are displayed.
Network Policy LLDP-MED Extensions Network Policy TLV. For all applications enabled
(app/tag/vlanId/cos/dscp) on the port to be transmitted in a TLV, displays the application name,
VLAN type (tagged or untagged), VLAN Id, and both the Layer 2 and
Layer 3 priorities associated with the application.
ECS ELIN LLDP-MED Extensions Location Identification TLV. Emergency Call
Services (ECS) Emergency Location Identification Number (ELIN) is
currently the only type supported. Value is the ELIN configured on this
port.
PoE Device LLDP-MED Extensions Extended Power via MDI TLV. Displayed only
when a port has PoE capabilities. Value is the Power Type of the device.
On a switch port, the value is Power Sourcing Entity (PSE).
PoE Power Source LLDP-MED Extensions Extended Power via MDI TLV. Displayed only
when a port has PoE capabilities. Value can be primary or backup,
indicating whether the PSE is using its primary or backup power source.
PoE MDI Supported/Enabled IEEE 802.3 Extensions Power via MDI TLV. Displayed only when a port
has PoE capabilities. Indicates whether sending the Power via MDI TLV is
supported/enabled. Value can be yes or no.
PoE Pair Controllable/Used IEEE 802.3 Extensions Power via MDI TLV. Displayed only when a port
has PoE capabilities. Indicates whether pair selection can be controlled on
the given port (refer to RFC 3621). Value for Controllable can be true or
false. Value of Used can be signal (signal pairs only are in use) or spare
(spare pairs only are in use).
PoE Power Class IEEE 802.3 Extensions Power via MDI TLV. Displayed only when a port
has PoE capabilities. Indicates the power class supplied by the port. Value
can range from 0 to 4.

8-18 Discovery Protocol Configuration

 show lldp port remote-info

Table 8-4 show lldp port local-info Output Details (Continued)

Output Field What it Displays...
PoE Power Limit (mW) LLDP-MED Extensions Extended Power via MDI TLV. Displayed only
when a port has PoE capabilities. Indicates the total power the port is
capable of sourcing over a maximum length cable, based on its current
configuration, in milli-Watts.
PoE Power Priority LLDP-MED Extensions Extended Power via MDI TLV. Displayed only
when a port has PoE capabilities. Indicates the power priority configured
on the port. Value can be critical, high, or low.

show lldp port remote-info

Use this command to display the remote system information stored for a remote device connected
to a local port. You can use this information to detect misconfigurations or incompatibilities
between the local port and the attached endpoint device (remote port).

Syntax
show lldp port remote-info [port-string]

Parameters
port-string (Optional) Displays remote system information for one or a range of
ports.

Defaults
If port-string is not specified, remote system information will be displayed for all ports.

Mode
Switch command, read-only.

Example
This example shows how to display the remote system information stored for port fe.3.1. The
remote system information was received from an IP phone, which is an LLDP-MED-enabled
device. Table 8-5 describes the output fields that are unique to the remote system information
displayed for a MED-enabled device.
A4(ro)->show lldp port remote-info fe.3.1
Local Port : fe.3.1 Remote Port Id : 00-09-6e-0e-14-3d
---------------------
Mgmt Addr : 0.0.0.0
Chassis ID : 0.0.0.0
Device Type : Communication Device Endpoint (class III)
Sys Name : AVE0E143D
Sys Cap Supported/Enabled : bridge,telephone/bridge

Auto-Neg Supported/Enabled : yes/yes

Auto-Neg Advertised : 10BASE-T, 10BASE-TFD
: 100BASE-TX, 100BASE-TXFD
: pause, Spause
Operational Speed/Duplex/Type : 100/full/TX
Network Policy
(app/tag/vlanId/cos/dscp) : voice/untagged/0/6/46

Extreme A4 CLI Reference 8-19

show lldp port network-policy

Hardware Revision : 4610D01A

Firmware Revision : b10d01b2_7.bin
Software Revision : a10d01b2_7.bin
Serial Number : 05GM42004348
Manufacturer : Avaya
Model Number : 4610
Note that the information fields displayed by the show lldp port remote-info command will vary,
depending on the type of remote device that is connected to the port.
Table 8-5 describes the output fields that are unique to the remote system information database.
Refer to Table 8-4 on page 17 for descriptions of the information fields that are common to both the
local and the remote system information databases.

Table 8-5 show lldp port remote-info Output Display

Output Field What it Displays...
Remote Port Id Displays whatever port Id information received in the LLDPDU from the remote
device. In this case, the port Id is MAC address of remote device.
Device Type Mandatory LLDP-MED Capabilities TLV. Displayed only when the port is
connected to an LLDP-MED-capable endpoint device.
Hardware Revision LLDP-MED Extensions Inventory Management TLV component.
Firmware Revision LLDP-MED Extensions Inventory Management TLV component.
Software Revision LLDP-MED Extensions Inventory Management TLV component.
Serial Number LLDP-MED Extensions Inventory Management TLV component.
Manufacturer LLDP-MED Extensions Inventory Management TLV component.
Model Number LLDP-MED Extensions Inventory Management TLV component.
Asset ID LLDP-MED Extensions Inventory Management TLV component. In the above
example, no asset ID was received from the remote device so the field is not
displayed.

show lldp port network-policy

Use this command to display LLDP port network policy configuration information. Network
policy information is configured using the set lldp port network-policy command.

Syntax
show lldp port network-policy {all | voice | voice-signaling | guest-voice | guest-
voice-signaling | softphone-voice | video-conferencing | streaming-video | video-
signaling} [port-string]

Parameters
all Displays information about all network policy applications.
voice Displays information about only the voice application type.
voice-signaling Displays information about only the voice signaling application
type.
guest-voice Displays information about only the guest voice application type.
guest-voice-signaling Displays information about only the guest voice signaling
application type.

8-20 Discovery Protocol Configuration

 set lldp tx-interval

softphone-voice Displays information about only the softphone voice application

type.
video-conferencing Displays information about only the video conferencing
application type.
streaming-video Displays information about only the streaming video application
type.
video-signaling Displays information about only the video signaling application
type.
port-string (Optional) Displays information about LLDP network policy for
one or a range of ports.

Defaults
If port-string is not specified, only non-default values will be displayed for all ports that have non-
default values configured.
If a port-string is specified, then all values, default and non-default, are displayed for the specified
ports.

Mode
Switch command, read-only.

Example
This example shows how to display all LLDP network policy information for fe.1.1.
A4(ro)->show lldp port network-policy all fe.1.1

Ports Application State Tag Vlan-Id Cos Dscp

------- --------------------- -------- -------- ------- --- ---
fe.1.1 voice enabled untagged 1 0 0
voice signaling enabled untagged 1 0 0
guest voice enabled untagged 1 0 0
guest voice signaling enabled untagged 1 0 0
softphone voice enabled untagged 1 0 0
video conferencing enabled untagged 1 0 0
streaming video enabled untagged 1 0 0
video signaling enabled untagged 1 0 0

set lldp tx-interval

Use this command to set the time, in seconds, between successive LLDP frame transmissions
initiated by changes in the LLDP local system information.

Syntax
set lldp tx-interval frequency

Parameters
frequency Specifies the number of seconds between transmissions of LLDP
frames. Value can range from 5 to 32,768 seconds. The default is 30
seconds.

Extreme A4 CLI Reference 8-21

set lldp hold-multiplier

Defaults
None.

Mode
Switch command, read-write.

Example
This example sets the transmit interval to 20 seconds.
A4(rw)->set lldp tx-interval 20

set lldp hold-multiplier

Use this command to set the time-to-live value used in LLDP frames sent by this device. The time-
to-live for LLDPDU data is calculated by multiplying the transmit interval by the hold multiplier
value.

Syntax
set lldp hold-multiplier multiplier-val

Parameters
multiplier-val Specifies the multiplier to apply to the transmit interval to determine
the time-to-live value. Value can range from 2 to 10. Default value is 4.

Defaults
None.

Mode
Switch command, read-write.

Example
This example sets the transmit interval to 20 seconds and the hold multiplier to 5, which will
configure a time-to-live of 100 to be used in the TTL field in the LLDPDU header.
A4(rw)->set lldp tx-interval 20
A4(rw)->set lldp hold-multiplier 5

set lldp trap-interval

Use this command to set the minimum interval between LLDP notifications sent by this device.
LLDP notifications are sent when a remote system change has been detected.

Syntax
set lldp trap-interval frequency

Parameters
frequency Specifies the minimum time between LLDP trap transmissions, in
seconds. The value can range from 5 to 3600 seconds. The default
value is 5 seconds.

8-22 Discovery Protocol Configuration

 set lldp med-fast-repeat

Defaults
None.

Mode
Switch command, read-write.

Example
This example sets the minimum interval between LLDP traps to 10 seconds.
A4(rw)->set lldp trap-interval 10

set lldp med-fast-repeat

Network connectivity devices transmit only LLDP TLVs in LLDPDUs until they detect that an
LLDP-MED endpoint device has connected to a port. At that point, the network connectivity
device starts sending LLDP-MED TLVs at a fast start rate on that port. Use this command to set the
number of successive LLDPDUs (with LLDP-MED TLVs) to be sent for one complete fast start
interval.

Syntax
set lldp med-fast-repeat count

Parameters
count Specifies the number of fast start LLDPDUs to be sent when an
LLDP-MED endpoint device is detected. Value can range from 1 to
10. Default is 3.

Defaults
None.

Mode
Switch command, read-write.

Example
This example sets the number of fast start LLDPDUs to be sent to 4.
A4(rw)->set lldp med-fast-repeat 4

set lldp port status

Use this command to enable or disable transmitting and processing received LLDPDUs on a port
or range of ports.

Syntax
set lldp port status {tx-enable | rx-enable | both | disable} port-string

Parameters
tx-enable Enables transmitting LLDPDUs on the specified ports.

Extreme A4 CLI Reference 8-23

set lldp port trap

rx-enable Enables receiving and processing LLDPDUs from remote systems on

the specified ports.
both Enables both transmitting and processing received LLDPDUs on the
specified ports.
disable Disables both transmitting and processing received LLDPDUs on the
specified ports.
port-string Specifies the port or range of ports to be affected.

Defaults
None.

Mode
Switch command, read-write.

Example
This example enables both transmitting LLDPDUs and receiving and processing LLDPDUs from
remote systems on ports fe.1.1 through fe.1.6.
A4(rw)->set lldp port status both fe.1.1-6

set lldp port trap

Use this command to enable or disable sending LLDP notifications (traps) when a remote system
change is detected.

Syntax
set lldp port trap {enable | disable} port-string

Parameters
enable Enable transmitting LLDP traps on the specified ports.
disable Disable transmitting LLDP traps on the specified ports.
port-string Specifies the port or range of ports to be affected.

Defaults
None.

Mode
Switch command, read-write.

Example
This example enables transmitting LLDP traps on ports fe.1.1 through fe.1.6.
A4(rw)->set lldp port trap enable fe.1.1-6

8-24 Discovery Protocol Configuration

 set lldp port med-trap

set lldp port med-trap

Use this command to enable or disable sending an LLDP-MED notification when a change in the
topology has been sensed on the port (that is, a remote endpoint device has been attached or
removed from the port).

Syntax
set lldp port med-trap {enable | disable} port-string

Parameters
enable Enables transmitting LLDP-MED traps on the specified ports.
disable Disables transmitting LLDP-MED traps on the specified ports.
port-string Specifies the port or range of ports to be affected.

Defaults
None.

Mode
Switch command, read-write.

Example
This example enables transmitting LLDP-MED traps on ports fe.1.1 through fe.1.6.
A4(rw)->set lldp port med-trap enable fe.1.1-6

set lldp port location-info

Use this command to configure LLDP-MED location information on a port or range of ports.
Currently, only Emergency Call Services (ECS) Emergency Location Identification Number (ELIN)
is supported.

Syntax
set lldp port location-info elin elin-string port-string

Parameters
elin Specifies that the ECS ELIN data format is to be used.
elin-string Specifies the location identifier. Value can be from 10 to 25 numerical
characters.
port-string Specifies the port or range of ports to be affected.

Defaults
None.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 8-25

set lldp port tx-tlv

Example
After you configure a location information value, you must also configure the port to send the
Location Information TLV with the set lldp port tx-tlv command. This example configures the
ELIN identifier 5551234567 on ports fe.1.1 through fe.1.6 and then configures the ports to send the
Location Information TLV.
A4(rw)->set lldp port location-info 5551234567 fe.1.1-6
A4(rw)->set lldp port tx-tlv med-loc fe.1.1-6

set lldp port tx-tlv

Use this command to select the optional LLDP and LLDP-MED TLVs to be transmitted in
LLDPDUs by the specified port or ports. Use the show lldp port local-info command to display
the values of these TLVs for the port.

Syntax
set lldp port tx-tlv {[all] | [port-desc] [sys-name] [sys-desc] [sys-cap] [mgmt-
addr] [vlan-id] [stp] [lacp] [gvrp] [mac-phy] [poe] [link-aggr] [max-frame] [med-
cap] [med-pol] [med-loc] [med-poe]} port-string

Parameters
all Adds all optional TLVs to transmitted LLDPDUs.
port-desc Port Description optional basic LLDP TLV. Value sent is ifDescr object
defined in RFC 2863.
sys-name System Name optional basic LLDP TLV. Value sent is the
administratively assigned name for the system.
sys-desc System Description optional basic LLDP TLV. Value sent is sysDescr
object defined in RFC 3418.
sys-cap System Capabilities optional basic LLDP TLV. For a network
connectivity device, value sent can be bridge and/or router.
mgmt-addr Management Address optional basic LLDP TLV. Value sent is IPv4
address of host interface.
vlan-id Port VLAN ID IEEE 802.1 Extensions TLV. Value sent is port VLAN
ID (PVID).
stp Spanning Tree information defined by Protocol Identity IEEE 802.1
Extensions TLV. If STP is enabled on the port, value sent includes
version of protocol being used.
lacp LACP information defined by Protocol Identity IEEE 802.1
Extensions TLV. If LACP is enabled on the port, value sent includes
version of protocol being used.
gvrp GVRP information defined by Protocol Identity IEEE 802.1
Extensions TLV. If LACP is enabled on the port, value sent includes
version of protocol being used.
mac-phy MAC-PHY Configuration/Status IEEE 802.3 Extensions TLV. Value
sent includes the operational MAU type, duplex, and speed of the
port.
poe Power via MDI IEEE 802.3 Extensions TLV. Values sent include
whether pair selection can be controlled on port, and the power class
supplied by the port. Only valid for PoE-enabled ports.

8-26 Discovery Protocol Configuration

 set lldp port network-policy

link-aggr Link Aggregation IEEE 802.3 Extensions TLV. Values sent indicate
whether the link associated with this port can be aggregated,
whether it is currently aggregated, and if aggregated, the aggregated
port identifier.
max-frame Maximum Frame Size IEEE 802.3 Extensions TLV. Value sent
indicates maximum frame size of the port’s MAC and PHY.
med-cap LLDP-MED Capabilities TLV.Value sent indicates the capabilities
(whether the device supports location information, network policy,
extended power via MDI) and Device Type (network connectivity
device) of the sending device.
med-pol LLDP-MED Network Policy TLV. Values sent include application
name, VLAN type (tagged or untagged), VLAN ID, and both Layer 2
and Layer 3 priorities associated with application, for all applications
enabled on the port. See the set lldp port network-policy command
for more information.
med-loc LLDP-MED Location Identification TLV. Value sent is the ECS ELIN
value configured on the port. See the set lldp port location-info
command for more information.
med-poe LLDP-MED Extended Power via MDI TLV. Values sent include the
Power Limit (total power the port is capable of sourcing over a
maximum length cable) and the power priority configured on the
port. Only valid for PoE-enabled ports.
port-string Specifies the port or range of ports to be affected.

Defaults
None.

Mode
Switch command, read-write.

Example
This example configures the management address, MED capability, MED network policy, and
MED location identification TLVs to be sent in LLDPDUs by port fe.1.1.
A4(rw)->set lldp port tx-tlv mgmt-addr med-cap med-pol med-loc fe.1.1

set lldp port network-policy

Use this command to configure LLDP network policies for a set of applications on a port or range
of ports. The policies configured with this command are sent in LLDPDUs as LLDP-MED
Network Policy TLVs. Multiple Network Policy TLVs can be sent in a single LLDPDU.

Syntax
set lldp port network-policy {all | voice | voice-signaling | guest-voice |
guest-voice-signaling | softphone-voice | video-conferencing | streaming-video |
video-signaling} [state {enable | disable}] [tag {tagged | untagged}]
[vid {vlan-id | dot1p}] [cos cos-value] [dscp dscp-value] port-string

Parameters
all Configures all applications.

Extreme A4 CLI Reference 8-27

set lldp port network-policy

voice Configures the voice application.

voice-signaling Configures the voice signaling application.
This application will not be advertised if the voice application is
configured with the same parameters.
guest-voice Configures the guest voice application.
guest-voice-signaling Configures the guest voice signaling application.
This application will not be advertised if the guest-voice
application is configured with the same parameters.
softphone-voice Configures the softphone voice application.
video-conferencing Configures the video conferencing application.
streaming-video Configures the streaming video application.
video-signaling Configures the video signaling application.
This application will not be advertised if the video-conferencing
application is configured with the same parameters.
state enable | disable (Optional) Enables or disables advertising the application
information being configured.
tag tagged | untagged (Optional) Indicates whether the application being configured is
using a tagged or untagged VLAN. If untagged, both the VLAN ID
and the CoS priority fields are ignored and only the DSCP value
has relevance.
vid vlan-id | dot1p (Optional) VLAN identifier for the port. The value of vlan-id can
range from 1 to 4093.
Use dot1p if the device is using priority tagged frames, meaning
that only the IEEE 802.1D priority level is significant and the
default PVID of the ingress port is used.
cos cos-value (Optional) Specifies the Layer 2 priority to be used for the
application being configured. The value can range from 0 to 7. A
value of 0 represents use of the default priority as defined in IEEE
802.1D.
dscp dscp-value (Optional) Specifies the DSCP value to be used to provide Diffserv
node behavior for the application being configured. The value can
range from 0 to 63. A value of 0 represents use of the default DSCP
value as defined in RFC 2475.
port-string Specifies the port or range of ports to be affected.

Defaults
None.

Mode
Switch command, read-write.

Usage
This feature allows administrators to quickly provision LLDP end-points via the switch. LLDP
clients will use these LLDP network policy parameters for traffic originating from the end-point.

8-28 Discovery Protocol Configuration

 clear lldp

As described in the ANSI/TIA Standards document 1057, the Network Policy TLV is “intended for
use with applications that have specific real-time network policy requirements, such as interactive
voice and/or video services” and should be implemented only on direct links between network
connectivity devices and endpoint devices. Refer to the ANSI/TIA Standards document 1057 for
descriptions of the application types.
After you configure Network Policy TLVs, you must also configure the port to send the Network
Policy TLV with the set lldp port tx-tlv command.

Example
This example configures the voice application TLV on port fe.2.1 and then configures the port to
send the Network Policy TLV.
A4(rw)->set lldp port network-policy voice state enable tag tagged vlan dot1p
fe.2.1
A4(rw)->set lldp port tx-tlv med-pol fe.2.1

clear lldp
Use this command to return LLDP parameters to their default values.

Syntax
clear lldp {all | tx-interval | hold-multiplier | trap-interval | med-fast-repeat}

Parameters
all Returns all LLDP configuration parameters to their default values,
including port LLDP configuration parameters.
tx-interval Returns the number of seconds between transmissions of LLDP
frames.to the default of 30 seconds.
hold-multiplier Returns the multiplier to apply to the transmit interval to determine
the time-to-live value to the default value of 4.
trap-interval Returns the minimum time between LLSP trap transmissions to the
default value of 5 seconds.
med-fast-repeat Returns the number of fast start LLDPDUs to be sent when an LLDP-
MED endpoint device is detected to the default of 3.

Defaults
None.

Mode
Switch command, read-write.

Example
This example returns the transmit interval to the default value of 30 seconds.
A4(rw)->clear lldp tx-interval

Extreme A4 CLI Reference 8-29

clear lldp port status

clear lldp port status

Use this command to return the port status to the default value of both (both transmitting and
processing received LLDPDUs are enabled).

Syntax
clear lldp port status port-string

Parameters
port-string Specifies the port or range of ports to be affected.

Defaults
None.

Mode
Switch command, read-write.

Example
This example returns port fe.1.1 to the default state of enabled for both transmitting and
processing received LLDPDUs.
A4(rw)->clear lldp port status fe.1.1

clear lldp port trap

Use this command to return the port LLDP trap setting to the default value of disabled.

Syntax
clear lldp port trap port-string

Parameters
port-string Specifies the port or range of ports to be affected.

Defaults
None.

Mode
Switch command, read-write.

Example
This example returns port fe.1.1 to the default LLDP trap state of disabled.
A4(rw)->clear lldp port trap fe.1.1

8-30 Discovery Protocol Configuration

 clear lldp port med-trap

clear lldp port med-trap

Use this command to return the port LLDP-MED trap setting to the default value of disabled.

Syntax
clear lldp port med-trap port-string

Parameters
port-string Specifies the port or range of ports to be affected.

Defaults
None.

Mode
Switch command, read-write.

Example
This example returns port fe.1.1 to the default LLDP-MED trap state of disabled.
A4(rw)->clear lldp port med-trap fe.1.1

clear lldp port location-info

Use this command to return the port ECS ELIN location setting to the default value of null.

Syntax
clear lldp port location-info elin port-string

Parameters
elin Specifies that the ECS ELIN location information value should be
cleared.
port-string Specifies the port or range of ports to be affected.

Defaults
None.

Mode
Switch command, read-write.

Example
This example returns the location information ELIN value on port fe.1.1 to the default value of
null.
A4(rw)->clear lldp port location-info elin fe.1.1

Extreme A4 CLI Reference 8-31

clear lldp port network-policy

clear lldp port network-policy

Use this command to return LLDP network policy for a set of applications on a port or range of
ports to default values.

Syntax
clear lldp port network-policy {all | voice | voice-signaling | guest-voice |
guest-voice-signaling | softphone-voice | video-conferencing | streaming-video |
video-signaling} {[state] [tag] [vid] [cos] [dscp]} port-string

Parameters
all Applies command to all applications.
voice Applies command to the voice application.
voice-signaling Applies command to the voice signaling application.
guest-voice Applies command to the guest voice application.
guest-voice-signaling Applies command to the guest voice signaling application.
softphone-voice Applies command to the softphone voice application.
video-conferencing Applies command to the video conferencing application.
streaming-video Applies command to the streaming video application.
video-signaling Applies command to the video signaling application.
state (Optional) Clears the state of advertising the application
information being configured to disabled.
tag (Optional) Clears the tag value of the application being configured
to untagged.
vid (Optional) Clears the VLAN identifier for the port to the default
value of 1.
cos (Optional) Clears the Layer 2 priority to be used for the application
being configured to the default value of 0. (A value of 0 represents
use of the default priority as defined in IEEE 802.1D.)
dscp (Optional) Clears the DSCP value to be used to provide Diffserv
node behavior for the application being configured to the default
value of 0. (A value of 0 represents use of the default DSCP value
as defined in RFC 2475.)
port-string Specifies the port or range of ports to be affected.

Defaults
At least one application (or all) and one policy parameter must be specified.

Mode
Switch command, read-write.

Example
This example returns all network policy values for all applications on port fe.1.1 to their default
values.
A4(rw)->clear lldp port network-policy all state tag vid cos dscp fe.1.1

8-32 Discovery Protocol Configuration

 clear lldp port tx-tlv

clear lldp port tx-tlv

Use this command to clear the optional LLDP and LLDP-MED TLVs to be transmitted in
LLDPDUs by the specified port or ports to the default value of disabled.

Syntax
clear lldp port tx-tlv {[all] | [port-desc] [sys-name] [sys-desc] [sys-cap] [mgmt-
addr] [vlan-id] [stp] [lacp] [gvrp] [mac-phy] [poe] [link-aggr] [max-frame] [med-
cap] [med-pol] [med-loc] [med-poe]} port-string

Parameters
all Disables all optional TLVs from being transmitted in LLDPDUs.
port-desc Disables the Port Description optional basic LLDP TLV from being
transmitted in LLDPDUs.
sys-name Disables the System Name optional basic LLDP TLV from being
transmitted in LLDPDUs.
sys-desc Disables the System Description optional basic LLDP TLV from being
transmitted in LLDPDUs.
sys-cap Disables the System Capabilities optional basic LLDP TLV from
being transmitted in LLDPDUs.
mgmt-addr Disables the Management Address optional basic LLDP TLV from
being transmitted in LLDPDUs.
vlan-id Disables the Port VLAN ID IEEE 802.1 Extensions TLV from being
transmitted in LLDPDUs.
stp Disables the Spanning Tree information defined by Protocol Identity
IEEE 802.1 Extensions TLV from being transmitted in LLDPDUs.
lacp Disables the LACP information defined by Protocol Identity IEEE
802.1 Extensions TLV from being transmitted in LLDPDUs.
gvrp Disables the GVRP information defined by Protocol Identity IEEE
802.1 Extensions TLV from being transmitted in LLDPDUs.
mac-phy Disables the MAC-PHY Configuration/Status IEEE 802.3 Extensions
TLV from being transmitted in LLDPDUs.
poe Disables the Power via MDI IEEE 802.3 Extensions TLV from being
transmitted in LLDPDUs. Only valid for PoE-enabled ports.
link-aggr Disables the Link Aggregation IEEE 802.3 Extensions TLV from being
transmitted in LLDPDUs.
max-frame Disables the Maximum Frame Size IEEE 802.3 Extensions TLV from
being transmitted in LLDPDUs.
med-cap Disables the LLDP-MED Capabilities TLV from being transmitted in
LLDPDUs.
med-pol Disables the LLDP-MED Network Policy TLV from being transmitted
in LLDPDUs.
med-loc Disables the LLDP-MED Location Identification TLV from being
transmitted in LLDPDUs.
med-poe Disables the LLDP-MED Extended Power via MDI TLV from being
transmitted in LLDPDUs. Only valid for PoE-enabled ports.

Extreme A4 CLI Reference 8-33

clear lldp port tx-tlv

port-string Specifies the port or range of ports to be affected.

Defaults
None.

Mode
Switch command, read-write.

Example
This example disables the management address, MED capability, MED network policy, and MED
location identification TLVs from being sent in LLDPDUs by port fe.1.1.
A4(rw)->clear lldp port tx-tlv mgmt-addr med-cap med-pol med-loc fe.1.1

8-34 Discovery Protocol Configuration

 9
Port Configuration

This chapter describes the Port Configuration set of commands and how to use them. Refer to
Chapter 8, “Port Configuration,” in the Fixed Switching Configuration Guide for configuration
procedures and other information.

For information about... Refer to page...

Reviewing Port Status 9-1

Disabling / Enabling and Naming Ports 9-6

Setting Speed and Duplex Mode 9-9

Enabling / Disabling Jumbo Frame Support 9-12

Setting Auto-Negotiation and Advertised Ability 9-14

Setting Flow Control 9-19

Setting Port Link Traps and Link Flap Detection 9-20

Configuring Broadcast Suppression 9-30

Port Mirroring 9-33

Link Aggregation Control Protocol (LACP) 9-35

Configuring Protected Ports 9-48

Reviewing Port Status

Use the following commands to display operating status, duplex mode, speed, port type, and
statistical information about traffic received and transmitted through one or all switch ports on the
device.

For information about... Refer to page...

show port 9-2

show port status 9-2

show port counters 9-3

clear port counters 9-5

show port cablestatus 9-5

Extreme A4 CLI Reference 9-1

show port

show port
Use this command to display whether or not one or more ports are enabled for switching.

Syntax
show port [port-string]

Parameters
port-string (Optional) Displays operational status for specific port(s).

Defaults
If port-string is not specified, operational status information for all ports will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display operational status information for fe.3.14:
A4(su)->show port fe.3.14
Port fe.3.14 enabled

show port status

Use this command to display operating and admin status, speed, duplex mode and port type for
one or more ports on the device.

Syntax
show port status [port-string]

Parameters
port-string (Optional) Displays status for specific port(s).

Defaults
If port-string is not specified, status information for all ports will be displayed.

Mode
Switch command, read-only.

Usage
The front panel Stacking Ports will only be displayed with the show port status command when
they are in Ethernet mode. For information on configuring front panel stack ports refer to Chapter
2, “Configuring Switches in a Stack,” in the Fixed Switching Configuration Guide.

Example
This example shows how to display status information for fe.1.1 and fe.1.2:
A4(su)->show port status fe.1.1-2

9-2 Port Configuration

 show port counters

Alias Oper Admin Speed

Port (truncated) Status Status (bps) Duplex Type
--------- ------------ ------- ------- --------- ------- ------------
fe.1.47 Down Up N/A N/A RJ45
fe.1.48 Up Up 1.0G full RJ45

Table 9-1 provides an explanation of the command output.

Table 9-1 show port status Output Details

Output Field What It Displays...
Port Port designation.
Alias (truncated) Alias configured for the port. For details on using the set port alias command, refer
to “set port alias” on page 9-8.
Oper Status Operating status (up or down).
Admin Status Whether the specified port is enabled (up) or disabled (down). For details on using
the set port disable command to change the default port status of enabled, refer to
“set port disable” on page 9-7. For details on using the set port enable command to
re-enable ports, refer to “set port enable” on page 9-7.
Speed Operational speed in Mbps or Kbps of the specified port. For details on using the set
port speed command to change defaults, refer to “set port speed” on page 9-9.
Duplex Duplex mode (half or full) of the specified port. For details on using the set port
duplex command to change defaults, refer to “Setting Auto-Negotiation and
Advertised Ability” on page 9-14.
Type Physical port and interface type.

show port counters

Use this command to display port counter statistics detailing traffic through the device and
through all MIB2 network devices.

Syntax
show port counters [port-string] [switch | mib2]

Parameters
port-string (Optional) Displays counter statistics for specific port(s).
switch | mib2 (Optional) Displays switch or MIB2 statistics. Switch statistics detail
performance of the A4 device. MIB2 interface statistics detail performance
of all network devices.

Defaults
If port-string is not specified, counter statistics will be displayed for all ports.
If mib2 or switch are not specified, all counter statistics will be displayed for the specified port(s).

Mode
Switch command, read-only.

Extreme A4 CLI Reference 9-3

show port counters

Examples
This example shows how to display all counter statistics, including MIB2 network traffic and
traffic through the device for fe.3.1:
A4(su)->show port counters fe.3.1

Port: fe.3.1 MIB2 Interface: 1

No counter discontinuity time
-----------------------------------------------------------------

MIB2 Interface Counters

-----------------------
In Octets 0
In Unicast Pkts 0
In Multicast Pkts 0
In Broadcast Pkts 0
In Discards 0
In Errors 0
Out Octets 0
Out Unicasts Pkts 0
Out Multicast Pkts 0
Out Broadcast Pkts 0
Out Errors 0

802.1Q Switch Counters

----------------------
Frames Received 0
Frames Transmitted 0

This example shows how to display all fe.3.1 port counter statistics related to traffic through the
device.
A4(su)->show port counters fe.3.1 switch

Port: fe.3.1 Bridge Port: 2

802.1Q Switch Counters

-----------------------
Frames Received 0
Frames Transmitted 0
Table 9-2 provides an explanation of the command output.

Table 9-2 show port counters Output Details

Output Field What It Displays...
Port Port designation.
MIB2 Interface MIB2 interface designation.
Bridge Port IEEE 802.1D bridge port designation.
MIB2 Interface MIB2 network traffic counts
Counters
802.1Q Switch Counts of frames received, transmitted, and filtered.
Counters

9-4 Port Configuration

 clear port counters

clear port counters

Use this command to clear port counter statistics for a port or range of ports.

Syntax
clear port counters [port-string]

Parameters
port-string (Optional) Specifies the port or range of ports to clear port counter
statistics.

Defaults
If no port-string is specified, port counters are cleared for all ports.

Mode
Switch command, read-write

Example
This example clears the port counters for fe.3.1.
A4(rw)->clear port counters fe.3.1

show port cablestatus

Use this command to troubleshoot and locate faults in copper cable connections on a per port
basis. This command is only available on switch platforms that provide 1 Gigabit Ethernet RJ45
ports.

Syntax
show port cablestatus [port-string]

Parameters
port-string (Optional) Specifies the port or ports to show status for.

Defaults
If no port is specified, information about all ports will be displayed.

Mode
Switch command, read-only.

Usage
For 1 Gigabit Ethernet RJ45 ports only, this command will display the status of the port’s cable
connection (described in Table 9-3 below), and the approximate length of the cable attached to the
port. If your switch platform does not support 1 GE RJ45 ports, this command will not be
available.
If no cable is attached to the port, the status will be “Open” and no length will be shown. If the
port is not a 1GE RJ45 port, the command will return a status of “Not Supported.”

Extreme A4 CLI Reference 9-5

Disabling / Enabling and Naming Ports

Since running the cable diagnostics may momentarily interrupt packet flow, a warning message is
displayed and you are prompted to continue.

Example
This example shows the cable status for port fe.1.1.
A4(su)->show port cablestatus fe.1.1
Warning: port(s) will be offline momentarily.
Do you want to continue (y/n) [n]?y

Port Status Length

--------- --------- -------
fe.1.1 Normal 3(m)-5(m)
Table 9-3 provides an explanation of the command output.

Table 9-3 show port cablestatus Output Details

Output... What it displays...

Port Lists the port designation.

Status Indicates the status of the port. The value is one of the following:
Normal = normal
Open = no cable attached to port
Short = detection of an inter-pair short
Fail = unknown error or crosstalk
Detach = indicates ports on stack units that are no longer present,
but were previously connected
Not Supported = ports other than 1GE RJ45 ports

Length Indicates the approximate length of the cable attached to the port.

Disabling / Enabling and Naming Ports

Use the following commands to disable and re-enable one or more ports, and to assign an alias to
a port. By default, all ports are enabled at device startup. You may want to disable ports for
security or to troubleshoot network issues. Ports may also be assigned an alias for convenience.

For information about... Refer to page...

set port disable 9-7

set port enable 9-7

show port alias 9-8

set port alias 9-8

9-6 Port Configuration

 set port disable

set port disable

Use this command to administratively disable one or more ports. When this command is
executed, in addition to disabling the physical Ethernet link, the port will no longer learn entries
in the forwarding database.

Syntax
set port disable port-string

Parameters
port-string Specifies the port(s) to disable.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to disable fe.1.1:
A4(su)->set port disable fe.1.1

set port enable

Use this command to administratively enable one or more ports.

Syntax
set port enable port-string

Parameters
port-string Specifies the port(s) to enable.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to enable fe.1.3:
A4(su)->set port enable fe.1.3

Extreme A4 CLI Reference 9-7

show port alias

show port alias

Use this command to display the alias name for one or more ports.

Syntax
show port alias [port-string]

Parameters
port-string (Optional) Displays alias name(s) for specific port(s).

Defaults
If port-string is not specified, aliases for all ports will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display alias information for ports 1-3 on unit 3:
A4(rw)->show port alias fe.3.1-3
Port fe.3.1 user
Port fe.3.2 user
Port fe.3.3 Admin

set port alias

Use this command to assign an alias name to a port.

Syntax
set port alias port-string [name]

Parameters
port-string Specifies the port to which an alias will be assigned.
name (Optional) Assigns an alias name to the port. If the alias name contains
spaces, the text string must be surrounded by double quotes. Maximum
length is 60 characters.

Defaults
If name is not specified, the alias assigned to the port will be cleared.

Mode
Switch command, read-write.

Examples
This example shows how to assign the alias “Admin” to fe.3.3:
A4(rw)->set port alias fe.3.3 Admin
This example shows how to clear the alias for fe.3.3:

9-8 Port Configuration

 Setting Speed and Duplex Mode

A4(rw)->set port alias fe.3.3

Setting Speed and Duplex Mode

Use the following commands to review and set the operational speed in Mbps and the default
duplex mode: Half, for half duplex, or Full, for full duplex for one or more ports.

Note: These settings only take effect on ports that have auto-negotiation disabled.

For information about... Refer to page...

show port speed 9-9

set port speed 9-9

show port duplex 9-10

set port duplex 9-14

show port speed

Use this command to display the default speed setting on one or more ports.

Syntax
show port speed [port-string]

Parameters
port-string (Optional) Displays default speed setting(s) for specific port(s).

Defaults
If port-string is not specified, default speed settings for all ports will display.

Mode
Switch command, read-only.

Example
This example shows how to display the default speed setting for Ethernet port 14 in unit 3:
A4(su)->show port speed fe.3.14
default speed is 10 on port fe.3.14.

set port speed

Use this command to set the default speed of one or more ports. This setting only takes effect on
ports that have auto-negotiation disabled.

Syntax
set port speed port-string {10 | 100 | 1000}

Extreme A4 CLI Reference 9-9

show port duplex

Parameters
port-string Specifies the port(s) for which to a speed value will be set.
10 | 100 | 1000 Specifies the port speed. Valid values are: 10 Mbps, 100 Mbps, or
1000 Mbps.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set fe.3.3 to a port speed of 10 Mbps:
A4(su)->set port speed fe.3.3 10

show port duplex

Use this command to display the default duplex setting (half or full) for one or more ports.

Syntax
show port duplex [port-string]

Parameters
port-string (Optional) Displays default duplex setting(s) for specific port(s).

Defaults
If port-string is not specified, default duplex settings for all ports will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display the default duplex setting for Ethernet port 14 in unit 3:
A4(su)->show port duplex fe.3.14
default duplex mode is full on port fe.3.14.

set port duplex

Use this command to set the default duplex type for one or more ports. This command will only
take effect on ports that have auto-negotiation disabled.

Syntax
set port duplex port-string {full | half}

9-10 Port Configuration

 set port duplex

Parameters
port-string Specifies the port(s) for which duplex type will be set.
full | half Sets the port(s) to full-duplex or half-duplex operation.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set fe.1.17 to full duplex:
A4(su)->set port duplex fe.1.17 full

Extreme A4 CLI Reference 9-11

Enabling / Disabling Jumbo Frame Support

Enabling / Disabling Jumbo Frame Support

Use the following commands to review, enable, and disable jumbo frame support on one or more
ports. This allows Gigabit Ethernet ports to transmit frames up to 10 KB in size. LAG ports can
also be configured for jumbo frame support.

For information about... Refer to page...

show port jumbo 9-12

set port jumbo 9-12

clear port jumbo 9-13

show port jumbo

Use this command to display the status of jumbo frame support and maximum transmission units
(MTU) on one or more ports.

Syntax
show port jumbo [port-string]

Parameters
port-string (Optional) Displays the status of jumbo frame support for specific
port(s).

Defaults
If port-string is not specified, jumbo frame support status for all ports will display.

Mode
Switch command, read-only.

Example
This example shows how to display the status of jumbo frame support for fe.1.1:
A4(su)->show port jumbo fe.1.1

Port Number Jumbo Status Max Frame Size

------------- --------------- ------------------
fe.1.1 Enable 9216

set port jumbo

Use this command to enable or disable jumbo frame support on one or more ports.

Syntax
set port jumbo {enable | disable}[port-string]

9-12 Port Configuration

 clear port jumbo

Parameters
enable | disable Enables or disables jumbo frame support.
port-string (Optional) Specifies the port(s) on which to disable or enable jumbo
frame support.

Defaults
If port-string is not specified, jumbo frame support will be enabled or disabled on all ports.

Mode
Switch command, read-write.

Example
This example shows how to enable jumbo frame support for Ethernet port 14 in unit 3:
A4(su)->set port jumbo enable fe.3.14

clear port jumbo

Use this command to reset jumbo frame support status to enabled on one or more ports.

Syntax
clear port jumbo [port-string]

Parameters
port-string (Optional) Specifies the port(s) on which to reset jumbo frame
support status to enabled.

Defaults
If port-string is not specified, jumbo frame support status will be reset on all ports.

Mode
Switch command, read-write.

Example
This example shows how to reset jumbo frame support status for Ethernet port 14 in unit 3:
A4(su)->clear port jumbo fe.3.14

Extreme A4 CLI Reference 9-13

Setting Auto-Negotiation and Advertised Ability

Setting Auto-Negotiation and Advertised Ability

Use the following commands to review, disable or enable auto-negotiation, and to configure port
advertisement for speed and duplex.

Note: Advertised ability can be activated only on ports that have auto-negotiation enabled.

For information about... Refer to page...

show port negotiation 9-14

set port negotiation 9-14

show port advertise 9-15

set port advertise 9-16

clear port advertise 9-16

show port mdix 9-17

set port mdix 9-18

show port negotiation

Use this command to display the status of auto-negotiation for one or more ports.

Syntax
show port negotiation [port-string]

Parameters
port-string (Optional) Displays auto-negotiation status for specific port(s).

Defaults
If port-string is not specified, auto-negotiation status for all ports will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display auto-negotiation status for Ethernet port 14 in unit 3:
A4(su)->show port negotiation fe.3.14
auto-negotiation is enabled on port fe.3.14.

set port negotiation

Use this command to enable or disable auto-negotiation on one or more ports.

Syntax
set port negotiation port-string {enable | disable}

9-14 Port Configuration

 show port advertise

Parameters
port-string Specifies the port(s) for which to enable or disable auto-negotiation.
enable | disable Enables or disables auto-negotiation.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to disable auto-negotiation on Ethernet port 3 in unit 14:
A4(su)->set port negotiation fe.3.14 disable

show port advertise

Use this command to display port capability and advertisement as far as speed and duplex for
auto-negotiation.

Syntax
show port advertise [port-string]

Parameters
port-string (Optional) Displays advertised ability for specific port(s).

Defaults
If port-string is not specified, advertisement for all ports will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display advertisement status for ports 13 and 14:
A4(su)->show port advertise fe.1.13-14
fe.1.13 capability advertised remote
-------------------------------------------------
10BASE-T yes yes yes
10BASE-TFD yes yes yes
100BASE-TX yes yes yes
100BASE-TXFD yes yes yes
1000BASE-T no no no
1000BASE-TFD yes yes yes
pause yes yes no

fe.1.14 capability advertised remote

-------------------------------------------------
10BASE-T yes yes yes
10BASE-TFD yes yes yes

Extreme A4 CLI Reference 9-15

set port advertise

100BASE-TX yes yes yes

100BASE-TXFD yes yes yes
1000BASE-T no no no
1000BASE-TFD yes yes yes
pause yes yes no

set port advertise

Use this command to configure what a port will advertise for speed/duplex capabilities in auto-
negotiation.

Syntax
set port advertise {port-string}{10t | 10tfd | 100tx | 100txfd | 1000t | 1000tfd
| pause}

Parameters
port-string Select the ports for which to configure advertisements.
10t Advertise 10BASE-T half duplex mode.
10tfd Advertise 10BASE-T full duplex mode.
100tx Advertise 100BASE-TX half duplex mode.
100txfd Advertise 100BASE-TX full duplex mode.
1000t Advertise 1000BASE-T half duplex mode.
1000tfd Advertise 1000BASE-T full duplex mode.
pause Advertise PAUSE for full-duplex links.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to configure port 1 to advertise 1000BASE-T full duplex:
A4(su)->set port advertise fe.1.1 1000tfd

clear port advertise

Use this command to configure a port to not advertise a specific speed/duplex capability when
auto-negotiating with another port.

Syntax
clear port advertise {port-string}{10t | 10tfd | 100tx | 100txfd | 1000t | 1000tfd
| pause}

9-16 Port Configuration

 show port mdix

Parameters
port-string Clear advertisements for specific port(s).
10t Do not advertise 10BASE-T half duplex mode.
10tfd Do not advertise 10BASE-T full duplex mode.
100tx Do not advertise 100BASE-TX half duplex mode.
100txfd Do not advertise 100BASE-TX full duplex mode.
1000t Do not advertise 1000BASE-T half duplex mode.
1000tfd Do not advertise 1000BASE-T full duplex mode.
pause Do not advertise PAUSE for full-duplex links.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to configure port 1 to not advertise 10 MB capability for auto-
negotiation:
A4(su)->clear port advertise fe.1.1 10t 10tfd

show port mdix

Use this command to display the status of cable connection type configuration mode for one or
more ports. Switch ports can automatically detect and configure the required cable type, either
straight through (MDI) or cross-over (MDIX), or the ports can be configured to only allow one
type of cable type, either MDI or MDIX.

Syntax
show port mdix {all|auto|forced-auto|mdi|mdix} [port-string]

Parameters
all Display information about all ports.
auto Display information about the ports configured to automatically
determine the required MDI/MDIX mode.
forced-auto Display information about the ports forced automatically to determine
the required MDI/MDIX mode.
mdi Display information about the ports configured with MDI only mode.
mdix Display information about the ports configured with MDIX only mode.
port-string (Optional) Display the selected MDI/MDIX mode only for the port or
ports specified.

Defaults
If port-string is not specified, information is displayed for all ports.

Extreme A4 CLI Reference 9-17

set port mdix

Mode
Switch command, read-only.

Example
This example displays information about ports configured for MDIX only mode.
A4(su)->show port mdix mdix

Port Number MDIX Mode

------------- ------------------
fe.1.27 MDIX
fe.1.28 MDIX

set port mdix

Use this command to configure cable connection type configuration mode for one or more ports.

Syntax
set port mdix {auto|forced-auto|mdi|mdix} [port-string]

Parameters
auto Configure ports to automatically determine the required MDI/MDIX
mode. This is the default condition.
forced-auto Force ports to automatically determine the required MDI/MDIX mode.
mdi Configure ports to use MDI mode only.
mdix Configure ports to use MDIX mode only.
port-string (Optional) Specify the port or ports to configure.

Defaults
If port-string is not entered, all ports on the switch are configured.

Mode
Switch command, read-write.

Usage
By default, Extreme switch devices are configured to automatically detect the cable type
connection, straight through (MDI) or cross-over (MDIX), required by the cable connected to the
port. You can configure ports to only use MDI or MDIX connections with this command.
This command only configures Ethernet ports, and cannot be used to configure combo ports on
the switch. Fiber ports always have a status of MDIX.

Example
This example configures ports fe.1.1 and fe.1.2 to use MDIX mode.
A4(su)->set port mdix mdix fe.1.1-2

9-18 Port Configuration

 Setting Flow Control

Setting Flow Control

Use the following commands to review, enable or disable port flow control. Flow control is used to
manage the transmission between two devices as specified by IEEE 802.3x to prevent receiving
ports from being overwhelmed by frames from transmitting devices.

For information about... Refer to page...

show flowcontrol 9-19

set flowcontrol 9-19

show flowcontrol
Use this command to display the flow control state.

Syntax
show flowcontrol

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the port flow control state:
A4(su)->show flowcontrol
Flow control status: enabled

set flowcontrol
Use this command to enable or disable flow control.

Syntax
set flowcontrol {enable | disable}

Parameters
enable | disable Enables or disables flow control settings.

Defaults
None.

Extreme A4 CLI Reference 9-19

Setting Port Link Traps and Link Flap Detection

Mode
Switch command, read-write.

Example
This example shows how to enable flow control:
A4(su)->set flowcontrol enable

Setting Port Link Traps and Link Flap Detection

Use the following commands to disable or re-enable link traps, display link trap status, and to
configure the link flapping detection function. By default, all ports are enabled to send SNMP trap
messages indicating changes to their link status (up or down).
See Chapter 8, “Port Configuration,” in the Fixed Switching Configuration Guide for more
information.

For information about... Refer to page...

show port trap 9-20

set port trap 9-21

show linkflap 9-21

set linkflap globalstate 9-24

set linkflap portstate 9-24

set linkflap interval 9-25

set linkflap action 9-25

clear linkflap action 9-26

set linkflap threshold 9-27

set linkflap downtime 9-27

clear linkflap down 9-28

clear linkflap 9-28

show newaddrtrap 9-29

set newaddrtrap 9-29

show port trap

Use this command to display whether the port is enabled for generating an SNMP trap message if
its link state changes.

Syntax
show port trap [port-string]

Parameters
port-string (Optional) Displays link trap status for specific port(s).

9-20 Port Configuration

 set port trap

Defaults
If port-string is not specified, the trap status for all ports will be displayed.

Mode
Switch command, read-write.

Example
This example shows how to display link trap status for fe.3.1 through 4:
A4(su)->show port trap fe.3.1-4
Link traps enabled on port fe.3.1.
Link traps enabled on port fe.3.2.
Link traps enabled on port fe.3.3.
Link traps enabled on port fe.3.4.

set port trap

Use this command to enable of disable ports for sending SNMP trap messages when their link
status changes.

Syntax
set port trap port-string {enable | disable}

Parameters
port-string Specifies the port(s) for which to enable or disable port traps.
enable | disable Enables or disables sending trap messages when link status changes.

Defaults
Sending traps when link status changes is enabled by default.

Mode
Switch command, read-write.

Example
The following example disables sending trap on fe.3.1.
A4(su)->set port trap fe.3.1 disable

show linkflap
Use this command to display link flap detection state and configuration information.

Syntax
show linkflap {globalstate | portstate | parameters | metrics | portsupported |
actsupported | maximum | downports | action | operstatus | threshold | interval |
downtime | currentcount | totalcount | timelapsed | violations [port-string]}

Extreme A4 CLI Reference 9-21

show linkflap

Parameters
globalstate Displays the global enable state of link flap detection.
portstate Displays the port enable state of link flap detection.
parameters Displays the current value of settable link flap detection parameters.
metrics Displays linkflap detection metrics.
portsupported Displays ports which can support the link flap detection function.
actsupported Displays link flap detection actions supported by system hardware.
maximum Displays the maximum allowed linkdowns per 10 seconds supported
by system hardware.
downports Displays ports disabled by link flap detection due to a violation.
action Displays linkflap actions taken on violating port(s).
operstatus Displays whether linkflap has deactivated port(s).
threshold Displays the number of allowed link down transitions before action is
taken.
interval Displays the time period for counting link down transitions.
downtime Displays how long violating port(s) are deactivated.
currentcount Displays how many linkdown transitions are in the current interval.
totalcount Displays how many linkdown transitions have occurred since the last
reset.
timelapsed Displays the time period since the last link down event or reset.
violations Displays the number of link flap violations since the last reset.
port-string (Optional) Displays information for specific port(s).

Defaults
• If not specified, information about all link flap detection settings will be displayed.
• If port-string is not specified, information for all ports will be displayed.

Mode
Switch mode, read-only.

Usage
The linkflap default conditions are shown in the following table.

Linkflap Parameter Default Condition

Linkflap global state Disabled

Linkflap port state Disabled

Linkflap action None

Linkflap interval 5

Linkflap maximum allowed link downs per 10 seconds 20

Linkflap threshold 10
(number of allowed link down transitions before action is taken)

9-22 Port Configuration

 show linkflap

Linkflap Parameter Default Condition

Linkflap downtime 300 seconds

Examples
This example shows how to display the global status of the link trap detection function:
A4(rw)->show linkflap globalstate
Linkflap feature globally disabled
This example shows how to display ports disabled by link flap detection due to a violation:
A4(rw)->show linkflap downports
Ports currently held DOWN for Linkflap violations:
None.
This example shows how to display the link flap parameters table:
A4(rw)->show linkflap parameters
Linkflap Port Settable Parameter Table (X means error occurred)
Port LF Status Actions Threshold Interval Downtime
-------- --------- ------- ---------- ---------- ----------
fe.1.1 disabled ....... 10 5 300
fe.1.2 enabled D..S..T 3 5 300
fe.1.3 disabled ...S..T 10 5 300
Table 9-4 provides an explanation of the show linkflap parameters command output.

Table 9-4 show linkflap parameters Output Details

Output... What it displays...

Port Port designation.

LF Status Link flap enabled state.

Actions Actions to be taken if the port violates allowed link flap behavior.
D = disabled, S = Syslog entry will be generated, T= SNMP trap
will be generated.

Threshold Number of link down transitions necessary to trigger the link flap
action.

Interval Time interval (in seconds) for accumulating link down transitions.

Downtime Interval (in seconds) port(s) will be held down after a link flap
violation.

This example shows how to display the link flap metrics table:
A4(rw)->show linkflap metrics
Port LinkStatus CurrentCount TotalCount TimeElapsed Violations
-------- ----------- ------------ ---------- ----------- -------------
fe.1.1 operational 0 0 241437 0
fe.1.2 disabled 4 15 147 5
fe.1.3 operational 3 3 241402 0
Table 9-5 provides an explanation of the show linkflap metrics command output.

Extreme A4 CLI Reference 9-23

set linkflap globalstate

Table 9-5 show linkflap metrics Output Details

Output... What it displays...

Port Port designation.

LinkStatus Link status according to the link flap function.

CurrentCount Link down count accruing toward the link flap threshold.

TotalCount Number of link downs since system start,

TimeElapsed Time (in seconds) since the last link down event.

Violations Number of link flap violations on listed ports since system start.

set linkflap globalstate

Use this command to globally enable or disable the link flap detection function.

Syntax
set linkflap globalstate {disable | enable}

Parameters
disable | enable Globally disables or enables the link flap detection function.

Defaults
By default, the function is disabled globally and on all ports.

Mode
Switch mode, read-write.

Usage
By default, the function is disabled globally and on all ports. If disabled globally after per-port
settings have been configured using the linkflap commands, per-port settings will be retained.

Example
This example shows how to globally enable the link trap detection function.
A4(rw)->set linkflap globalstate enable

set linkflap portstate

Use this command to enable or disable link flap monitoring on one or more ports.

Syntax
set linkflap portstate {disable | enable} [port-string]

9-24 Port Configuration

 set linkflap interval

Parameters
disable | enable Disables or enables the link flap detection function.
port-string (Optional) Specifies the port or ports on which to disable or enable
monitoring.

Defaults
If port-string is not specified, all ports are enabled or disabled.

Mode
Switch command, read-write.

Example
This example shows how to enable the link trap monitoring on all ports.
A4(rw)->set linkflap portstate enable

set linkflap interval

Use this command to set the time interval (in seconds) for accumulating link down transitions.

Syntax
set linkflap interval port-string interval-value

Parameters
port-string Specifies the port(s) on which to set the link flap interval.
interval-value Specifies an interval in seconds. A value of 0 will set the interval to
forever.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the link flap interval on port fe.1.4 to 1000 seconds.
A4(rw)->set linkflap interval fe.1.4 1000

set linkflap action

Use this command to set reactions to a link flap violation.

Syntax
set linkflap action port-string {disableInterface | gensyslogentry | gentrap |
all}

Extreme A4 CLI Reference 9-25

clear linkflap action

Parameters
port-string Specifies the port(s) on which to set the link flap action.
disableInterface Sets the reaction as disabling the interface.
gensyslogentry Sets the reaction as generating a syslog entry.
gentrap Sets the reaction as generating an SNMP trap.
all Sets the reaction as all of the above.

Defaults
None.

Mode
Switch mode, read-write.

Example
This example shows how to set the link flap violation action on port fe.1.4 to generating a Syslog
entry.
A4(rw)->set linkflap action fe.1.4 gensyslogentry

clear linkflap action

Use this command to clear reactions to a link flap violation.

Syntax
clear linkflap action port-string {disableInterface | gensyslogentry | gentrap |
all}

Parameters
port-string Specifies the port(s) on which to clear the link flap action.
disableInterface Clears the reaction as disabling the interface.
gensyslogentry Clears the reaction as generating a syslog entry.
gentrap Clears the reaction as generating an SNMP trap.
all Clears the reaction as all of the above.

Defaults
If port-string is not specified, actions will be cleared on all ports.

Mode
Switch mode, read-write.

Example
This example shows how to clear the link flap violation action on port fe.1.4 to generating a Syslog
entry.
A4(rw)->clear linkflap action fe.1.4 gensyslogentry

9-26 Port Configuration

 set linkflap threshold

set linkflap threshold

Use this command to set the link flap action trigger count.

Syntax
set linkflap threshold port-string threshold-value

Parameters
port-string Specifies the port(s) on which to set the link flap action trigger count.
threshold-value Specifies the number of link down transitions necessary to trigger the
link flap action. A minimum of 1 must be configured.

Defaults
None.

Mode
Switch mode, read-write.

Example
This example shows how to set the link flap threshold on port fe.1.4 to 5.
A4(rw)->set linkflap threshold fe.1.4 5

set linkflap downtime

Use this command to set the time interval (in seconds) one or more ports will be held down after a
link flap violation.

Syntax
set linkflap downtime port-string downtime-value

Parameters
port-string Specifies the port(s) on which to set the link flap downtime.
downtime-value Specifies a downtime in seconds. A value of 0 will set the downtime to
forever.

Defaults
None.

Mode
Switch mode, read-write.

Example
This example shows how to set the link flap downtime on port fe.1.4 to 5000 seconds.
A4(rw)->set linkflap downtime fe.1.4 5000

Extreme A4 CLI Reference 9-27

clear linkflap down

clear linkflap down

Use this command to toggle link flap disabled ports to operational.

Syntax
clear linkflap down [port-string]

Parameters
port-string (Optional) Specifies the ports to make operational.

Defaults
If port-string is not specified, all ports disabled by a link flap violation will be made operational.

Mode
Switch mode, read-write.

Example
This example shows how to make disabled port fe.1.4 operational.
A4(rw)->clear linkflap down fe.1.4

clear linkflap
Use this command to clear all link flap options and / or statistics on one or more ports.

Syntax
clear linkflap {all | stats [port-string] | parameter port-string {threshold |
interval | downtime | all}

Parameters
all | stats Clears all options and statistics, or clears only statistics.
parameter Clears link flap parameters.
threshold | interval | Clears link flap threshold, interval, downtime or all parameters.
downtime | all
port-string (Optional unless parameter is specified) Specifies the port(s) on which
to clear settings.

Defaults
If port-string is not specified, settings and/or statistics will be cleared on all ports.

Mode
Switch mode, read-write.

Example
This example shows how to clear all link flap options on port fe.1.4.
A4(rw)->clear linkflap all fe.1.4

9-28 Port Configuration

 show newaddrtrap

show newaddrtrap
Use this command to display the global and port-specific status of the new MAC addresses trap
function.

Syntax
show newaddrtrap [port-string]

Parameters
port-string (Optional) Displays the status of the new MAC addresses trap function
on specific ports.

Defaults
If port-string is not specified, the status of the new MAC addresses trap function will be displayed
for all ports.

Mode
Switch command, read-only.

Usage
By default, this function is disabled globally and per port.

Example
This example displays the New Address Trap state for ports 1 through 5 in unit/slot 1.
A4(ro)->show newaddrtrap fe.1.1-5
New Address Traps Globally disabled

Port Enable State

--------- ------------
fe.1.1 disabled
fe.1.2 disabled
fe.1.3 disabled
fe.1.4 disabled
fe.1.5 disabled

set newaddrtrap
Use this command to enable or disable trap messaging, globally or on one or more ports, when
new source MAC addresses are detected.

Syntax
set newaddrtrap [port-string] {enable | disable}

Extreme A4 CLI Reference 9-29

Configuring Broadcast Suppression

Parameters
port-string (Optional) Enable or disable the new MAC addresses trap function on
specific ports.
enable | disable Enable or disable the new MAC addresses trap function. If entered
without the port-string parameter, enables or disables the function
globally. When entered with the port-string parameter, enables or
disables the function on specific ports.

Defaults
If port-string is not specified, the trap function is set globally.

Mode
Switch mode, read-write.

Usage
This command enables and disables sending SNMP trap messages when a new source MAC
address is detected by a port. If the port is a CDP port, however, traps for new source MAC
addresses will not be sent.
The default mode is disabled globally and per port.

Example
This example enables the trap function globally and then on ports 1 through 5 in unit/slot 1.
A4(rw)->set newaddrtrap enable
A4(rw)->set newaddrtrap fe.1.1-5 enable

Configuring Broadcast Suppression

Use the following commands to review and set the broadcast suppression threshold for one or
more ports. This feature limits the number of received broadcast frames the switch will accept per
port. Broadcast suppression thresholds apply only to broadcast traffic—multicast traffic is not
affected. By default, a broadcast suppression threshold of 14881 packets per second (pps) will be
used, regardless of actual port speed. Broadcast suppression protects against broadcast storms
and ARP sweeps.

For information about... Refer to page...

show port broadcast 9-30

set port broadcast 9-31

clear port broadcast 9-32

show port broadcast

Use this command to display port broadcast suppression thresholds.

Syntax
show port broadcast [port-string]

9-30 Port Configuration

 set port broadcast

Parameters
port-string (Optional) Select the ports for which to show broadcast suppression
thresholds.

Defaults
If port-string is not specified, broadcast status of all ports will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display the broadcast suppression thresholds for ports 1 through 4:
A4(su)->show port broadcast fe.1.1-4
Port Total BC Threshold
Packets (pkts/s)
----------------------------------------
fe.1.1 0 50
fe.1.2 0 50
fe.1.3 0 40
fe.1.4 0 14881

set port broadcast

Use this command to set the broadcast suppression threshold, in packets per second, on one or
more ports. This sets a threshold on the broadcast traffic that is received and switched out to other
ports.

Syntax
set port broadcast port-string threshold-val

Parameters
port-string Select the ports for which to configure broadcast suppression thresholds.
threshold-val Sets the packets per second threshold on broadcast traffic. Maximum
value is
• 148810 for Fast Ethernet ports
• 1488100 for 1-Gigabit ports.
• 14881000 for 10- Gigabit ports

Defaults
None.

Mode
Switch command, read-write.

Usage
Per port broadcast suppression is hardset to be globally enabled on the A4. If you would like to
disable broadcast suppression, you can get the same result by setting the threshold limit for each
port to the maximum number of packets which can be received per second as listed in the

Extreme A4 CLI Reference 9-31

clear port broadcast

parameters section, above. The default broadcast suppression threshold for all ports is set to
14881.

Example
This example configures ports 1 through 5 with a broadcast limit of 50 pps:
A4(su)->set port broadcast fe.1.1-5 50

clear port broadcast

Use this command to clear the broadcast threshold limit to the default value of 14881 for the
selected port.

Syntax
clear port broadcast port-string threshold

Parameters
port-string Select the ports for which to clear broadcast suppression thresholds.

Defaults
None.

Mode
Switch command, read-write.

Example
This example clears the broadcast threshold limit to 14881 pps for ports 1 through 5:
A4(su)->clear port broadcast fe.1.1-5 threshold

9-32 Port Configuration

 Port Mirroring

Port Mirroring
Caution: Port mirroring configuration should be performed only by personnel who are
knowledgeable about the effects of port mirroring and its impact on network operation.

The A4 device allows you to mirror (or redirect) the traffic being switched on a port for the
purposes of network traffic analysis and connection assurance. When port mirroring is enabled,
one port becomes a monitor port for another port within the device (the stack, if applicable).
Refer to Chapter 8, “Port Configuration,” in the Fixed Switching Configuration Guide for more
information about port mirroring.

For information about... Refer to page...

show port mirroring 9-33

set port mirroring 9-34

clear port mirroring 9-34

show port mirroring

Use this command to display the source and target ports for mirroring, and whether mirroring is
currently enabled or disabled for those ports.

Syntax
show port mirroring

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display port mirroring information. In this case, fe.1.4 is configured as
a source port and fe.1.11 is a target and mirroring has been enabled between these ports:
A4(su)->show port mirroring

Port Mirroring
==============
Source Port = fe.1.4
Target Port = fe.1.11
Frames Mirrored = Rx and Tx
Port Mirroring status enabled.

Extreme A4 CLI Reference 9-33

set port mirroring

set port mirroring

Use this command to create a new mirroring relationship or to enable or disable an existing
mirroring relationship between two ports.

Notes: When a port mirror is created, the mirror destination port is removed from VLAN 1’s egress
list after a reboot.

Syntax
set port mirroring {create | disable | enable} source destination}

Parameters
create | disable | Creates, disables or enables mirroring settings on the specified ports. By
enable default, port mirrors are enabled automatically when created.
source Specifies the source port designation. This is the port on which the traffic
will be monitored. Up to 8 source ports can be specified.
destination Specifies the target port designation. This is the port that will duplicate or
“mirror” all the traffic on the monitored port. Only one destination port
can be configured per stack, if applicable.

Defaults
Port mirrors are automatically enabled when created on this platform.

Mode
Switch command, read-write.

Usage
LAG ports, as described in “Link Aggregation Control Protocol (LACP)” on page 9-35, can be
mirror source ports. However, if a LAG port is configured as the source port, no other ports can be
added as source ports for that mirror.

Examples
This example shows how to create and enable port mirroring with fe.1.4 as the source port, and
fe.1.11 as the target port:
A4(su)->set port mirroring create fe.1.4 fe.1.11
This example enables a mirror that was previously disabled.
A4(su)->set port mirroring enable fe.1.4 fe.1.11

clear port mirroring

Use this command to clear a port mirroring relationship.

Syntax
clear port mirroring source destination

9-34 Port Configuration

 Link Aggregation Control Protocol (LACP)

Parameters
source Specifies the source ports (up to 8 ports) of the mirroring configuration to
be cleared.
destination Specifies the target port of the mirroring configuration to be cleared.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear a port mirroring relationship between source port fe.1.4 and
target port fe.1.11:
A4(su)->clear port mirroring fe.1.4 fe.1.11

Link Aggregation Control Protocol (LACP)

Caution: Link aggregation configuration should only be performed by personnel who are
knowledgeable about Spanning Tree and Link Aggregation, and fully understand the ramifications
of modifications beyond device defaults. Otherwise, the proper operation of the network could be
at risk.

Use the following commands to configure LACP.

For information about... Refer to page...

show lacp 9-36

set lacp 9-37

set lacp asyspri 9-38

set lacp aadminkey 9-38

clear lacp 9-39

set lacp static 9-39

clear lacp static 9-40

set lacp singleportlag 9-41

clear lacp singleportlag 9-40

show port lacp 9-42

set port lacp 9-43

clear port lacp 9-45

set lacp groups 9-46

clear lacp groups 9-47

show lacp groups 9-48

Extreme A4 CLI Reference 9-35

show lacp

show lacp
Use this command to display information about one or more aggregator ports.

Syntax
show lacp [port-string]

Parameters
port-string (Optional) Displays LACP information for specific LAG port(s).
Valid port designations are lag.0.1 – 24 depending on the number of LAG
groups configured.

Defaults
If port-string is not specified, link aggregation information for all LAGs will be displayed.

Mode
Switch command, read-only.

Usage
Each A4 switch provides 6, 12, or 24 virtual link aggregator ports, which are designated in the CLI
as lag.0.1 through lag.0.24, depending on how many LAG groups have been configured. See “set
lacp groups” on page 9-46.
Once underlying physical ports (that is, fe.x.x) are associated with an aggregator port, the
resulting aggregation will be represented as one Link Aggregation Group (LAG) with a lag.0.x
port designation.

Example
This example shows how to display lacp information for lag.0.1. The following table describes the
output fields.
A4(su)->show lacp lag.0.1
Global Link Aggregation state: enabled
Single Port LAGs: disabled

Aggregator: lag.0.1
Actor Partner
System Identifier: 00:01:F4:5F:1E:20 00:11:88:11:74:F9
System Priority: 32768 32768
Admin Key: 65535
Oper Key: 65535 101
Attached Ports: fe.1.1
fe.1.3
Table 9-6 provides an explanation of the command output.

Table 9-6 show lacp Output Details

Output Field What It Displays...
Global Link Shows if LACP is globally enabled or disabled on the switch.
Aggregation state
Single Port LAGs Displays if the single port LAG feature has been enabled on the switch. See “set lacp
singleportlag” on page 9-41 for more about single port LAG.

9-36 Port Configuration

 set lacp

Table 9-6 show lacp Output Details (Continued)

Output Field What It Displays...
Aggregator LAG port designation. Each A4 module provides 6, 12, or 24 virtual link aggregator
ports, which are designated in the CLI as lag.0.1 through lag.0.24. Once underlying
physical ports (for example, fe.x.x) are associated with an aggregator port, the
resulting Link Aggregation Group (LAG) is represented with a lag.0.x port
designation.
Actor Local device participating in LACP negotiation.
Partner Remote device participating in LACP negotiation.
System Identifier MAC addresses for actor and partner.
System Priority System priority value which determines aggregation precedence. Only one LACP
system priority can be set on a A4 device, using either the set lacp asyspri
command (page 9-38), or the set port lacp command (page 9-43).
Admin Key Port’s assigned key. A4 devices provide a default admin key value of 32768 for all
LAG ports (lag.0.x).
Oper Key Port’s operational key, derived from the admin key. Only underlying physical ports
with oper keys matching the aggregator’s will be allowed to aggregate.
Attached Ports Underlying physical ports associated with this aggregator.

set lacp
Use this command to disable or enable the Link Aggregation Control Protocol (LACP) globally on
the device.

Syntax
set lacp {disable | enable}

Parameters
disable | enable Disables or enables LACP.

Defaults
By default, the global LACP state is enabled, enabled per port.

Mode
Switch command, read-write.

Usage
This command configures the global state of LACP on the switch. Use the command “set port
lacp” on page 9-43 to enable/disable LACP per port.

Example
This example shows how to disable LACP globally:
A4(su)->set lacp disable

Extreme A4 CLI Reference 9-37

set lacp asyspri

set lacp asyspri

Use this command to set the LACP system priority to be used in creating a LAG (Link
Aggregation Group) ID.

Syntax
set lacp asyspri value

Parameters
value Specifies a system priority value. Valid values are 0 to 65535, with
precedence given to lower values. The default system priority is 32768.

Defaults
None.

Mode
Switch command, read-write.

Usage
LACP uses this value to determine aggregation precedence. If there are two partner devices
competing for the same aggregator, LACP compares the LAG IDs for each grouping of ports. The
LAG with the lower LAG ID is given precedence and will be allowed to use the aggregator.

Example
This example shows how to set the LACP system priority to 1000:
A4(su)->set lacp asyspri 1000

set lacp aadminkey

Use this command to set the administratively assigned key for one or more aggregator ports.

Syntax
set lacp aadminkey port-string value

Parameters
port-string Specifies the LAG port(s) on which to assign an admin key.
value Specifies an admin key value to set. Valid values are 0 to 65535. The
default admin key value is 32768.

Defaults
None.

Mode
Switch command, read-write.

9-38 Port Configuration

 clear lacp

Usage
LACP will use this value to form an oper key. Only underlying physical ports with oper keys
matching those of their aggregators will be allowed to aggregate. The default admin key value for
all LAG ports is 32768.

Example
This example shows how to set the LACP admin key to 2000 for LAG port 6:
A4(su)->set lacp aadminkey lag.0.6 2000

clear lacp
Use this command to clear LACP system priority or admin key settings.

Syntax
clear lacp {[asyspri] [aadminkey port-string]}

Parameters
asyspri Clears system priority.
aadminkey port-string Resets admin keys for one or more ports to the default value of 32768.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the actor admin key for LAG port 6:
A4(su)->clear lacp aadminkey lag.0.6

set lacp static

Use this command to assign one or more underlying physical ports to a Link Aggregation Group
(LAG).

Syntax
set lacp static lagportstring [key key] [port-string]

Parameters
lagportstring Specifies the LAG aggregator port to which new ports will be assigned.

Extreme A4 CLI Reference 9-39

clear lacp static

key key (Optional) Specifies the new member port and LAG port aggregator
admin key value. Only ports with matching keys are allowed to
aggregate. Valid values are 0 - 65535.
Note: This key value must be unique. If ports other than the desired underlying
physical ports share the same admin key value, aggregation will fail or undesired
aggregations will form.
port-string (Optional) Specifies the physical port(s) to add to the LAG.

Defaults
If not specified, a key will be assigned according to the specified aggregator. For example a key of 4
would be assigned to lag.0.4.

Mode
Switch command, read-write.

Examples
This example shows how to add port fe.1.6 to the LAG of aggregator port 6:
A4(su)->set lacp static lag.0.6 fe.1.6

Issuing :
set lacp static lag.0.6
set lacp aadminkey lag.0.6 6
set port lacp port fe.1.1 aadminkey 6
set port lacp port fe.1.1 disable
This example sets the aggregator admin key to the default (1) for lag.0.1.
A4(su)->set lacp static lag.0.1

Issuing :
set lacp static lag.0.1
set lacp aadminkey lag.0.1 1

clear lacp static

Use this command to remove specific ports from a Link Aggregation Group.

Syntax
clear lacp static lagportstring port-string

Parameters
lagportstring Specifies the LAG aggregator port from which physical ports will be
removed.
port-string Specifies the port(s) to remove from the LAG.

Defaults
None.

Mode
Switch command, read-write.

9-40 Port Configuration

 set lacp singleportlag

Example
This example shows how to remove fe.1.6 from the LAG of aggregator port 6:
A4(su)->clear lacp static lag.0.6 fe.1.6

set lacp singleportlag

Use this command to enable or disable the formation of single port LAGs.

Syntax
set lacp singleportlag {enable | disable}

Parameters
disable | enable Enables or disables the formation of single port LAGs.

Defaults
None.

Mode
Switch command, read-write.

Usage
When single port LAGs are enabled, Link Aggregration Groups can be formed when only one
port is receiving protocol transmissions from a partner. When this setting is disabled, two or more
ports are required to form a LAG.
This setting has no effect on existing LAGs created with multiple member ports. It also does not
prevent previously formed LAGs from coming up after they have gone down, as long as any
previous LAG member ports come up connected to the same switch as before the LAG went
down.

Example
This example enables the formation of single port LAGs:
A4(su)->set lacp singleportlag enable

clear lacp singleportlag

Use this command to reset the single port LAG function back to the default state of disabled.

Syntax
clear lacp singleportlag

Parameters
None.

Defaults
None.

Extreme A4 CLI Reference 9-41

show port lacp

Mode
Switch command, read-write.

Example
This example shows how to reset the single port LAG function back to disabled:
A4(su)->clear lacp singleportlag

show port lacp

Use this command to display link aggregation information for one or more underlying physical
ports.

Syntax
show port lacp port port-string {[status {detail | summary}] | [counters]}

Parameters
port port-string Displays LACP information for specific port(s).
status detail | Displays LACP status in detailed or summary information.
summary
counters Displays LACP counter information.

Defaults
None.

Mode
Switch command, read-only.

Usage
State definitions, such as ActorAdminState and Partner AdminState, are indicated with letter
abbreviations. If the show port lacp command displays one or more of the following letters, it
means the state is true for the associated actor or partner ports:
• E = Expired
• F = Defaulted
• D = Distributing (tx enabled)
• C = Collecting (rx enabled)
• S = Synchronized (actor and partner agree)
• G = Aggregation allowed
• S/L = Short/Long LACP timeout
• A/p = Active/Passive LACP
For more information about these states, refer to set port lacp (page 9-43) and the IEEE 802.3 2002
specification.

9-42 Port Configuration

 set port lacp

Examples
This example shows how to display detailed LACP status information for port fe.1.1
A4(su)-> show port lacp port fe.1.1 status detail
Global Link Aggregation state : Disabled

Port Instance: ge.1.1 Port enable state: Disabled

ActorPort: 1 PartnerAdminPort: 1
ActorSystemPriority: 32768 PartnerOperPort: 1
ActorPortPriority: 32768 PartnerAdminSystemPriority: 32768
ActorAdminKey: 32768 PartnerOperSystemPriority: 32768
ActorOperKey: 32768 PartnerAdminPortPriority: 32768
ActorAdminState: -----GLA PartnerOperPortPriority: 32768
ActorOperState: -F---GLA PartnerAdminKey: 1
ActorSystemID: 00:1F:45:47:81:FC PartnerOperKey: 1
SelectedAggID: None PartnerAdminState: -----GSA
AttachedAggID: None PartnerOperState: ------SA
MuxState: Detached PartnerAdminSystemID: 00:00:00:00:00:00
DebugRxState: Portdisable PartnerOperSystemID: 00:00:00:00:00:00
This example shows how to display summarized LACP status information for port fe.1.12:
A4(su)->show port lacp port fe.1.12 status summary
Port Aggr Actor System Partner System
Pri: System ID: Key: Pri: System ID: Key:
fe.1.12 none [(32768,00e0639db587,32768),(32768,000000000000, 1411)]

This example shows how to display LACP counters for port fe.1.12:
A4(su)->show port lacp port fe.1.12 counters
Port Instance: fe.1.12
LACPDUsRx: 11067
LACPDUsTx: 0
IllegalRx: 0
UnknownRx: 0
MarkerPDUsRx: 0
MarkerPDUsTx: 0
MarkerResponsePDUsRx: 0
MarkerResponsePDUsTx: 374

set port lacp

Use this command to set link aggregation parameters for one or more ports. These settings will
determine the specified underlying physical ports’ ability to join a LAG, and their administrative
state once aggregated.

Syntax
set port lacp port port-string {[aadminkey aadminkey] [aadminstate {lacpactive |
lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire}]
[aportpri aportpri] [asyspri asyspri] [enable | [disable] [padminkey padminkey]
[padminport padminport] [padminportpri padminportpri] [padminstate {lacpactive |
lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef | lacpexpire}]
[padminsysid padminsysid] [padminsyspri padminsyspri]

Extreme A4 CLI Reference 9-43

set port lacp

Parameters
port port-string Specifies the physical port(s) on which to configure LACP.
aadminkey Sets the port’s actor admin key. LACP will use this value to form an oper
aadminkey key and will determine which underlying physical ports are capable of
aggregating by comparing oper keys. Aggregator ports allow only
underlying ports with oper keys matching theirs to join their LAG. Valid
values are 1 - 65535. The default key value is 32768.
aadminstate Sets the port’s actor LACP administrative state to allow for:
lacpactive |
lacpactive - Transmitting LACP PDUs.
lacptimeout |
lacpagg | lacptimeout - Transmitting LACP PDUs every 1 sec.\vs 30 sec. (default).
lacpsync |
lacpagg - Aggregation on this port.
lacpcollect |
lacpdist | lacpsync - Transition to synchronization state.
lacpdef |
lacpcollect - Transition to collection state.
lacpexpire
lacpdist - Transition to distribution state.
lacpdef - Transition to defaulted state.
lacpexpire - Transition to expired state.
aportpri aportpri Sets the port’s actor port priority. Valid values are 0 - 65535, with lower
values designating higher priority.
asyspri asyspri Sets the port’s actor system priority. The LACP implementation on the A4
device uses this value to determine aggregation precedence when there
are two devices competing for the same aggregator. Valid values are 0 -
65535, with higher precedence given to lower values.
Note: Only one LACP system priority can be set on a A4 device, using either this
command, or the set lacp asyspri command (“set lacp asyspri” on page 9-38).
enable (Optional) Enables LACPDU processing on this port. By default, LACP is
enabled on ports.
disable (Optional) Disables LACPDU processing on this port.
padminkey Sets a default value to use as the port’s partner admin key. Only ports with
padminkey matching admin keys are allowed to aggregate. Valid values are 1 - 65535.
padminport Sets a default value to use as the port’s partner admin value. Valid values
padminport are 1 - 65535.
padminportpri Sets a default value to use as the port’s partner port priority. Valid values
padminportpri are 0 - 65535, with lower values given higher priority.
padminstate Sets a port’s partner LACP administrative state. See aadminstate for valid
lacpactive | options.
lacptimeout |
lacpagg |
lacpsync |
lacpcollect |
lacpdist |
lacpdef |
lacpexpire

9-44 Port Configuration

 clear port lacp

padminsysid Sets a default value to use as the port’s partner system ID. This is a MAC
padminsysid address.
padminsyspri Sets a default value to use as the port’s partner priority. Valid values are 0
padminsyspri - 65535, with lower values given higher priority.

Defaults
At least one parameter must be entered per port-string.

Mode
Switch command, read-write.

Usage
LACP commands and parameters beginning with an “a” (such as aadminkey) set actor values.
Corresponding commands and parameters beginning with a “p” (such as padminkey) set
corresponding partner values. Actor refers to the local device participating in LACP negotiation,
while partner refers to its remote device partner at the other end of the negotiation. Actors and
partners maintain current status of the other via LACPDUs containing information about their
ports’ LACP status and operational state.

Example
This example shows how to set the actor admin key to 3555 for port fe.3.16and enable LACP on
the port:
A4(su)->set port lacp port fe.3.16 aadminkey 3555 enable

clear port lacp

Use this command to clear link aggregation settings for one or more ports.

Syntax
clear port lacp port port-string {[aadminkey] [aportpri] [asyspri] [aadminstate
{lacpactive | lacptimeout | lacpagg | lacpsync | lacpcollect | lacpdist | lacpdef
| lacpexpire | all}] [padminsyspri] [padminsysid] [padminkey] [padminportpri]
[padminport] [padminstate {lacpactive | lacptimeout | lacpagg | lacpsync |
lacpcollect | lacpdist | lacpdef | lacpexpire | all}]}

Parameters
port port-string Specifies the physical port(s) on which LACP settings will be cleared.
aadminkey Clears a port’s actor admin key.
aportpri Clears a port’s actor port priority.
asyspri Clears the port’s actor system priority.

Extreme A4 CLI Reference 9-45

set lacp groups

aadminstate Clears a port’s specific actor admin state, or all actor admin state(s). For
lacpactive | descriptions of specific states, refer to the set port lacp command (“set
lacptimeout | port lacp” on page 9-43).
lacpagg |
lacpsync |
lacpcollect |
lacpdist |
lacpdef |
lacpexpire |
all
padminsyspri Clears the port’s default partner priority value.
padminsysid Clears the port’s default partner system ID.
padminkey Clears the port’s default partner admin key.
padminportpri Clears the port’s default partner port priority.
padminport Deletes a partner port from the LACP configuration.
padminstate Clears the port’s specific partner admin state, or all partner admin state(s).
lacpactive |
lacptimeout |
lacpagg |
lacpsync |
lacpcollect |
lacpdist |
lacpdef |
lacpexpire |
all

Defaults
None.

Mode
Switch command, read-write.

Usage
If you set a port to LACP passive using the command clear port lacp port <port-string>
aadminstate lacpactive, the command clear port lacp port <port-string> aadminstate lacptimeout
will also be added to the configuration. If you unset the first command, it will remove the second
command automatically from the configuration file.

Example
This example shows how to clear all link aggregation parameters for port fe.3.16:
A4(su)->clear port lacp port fe.3.16

set lacp groups

Use this command to set the maximum number of LACP groups that will be supported on the
switch.

9-46 Port Configuration

 clear lacp groups

Syntax
set lacp groups number

Parameters
number Specifies the maximum number of Link Aggregation Groups (LAGs)
that will be supported. Valid values are 6, 12, and 24. The maximum
number of physical ports in a group is 8 ports for 6 groups, 4 ports for
12 groups, and 2 ports for 24 groups.

Defaults
The default maximum number of groups supported is 6.

Mode
Switch command, read-write.

Usage
The maximum number of physical ports that can be assigned to LAGs is 48 ports. If 6 groups are
configured, the maximum number of physical ports per LAG is 8. For 12 groups, the maximum
number of ports per LAG is 4, and for 24 groups, the maximum number of ports per LAG is 2.
Changing the group limit will result in a system reset and LACP configuration settings will be
returned to their default values, with the exception of the group limit.

Example
This example sets the number of LAG groups to 24.
A4(su)->set lacp groups 24
Changing group limits will result in a system reset and loss of LACP configuration.
Do you wish to proceed? (y/n)

clear lacp groups

Use this command to reset the maximum number of LACP groups to the default of 6.

Syntax
clear lacp groups

Parameters
None.

Defaults
The default maximum number of groups supported is 6.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 9-47

show lacp groups

Usage
If the number of LACP groups has been changed from the default, executing this command will
result in a system reset and LACP configuration settings will be returned to their default values,
including the group limit.

Example
This example resets the group limit to the default of 6.
A4(su)->clear lacp groups
Changing group limits will result in a system reset and loss of LACP configuration.
Do you wish to proceed? (y/n)

show lacp groups

Use this command to display the maximum number of LACP groups configured on the switch.

Syntax
show lacp groups

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows the number of configured LACP groups.
A4(su)->show lacp groups
LACP groups supported 6

Configuring Protected Ports

The Protected Port feature is used to prevent ports from forwarding traffic to each other, even
when they are on the same VLAN. Ports may be designated as either protected or unprotected.
Ports are unprotected by default. Multiple groups of protected ports are supported.
Refer to Chapter 8, “Port Configuration,” in the Fixed Switching Configuration Guide for more
information.

For information about... Refer to page...

set port protected 9-49

show port protected 9-49

clear port protected 9-50

set port protected name 9-50

9-48 Port Configuration

 set port protected

For information about... Refer to page...

show port protected name 9-51

clear port protected name 9-51

set port protected

Use this command to specify a port to be protected and assign the port to a group of protected
ports. A port can be assigned to only one group.

Syntax
set port protected port-string group-id

Parameters
port-string Specifies the port or ports to be protected.
group-id Specifies the id of the group to which the ports should be assigned. Id can
range from 0 to 2.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to assign ports fe.1.1 through fe.1.3 to protected port group 1:
A4(rw)->set port protected fe.1.1-3 1

show port protected

Use this command to display information about the ports configured for protected mode.

Syntax
show port protected [port-string] | [group-id]

Parameters
port-string (Optional) Specifies the port or ports for which to display information.
group-id (Optional) Specifies the id of the group for which to display information.
Id can range from 0 to 2.

Defaults
If no parameters are entered, information about all protected ports is displayed.

Mode
Read-only.

Extreme A4 CLI Reference 9-49

clear port protected

Example
This example shows how to display information about all protected ports:
A4(ro)->show port protected
Group id Port GroupName
-------------------------------------
1 fe.1.1 group1
1 fe.1.2 group1
1 fe.1.3 group1

clear port protected

Use this command to remove a port or group from protected mode.

Syntax
clear port protected [port-string] | [group-id]

Parameters
port-string (Optional) Specifies the port or ports to remove from protected mode.
group-id (Optional) Specifies the id of the group to remove from protected mode.
Id can range from 0 to 2.

Defaults
If no parameters are entered, all protected ports and groups are cleared.

Mode
Switch command, read-write.

Example
This example shows how to clear protected ports fe.1.1 through fe.1.3:
A4(rw)->clear port protected fe.1.1-3

set port protected name

Use this command to assign a name to a protected port group id.

Syntax
set port protected name group-id name

Parameters
group-id Specifies the id of this group. Id can range from 0 to 2.
name Specifies a name for the group. The name can be up to 32 characters in
length.

Defaults
None.

9-50 Port Configuration

 show port protected name

Mode
Switch command, read-write.

Example
This example shows how to assign the name “group1” to protected port group 1:
A4(rw)->set port protected name 1 group1

show port protected name

Use this command to display the name for the group ids specified.

Syntax
show port protected name group-id

Parameters
group-id Specifies the id of the group to display. Id can range from 0 to 2.

Defaults
None.

Mode
Read-only.

Example
This example shows how to show the name of protected port group 1:
A4(ro)->show port protected name 1
Group ID Group Name
-----------------------------
1 group1

clear port protected name

Use this command to clear the name of a protected group.

Syntax
clear port protected name group-id

Parameters
group-id Specifies the id of the group for which to clear the name. Id can range
from 0 to 2.

Defaults
None.

Extreme A4 CLI Reference 9-51

clear port protected name

Mode
Switch command, read-write.

Example
This example shows how to clear the name of protected port group 1:
A4(rw)->clear port protected name 1

9-52 Port Configuration

 10
SNMP Configuration

This chapter describes the Simple Network Management Protocol (SNMP) set of commands and
how to use them.
Refer to Chapter 12, “Configuring SNMP,” in the Fixed Switching Configuration Guide for
configuration procedures and more information.

For information about... Refer to page...

Reviewing SNMP Statistics 10-1

Configuring SNMP Users, Groups, and Communities 10-4

Configuring SNMP Access Rights 10-12

Configuring SNMP MIB Views 10-16

Configuring SNMP Target Parameters 10-19

Configuring SNMP Target Addresses 10-22

Configuring SNMP Notification Parameters 10-25

Configuring the SNMP Management Interface 10-32

Configuring the SNMP Engine ID 10-34

Reviewing SNMP Statistics

Use the following command to review SNMP statistics.

show snmp counters

Use this command to display SNMP traffic counter values.

Syntax
show snmp counters

Parameters
None.

Defaults
None.

Extreme A4 CLI Reference 10-1

show snmp counters

Mode
Switch command, read-only.

Example
This example shows how to display SNMP counter values
A4(su)->show snmp counters

--- mib2 SNMP group counters:

snmpInPkts = 396601
snmpOutPkts = 396601
snmpInBadVersions = 0
snmpInBadCommunityNames = 0
snmpInBadCommunityUses = 0
snmpInASNParseErrs = 0
snmpInTooBigs = 0
snmpInNoSuchNames = 0
snmpInBadValues = 0
snmpInReadOnlys = 0
snmpInGenErrs = 0
snmpInTotalReqVars = 403661
snmpInTotalSetVars = 534
snmpInGetRequests = 290
snmpInGetNexts = 396279
snmpInSetRequests = 32
snmpInGetResponses = 0
snmpInTraps = 0
snmpOutTooBigs = 0
snmpOutNoSuchNames = 11
snmpOutBadValues = 0
snmpOutGenErrs = 0
snmpOutGetRequests = 0
snmpOutGetNexts = 0
snmpOutSetRequests = 0
snmpOutGetResponses = 396601
snmpOutTraps = 0
snmpSilentDrops = 0
snmpProxyDrops = 0

--- USM Stats counters:

usmStatsUnsupportedSecLevels = 0
usmStatsNotInTimeWindows = 0
usmStatsUnknownUserNames = 0
usmStatsUnknownEngineIDs = 0
usmStatsWrongDigests = 0
usmStatsDecryptionErrors = 0
Table 10-1 provides an explanation of the command output.

Table 10-1 show snmp counters Output Details

Output Field What It Displays...
snmpInPkts Number of messages delivered to the SNMP entity from the transport
service.
snmpOutPkts Number of SNMP messages passed from the SNMP protocol entity to
the transport service.
snmpInBadVersions Number of SNMP messages delivered to the SNMP entity for an
unsupported SNMP version.

10-2 SNMP Configuration

 show snmp counters

Table 10-1 show snmp counters Output Details (Continued)

Output Field What It Displays...
snmpInBadCommunityNames Number of SNMP messages delivered to the SNMP entity that used an
SNMP community name not known to the entity.
snmpInBadCommunityUses Number of SNMP messages delivered to the SNMP entity that
represented an SNMP operation not allowed by the SNMP community
named in the message.
snmpInASNParseErrs Number of ASN.1 (Abstract Syntax Notation) or BER (Basic Encoding
Rules) errors encountered by the SNMP entity when decoding received
SNMP messages.
snmpInTooBigs Number of SNMP PDUs delivered to the SNMP protocol entity with the
value of the error-status field as “tooBig.”
snmpInNoSuchNames Number of SNMP PDUs delivered to the SNMP protocol entity with the
value of the error-status field as “noSuchName.”
snmpInBadValues Number of SNMP PDUs delivered to the SNMP protocol entity with the
value of the error-status field as “badValue.”
snmpInReadOnlys Number of valid SNMP PDUs delivered to the SNMP protocol entity with
the value of the error-status field as "readOnly."
snmpInGenErrs Number of SNMP PDUs delivered to the SNMP protocol entity with the
value of the error-status field as "genErr."
snmpInTotalReqVars Number of MIB objects retrieved successfully by the SNMP protocol
entity as the result of receiving valid SNMP Get-Request and Get-Next
PDUs.
snmpInTotalSetVars Number of MIB objects altered successfully by the SNMP protocol entity
as the result of receiving valid SNMP Set-Request PDUs.
snmpInGetRequests Number of SNMP Get-Request PDUs accepted and processed by the
SNMP protocol entity.
snmpInGetNexts Number of SNMP Get-Next PDUs accepted and processed by the
SNMP protocol entity.
snmpInSetRequests Number of SNMP Set-Request PDUs accepted and processed by the
SNMP protocol entity.
snmpInGetResponses Number of SNMP Get-Response PDUs accepted and processed by the
SNMP protocol entity.
snmpInTraps Number of SNMP Trap PDUs accepted and processed by the SNMP
protocol entity.
snmpOutTooBigs Number of SNMP PDUs generated by the SNMP protocol entity with the
value of the error-status field as "tooBig."
snmpOutNoSuchNames Number of SNMP PDUs generated by the SNMP protocol entity with the
value of the error-status as "noSuchName."
snmpOutBadValues Number of SNMP PDUs generated by the SNMP protocol entity with the
value of the error-status field as "badValue."
snmpOutGenErrs Number of SNMP PDUs generated by the SNMP protocol entity with the
value of the error-status field as "genErr."
snmpOutGetRequests Number of SNMP Get-Request PDUs generated by the SNMP protocol
entity.
snmpOutGetNexts Number of SNMP Get-Next PDUs generated by the SNMP protocol
entity.
snmpOutSetRequests Number of SNMP Set-Request PDUs generated by the SNMP protocol
entity.

Extreme A4 CLI Reference 10-3

Configuring SNMP Users, Groups, and Communities

Table 10-1 show snmp counters Output Details (Continued)

Output Field What It Displays...
snmpOutGetResponses Number of SNMP Get-Response PDUs generated by the SNMP
protocol entity.
snmpOutTraps Number of SNMP Trap PDUs generated by the SNMP protocol entity.
snmpSilentDrops Number of SNMP Get, Set, or Inform request error messages that were
dropped because the reply was larger than the requestor’s maximum
message size.
snmpProxyDrops Number of SNMP Get, Set, or Inform request error messages that were
dropped because the reply was larger than the proxy target’s maximum
message size.
usmStatsUnsupportedSec Number of packets received by the SNMP engine that were dropped
Levels because they requested a security level that was unknown to the SNMP
engine or otherwise unavailable.
usmStatsNotInTimeWindows Number of packets received by the SNMP engine that were dropped
because they appeared outside of the authoritative SNMP engine's
window.
usmStatsUnknownUserNames Number of packets received by the SNMP engine that were dropped
because they referenced a user that was not known to the SNMP
engine.
usmStatsUnknownEngineIDs Number of packets received by the SNMP engine that were dropped
because they referenced an snmpEngineID that was not known to the
SNMP engine.
usmStatsWrongDigests Number of packets received by the SNMP engine that were dropped
because they did not contain the expected digest value.
usmStatsDecriptionErrors Number of packets received by the SNMP engine that were dropped
because they could not be decrypted.

Configuring SNMP Users, Groups, and Communities

Use the following commands to review and configure SNMP users, groups, and v1 and v2
communities.

For information about... Refer to page...

show snmp user 10-5

set snmp user 10-6

clear snmp user 10-7

show snmp group 10-8

set snmp group 10-9

clear snmp group 10-10

show snmp community 10-10

set snmp community 10-11

clear snmp community 10-12

10-4 SNMP Configuration

 show snmp user

show snmp user

Use this command to display information about SNMP users. These are people registered to
access SNMP management.

Syntax
show snmp user [list] | [user] | [remote remote] [volatile | nonvolatile | read-
only]

Parameters
list (Optional) Displays a list of registered SNMP user names.
user (Optional) Displays information about a specific user.
remote remote (Optional) Displays information about users on a specific remote SNMP
engine.
volatile | nonvolatile (Optional) Displays user information for a specified storage type.
| read-only

Defaults
If list is not specified, detailed SNMP information will be displayed.
If user is not specified, information about all SNMP users will be displayed.
If remote is not specified, user information about the local SNMP engine will be displayed.
If a storage type is not specified, user information for all storage types will be displayed.

Mode
Switch command, read-only.

Examples
This example shows how to display an SNMP user list:
A4(su)->show snmp user list
--- SNMP user information ---
--- List of registered users:
Guest
admin1
admin2
netops

This example shows how to display information for the SNMP “guest” user:
(su)->show snmp user guest
--- SNMP user information ---
EngineId: 00:00:00:63:00:00:00:a1:00:00:00:00
Username = Guest
Auth protocol = usmNoAuthProtocol
Privacy protocol = usmNoPrivProtocol
Storage type = nonVolatile
Row status = active
Table 10-2 provides an explanation of the command output.

Extreme A4 CLI Reference 10-5

set snmp user

Table 10-2 show snmp user Output Details

Output Field What It Displays...
EngineId SNMP local engine identifier.
Username SNMPv1 or v2 community name or SNMPv3 user name.
Auth protocol Type of authentication protocol applied to this user.
Privacy protocol Type of encryption protocol applied to this user.
Storage type Whether entry is stored in volatile, nonvolatile or read-only memory.
Row status Status of this entry: active, notInService, or notReady.

set snmp user

Use this command to create a new SNMPv3 user.

Syntax
set snmp user user [remote remoteid] [encryption {des | aes}] [privacy
privpassword] [authentication {md5 | sha}] [authpassword] [volatile | nonvolatile]

Parameters
user Specifies a name for the SNMPv3 user.
remote remoteid (Optional) Registers the user on a specific remote SNMP engine.
encryption des | (Optional) Specifies the encryption type for this user.
aes
AES refers to the Advanced Encryption Standard using a 128 bit key size.
privacy privpassword (Optional) Specifies an encryption password. Minimum of 8 characters.
Required if encryption is specified.
authentication md5 (Optional) Specifies the authentication type required for this user as MD5
| sha or SHA.
authpassword (Optional) Specifies a password for this user when authentication is
required. Minimum of 8 characters.
volatile | (Optional) Specifies a storage type for this user entry.
nonvolatile

Defaults
If remote is not specified, the user will be registered for the local SNMP engine.
If encryption is not specified, no encryption will be applied.
If authentication is not specified, no authentication will be applied.
If storage type is not specified, nonvolatile will be applied.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

10-6 SNMP Configuration

 clear snmp user

Usage
Although all the parameters except for the user name are optional, if you are entering any of the
optional parameters, it is recommended that you enter them in the order shown in the syntax
statement.
When FIPS mode (security profile = c2) is enabled, the default authentication mechanism for
SNMPv3 is HMAC-SHA-1. The entire SNMPv3 message will be checked for integrity using
HMAC-SHA-1. The authentication option of the "set snmp user" command will not accept MD5 as
an option. Only the FIPS cryptographic module will be used for HMAC-SHA-1 even if this same
algorithm is provided by other functions.
When FIPS mode (security profile = c2) is enabled, the encryption mechanism for SNMPv3 will be
AES-128. The encryption option of the "set snmp user" command will not accept DES as an option
while in FIPS mode. Only the FIPS cryptographic module will be used for AES-128 even if this
same algorithm is provided by other functions.
Refer to Chapter 26. “Configuring Security Features,” in the Fixed Switching Configuration Guide for
more information about FIPS security mode.
Extreme Networks highly recommends that, before you configure SNMPv3 users on a stack of
fixed switches, you set the SNMP engine ID to a non-default value with the command “set snmp
engineid” on page 10-35. This will prevent losing SNMP management access if a different unit in
the stack takes over the manager function, since SNMPv3 users are associated (registered) with
the local SNMP engine. If a different unit takes over the manager function and an engine ID has
not been set with the set snmp engineid command, the new manager unit will use a different
engine ID and the previously configured SNMPv3 users will no longer have access to the stack.

Examples
This example shows how to create a new SNMP user named “netops”. By default, this user will be
registered on the local SNMP engine without authentication and encryption. Entries related to this
user will be stored in permanent (nonvolatile) memory:
A4(su)->set snmp user netops
This example creates a new SNMP user named “admin” with AES encryption and HMAC-SHA-1
authentication required. The encryption password is “admintest1” and the authentication
password is “admintest2.” By default, this user will be registered on the local SNMP engine and
entries related to this user will be stored in permanent (nonvolatile) memory.
A4(su)->set snmp user admin encryption aes privacy admintest1 authentication sha
admintest2

clear snmp user

Use this command to remove a user from the SNMPv3 security-model list.

Syntax
clear snmp user user [remote remote]

Parameters
user Specifies an SNMPv3 user to remove.
remote remote (Optional) Removes the user from a specific remote SNMP engine.

Extreme A4 CLI Reference 10-7

show snmp group

Defaults
If remote is not specified, the user will be removed from the local SNMP engine.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to remove the SNMP user named “bill”:
A4(su)->clear snmp user bill

show snmp group

Use this command to display an SNMP group configuration. An SNMP group is a collection of
SNMPv3 users who share the same access privileges.

Syntax
show snmp group [groupname groupname] [user user] [security-model {v1 | v2c | usm}]
[volatile | nonvolatile | read-only]

Parameters
groupname (Optional) Displays information for a specific SNMP group.
groupname
user user (Optional) Displays information about users within the specified group.
security-model v1 | (Optional) Displays information about groups assigned to a specific
v2c | usm security SNMP model.
volatile | (Optional) Displays SNMP group information for a specified storage type.
nonvolatile | read-
only

Defaults
If groupname is not specified, information about all SNMP groups will be displayed.
If user is not specified, information about all SNMP users will be displayed.
If security-model is not specified, user information about all SNMP versions will be displayed.
If not specified, information for all storage types will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display SNMP group information:
A4(su)->show snmp group
--- SNMP group information ---
Security model = SNMPv1
Security/user name = public

10-8 SNMP Configuration

 set snmp group

Group name = Anyone

Storage type = nonVolatile
Row status = active

Security model = SNMPv1

Security/user name = public.router1
Group name = Anyone
Storage type = nonVolatile
Row status = active
Table 10-3 provides an explanation of the command output.

Table 10-3 show snmp group Output Details

Output Field What It Displays...
Security model SNMP version associated with this group.
Security/user name User belonging to the SNMP group.
Group name Name of SNMP group.
Storage type Whether entry is stored in volatile, nonvolatile or read-only memory.
Row status Status of this entry: active, notInService, or notReady.

set snmp group

Use this command to create an SNMP group. This associates SNMPv3 users to a group that shares
common access privileges.

Syntax
set snmp group groupname user user security-model {v1 | v2c | usm} [volatile |
nonvolatile]

Parameters
groupname Specifies an SNMP group name to create.
user user Specifies an SNMPv3 user name to assign to the group.
security-model v1 | Specifies an SNMP security model to assign to the group.
v2c | usm
volatile | (Optional) Specifies a storage type for SNMP entries associated with the
nonvolatile group.

Defaults
If storage type is not specified, nonvolatile storage will be applied.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to create an SNMP group called “anyone”, assign a user named “public”
and assign SNMPv3 security to the group:
A4(su)->set snmp group anyone user public security-model usm

Extreme A4 CLI Reference 10-9

clear snmp group

clear snmp group

Use this command to clear SNMP group settings globally or for a specific SNMP group and user.

Syntax
clear snmp group groupname user [security-model {v1 | v2c | usm}]

Parameters
groupname Specifies the SNMP group to be cleared.
user Specifies the SNMP user to be cleared.
security-model v1 | (Optional) Clears the settings associated with a specific security model.
v2c | usm

Defaults
If not specified, settings related to all security models will be cleared.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to clear all settings assigned to the “public” user within the SNMP group
“anyone”:
A4(su)->clear snmp group anyone public

show snmp community

Use this command to display SNMP community names and status. In SNMPv1 and v2,
community names act as passwords to remote management.

Syntax
show snmp community [name]

Parameters
name (Optional) Displays SNMP information for a specific community name.

Defaults
If name is not specified, information will be displayed for all SNMP communities.

Mode
Switch command, read-only.

10-10 SNMP Configuration

 set snmp community

Example
This example shows how to display information about the SNMP “public” community name. For
a description of this output, refer to set snmp community (page 10-11).
A4(su)->show snmp community public

--- Configured community strings ---

Name = *********
Security name = public
Context =
Transport tag =
Storage type = nonVolatile
Status = active

set snmp community

Use this command to configure an SNMP community group.

Syntax
set snmp community community [securityname securityname] [context context]
[transport transport] [volatile | nonvolatile]

Parameters
community Specifies a community group name.
securityname (Optional) Specifies an SNMP security name to associate with this
securityname community.
context context (Optional) Specifies a subset of management information this community
will be allowed to access. Valid values are full or partial context names. To
review all contexts configured for the device, use the show snmp context
command as described in “show snmp context” on page 10-17.
transport transport (Optional) Specifies the set of transport endpoints from which SNMP
request with this community name will be accepted. Makes a link to a
target address table.
volatile | (Optional) Specifies the storage type for these entries.
nonvolatile

Defaults
If securityname is not specified, the community name will be used.
If context is not specified, the default (NULL) context is applied.
If transport tag is not specified, none will be applied.
If storage type is not specified, nonvolatile will be applied.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Extreme A4 CLI Reference 10-11

clear snmp community

Usage
When you configure a community name, if you don’t specify a context with the context parameter,
the default (NULL) context is applied. If you want to change a configured context back to the
default (NULL )context, enter a hyphen as the value of the context parameter, as shown in the
Examples below.

Examples
This example shows how to set an SNMP community name called “vip.”
A4(su)->set snmp community vip
The example shows how to set the context for SNMP community “vip” to the default NULL
context.
A4(su)->set snmp community vip context -

clear snmp community

Use this command to delete an SNMP community name.

Syntax
clear snmp community name

Parameters
name Specifies the SNMP community name to clear.

Defaults
None.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to delete the community name “vip.”
A4(su)->clear snmp community vip

Configuring SNMP Access Rights

Use the following commands to review and configure SNMP access rights, assigning viewing
privileges and security levels to SNMP user groups.

For information about... Refer to page...

show snmp access 10-13

set snmp access 10-14

clear snmp access 10-15

10-12 SNMP Configuration

 show snmp access

show snmp access

Use this command to display access rights and security levels configured for SNMP one or more
groups.

Syntax
show snmp access [groupname] [security-model {v1 | v2c | usm}] [noauthentication
| authentication | privacy] [context context] [volatile | nonvolatile | read-only]

Parameters
groupname (Optional) Displays access information for a specific SNMPv3 group.
security-model v1 | (Optional) Displays access information for SNMP security model version
v2c | usm 1, 2c or 3 (usm).
noauthentication | (Optional) Displays access information for a specific security level.
authentication |
privacy
context context (Optional) Displays access information for a specific context.
volatile | (Optional) Displays access entries for a specific storage type.
nonvolatile | read-
only

Defaults
If groupname is not specified, access information for all SNMP groups will be displayed.
If security-model is not specified, access information for all SNMP versions will be displayed.
If noauthentication, authentication or privacy are not specified, access information for all
security levels will be displayed.
If context is not specified, all contexts will be displayed.
If volatile, nonvolatile or read-only are not specified, all entries of all storage types will be
displayed.

Mode
Switch command, read-only.

Example
This example shows how to display SNMP access information:
A4(su)->show snmp access
Group = SystemAdmin
Security model = USM
Security level = noAuthNoPriv
Read View = All
Write View =
Notify View = All
Context match = exact match
Storage type = nonVolatile
Row status = active

Group = NightOperator
Security model = USM
Security level = noAuthNoPriv

Extreme A4 CLI Reference 10-13

set snmp access

Read View = All

Write View =
Notify View = All
Context match = exact match
Storage type = nonVolatile
Row status = active
Table 10-4 provides an explanation of the command output.

Table 10-4 show snmp access Output Details

Output Field What It Displays...
Group SNMP group name.
Security model Security model applied to this group. Valid types are: SNMPv1,
SNMPv2c, and SNMPv3 (User based - USM).
Security level Security level applied to this group. Valid levels are:
• noAuthNoPrivacy (no authentication required)
• AuthNoPrivacy (authentication required)
• authPriv (privacy -- most secure level)
Read View Name of the view that allows this group to view SNMP MIB objects.
Write View Name of the view that allows this group to configure the contents of the
SNMP agent.
Notify View Name of the view that allows this group to send an SNMP trap message.
Context match Whether or not SNMP context match must be exact (full context name
match) or a partial match with a given prefix.
Storage type Whether access entries for this group are stored in volatile, nonvolatile
or read-only memory.
Row status Status of this entry: active, notInService, or notReady.

set snmp access

Use this command to set an SNMP access configuration.

Syntax
set snmp access groupname security-model {v1 | v2c | usm} [noauthentication |
authentication | privacy] [context context] [exact | prefix] [read read] [write
write] [notify notify] [volatile | nonvolatile]

Parameters
groupname Specifies a name for an SNMPv3 group.
security-model v1 | Specifies SNMP version 1, 2c or 3 (usm).
v2c | usm
noauthentication | (Optional) Applies SNMP security level as no authentication,
authentication | authentication (without privacy) or privacy. Privacy specifies that
privacy messages sent on behalf of the user are protected from disclosure.

10-14 SNMP Configuration

 clear snmp access

context context exact (Optional) Sets the context for this access configuration and specifies that
| prefix the match must be exact (matching the whole context string) or a prefix
match only. Context is a subset of management information this SNMP
group will be allowed to access. Valid values are full or partial context
names. To review all contexts configured for the device, use the show
snmp context command as described in “show snmp context” on
page 10-17.
read read (Optional) Specifies a read access view.
write write (Optional) Specifies a write access view.
notify notify (Optional) Specifies a notify access view.
volatile | (Optional) Stores associated SNMP entries as temporary or permanent, or
nonvolatile | read- read-only.
only

Defaults
If security level is not specified, no authentication will be applied.
If context is not specified, access will be enabled for the default context. If context is specified
without a context match, exact match will be applied.
If read view is not specified none will be applied.
If write view is not specified, none will be applied.
If notify view is not specified, none will be applied.
If storage type is not specified, entries will be stored as permanent and will be held through device
reboot.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example permits the “powergroup” to manage all MIBs via SNMPv3:
A4(su)->set snmp access powergroup security-model usm

clear snmp access

Use this command to clear the SNMP access entry of a specific group, including its set SNMP
security-model, and level of security.

Syntax
clear snmp access groupname security-model {v1 | v2c | usm} [noauthentication |
authentication | privacy] [context context]

Parameters
groupname Specifies the name of the SNMP group for which to clear access.
security-model v1 | Specifies the security model to be cleared for the SNMP access group.
v2c | usm

Extreme A4 CLI Reference 10-15

Configuring SNMP MIB Views

noauthentication | (Optional) Clears a specific security level for the SNMP access group.
authentication |
privacy
context context (Optional) Clears a specific context for the SNMP access group. Enter / - /
to clear the default context.

Defaults
If security level is not specified, all levels will be cleared.
If context is not specified, none will be applied.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to clear SNMP version 3 access for the “mis-group” via the
authentication protocol:
A4(su)->clear snmp access mis-group security-model usm authentication

Configuring SNMP MIB Views

Use the following commands to review and configure SNMP MIB views. SNMP views map
SNMP objects to access rights.

For information about... Refer to page...

show snmp view 10-16

show snmp context 10-17

set snmp view 10-18

clear snmp view 10-19

show snmp view

Use this command to display the MIB configuration for SNMPv3 view-based access (VACM).

Syntax
show snmp view [viewname] [subtree oid-or-mibobject] [volatile | nonvolatile |
read-only]

Parameters
viewname (Optional) Displays information for a specific MIB view.
subtree oid-or-mibobject (Optional) Displays information for a specific MIB subtree when
viewname is specified.
volatile | nonvolatile | (Optional) Displays entries for a specific storage type.
read-only

10-16 SNMP Configuration

 show snmp context

Defaults
If no parameters are specified, all SNMP MIB view configuration information will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display SNMP MIB view configuration information:
A4(su)->show snmp view

--- SNMP MIB View information ---

View Name = All
Subtree OID = 1
Subtree mask =
View Type = included
Storage type = nonVolatile
Row status = active

View Name = All

Subtree OID = 0.0
Subtree mask =
View Type = included
Storage type = nonVolatile
Row status = active

View Name = Network

Subtree OID = 1.3.6.1.2.1
Subtree mask =
View Type = included
Storage type = nonVolatile
Row status = active
Table 10-5 provides an explanation of the command output. For details on using the set snmp
view command to assign variables, refer to “set snmp view” on page 10-18.

Table 10-5 show snmp view Output Details

Output Field What It Displays...
View Name Name assigned to a MIB view.
Subtree OID Name identifying a MIB subtree.
Subtree mask Bitmask applied to a MIB subtree.
View Type Whether or not subtree use must be included or excluded for this view.
Storage type Whether storage is in nonVolatile or Volatile memory
Row status Status of this entry: active, notInService, or notReady.

show snmp context

Use this command to display the context list configuration for SNMP’s view-based access control.

Syntax
show snmp context

Extreme A4 CLI Reference 10-17

set snmp view

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Usage
An SNMP context is a collection of management information that can be accessed by an SNMP
agent or entity. The default context allows all SNMP agents to access all management information
(MIBs). When created using the set snmp access command (“set snmp access” on page 10-14),
other contexts can be applied to limit access to a subset of management information.

Example
This example shows how to display a list of all SNMP contexts known to the device:
A4(su)->show snmp context

--- Configured contexts:

default context (all mibs)

set snmp view

Use this command to set a MIB configuration for SNMPv3 view-based access (VACM).

Syntax
set snmp view viewname viewname subtree subtree [mask mask] [included | excluded]
[volatile | nonvolatile]

Parameters
viewname viewname Specifies a name for a MIB view.
subtree subtree Specifies a MIB subtree name.
mask mask (Optional) Specifies a bitmask for a subtree.
included | (Optional) Specifies subtree use (default) or no subtree use.
excluded
volatile | (Optional) Specifies the use of temporary or permanent (default) storage.
nonvolatile

Defaults
If not specified, mask will be set to 255.255.255.255
If not specified, subtree use will be included.
If storage type is not specified, nonvolatile (permanent) will be applied.

Mode
Switch mode, read-write, when security profile = normal.

10-18 SNMP Configuration

 clear snmp view

Switch mode, super-user, when security profile = C2.

Example
This example shows how to set an SNMP MIB view to “public” with a subtree name of 1.3.6.1
included:
A4(su)->set snmp view viewname public subtree 1.3.6.1 included

clear snmp view

Use this command to delete an SNMPv3 MIB view.

Syntax
clear snmp view viewname subtree

Parameters
viewname Specifies the MIB view name to be deleted.
subtree Specifies the subtree name of the MIB view to be deleted.

Defaults
None.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to delete SNMP MIB view “public”:
A4(su)->clear snmp view public 1.3.6.1

Configuring SNMP Target Parameters

Use the following commands to review and configure SNMP target parameters. This controls
where and under what circumstances SNMP notifications will be sent. A target parameter entry
can be bound to a target IP address allowed to receive SNMP notification messages with the set
snmp targetaddr command (“set snmp targetaddr” on page 10-24).

For information about... Refer to page...

show snmp targetparams 10-20

set snmp targetparams 10-21

clear snmp targetparams 10-22

Extreme A4 CLI Reference 10-19

show snmp targetparams

show snmp targetparams

Use this command to display SNMP parameters used to generate a message to a target.

Syntax
show snmp targetparams [targetParams] [volatile | nonvolatile | read-only]

Parameters
targetParams (Optional) Displays entries for a specific target parameter.
volatile | nonvolatile | (Optional) Displays target parameter entries for a specific storage
read-only type.

Defaults
If targetParams is not specified, entries associated with all target parameters will be displayed.
If not specified, entries of all storage types will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display SNMP target parameters information:
A4(su)->show snmp targetparams

--- SNMP TargetParams information ---

Target Parameter Name = v1ExampleParams
Security Name = public
Message Proc. Model = SNMPv1
Security Level = noAuthNoPriv
Storage type = nonVolatile
Row status = active
Target Parameter Name = v2cExampleParams
Security Name = public
Message Proc. Model = SNMPv2c
Security Level = noAuthNoPriv
Storage type = nonVolatile
Row status = active

Target Parameter Name = v3ExampleParams

Security Name = CharlieDChief
Message Proc. Model = USM
Security Level = authNoPriv
Storage type = nonVolatile
Row status = active
Table 10-6 provides an explanation of the command output.

Table 10-6 show snmp targetparams Output Details

Output Field What It Displays...
Target Parameter Name Unique identifier for the parameter in the SNMP target parameters table.
Maximum length is 32 bytes.
Security Name Security string definition.

10-20 SNMP Configuration

 set snmp targetparams

Table 10-6 show snmp targetparams Output Details (Continued)

Output Field What It Displays...
Message Proc. Model SNMP version.
Security Level Type of security level (auth: security level is set to use authentication
protocol, noauth: security level is not set to use authentication protocol,
or privacy).
Storage type Whether entry is stored in volatile, nonvolatile or read-only memory.
Row status Status of this entry: active, notInService, or notReady.

set snmp targetparams

Use this command to set SNMP target parameters, a named set of security/authorization criteria
used to generate a message to a target.

Syntax
set snmp targetparams paramsname user user security-model {v1 | v2c | usm} message-
processing {v1 | v2c | v3} [noauthentication | authentication | privacy] [volatile
| nonvolatile]

Parameters
paramsname Specifies a name identifying parameters used to generate SNMP messages
to a particular target.
user user Specifies an SNMPv1 or v2 community name or an SNMPv3 user name.
Maximum length is 32 bytes.
security-model v1 | Specifies the SNMP security model applied to this target parameter as
v2c | usm version 1, 2c or 3 (usm).
message- Specifies the SNMP message processing model applied to this target
processing v1 | v2c parameter as version 1, 2c or 3.
| v3
noauthentication | (Optional) Specifies the SNMP security level applied to this target
authentication | parameter as no authentication, authentication (without privacy) or
privacy privacy. Privacy specifies that messages sent on behalf of the user are
protected from disclosure.
volatile | (Optional) Specifies the storage type applied to this target parameter.
nonvolatile

Defaults
None.
If not specified, security level will be set to noauthentication.
If not specified, storage type will be set to nonvolatile.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Extreme A4 CLI Reference 10-21

clear snmp targetparams

Example
This example shows how to set SNMP target parameters named “v1ExampleParams” for a user
named “fred” using version 3 security model and message processing, and authentication:
A4(su)->set snmp targetparams v1ExampleParams user fred security-model usm
message-processing v3 authentication

clear snmp targetparams

Use this command to clear the SNMP target parameter configuration.

Syntax
clear snmp targetparams targetParams

Parameters
targetParams Specifies the name of the parameter in the SNMP target parameters table
to be cleared.

Defaults
None.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to clear SNMP target parameters named “v1ExampleParams”:
A4(su)->clear snmp targetparams v1ExampleParams

Configuring SNMP Target Addresses

Use the following commands to review and configure SNMP target addresses which will receive
SNMP notification messages. An address configuration can be linked to optional SNMP transmit,
or target, parameters (such as timeout, retry count, and UDP port) set with the set snmp
targetparams command (page 10-21).

For information about... Refer to page...

show snmp targetaddr 10-23

set snmp targetaddr 10-24

clear snmp targetaddr 10-25

10-22 SNMP Configuration

 show snmp targetaddr

show snmp targetaddr

Use this command to display SNMP target address information.

Syntax
show snmp targetaddr [targetAddr] [volatile | nonvolatile | read-only]

Parameters
targetAddr (Optional) Displays information for a specific target address name.
volatile | nonvolatile (Optional) When target address is specified, displays target address
| read-only information for a specific storage type.

Defaults
If targetAddr is not specified, entries for all target address names will be displayed.
If not specified, entries of all storage types will be displayed for a target address.

Mode
Switch command, read-only.

Example
This example shows how to display SNMP target address information:
A4(su)->show snmp targetaddr
Target Address Name = labmachine
Tag List = v2cTrap
IP Address = 10.2.3.116
UDP Port# = 162
Target Mask = 255.255.255.255
Timeout = 1500
Retry count = 4
Parameters = v2cParams
Storage type = nonVolatile
Row status = active
Table 10-7 provides an explanation of the command output.

Table 10-7 show snmp targetaddr Output Details

Output Field What It Displays...
Target Address Name Unique identifier in the snmpTargetAddressTable.
Tag List Tags a location to the target address as a place to send notifications.
IP Address Target IP address.
UDP Port# Number of the UDP port of the target host to use.
Target Mask Target IP address mask.
Timeout Timeout setting for the target address.
Retry count Retry setting for the target address.
Parameters Entry in the snmpTargetParamsTable.
Storage type Whether entry is stored in volatile, nonvolatile or read-only memory.
Row status Status of this entry: active, notInService, or notReady.

Extreme A4 CLI Reference 10-23

set snmp targetaddr

set snmp targetaddr

Use this command to configure an SNMP target address. The target address is a unique identifier
and a specific IP address that will receive SNMP notification messages and determine which
community strings will be accepted. This address configuration can be linked to optional SNMP
transmit parameters (such as timeout, retry count, and UDP port).

Syntax
set snmp targetaddr targetaddr ipaddr param param [udpport udpport] [mask mask]
[timeout timeout] [retries retries] [taglist taglist] [volatile | nonvolatile]

Parameters
targetaddr Specifies a unique identifier to index the snmpTargetAddrTable.
Maximum length is 32 bytes.
ipaddr Specifies the IP address of the target.
param param Specifies an entry in the SNMP target parameters table, which is used
when generating a message to the target. Maximum length is 32 bytes.
udpport udpport (Optional) Specifies which UDP port of the target host to use.
mask mask (Optional) Specifies the IP mask of the target.
timeout timeout (Optional) Specifies the maximum round trip time allowed to
communicate to this target address. This value is in .01 seconds and the
default is 1500 (15 seconds.)
retries retries (Optional) Specifies the number of message retries allowed if a response is
not received. Default is 3.
taglist taglist (Optional) Specifies a list of SNMP notify tag values. This tags a location
to the target address as a place to send notifications. List must be enclosed
in quotes and tag values must be separated by a space (for example,
“tag 1 tag 2”).
volatile | (Optional) Specifies temporary (default), or permanent storage for SNMP
nonvolatile entries.

Defaults
If not specified, udpport will be set to 162.
If not specified, mask will be set to 255.255.255.255
If not specified, timeout will be set to 1500.
If not specified, number of retries will be set to 3.
If taglist is not specified, none will be set.
If not specified, storage type will be nonvolatile.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

10-24 SNMP Configuration

 clear snmp targetaddr

Example
This example shows how to configure a trap notification called “TrapSink.” This trap notification
will be sent to the workstation 192.168.190.80 (which is target address “tr”). It will use security
and authorization criteria contained in a target parameters entry called “v2cExampleParams”.
A4(su)->set snmp targetaddr tr 192.168.190.80 param v2cExampleParams taglist
TrapSink

clear snmp targetaddr

Use this command to delete an SNMP target address entry.

Syntax
clear snmp targetaddr targetAddr

Parameters
targetAddr Specifies the target address entry to delete.

Defaults
None.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to clear SNMP target address entry “tr”:
A4(su)->clear snmp targetaddr tr

Configuring SNMP Notification Parameters

Use the following commands to configure SNMP notification parameters and optional filters.
Notifications are entities which handle the generation of SNMP v1 and v2 “traps” or SNMP v3
“informs” messages to select management targets. Optional notification filters identify which
targets should not receive notifications.

For information about... Refer to page...

show snmp notify 10-26

set snmp notify 10-27

clear snmp notify 10-28

show snmp notifyfilter 10-28

set snmp notifyfilter 10-29

clear snmp notifyfilter 10-30

show snmp notifyprofile 10-30

Extreme A4 CLI Reference 10-25

show snmp notify

For information about... Refer to page...

set snmp notifyprofile 10-31

clear snmp notifyprofile 10-31

show snmp notify

Use this command to display the SNMP notify configuration, which determines the management
targets that will receive SNMP notifications.

Syntax
show snmp notify [notify] [volatile | nonvolatile | read-only]

Parameters
notify (Optional) Displays notify entries for a specific notify name.
volatile | (Optional) Displays notify entries for a specific storage type.
nonvolatile | read-
only

Defaults
If a notify name is not specified, all entries will be displayed.
If volatile, nonvolatile, or read-only are not specified, all storage type entries will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display the SNMP notify information:
A4(su)->show snmp notify

--- SNMP notifyTable information ---

Notify name = 1
Notify Tag = Console
Notify Type = trap
Storage type = nonVolatile
Row status = active

Notify name = 2
Notify Tag = TrapSink
Notify Type = trap
Storage type = nonVolatile
Row status = active
Table 10-8 provides an explanation of the command output.

Table 10-8 show snmp notify Output Details

Output Field What It Displays...
Notify name A unique identifier used to index the SNMP notify table.
Notify Tag Name of the entry in the SNMP notify table.

10-26 SNMP Configuration

 set snmp notify

Table 10-8 show snmp notify Output Details (Continued)

Output Field What It Displays...
Notify Type Type of notification: SNMPv1 or v2 trap or SNMPv3 InformRequest
message.
Storage type Whether access entry is stored in volatile, nonvolatile, or read-only
memory.
Row status Status of this entry: active, notInService, or notReady.

set snmp notify

Use this command to set the SNMP notify configuration. This creates an entry in the SNMP notify
table, which is used to select management targets who should receive notification messages. This
command’s tag parameter can be used to bind each entry to a target address using the set snmp
targetaddr command (“set snmp targetaddr” on page 10-24).

Syntax
set snmp notify notify tag tag [trap | inform] [volatile | nonvolatile]

Parameters
notify Specifies an SNMP notify name.
tag tag Specifies an SNMP notify tag. This binds the notify name to the SNMP
target address table.
trap | inform (Optional) Specifies SNMPv1 or v2 Trap messages (default) or SNMP v3
InformRequest messages.
volatile | (Optional) Specifies temporary (default), or permanent storage for SNMP
nonvolatile entries.

Defaults
If not specified, message type will be set to trap.
If not specified, storage type will be set to nonvolatile.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to set an SNMP notify configuration with a notify name of “hello” and a
notify tag of “world”. Notifications will be sent as trap messages and storage type will
automatically default to permanent:
A4(su)->set snmp notify hello tag world trap

Extreme A4 CLI Reference 10-27

clear snmp notify

clear snmp notify

Use this command to clear an SNMP notify configuration.

Syntax
clear snmp notify notify

Parameters
notify Specifies an SNMP notify name to clear.

Defaults
None.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to clear the SNMP notify configuration for “hello”:
A4(su)->clear snmp notify hello

show snmp notifyfilter

Use this command to display SNMP notify filter information, identifying which profiles will not
receive SNMP notifications.

Syntax
show snmp notifyfilter [profile] [subtree oid-or-mibobject] [volatile |
nonvolatile | read-only]

Parameters
profile (Optional) Displays a specific notify filter.
subtree oid-or- (Optional) Displays a notify filter within a specific subtree.
mibobject
volatile | (Optional) Displays notify filter entries of a specific storage type.
nonvolatile | read-
only

Defaults
If no parameters are specified, all notify filter information will be displayed.

Mode
Switch command, read-only.

10-28 SNMP Configuration

 set snmp notifyfilter

Example
This example shows how to display SNMP notify filter information. In this case, the notify profile
“pilot1” in subtree 1.3.6 will not receive SNMP notification messages:
A4(su)->show snmp notifyfilter

--- SNMP notifyFilter information ---

Profile = pilot1
Subtree = 1.3.6
Filter type = included
Storage type = nonVolatile
Row status = active

set snmp notifyfilter

Use this command to create an SNMP notify filter configuration. This identifies which
management targets should NOT receive notification messages, which is useful for fine-tuning the
amount of SNMP traffic generated.

Syntax
set snmp notifyfilter profile subtree oid-or-mibobject [mask mask] [included |
excluded] [volatile | nonvolatile]

Parameters
profile Specifies an SNMP filter notify name.
subtree oid-or- Specifies a MIB subtree ID target for the filter.
mibobject
mask mask (Optional) Applies a subtree mask.
included | (Optional) Specifies that subtree is included or excluded.
excluded
volatile | (Optional) Specifies a storage type.
nonvolatile

Defaults
If not specified, mask is not set.
If not specified, subtree will be included.
If storage type is not specified, nonvolatile (permanent) will be applied.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to create an SNMP notify filter called “pilot1” with a MIB subtree ID of
1.3.6:
A4(su)->set snmp notifyfilter pilot1 subtree 1.3.6

Extreme A4 CLI Reference 10-29

clear snmp notifyfilter

clear snmp notifyfilter

Use this command to delete an SNMP notify filter configuration.

Syntax
clear snmp notifyfilter profile subtree oid-or-mibobject

Parameters
profile Specifies an SNMP filter notify name to delete.
subtree oid-or- Specifies a MIB subtree ID containing the filter to be deleted.
mibobject

Defaults
None.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to delete the SNMP notify filter “pilot1”:
A4(su)->clear snmp notifyfilter pilot1 subtree 1.3.6

show snmp notifyprofile

Use this command to display SNMP notify profile information. This associates target parameters
to an SNMP notify filter to determine who should not receive SNMP notifications.

Syntax
show snmp notifyprofile [profile] [targetparam targetparam] [volatile |
nonvolatile | read-only]

Parameters
profile (Optional) Displays a specific notify profile.
targetparam (Optional) Displays entries for a specific target parameter.
targetparam
volatile | (Optional) Displays notify filter entries of a specific storage type.
nonvolatile | read-
only

Defaults
If no parameters are specified, all notify profile information will be displayed.

Mode
Switch command, read-only.

10-30 SNMP Configuration

 set snmp notifyprofile

Example
This example shows how to display SNMP notify information for the profile named “area51”:
A4(su)->show snmp notifyprofile area51

--- SNMP notifyProfile information ---

Notify Profile = area51
TargetParam = v3ExampleParams
Storage type = nonVolatile
Row status = active

set snmp notifyprofile

Use this command to create an SNMP notify filter profile configuration. This associates a
notification filter, created with the set snmp notifyfilter command (“set snmp notifyfilter” on
page 10-29), to a set of SNMP target parameters to determine which management targets should
not receive SNMP notifications.

Syntax
set snmp notifyprofile profile targetparam targetparam [volatile | nonvolatile]

Parameters
profile Specifies an SNMP filter notify name.
targetparam Specifies an associated entry in the SNMP Target Params Table.
targetparam
volatile | (Optional) Specifies a storage type.
nonvolatile

Defaults
If storage type is not specified, nonvolatile (permanent) will be applied.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to create an SNMP notify profile named area51 and associate a target
parameters entry.
A4(su)->set snmp notifyprofile area51 targetparam v3ExampleParams

clear snmp notifyprofile

Use this command to delete an SNMP notify profile configuration.

Syntax
clear snmp notifyprofile profile targetparam targetparam

Extreme A4 CLI Reference 10-31

Configuring the SNMP Management Interface

Parameters
profile Specifies an SNMP filter notify name to delete.
targetparam Specifies an associated entry in the snmpTargetParamsTable.
targetparam

Defaults
None.

Mode
Switch mode, read-write, when security profile = normal.
Switch mode, super-user, when security profile = C2.

Example
This example shows how to delete SNMP notify profile “area51”:
A4(su)->clear snmp notifyprofile area51 targetparam v3ExampleParams

Configuring the SNMP Management Interface

Use these commands to configure the source IP address used by the SNMP agent when generating
SNMP traps.

For information about... Refer to page...

show snmp interface 10-32

set snmp interface 10-33

clear snmp interface 10-34

show snmp interface

Use this command to display the interface used for the source IP address of the SNMP agent when
generating SNMP traps.

Syntax
show snmp interface

Parameters
None.

Defaults
None.

Mode
Switch mode, read-only.

10-32 SNMP Configuration

 set snmp interface

Example
This example displays the output of this command. In this case, the IP address assigned to
loopback interface 1 will be used as the source IP address of the SNMP agent.
A4(rw)->show snmp interface
loopback 1 192.168.10.1

set snmp interface

Use this command to specify the interface used for the source IP address of the SNMP agent when
generating SNMP traps.

Syntax
set snmp interface {loopback loop-ID | vlan vlan-ID}

Parameters
loopback loop-ID Specifies the loopback interface to be used. The value of loop-ID can
range from 0 to 7.
vlan vlan-ID Specifies the VLAN interface to be used. The value of vlan-ID can range
from 1 to 4093.

Defaults
None.

Mode
Switch command, read-write.

Usage
This command allows you to configure the source IP address used by the SNMP agent when
generating SNMP traps. Any of the management interfaces, including VLAN routing interfaces,
can be configured as the source IP address used in packets generated by the SNMP agent.
An interface must have an IP address assigned to it before it can be set by this command.
If no interface is specified, then the IP address of the Host interface will be used.
If a non-loopback interface is configured with this command, application packet egress is
restricted to that interface if the server can be reached from that interface. Otherwise, the packets
are transmitted over the first available route. Packets from the application server are received on
the configured interface.
If a loopback interface is configured, and there are multiple paths to the application server, the
outgoing interface (gateway) is determined based on the best route lookup. Packets from the
application server are then received on the sending interface. If route redundancy is required,
therefore, a loopback interface should be configured.

Example
This example configures an IP address on VLAN interface 100 and then sets that interface as the
SNMP agent source IP address.
A4(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0
A4(rw)->router(Config-if(Vlan 100))#exit

Extreme A4 CLI Reference 10-33

clear snmp interface

A4(rw)->router(Config)#exit
A4(rw)->router#exit
A4(rw)->router>exit
A4(rw)->set snmp interface vlan 100

A4(rw)->show snmp interface

vlan 100 192.168.10.1

clear snmp interface

Use this command to clear the interface used for the source IP address of the SNMP agent back to
the default of the Host interface.

Syntax
clear snmp interface

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This command returns the interface used for the source IP address of the SNMP agent back to the
default of the Host interface.
A4(rw)->show snmp interface
vlan 100 192.168.10.1
A4(rw)->clear snmp interface
A4(rw)->

Configuring the SNMP Engine ID

Use the following commands to display the SNMP local engine ID and to configure a non-default
SNMP engine ID on the switch.

For information about... Refer to page...

show snmp engineid 10-35

set snmp engineid 10-35

clear snmp engineid 10-37

10-34 SNMP Configuration

 show snmp engineid

show snmp engineid

Use this command to display the SNMP local engine ID. This is the SNMP v3 engine’s
administratively unique identifier.

Syntax
show snmp engineid

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display SNMP engine properties:
A4(su)->show snmp engineid
EngineId: 80:00:15:f8:03:00:e0:63:9d:b5:87
Engine Boots = 12
Engine Time = 162181
Max Msg Size = 2048

Table 10-9 provides an explanation of the command output.

Table 10-9 show snmp engineid Output Details

Output Field What It Displays...

EngineId String identifying the SNMP agent on the device.

Engine Boots Number of times the SNMP engine has been started or reinitialized.

Engine Time Time in seconds since last reboot.

Max Msg Size Maximum accepted length, in bytes, of SNMP frame.

set snmp engineid

Use this command to configure a non-default SNMP engine ID on the switch.

Syntax
set snmp engineid string

Parameters
string The engine ID string can be specified in text format or in octet format.
Maximum string length is 27 bytes.
If the engine ID is a text string, the fifth bit of the engine ID is set to 4. If
the engine ID is an octet, the fifth bit of the engine ID is set to 5.

Extreme A4 CLI Reference 10-35

set snmp engineid

Defaults
Default engine ID is used.

Mode
Switch command, read-write.

Usage
Changing the SNMP engine ID will cause all existing SNMP user configuration to be removed and
the switch to reset.
The default engine ID is defined per the standard as:
• First 4 octets — first bit = 1, the rest is IANA Enterprise number = 5624
• Fifth octet — set to 3 to indicate that a MAC address follows
• Last 6 octets — MAC address of the switch
Extreme Networks highly recommends that, before you configure SNMPv3 users on a stack of
fixed switches with the command “set snmp user” on page 10-6, you set the SNMP engine ID to a
non-default value with this command. This will prevent losing SNMP management access if a
different unit in the stack takes over the manager function, since SNMPv3 users are associated
(registered) with the local SNMP engine. If a different unit takes over the manager function and an
engine ID has not been set with the set snmp engineid command, the new manager unit will use a
different engine ID and the previously configured SNMPv3 users will no longer have access to the
stack.

Example
The following example sets the SNMP engine ID to an octet value, then configures SNMP users.
A4(su)->set snmp engineid 11:22:33:44:55:66:77:88

All SNMP user configuration will be removed before resetting.

This command will reset the stack. Are you sure you want to continue? (y/n)y

Saving Configuration to stacking members

Resetting system ...

A4(su)->show snmp engineid

EngineId: 80:00:15:f8:05:11:22:33:44:55:66:77:88
Engine Boots = 0
Engine Time = 55
Max Msg Size = 2048

A4(su)->set snmp group ro user ro security-model v1

A4(su)->set snmp group public user public security-model v1
A4(su)->set snmp group ro user ro security-model v2c
A4(su)->set snmp group public user public security-model v2c
A4(su)->set snmp group public user public security-model usm
A4(su)->clear snmp user public
A4(su)->set snmp view viewname All subtree 1

10-36 SNMP Configuration

 clear snmp engineid

clear snmp engineid

Use this command to set the SNMP engine ID to the default value.

Syntax
clear snmp engineid

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Usage
Changing the SNMP engine ID will cause all existing SNMP user configuration to be removed and
the switch to reset.
The default engine ID is defined per the standard as:
• First 4 octets — first bit = 1, the rest is IANA Enterprise number = 5624
• Fifth octet — set to 3 to indicate that a MAC address follows
• Last 6 octets — MAC address of the switch

Example
The following example resets the SNMP engine ID to the default value.
A4(su)->clear snmp engineid

All SNMP user configuration will be removed before resetting.

This command will reset the stack. Are you sure you want to continue? (y/n)y

Saving Configuration to stacking members

Resetting system ...

Extreme A4 CLI Reference 10-37

clear snmp engineid

10-38 SNMP Configuration

 11
Spanning Tree Configuration

This chapter describes the Spanning Tree Configuration set of commands and how to use them.
Refer to Chapter 15, “Configuring Spanning Tree,” in the Fixed Switching Configuration Guide for
configuration procedures and conceptual and other information.

For information about... Refer to page...

Configuring Spanning Tree Bridge Parameters 11-1

Configuring Spanning Tree Port Parameters 11-33

Configuring Spanning Tree Loop Protect Parameters 11-40

Caution: Spanning Tree configuration should be performed only by personnel who are very
knowledgeable about Spanning Trees and the configuration of the Spanning Tree Algorithm.
Otherwise, the proper operation of the network could be at risk.

Configuring Spanning Tree Bridge Parameters

Use these commands to display and set Spanning Tree bridge parameters, including device
priorities, hello time, maximum wait time, forward delay, path cost, and topology change trap
suppression.

For information about... Refer to page...

show spantree stats 11-3

set spantree 11-5

show spantree version 11-5

set spantree version 11-6

clear spantree version 11-6

show spantree bpdu-forwarding 11-7

set spantree bpdu-forwarding 11-7

show spantree bridgeprioritymode 11-8

set spantree bridgeprioritymode 11-8

clear spantree bridgeprioritymode 11-9

show spantree mstilist 11-9

set spantree msti 11-10

clear spantree msti 11-10

Extreme A4 CLI Reference 11-1

Configuring Spanning Tree Bridge Parameters

For information about... Refer to page...

show spantree mstmap 11-11

set spantree mstmap 11-11

clear spantree mstmap 11-12

show spantree vlanlist 11-12

show spantree mstcfgid 11-13

set spantree mstcfgid 11-14

clear spantree mstcfgid 11-14

set spantree priority 11-15

clear spantree priority 11-15

set spantree hello 11-16

clear spantree hello 11-16

set spantree maxage 11-17

clear spantree maxage 11-17

set spantree fwddelay 11-18

clear spantree fwddelay 11-18

show spantree backuproot 11-19

set spantree backuproot 11-19

clear spantree backuproot 11-20

show spantree tctrapsuppress 11-21

set spantree tctrapsuppress 11-21

clear spantree tctrapsuppress 11-22

set spantree protomigration 11-22

show spantree spanguard 11-23

set spantree spanguard 11-23

clear spantree spanguard 11-24

show spantree spanguardtimeout 11-24

set spantree spanguardtimeout 11-25

clear spantree spanguardtimeout 11-25

show spantree spanguardlock 11-26

clear/set spantree spanguardlock 11-26

show spantree spanguardtrapenable 11-27

set spanstree spanguardtrapenable 11-27

clear spanstree spanguardtrapenable 11-28

show spantree legacypathcost 11-28

set spantree legacypathcost 11-29

clear spantree legacypathcost 11-29

11-2 Spanning Tree Configuration

 show spantree stats

For information about... Refer to page...

show spantree autoedge 11-30

set spantree autoedge 11-30

clear spantree autoedge 11-31

show spantree debug 11-31

clear spantree debug 11-32

show spantree stats

Use this command to display Spanning Tree information for one or more ports.

Syntax
show spantree stats [port port-string] [sid sid] [active]

Parameters
port port-string (Optional) Displays information for the specified port(s).
sid sid (Optional) Displays information for a specific Spanning Tree identifier. If
not specified, SID 0 is assumed.
active (Optional) Displays information for ports that have received STP BPDUs
since boot.

Defaults
If port-string is not specified, Spanning Tree information for all ports will be displayed.
If sid is not specified, information for Spanning Tree 0 will be displayed.
If active is not specified information for all ports will be displayed regardless of whether or not
they have received BPDUs.

Mode
Switch command, read-only.

Usage
Note that if the output of “show spantree stats active” includes an asterisk (*) following the word
“Discarding,” that indicates that the port is in discarding state because of Loop Protect.

Example
This example shows how to display the device’s Spanning Tree configuration:
A4(su)->show spantree stats

Spanning tree status - enabled

Spanning tree instance - 0
Designated Root MacAddr - 00-e0-63-9d-c1-c8
Designated Root Priority - 0
Designated Root Cost - 10000
Designated Root Port - lag.0.1
Root Max Age - 20 sec
Root Hello Time - 2 sec

Extreme A4 CLI Reference 11-3

show spantree stats

Root Forward Delay - 15 sec

Bridge ID MAC Address - 00-01-f4-da-5e-3d
Bridge ID Priority - 32768
Bridge Max Age - 20 sec
Bridge Hello Time - 2 sec
Bridge Forward Delay - 15 sec
Topology Change Count - 7
Time Since Top Change - 00 days 03:19:15
Max Hops - 20
Table 11-1 shows a detailed explanation of command output.

Table 11-1 show spantree Output Details

Output What It Displays...

Spanning tree instance Spanning Tree ID.

Spanning tree status Whether Spanning Tree is enabled or disabled.

Designated Root MacAddr MAC address of the designated Spanning Tree root bridge.

Designated Root Port Port through which the root bridge can be reached.

Designated Root Priority Priority of the designated root bridge.

Designated Root Cost Total path cost to reach the root.

Root Max Age Amount of time (in seconds) a BPDU packet should be considered valid.

Root Hello Time Interval (in seconds) at which the root device sends BPDU (Bridge Protocol
Data Unit) packets.

Root Forward Delay Amount of time (in seconds) the root device spends in listening or learning
mode.

Bridge ID MAC Address Unique bridge MAC address, recognized by all bridges in the network.

Bridge ID Priority Bridge priority, which is a default value, or is assigned using the set
spantree priority command. For details, refer to “set spantree priority” on
page 11-15.

Bridge Max Age Maximum time (in seconds) the bridge can wait without receiving a
configuration message (bridge “hello”) before attempting to reconfigure.
This is a default value, or is assigned using the set spantree maxage
command. For details, refer to “set spantree maxage” on page 11-17.

Bridge Hello Time Amount of time (in seconds) the bridge sends BPDUs. This is a default
value, or is assigned using the set spantree hello command. For details,
refer to “set spantree hello” on page 11-16.

Bridge Forward Delay Amount of time (in seconds) the bridge spends in listening or learning
mode. This is a default value, or is assigned using the set spantree
fwddelay command. For details, refer to “set spantree fwddelay” on
page 11-18.

Topology Change Count Number of times topology has changed on the bridge.

Time Since Top Change Amount of time (in days, hours, minutes and seconds) since the last
topology change.

Max Hops Maximum number of hops information for a particular Spanning Tree
instance may traverse (via relay of BPDUs within the applicable MST
region) before being discarded.

11-4 Spanning Tree Configuration

 set spantree

set spantree
Use this command to globally enable or disable the Spanning Tree protocol on the switch.

Syntax
set spantree {disable | enable}

Parameters
disable | enable Globally disables or enables Spanning Tree.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to disable Spanning Tree on the device:
A4(su)->set spantree disable

show spantree version

Use this command to display the current version of the Spanning Tree protocol running on the
device.

Syntax
show spantree version

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display Spanning Tree version information for the device:
A4(su)->show spantree version
Force Version is mstp

Extreme A4 CLI Reference 11-5

set spantree version

set spantree version

Use this command to set the version of the Spanning Tree protocol to MSTP (Multiple Spanning
Tree Protocol), RSTP (Rapid Spanning Tree Protocol) or to STP 802.1D-compatible.

Syntax
set spantree version {mstp | stpcompatible | rstp}

Parameters
mstp Sets the version to STP 802.1s-compatible.
stpcompatible Sets the version to STP 802.1D-compatible.
rstp Sets the version to 802.1w-compatible.

Defaults
None.

Mode
Switch command, read-write.

Usage
In most networks, Spanning Tree version should not be changed from its default setting of mstp
(Multiple Spanning Tree Protocol) mode. MSTP mode is fully compatible and interoperable with
legacy STP 802.1D and Rapid Spanning Tree (RSTP) bridges. Setting the version to stpcompatible
mode will cause the bridge to transmit only 802.1D BPDUs, and will prevent non-edge ports from
rapidly transitioning to forwarding state.

Example
This example shows how to globally change the Spanning Tree version from the default of MSTP
to RSTP:
A4(su)->set spantree version rstp

clear spantree version

Use this command to reset the Spanning Tree version to MSTP mode.

Syntax
clear spantree version

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

11-6 Spanning Tree Configuration

 show spantree bpdu-forwarding

Example
This example shows how to reset the Spanning Tree version:
A4(su)->clear spantree version

show spantree bpdu-forwarding

Use this command to display the Spanning Tree BPDU forwarding mode.

Syntax
show spantree bpdu-forwarding

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the Spanning Tree BPDU forwarding mode:
A4(su)->show spantree bpdu-forwarding
BPDU forwarding is disabled.

set spantree bpdu-forwarding

Use this command to enable or disable Spanning Tree BPDU forwarding. By default BPDU
forwarding is disabled.

Syntax
set spantree bpdu-forwarding {disable | enable}

Parameters
disable | enable Disables or enables BPDU forwarding;.

Defaults
By default BPDU forwarding is disabled.

Mode
Switch command, read-write.

Usage
In order to enable Spanning Tree pass through on the switch, the Spanning Tree protocol must be
disabled (set spantree disable) and BPDU forwarding must be enabled with this command. When

Extreme A4 CLI Reference 11-7

show spantree bridgeprioritymode

pass-through is enabled, the switch forwards all received BPDUs but does not participate in any
Spanning Tree.

Example
This example shows how to enable BPDU forwarding:
A4(rw)-> set spantree disable
A4(rw)-> set spantree bpdu-forwarding enable

show spantree bridgeprioritymode

Use this command to display the Spanning Tree bridge priority mode setting.

Syntax
show spantree bridgeprioritymode

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the Spanning Tree bridge priority mode setting:
A4(rw)->show spantree bridgeprioritymode
Bridge Priority Mode is set to IEEE802.1t mode.

set spantree bridgeprioritymode

Use this command to set the Spanning Tree bridge priority mode to 802.1D (legacy) or 802.1t.

Syntax
set spantree bridgeprioritymode {8021d | 8021t}

Parameters
8021d Sets the bridge priority mode to use 802.1D (legacy) values, which are 0 -
65535.
8021t Sets the bridge priority mode to use 802.1t values, which are 0 to 61440, in
increments of 4096. Values will automatically be rounded up or down,
depending on the 802.1t value to which the entered value is closest.
This is the default bridge priority mode.

Defaults
None

11-8 Spanning Tree Configuration

 clear spantree bridgeprioritymode

Mode
Switch command, read-write.

Usage
The mode affects the range of priority values used to determine which device is selected as the
Spanning Tree root as described in set spantree priority (“set spantree priority” on page 11-15).
The default for the switch is to use 802.1t bridge priority mode.

Example
This example shows how to set the bridge priority mode to 802.1D:
A4(rw)->set spantree bridgeprioritymode 8021d

clear spantree bridgeprioritymode

Use this command to reset the Spanning Tree bridge priority mode to the default setting of 802.1t.

Syntax
clear spantree bridgeprioritymode

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset the bridge priority mode to 802.1t:
A4(rw)->clear spantree bridgeprioritymode

show spantree mstilist

Use this command to display a list of Multiple Spanning Tree (MST) instances configured on the
device.

Syntax
show spantree mstilist

Parameters
None.

Defaults
None.

Extreme A4 CLI Reference 11-9

set spantree msti

Mode
Switch command, read-only.

Example
This example shows how to display a list of MST instances. In this case, SID 2 has been configured:
A4(su)->show spantree mstilist
Configured Multiple Spanning Tree instances:
2

set spantree msti

Use this command to create or delete a Multiple Spanning Tree instance.

Syntax
set spantree msti sid sid {create | delete}

Parameters
sid sid Sets the Multiple Spanning Tree ID. Valid values are 1 - 4094.
A4 devices will support up to 4 MST instances, in addition to SID0.
create | delete Creates or deletes an MST instance.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to create an MST instance 2:
A4(su)->set spantree msti sid 2 create

clear spantree msti

Use this command to delete one or more Multiple Spanning Tree instances.

Syntax
clear spantree msti [sid sid]

Parameters
sid sid (Optional) Deletes a specific multiple Spanning Tree ID.

Defaults
If sid is not specified, all MST instances will be cleared.

11-10 Spanning Tree Configuration

 show spantree mstmap

Mode
Switch command, read-write.

Example
This example shows how to delete all MST instances:
A4(su)->clear spantree msti

show spantree mstmap

Use this command to display the mapping of a filtering database ID (FID) to a Spanning Trees.
Since VLANs are mapped to FIDs, this shows to which SID a VLAN is mapped.

Syntax
show spantree mstmap [fid fid]

Parameters
fid fid (Optional) Displays information for specific FIDs.

Defaults
If fid is not specified, information for all assigned FIDs will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display SID to FID mapping information for FID 1. In this case, no
new mappings have been configured:
A4(su)->show spantree mstmap fid 1
FID: SID:
1 0

set spantree mstmap

Use this command to map one or more filtering database IDs (FIDs) to a SID. Since VLANs are
mapped to FIDs, this essentially maps one or more VLAN IDs to a Spanning Tree (SID).

Note: Since any MST maps that are associated with GVRP-generated VLANs will be removed from
the configuration if GVRP communication is lost, it is recommended that you only create MST maps
on statically-created VLANs.

Syntax
set spantree mstmap fid [sid sid]

Extreme A4 CLI Reference 11-11

clear spantree mstmap

Parameters
fid Specifies one or more FIDs to assign to the MST. Valid values are 1 - 4093,
and must correspond to a VLAN ID created using the set vlan command.
sid sid (Optional) Specifies a Multiple Spanning Tree ID. Valid values are 1 - 4094,
and must correspond to a SID created using the set msti command.

Defaults
If sid is not specified, FID(s) will be mapped to Spanning Tree 0.

Mode
Switch command, read-write.

Example
This example shows how to map FID 3 to SID 2:
A4(su)->set spantree mstmap 3 sid 2

clear spantree mstmap

Use this command to map a FID back to SID 0.

Syntax
clear spantree mstmap fid

Parameters
fid Specifies one or more FIDs to reset to 0.

Defaults
If fid is not specified, all SID to FID mappings will be reset.

Mode
Switch command, read-write.

Example
This example shows how to map FID 2 back to SID 0:
A4(su)->clear spantree mstmap 2

show spantree vlanlist

Use this command to display the Spanning Tree ID(s) assigned to one or more VLANs.

Syntax
show spantree vlanlist [vlan-list]

11-12 Spanning Tree Configuration

 show spantree mstcfgid

Parameters
vlan-list (Optional) Displays SIDs assigned to specific VLAN(s).

Defaults
If not specified, SID assignment will be displayed for all VLANs.

Mode
Switch command, read-only.

Example
This example shows how to display the SIDs mapped to VLAN 1. In this case, SIDs 2, 16 and 42
are mapped to VLAN 1. For this information to display, the SID instance must be created using the
set spantree msti command as described in “set spantree msti” on page 11-10, and the FIDs must
be mapped to SID 1 using the set spantree mstmap command as described in “set spantree
mstmap” on page 11-11:
A4(su)->show spantree vlanlist 1
The following SIDS are assigned to VLAN 1: 2 16 42

show spantree mstcfgid

Use this command to display the MST configuration identifier elements, including format selector,
configuration name, revision level, and configuration digest.

Syntax
show spantree mstcfgid

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the MST configuration identifier elements. In this case, the
default revision level of 0, and the default configuration name (a string representing the bridge
MAC address) have not been changed. For information on using the set spantree mstcfgid
command to change these settings, refer to “set spantree mstcfgid” on page 11-14:
A4(su)->show spantree mstcfgid
MST Configuration Identifier:
Format Selector: 0
Configuration Name: 00:01:f4:89:51:94
Revision Level: 0
Configuration Digest: ac:36:17:7f:50:28:3c:d4:b8:38:21:d8:ab:26:de:62

Extreme A4 CLI Reference 11-13

set spantree mstcfgid

set spantree mstcfgid

Use this command to set the MST configuration name and/or revision level.

Syntax
set spantree mstcfgid {cfgname name | rev level}

Parameters
cfgname name Specifies an MST configuration name.
rev level Specifies an MST revision level. Valid values are 0 - 65535.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the MST configuration name to “mstconfig”:
A4(su)->set spantree mstconfigid cfgname mstconfig

clear spantree mstcfgid

Use this command to reset the MST revision level to a default value of 0, and the configuration
name to a default string representing the bridge MAC address.

Syntax
clear spantree mstcfgid

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset the MST configuration identifier elements to default values:
A4(su)->clear spantree mstcfgid

11-14 Spanning Tree Configuration

 set spantree priority

set spantree priority

Use this command to set the device’s Spanning Tree priority.

Syntax
set spantree priority priority [sid]

Parameters
priority Specifies the priority of the bridge. Valid values are from 0 to 61440 (in
increments of 4096), with 0 indicating highest priority and 61440
lowest priority.
sid (Optional) Sets the priority on a specific Spanning Tree. Valid values
are 0 - 4094. If not specified, SID 0 is assumed.

Defaults
If sid is not specified, priority will be set on Spanning Tree 0.

Mode
Switch command, read-write.

Usage
The device with the highest priority (lowest numerical value) becomes the Spanning Tree root
device. If all devices have the same priority, the device with the lowest MAC address will then
become the root device. Depending on the bridge priority mode (set with the set spantree
bridgeprioritymode command described in “set spantree bridgeprioritymode” on page 11-8,
some priority values may be rounded up or down.

Example
This example shows how to set the bridge priority to 4096 on SID 1:
A4(su)->set spantree priority 4096 1

clear spantree priority

Use this command to reset the Spanning Tree priority to the default value of 32768.

Syntax
clear spantree priority [sid]

Parameters
sid (Optional) Resets the priority on a specific Spanning Tree. Valid values
are 0 - 4094. If not specified, SID 0 is assumed.

Defaults
If sid is not specified, priority will be reset on Spanning Tree 0.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 11-15

set spantree hello

Example
This example shows how to reset the bridge priority on SID 1:
A4(su)->clear spantree priority 1

set spantree hello

Use this command to set the device’s Spanning Tree hello time, This is the time interval (in
seconds) the device will transmit BPDUs indicating it is active.

Syntax
set spantree hello interval

Parameters
interval Specifies the number of seconds the system waits before broadcasting a
bridge hello message (a multicast message indicating that the system is
active). Valid values are 1 - 10.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to globally set the Spanning Tree hello time to 10 seconds:
A4(su)->set spantree hello 10

clear spantree hello

Use this command to reset the Spanning Tree hello time to the default value of 2 seconds.

Syntax
clear spantree hello

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

11-16 Spanning Tree Configuration

 set spantree maxage

Example
This example shows how to globally reset the Spanning Tree hello time:
A4(su)->clear spantree hello

set spantree maxage

Use this command to set the bridge maximum aging time.

Syntax
set spantree maxage agingtime

Parameters
agingtime Specifies the maximum number of seconds that the system retains the
information received from other bridges through STP. Valid values are 6 -
40.

Defaults
None.

Mode
Switch command, read-write.

Usage
The bridge maximum aging time is the maximum time (in seconds) a device can wait without
receiving a configuration message (bridge “hello”) before attempting to reconfigure. All device
ports (except for designated ports) should receive configuration messages at regular intervals.
Any port that ages out STP information provided in the last configuration message becomes the
designated port for the attached LAN. If it is a root port, a new root port is selected from among
the device ports attached to the network.

Example
This example shows how to set the maximum aging time to 25 seconds:
A4(su)->set spantree maxage 25

clear spantree maxage

Use this command to reset the maximum aging time for a Spanning Tree to the default value of 20
seconds.

Syntax
clear spantree maxage

Parameters
None.

Extreme A4 CLI Reference 11-17

set spantree fwddelay

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to globally reset the maximum aging time:
A4(su)->clear spantree maxage

set spantree fwddelay

Use this command to set the Spanning Tree forward delay.

Syntax
set spantree fwddelay delay

Parameters
delay Specifies the number of seconds for the bridge forward delay. Valid values
are 4 - 30.

Defaults
None.

Mode
Switch command, read-write.

Usage
The forward delay is the maximum time (in seconds) the root device will wait before changing
states (i.e., listening to learning to forwarding). This delay is required because every device must
receive information about topology changes before it starts to forward frames. In addition, each
port needs time to listen for conflicting information that would make it return to a blocking state;
otherwise, temporary data loops might result.

Example
This example shows how to globally set the bridge forward delay to 16 seconds:
A4(su)->set spantree fwddelay 16

clear spantree fwddelay

Use this command to reset the Spanning Tree forward delay to the default setting of 15 seconds.

Syntax
clear spantree fwddelay

11-18 Spanning Tree Configuration

 show spantree backuproot

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to globally reset the bridge forward delay:
A4(su)->clear spantree fwddelay

show spantree backuproot

Use this command to display the backup root status for an MST instance.

Syntax
show spantree backuproot [sid]

Parameters
sid (Optional) Display backup root status for a specific Spanning Tree
identifier. Valid values are 0 - 4094. If not specified, SID 0 is assumed.

Defaults
If a SID is not specified, then status will be shown for Spanning Tree instance 0.

Mode
Switch command, read-only.

Example
This example shows how to display the status of the backup root function on SID 0:
A4(rw)->show spantree backuproot
Backup root is set to disable on sid 0

set spantree backuproot

Use this command to enable or disable the Spanning Tree backup root function on the switch.

Syntax
set spantree backuproot sid {disable | enable}

Extreme A4 CLI Reference 11-19

clear spantree backuproot

Parameters
sid Specifies the Spanning Tree instance on which to enable or disable the
backup root function.Valid values are 0 - 4094.
disable | enable Enables or disables the backup root function.

Defaults
None.

Mode
Switch command, read-write.

Usage
The Spanning Tree backup root function is disabled by default on the A4. When this feature is
enabled and the switch is directly connected to the root bridge, stale Spanning Tree information is
prevented from circulating if the root bridge is lost. If the root bridge is lost, the backup root will
dynamically lower its bridge priority so that it will be selected as the new root over the lost root
bridge.

Example
This example shows how to enable the backup root function on SID 2:
A4(rw)->set spantree backuproot 2 enable

clear spantree backuproot

Use this command to reset the Spanning Tree backup root function to the default state of disabled.

Syntax
clear spantree backuproot sid

Parameters
sid Specifies the Spanning Tree on which to clear the backup root
function.Valid values are 0 - 4094.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset the backup root function to disabled on SID 2:
A4(rw)->clear spantree backuproot 2

11-20 Spanning Tree Configuration

 show spantree tctrapsuppress

show spantree tctrapsuppress

Use this command to display the status of topology change trap suppression on Rapid Spanning
Tree edge ports.

Syntax
show spantree tctrapsuppress

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the status of topology change trap suppression:
A4(rw)->show spantree tctrapsuppress
Topology change Trap Suppression is set to enabled

set spantree tctrapsuppress

Use this command to disable or enable topology change trap suppression on Rapid Spanning Tree
edge ports.

Syntax
set spantree tctrapsuppress {disable | enable}

Parameters
disable | enable Disables or enables topology change trap suppression.

Defaults
None.

Mode
Switch command, read-write.

Usage
By default, RSTP non-edge (bridge) ports that transition to forwarding or blocking cause the
switch to issue a topology change trap. When topology change trap suppression is enabled, which
is the device default, edge ports (such as end station PCs) are prevented from sending topology
change traps. This is because there is usually no need for network management to monitor edge
port STP transition states, such as when PCs are powered on. When topology change trap
suppression is disabled, all ports, including edge and bridge ports, will transmit topology change
traps.

Extreme A4 CLI Reference 11-21

clear spantree tctrapsuppress

Example
This example shows how to allow Rapid Spanning Tree edge ports to transmit topology change
traps:
A4(rw)->set spantree tctrapsuppress disable

clear spantree tctrapsuppress

Use this command to clear the status of topology change trap suppression on Rapid Spanning Tree
edge ports to the default state of enabled (edge port topology changes do not generate traps).

Syntax
clear spantree tctrapsuppress

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear topology change trap suppression setting:
A4(rw)->clear spantree tctrapsuppress

set spantree protomigration

Use this command to reset the protocol state migration machine for one or more Spanning Tree
ports. When operating in RSTP mode, this forces a port to transmit MSTP BPDUs.

Syntax
set spantree protomigration <port-string>

Parameters
port-string Reset the protocol state migration machine for specific port(s).

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset the protocol state migration machine on port 20:

11-22 Spanning Tree Configuration

 show spantree spanguard

A4(su)->set spantree protomigration fe.1.20

show spantree spanguard

Use this command to display the status of the Spanning Tree SpanGuard function.

Syntax
show spantree spanguard

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the SpanGuard function status:
A4(su)->show spantree spanguard
Spanguard is disabled

set spantree spanguard

Use this command to enable or disable the Spanning Tree SpanGuard function.

Syntax
set spantree spanguard {enable | disable}

Parameters
enable | disable Enables or disables the SpanGuard function.

Defaults
None.

Mode
Switch command, read-write.

Usage
SpanGuard is designed to disable, or lock out an “edge” port when an unexpected BPDU is
received. The port can be configured to be re-enabled after a set time period, or only after manual
intervention.
A port can be defined as an edge (user) port using the set spantree adminedge command,
described in “set spantree adminedge” on page 11-38. A port designated as an edge port is
expected to be connected to a workstation or other end-user type of device, and not to another
switch in the network. When SpanGuard is enabled, if a non-loopback BPDU is received on an

Extreme A4 CLI Reference 11-23

clear spantree spanguard

edge port, the Spanning Tree state of that port will be changed to “blocking” and will no longer
forward traffic. The port will remain disabled until the amount of time defined by set spantree
spanguardtimeout (“set spantree spanguardtimeout” on page 11-25) has passed since the last
seen BPDU, the port is manually unlocked (set or clear spantree spanguardlock, “clear / set
spantree spanguardlock” on page 11-26), the configuration of the port is changed so it is not
longer an edge port, or the SpanGuard function is disabled.
SpanGuard is enabled and disabled only on a global basis (across the stack, if applicable). By
default, SpanGuard is disabled and SpanGuard traps are enabled.

Example
This example shows how to enable the SpanGuard function:
A4(rw)->set spantree spanguard enable

clear spantree spanguard

Use this command to reset the status of the Spanning Tree SpanGuard function to disabled.

Syntax
clear spantree spanguard

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset the status of the SpanGuard function to disabled:
A4(rw)->clear spantree spanguard

show spantree spanguardtimeout

Use this command to display the Spanning Tree SpanGuard timeout setting.

Syntax
show spantree spanguardtimeout

Parameters
None.

Defaults
None.

11-24 Spanning Tree Configuration

 set spantree spanguardtimeout

Mode
Switch command, read-only.

Example
This example shows how to display the SpanGuard timeout setting:
A4(su)->show spantree spanguardtimeout
Spanguard timeout: 300

set spantree spanguardtimeout

Use this command to set the amount of time (in seconds) an edge port will remain locked by the
SpanGuard function.

Syntax
set spantree spanguardtimeout timeout

Parameters
timeout Specifies a timeout value in seconds. Valid values are 0 to 65535.
A value of 0 will keep the port locked until manually unlocked. The default
value is 300 seconds.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the SpanGuard timeout to 600 seconds:
A4(su)->set spantree spanguardtimeout 600

clear spantree spanguardtimeout

Use this command to reset the Spanning Tree SpanGuard timeout to the default value of 300
seconds.

Syntax
clear spantree spanguardtimeout

Parameters
None.

Defaults
None.

Extreme A4 CLI Reference 11-25

show spantree spanguardlock

Mode
Switch command, read-write.

Example
This example shows how to reset the SpanGuard timeout to 300 seconds:
A4(rw)->clear spantree spanguardtimeout

show spantree spanguardlock

Use this command to display the SpanGuard lock status of one or more ports.

Syntax
show spantree spanguardlock [port-string]

Parameters
port-string (Optional) Specifies the port(s) for which to show SpanGuard lock status.

Defaults
If no port string is specified, the SpanGuard lock status for all ports is displayed.

Mode
Switch command, read-only.

Example
This example shows how to display the SpanGuard lock status for fe.1.1:
A4(su)->show spantree spanguardlock fe.1.1
Port fe.1.1 is Unlocked

clear / set spantree spanguardlock

Use either of these commands to unlock one or more ports locked by the Spanning Tree
SpanGuard function. When SpanGuard is enabled, it locks ports that receive BPDUs when those
ports have been defined as edge (user) ports (as described in “set spantree adminedge” on
page 11-38).

Syntax
clear spantree spanguardlock port-string
set spantree spanguardlock port-string

Parameters
port-string Specifies port(s) to unlock.

Defaults
None.

11-26 Spanning Tree Configuration

 show spantree spanguardtrapenable

Mode
Switch command, read-write.

Example
This example shows how to unlock port fe.1.16:
A4(rw)->clear spantree spanguardlock fe.1.16

show spantree spanguardtrapenable

Use this command to display the state of the Spanning Tree SpanGuard trap function.

Syntax
show spantree spanguardtrapenable

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the state of the SpanGuard trap function:
A4(ro)->show spantree spanguardtrapenable
Spanguard SNMP traps are enabled

set spantree spanguardtrapenable

Use this command to enable or disable the sending of an SNMP trap message when SpanGuard
has locked a port.

Syntax
set spantree spanguardtrapenable {disable | enable}

Parameters
disable | enable Disables or enables sending SpanGuard traps. By default, sending traps
is enabled.

Defaults
None.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 11-27

clear spantree spanguardtrapenable

Example
This example shows how to disable the SpanGuard trap function:
A4(su)->set spantree spanguardtrapenable disable

clear spantree spanguardtrapenable

Use this command to reset the Spanning Tree SpanGuard trap function back to the default state of
enabled.

Syntax
clear spantree spanguardtrapenable

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset the SpanGuard trap function to enabled:
A4(rw)->clear spantree spanguardtrapenable

show spantree legacypathcost

Use this command to display the default Spanning Tree path cost setting.

Syntax
show spantree legacypathcost

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the default Spanning Tree path cost setting.
A4(su)->show spantree legacypathcost
Legacy Path Cost is disabled.

11-28 Spanning Tree Configuration

 set spantree legacypathcost

set spantree legacypathcost

Use this command to enable or disable legacy (802.1D) path cost values.

Syntax
set spantree legacypathcost {disable | enable}

Parameters
disable Use 802.1t2001 values to calculate path cost.
enable Use 802.1d1998 values to calculate path cost.

Defaults
None.

Mode
Switch command, read-write.

Usage
By default, legacy path cost is disabled. Enabling the device to calculate legacy path costs affects
the range of valid values that can be entered in the set spantree adminpathcost command.

Example
This example shows how to set the default path cost values to 802.1D.
A4(rw)->set spantree legacypathcost enable

clear spantree legacypathcost

Use this command to set the Spanning Tree default value for legacy path cost to 802.1t values.

Syntax
clear spantree legacypathcost

Defaults
None.

Mode
Switch command, read-write.

Example
This example clears the legacy path cost to 802.1t values.
A4(rw)->clear spantree legacypathcost

Extreme A4 CLI Reference 11-29

show spantree autoedge

show spantree autoedge

Use this command to display the status of automatic edge port detection.

Syntax
show spantree autoedge

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the status of the automatic edge port detection function:
A4(rw)->show spantree autoedge
autoEdge is currently enabled.

set spantree autoedge

Use this command to enable or disable the automatic edge port detection function.

Syntax
set spantree autoedge {disable | enable}

Parameters
disable | enable Disables or enables automatic edge port detection.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to disable automatic edge port detection:
A4(rw)->set spantree autoedge disable

11-30 Spanning Tree Configuration

 clear spantree autoedge

clear spantree autoedge

Use this command to reset automatic edge port detection to the default state of enabled.

Syntax
clear spantree autoedge

Parameters
None.

Defaults
None.

Mode
Switch command, Read-Write.

Example
This example shows how to reset automatic edge port detection to enabled:
A4(rw)->clear spantree autoedge

show spantree debug

Use this command to display Spanning Tree debug counters for one or more ports.

Syntax
show spantree debug [port port-string] [sid sid] [active]

Parameters
port port-string (Optional) Displays debug counters for specific port(s).
sid sid (Optional) Displays the debug counters for a specific Spanning Tree
identifier. Valid values are 0 - 4094. If not specified, SID 0 is assumed.
active (Optional) Displays only the debug counters for ports that have
received at least one configuration or RSTP BPDU.

Defaults
If port?string is not specified, no port information will be displayed.
If sid is not specified, debug counters will be displayed for Spanning Tree 0.

Mode
Switch command, read-only.

Usage
This command displays diagnostic information from the Enterasys Spanning Tree Diagnostic MIB.

Example
This example displays counters for Link Aggregation port lag.0.1.

Extreme A4 CLI Reference 11-31

clear spantree debug

A4(su)->show spantree debug port lag.0.1

STP Diagnostic Common Counters
----------------------------------
Topology Change Count - 0
Message Expiration Count - 0
Invalid BPDU Count - 0
STP BPDU Rx Count - 0
STP BPDU Tx Count - 0
STP TCN BPDU Rx Count - 0
STP TCN BPDU Tx Count - 0
STP TC BPDU Rx Count - 0
STP TC BPDU Tx Count - 0
RST BPDU Rx Count - 0
RST BPDU Tx Count - 0
RST TC BPDU Rx Count - 0
RST TC BPDU Tx Count - 0
MST BPDU Rx Count - 0
MST BPDU Tx Count - 177752
MST CIST TC BPDU Rx Count - 0
MST CIST TC BPDU Tx Count - 0

STP Diagnostic Port Counters for Interface Number lag.0.1

---------------------------------------------------------
Port Role - Disabled
Message Expiration Count - 0
Invalid BPDU Count - 0
STP BPDU Rx Count - 0
STP BPDU Tx Count - 0
STP TCN BPDU Rx Count - 0
STP TCN BPDU Tx Count - 0
STP TC BPDU Rx Count - 0
STP TC BPDU Tx Count - 0
RST BPDU Rx Count - 0
RST BPDU Tx Count - 0
RST TC BPDU Rx Count - 0
RST TC BPDU Tx Count - 0
MST BPDU Rx Count - 0
MST BPDU Tx Count - 0
MST CIST TC BPDU Rx Count - 0
MST CIST TC BPDU Tx Count - 0

clear spantree debug

Use this command to clear Spanning Tree debug counters.

Syntax
clear spantree debug

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

11-32 Spanning Tree Configuration

 Configuring Spanning Tree Port Parameters

Example
This example clears the Spanning Tree debug counters.
A4(su)->clear spantree debug

Configuring Spanning Tree Port Parameters

Use these commands to display and set Spanning Tree port parameters.

For information about... Refer to page...

set spantree portadmin 11-33

clear spantree portadmin 11-34

show spantree portadmin 11-34

show spantree portpri 11-35

set spantree portpri 11-35

clear spantree portpri 11-36

show spantree adminpathcost 11-36

set spantree adminpathcost 11-37

clear spantree adminpathcost 11-37

show spantree adminedge 11-38

set spantree adminedge 11-38

clear spantree adminedge 11-39

show spantree operedge 11-39

set spantree portadmin

Use this command to disable or enable the Spanning Tree algorithm on one or more ports.

Syntax
set spantree portadmin port-string {disable | enable}

Parameters
port-string Specifies the port(s) for which to enable or disable Spanning Tree.
disable | enable Disables or enables Spanning Tree.

Defaults
None.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 11-33

clear spantree portadmin

Example
This example shows how to disable Spanning Tree on fe.1.5:
A4(rw)->set spantree portadmin fe.1.5 disable

clear spantree portadmin

Use this command to reset the default Spanning Tree admin status to enable on one or more ports.

Syntax
clear spantree portadmin port-string

Parameters
port-string Resets the default admin status on specific port(s).

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset the default Spanning Tree admin state to enable on fe.1.12:
A4(rw)->clear spantree portadmin fe.1.12

show spantree portadmin

Use this command to display the status of the Spanning Tree algorithm on one or more ports.

Syntax
show spantree portadmin [port port-string]

Parameters
port port-string (Optional) Displays status for specific port(s).

Defaults
If port-string is not specified, status will be displayed for all ports.

Mode
Switch command, read-only.

Example
This example shows how to display port admin status for fe.1.1:
A4(ro)->show spantree portadmin port fe.1.1
Port fe.1.1 has portadmin set to enabled

11-34 Spanning Tree Configuration

 show spantree portpri

show spantree portpri

Use this command to show the Spanning Tree priority for one or more ports. Port priority is a
component of the port ID, which is one element used in determining Spanning Tree port roles.

Syntax
show spantree portpri [port port-string] [sid sid]

Parameters
port port-string (Optional) Specifies the port(s) for which to display Spanning Tree priority.
sid sid (Optional) Displays port priority for a specific Spanning Tree identifier.
Valid values are 0 - 4094. If not specified, SID 0 is assumed.

Defaults
If port-string is not specified, port priority will be displayed for all Spanning Tree ports.
If sid is not specified, port priority will be displayed for Spanning Tree 0.

Mode
Switch command, read-only.

Example
This example shows how to display the port priority for fe.2.7:
A4(su)->show spantree portpri port fe.2.7
Port fe.2.7 has a Port Priority of 128 on SID 0

set spantree portpri

Use this command to set a port’s Spanning Tree priority.

Syntax
set spantree portpri port-string priority [sid sid]

Parameters
port-string Specifies the port(s) for which to set Spanning Tree port priority.
priority Specifies a number that represents the priority of a link in a Spanning Tree
bridge. Valid values are from 0 to 240 (in increments of 16) with 0
indicating high priority.
sid sid (Optional) Sets port priority for a specific Spanning Tree identifier. Valid
values are 0 - 4094. If not specified, SID 0 is assumed.

Defaults
If sid is not specified, port priority will be set for Spanning Tree 0.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 11-35

clear spantree portpri

Example
This example shows how to set the priority of fe.1.3 to 240 on SID 1
A4(su)->set spantree portpri fe.1.3 240 sid 1

clear spantree portpri

Use this command to reset the bridge priority of a Spanning Tree port to a default value of 128.

Syntax
clear spantree portpri port-string [sid sid]

Parameters
port-string Specifies the port(s) for which to set Spanning Tree port priority.
sid sid (Optional) Resets the port priority for a specific Spanning Tree identifier.
Valid values are 0 - 4094. If not specified, SID 0 will be assumed.

Defaults
If sid is not specified, port priority will be set for Spanning Tree 0.

Mode
Switch command, read-write.

Example
This example shows how to reset the priority of fe.1.3 to 128 on SID 1
A4(su)->clear spantree portpri fe.1.3 sid 1

show spantree adminpathcost

Use this command to display the admin path cost for a port on one or more Spanning Trees.

Syntax
show spantree adminpathcost [port port-string] [sid sid]

Parameters
port port-string (Optional) Displays the admin path cost value for specific port(s).
sid sid (Optional) Displays the admin path cost for a specific Spanning Tree
identifier. Valid values are 0 - 4094. If not specified, SID 0 will be assumed.

Defaults
If port-string is not specified, admin path cost for all Spanning Tree ports will be displayed.
If sid is not specified, admin path cost for Spanning Tree 0 will be displayed.

Mode
Switch command, read-only.

11-36 Spanning Tree Configuration

 set spantree adminpathcost

Example
This example shows how to display the admin path cost for fe.3.4 on SID 1:
A4(su)->show spantree adminpathcost port fe.3.4 sid 1
Port fe.3.4 has a Port Admin Path Cost of 0 on SID 1

set spantree adminpathcost

Use this command to set the administrative path cost on a port and one or more Spanning Trees.

Syntax
set spantree adminpathcost port-string cost [sid sid]

Parameters
port-string Specifies the port(s) on which to set an admin path cost.
cost Specifies the port path cost. Va1id values are 0 - 200000000.
sid sid (Optional) Sets the admin path cost for a specific Spanning Tree identifier.
Valid values are 0 - 4094. If not specified, SID 0 will be assumed.

Defaults
If sid is not specified, admin path cost will be set for Spanning Tree 0.

Mode
Switch command, read-write.

Example
This example shows how to set the admin path cost to 200 for fe.3.2 on SID 1:
A4(su)->set spantree adminpathcost fe.3.2 200 sid 1

clear spantree adminpathcost

Use this command to reset the Spanning Tree default value for port admin path cost to 0.

Syntax
clear spantree adminpathcost port-string [sid sid]

Parameters
port-string Specifies the port(s) for which to reset admin path cost.
sid sid (Optional) Resets the admin path cost for specific Spanning Tree(s).
Valid values are 0 - 4094. If not specified, SID 0 is assumed.

Defaults
If sid is not specified, admin path cost will be reset for Spanning Tree 0.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 11-37

show spantree adminedge

Example
This example shows how to reset the admin path cost to 0 for fe.3.2 on SID 1:
A4(su)->clear spantree adminpathcost fe.3.2 sid 1

show spantree adminedge

Use this command to display the edge port administrative status for a port.

Syntax
show spantree adminedge [port port-string]

Parameters
port-string (Optional) Displays edge port administrative status for specific
port(s).

Defaults
If port-string is not specified edge port administrative status will be displayed for all Spanning Tree
ports.

Mode
Switch command, read-only.

Example
This example shows how to display the edge port status for fe.3.2:
A4(su)->show spantree adminedge port fe.3.2
Port fe.3.2 has a Port Admin Edge of Edge-Port

set spantree adminedge

Use this command to set the edge port administrative status on a Spanning Tree port.

Syntax
set spantree adminedge port-string {true | false}

Parameters
port-string Specifies the edge port.
true | false Enables (true) or disables (false) the specified port as a Spanning Tree edge
port.

Defaults
None.

Mode
Switch command, read-write.

11-38 Spanning Tree Configuration

 clear spantree adminedge

Usage
The default behavior of the edge port administrative status begins with the value set to false
initially after the device is powered up. If a Spanning Tree BDPU is not received on the port within
a few seconds, the status setting changes to true.

Example
This example shows how to set fe.1.11 as an edge port:
A4(su)->set spantree adminedge fe.1.11 true

clear spantree adminedge

Use this command to reset a Spanning Tree port to non-edge status.

Syntax
clear spantree adminedge port-string

Parameters
port-string Specifies port(s) on which to reset edge port status.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset fe.1.11 as a non-edge port:
A4(su)->clear spantree adminedge fe.1.11

show spantree operedge

Use this command to display the Spanning Tree edge port operating status for a port.

Syntax
show spantree operedge [port port-string]

Parameters
port port-string Displays edge port operating status for specific port(s).

Defaults
If port-string is not specified, edge port operating status will be displayed for all Spanning Tree
ports.

Mode
Switch command, read-only.

Extreme A4 CLI Reference 11-39

Configuring Spanning Tree Loop Protect Parameters

Example
This example shows how to display the edge port status for fe.2.7:
A4(rw)->show spantree operedge port fe.2.7
Port fe.2.7 has a Port Oper Edge of Edge-Port

Configuring Spanning Tree Loop Protect Parameters

Use the following commands to display and set Spanning Tree Loop Protect parameters,
including the global parameters of Loop Protect threshold, window, enabling traps, and disputed
BPDU threshold, as well as per port and port/SID parameters. Refer to Chapter 15, “Configuring
Spanning Tree,” in the Fixed Switching Configuration Guide for more information.

For information about... Refer to page...

set spantree lp 11-41

show spantree lp 11-41

clear spantree lp 11-42

show spantree lplock 11-42

clear spantree lplock 11-43

set spantree lpcapablepartner 11-44

show spantree lpcapablepartner 11-44

clear spantree lpcapablepartner 11-45

set spantree lpthreshold 11-45

show spantree lpthreshold 11-46

clear spantree lpthreshold 11-46

set spantree lpwindow 11-47

show spantree lpwindow 11-47

clear spantree lpwindow 11-48

set spantree lptrapenable 11-48

show spantree lptrapenable 11-49

clear spantree lptrapenable 11-49

set spantree disputedbpduthreshold 11-50

show spantree disputedbpduthreshold 11-51

clear spantree disputedbpduthreshold 11-51

show spantree nonforwardingreason 11-52

11-40 Spanning Tree Configuration

 set spantree lp

set spantree lp
Use this command to enable or disable the Loop Protect feature per port and optionally, per SID.
The Loop Protect feature is disabled by default.

Syntax
set spantree lp port-string {enable | disable} [sid sid]

Parameters
port-string Specifies port(s) on which to enable or disable the Loop Protect feature.
enable | disable Enables or disables the feature on the specified port.
sid sid (Optional) Enables or disables the feature for specific Spanning Tree(s).
Valid values are 0 - 4094. If not specified, SID 0 is assumed.

Defaults
If no SID is specified, SID 0 is assumed.

Mode
Switch command, read-write.

Usage
Loop Protect takes precedence over per port STP enable/disable (portAdmin). Normally
portAdmin disabled would cause a port to go immediately to forwarding. If Loop Protect is
enabled, that port should go to listening and remain there.

Note: The Loop Protect enable/disable settings for an MSTI port should match those for the CIST
port.

Example
This example shows how to enable Loop Protect on fe.2.3:
A4(su)->set spantree lp fe.1.11 enable

show spantree lp
Use this command to display the Loop Protect status per port and/or per SID.

Syntax
show spantree lp [port port-string] [sid sid]

Parameters
port-string (Optional) Specifies port(s) for which to display the Loop Protect
feature status.
sid sid (Optional) Specifies the specific Spanning Tree(s) for which to display
the Loop Protect feature status. Valid values are 0 - 4094. If not
specified, SID 0 is assumed.

Extreme A4 CLI Reference 11-41

clear spantree lp

Defaults
If no port-string is specified, status is displayed for all ports.
If no SID is specified, SID 0 is assumed.

Mode
Switch command, read-only.

Example
This example shows how to display Loop Protect status on fe.2.3:
A4(su)->show spantree lp port fe.2.3
LoopProtect is disabled on port fe.2.3 , SI

clear spantree lp
Use this command to return the Loop Protect status per port and optionally, per SID, to its default
state of disabled.

Syntax
clear spantree lp port-string [sid sid]

Parameters
port-string Specifies port(s) for which to clear the Loop Protect feature status.
sid sid (Optional) Specifies the specific Spanning Tree(s) for which to clear the
Loop Protect feature status. Valid values are 0 - 4094. If not specified,
SID 0 is assumed.

Defaults
If no SID is specified, SID 0 is assumed.

Mode
Switch command, read-write.

Example
This example shows how to return the Loop Protect state on fe.2.3 to disabled:
A4(rw)->clear spantree lp port fe.2.3

show spantree lplock

Use this command to display the Loop Protect lock status per port and/or per SID. A port can
become locked if a configured number of Loop Protect events occur during the configured
window of time. See the set spantree lpthreshold and set spantree lpwindow commands. Once a
port is forced into blocking (locked), it remains locked until manually unlocked with the clear
spantree lplock command.

Syntax
show spantree lplock [port port-string] [sid sid]

11-42 Spanning Tree Configuration

 clear spantree lplock

Parameters
port-string (Optional) Specifies port(s) for which to display the Loop Protect lock
status.
sid sid (Optional) Specifies the specific Spanning Tree(s) for which to display
the Loop Protect lock status. Valid values are 0 - 4094. If not specified,
SID 0 is assumed.

Defaults
If no port-string is specified, status is displayed for all ports.
If no SID is specified, SID 0 is assumed.

Mode
Switch command, read-only.

Example
This example shows how to display Loop Protect lock status on fe.1.1:
A4(rw)->show spantree lplock port fe.1.1
The LoopProtect lock status for port fe.1.1 , SID 0 is UNLOCKED

clear spantree lplock

Use this command to manually unlock a blocked port and optionally, per SID. The default state is
unlocked.

Syntax
clear spantree lplock port-string [sid sid]

Parameters
port-string Specifies port(s) for which to clear the Loop Protect lock.
sid sid (Optional) Specifies the specific Spanning Tree(s) for which to clear the
Loop Protect lock. Valid values are 0 - 4094. If not specified, SID 0 is
assumed.

Defaults
If no SID is specified, SID 0 is assumed.

Mode
Switch command, read-only.

Example
This example shows how to clear Loop Protect lock from fe.1.1:
A4(rw)->show spantree lplock port fe.1.1
The LoopProtect lock status for port fe.1.1 , SID 0 is LOCKED
A4(rw)->clear spantree lplock fe.1.1
A4(rw)->show spantree lplock port fe.1.1
The LoopProtect lock status for port fe.1.1 , SID 0 is UNLOCKED

Extreme A4 CLI Reference 11-43

set spantree lpcapablepartner

set spantree lpcapablepartner

Use this command to specify per port whether the link partner is Loop Protect capable.

Syntax
set spantree lpcapablepartner port-string {true | false}

Parameters
port-string Specifies port(s) for which to configure a Loop Protect capable link
partner.
true | false Specifies whether the link partner is capable (true) or not (false).

Defaults
None.

Mode
Switch command, read-write.

Usage
The default value for Loop Protect capable partner is false. If the port is configured with a Loop
Protect capable partner (true), then the full functionality of the Loop Protect feature is used. If the
value is false, then there is some ambiguity as to whether an Active Partner timeout is due to a
loop protection event or is a normal situation due to the fact that the partner port does not
transmit Alternate Agreement BPDUs. Therefore, a conservative approach is taken in that
designated ports will not be allowed to forward unless receiving agreements from a port with root
role.
This type of timeout will not be considered a loop protection event. Loop protection is maintained
by keeping the port from forwarding but since this is not considered a loop event it will not be
factored into locking the port.

Example
This example shows how to set the Loop Protect capable partner to true for fe.1.1:
A4(rw)->set spantree lpcapablepartner fe.1.1 true

show spantree lpcapablepartner

Use this command to the Loop Protect capability of a link partner for one or more ports.

Syntax
show spantree lpcapablepartner [port port-string]

Parameters
port-string (Optional) Specifies port(s) for which to display Loop Protect capability
for its link partner.

Defaults
If no port-string is specified, Loop Protect capability for link partners is displayed for all ports.

11-44 Spanning Tree Configuration

 clear spantree lpcapablepartner

Mode
Switch command, read-only.

Example
This example shows how to display the Loop Protect partner capability for fe.1.1:
A4(rw)->show spantree lpcapablepartner port fe.1.1
Link partner of port fe.1.1 is not LoopProtect-capable

clear spantree lpcapablepartner

Use this command to reset the Loop Protect capability of port link partners to the default state of
false.

Syntax
clear spantree lpcapablepartner port-string

Parameters
port-string Specifies port(s) for which to clear their link partners’ Loop Protect
capability (reset to false).

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset the Loop Protect partner capability for fe.1.1:
A4(rw)->clear spantree lpcapablepartner fe.1.1

set spantree lpthreshold

Use this command to set the Loop Protect event threshold.

Syntax
set spantree lpthreshold value

Parameters
value Specifies the number of events that must occur during the event
window in order to lock a port/SID. The default value is 3 events. A
threshold of 0 specifies that ports will never be locked.

Defaults
None. The default event threshold is 3.

Extreme A4 CLI Reference 11-45

show spantree lpthreshold

Mode
Switch command, read-write.

Usage
The LoopProtect event threshold is a global integer variable that provides protection in the case of
intermittent failures. The default value is 3. If the event counter reaches the threshold within a
given period (the event window), then the port, for the given SID, becomes locked (that is, held
indefinitely in the blocking state). If the threshold is 0, the ports are never locked.

Example
This example shows how to set the Loop Protect threshold value to 4:
A4(rw)->set spantree lpthreshold 4

show spantree lpthreshold

Use this command to display the current value of the Loop Protect event threshold.

Syntax
show spantree lpthreshold

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the current Loop Protect threshold value:
A4(rw)->show spantree lpthreshold
The Loop Protect event threshold value is 4

clear spantree lpthreshold

Use this command to return the Loop Protect event threshold to its default value of 3.

Syntax
clear spantree lpthreshold

Parameters
None.

Defaults
None.

11-46 Spanning Tree Configuration

 set spantree lpwindow

Mode
Switch command, read-write.

Example
This example shows how to reset the Loop Protect event threshold to the default of 3:
A4(rw)->clear spantree lpthreshold

set spantree lpwindow

Use this command to set the Loop Protect event window value in seconds.

Syntax
set spantree lpwindow value

Parameters
value Specifies the number of seconds that comprise the period during which
Loop Protect events are counted. The default event window is 180
seconds.

Defaults
None.

Mode
Switch command, read-write.

Usage
The Loop Protect Window is a timer value, in seconds, that defines a period during which Loop
Protect events are counted. The default value is 180 seconds. If the timer is set to 0, the event
counter is not reset until the Loop Protect event threshold is reached. If the threshold is reached,
that constitutes a loop protection event.

Example
This example shows how to set the Loop Protect event window to 120 seconds:
A4(rw)->set spantree lpwindow 120

show spantree lpwindow

Use this command to display the current Loop Protect event window value.

Syntax
show spantree lpwindow

Parameters
None.

Extreme A4 CLI Reference 11-47

clear spantree lpwindow

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the current Loop Protect window value:
A4(rw)->show spantree lpwindow
The Loop Protect event window is set to 120 seconds

clear spantree lpwindow

Use this command to reset the Loop Protect event window to the default value of 180 seconds.

Syntax
clear spantree lpwindow

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset the Loop Protect event window to the default of 180 seconds:
A4(rw)->clear spantree lpwindow

set spantree lptrapenable

Use this command to enable or disable Loop Protect event notification.

Syntax
set spantree lptrapenable {enable | disable}

Parameters
enable | disable Enables or disables the sending of Loop Protect traps. Default is
disabled.

Defaults
None.

11-48 Spanning Tree Configuration

 show spantree lptrapenable

Mode
Switch command, read-write.

Usage
Loop Protect traps are sent when a Loop Protect event occurs, that is, when a port goes to listening
due to not receiving BPDUs. The trap indicates port, SID and loop protection status.

Example
This example shows how to enable sending of Loop Protect traps:
A4(rw)->set spantree lptrapenable enable

show spantree lptrapenable

Use this command to display the current status of Loop Protect event notification.

Syntax
show spantree lptrapenable

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the current Loop Protect event notification status:
A4(rw)->show spantree lptrapenable
The Loop Protect event notification status is enable

clear spantree lptrapenable

Use this command to return the Loop Protect event notification state to its default state of
disabled.

Syntax
clear spantree lptrapenable

Parameters
None.

Defaults
None.

Extreme A4 CLI Reference 11-49

set spantree disputedbpduthreshold

Mode
Switch command, read-write.

Example
This example shows how to reset the Loop Protect event notification state to the default of
disabled.
A4(rw)->clear spantree lptrapenable

set spantree disputedbpduthreshold

Use this command to set the disputed BPDU threshold, which is the number of disputed BPDUs
that must be received on a given port/SID until a disputed BPDU trap is sent.

Syntax
set spantree disputedbpduthreshold value

Parameters
value Specifies the number of disputed BPDUs that must be received on a
given port/SID to cause a disputed BPDU trap to be sent.
A threshold of 0 indicates that traps should not be sent. The default
value is 0.

Defaults
None.

Mode
Switch command, read-write.

Usage
A disputed BPDU is one in which the flags field indicates a designated role and learning, and the
priority vector is worse than that already held by the port. If a disputed BPDU is received the port
is forced to the listening state. Refer to the 802.1Q-2005 standard, IEEE Standard for Local and
Metropolitan Area Networks – Virtual Bridged Local Area Networks, for a full description of the dispute
mechanism, which prevents looping in cases of one-way communication.
The disputed BPDU threshold is an integer variable that represents the number of disputed
BPDUs that must be received on a given port/SID until a disputed BPDU trap is sent and a syslog
message is issued. For example, if the threshold is 10, then a trap is issued when 10, 20, 30, and so
on, disputed BPDUs have been received.
If the value is 0, traps are not sent. The trap indicates port, SID and total Disputed BPDU count.
The default is 0.

Example
This example shows how to set the disputed BPDU threshold value to 5:
A4(rw)->set spantree disputedbpduthreshold 5

11-50 Spanning Tree Configuration

 show spantree disputedbpduthreshold

show spantree disputedbpduthreshold

Use this command to display the current value of the disputed BPDU threshold.

Syntax
show spantree disputedbpduthreshold

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the current disputed BPDU threshold:
A4(rw)->show spantree disputedbpduthreshold
The disputed BPDU threshold value is 0

clear spantree disputedbpduthreshold

Use this command to return the disputed BPDU threshold to its default value of 0, meaning that
disputed BPDU traps should not be sent.

Syntax
clear spantree disputedbpduthreshold

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset the disputed BPDU threshold to the default of 0:
A4(rw)->clear spantree disputedbpduthreshold

Extreme A4 CLI Reference 11-51

show spantree nonforwardingreason

show spantree nonforwardingreason

Use this command to display the reason for placing a port in a non-forwarding state due to an
exceptional condition.

Syntax
show spantree nonforwardingreason port-string [sid sid]

Parameters
port-string Specifies port(s) for which to display the non-forwarding reason.
sid sid (Optional) Specifies the specific Spanning Tree(s) for which to display
the non-forwarding reason. Valid values are 0 - 4094. If not specified,
SID 0 is assumed.

Defaults
If no port-string is specified, non-forwarding reason is displayed for all ports.
If no SID is specified, SID 0 is assumed.

Mode
Switch command, read-only.

Usage
Exceptional conditions causing a port to be placed in listening or blocking state include a Loop
Protect event, receipt of disputed BPDUs, and loopback detection.

Example
This example shows how to display the non-forwarding reason on fe.1.1:
A4(rw)->show spantree nonforwardingreason port fe.1.1
The non-forwarding reason for port fe.1.1 on SID 0 is None

11-52 Spanning Tree Configuration

 12
802.1Q VLAN Configuration

This chapter describes the commands used to implement 802.1Q virtual LANs (VLANs). Refer to
Chapter 9, “Configuring VLANs,” in the Fixed Switching Configuration Guide for configuration
procedures and conceptual and other information.

For information about... Refer to page...

Viewing VLANs 12-1

Creating and Naming Static VLANs 12-3

Assigning Port VLAN IDs (PVIDs) and Ingress Filtering 12-5

Configuring the VLAN Egress List 12-10

Setting the Host VLAN 12-15

Enabling/Disabling GVRP (GARP VLAN Registration Protocol) 12-17

Configuring VLAN Associations 12-21

Viewing VLANs
Use the following command to display a list of VLANs currently configured on the device, to
determine how one or more VLANs were created, the ports allowed and disallowed to transmit
traffic belonging to VLAN(s), and if those ports will transmit the traffic with a VLAN tag
included.

show vlan
Use this command to display all information related to one or more VLANs.

Syntax
show vlan [static] [vlan-list] [portinfo [vlan vlan-list | vlan-name] [port port-
string]]

Parameters
static (Optional) Displays information related to static VLANs. Static VLANs are
manually created using the set vlan command (“set vlan” on page 12-3),
SNMP MIBs, or the WebView management application. The default VLAN,
VLAN 1, is always statically configured and can’t be deleted. Only ports
that use a specified VLAN as their default VLAN (PVID) will be displayed.
vlan-list (Optional) Displays information for a specific VLAN or range of VLANs.

Extreme A4 CLI Reference 12-1

show vlan

portinfo (Optional) Displays VLAN attributes related to one or more ports.

vlan vlan-list | (Optional) Displays port information for one or more VLANs.
vlan-name
port port-string (Optional) Displays port information for one or more ports.

Defaults
If no options are specified, all information related to static and dynamic VLANs will be displayed.

Mode
Switch command, read-only.

Usage
When you use the show vlan vlan-list command, only ports that have link state (port’s link LED is
lit) will be displayed. Use the static parameter to show all ports that are configured on a vlan,
whether they have link or not.

Example
This example shows how to display information for VLAN 1. In this case, VLAN 1 is named
“DEFAULT VLAN”. Ports allowed to transmit frames belonging to VLAN 1 are listed as egress
ports. Ports that won’t include a VLAN tag in their transmitted frames are listed as untagged
ports. There are no forbidden ports (prevented from transmitted frames) on VLAN 1:
A4(su)->show vlan 1
VLAN: 1 NAME: DEFAULT VLAN
VLAN Type: Default
Egress Ports
fe.1.1-10, fe.2.1-4, fe.3.1-7,
Forbidden Egress Ports
None.
Untagged Ports
fe.1.1-10, fe.2.1-4, fe.3.1-7,
Table 12-1 provides an explanation of the command output.

Table 12-1 show vlan Output Details

Output Field What It Displays...

VLAN VLAN ID.

NAME Name assigned to the VLAN.

Status Whether it is enabled or disabled.

VLAN Type Whether it is permanent (static) or dynamic.

Egress Ports Ports configured to transmit frames for this VLAN.

Forbidden Egress Ports prevented from transmitting frames for this VLAN.
Ports

Untagged Ports Ports configured to transmit untagged frames for this VLAN.

12-2 802.1Q VLAN Configuration

 Creating and Naming Static VLANs

Creating and Naming Static VLANs

Uses the following commands to create a new static VLAN, or to enable or disable existing
VLAN(s).

For information about... Refer to page...

set vlan 12-3

set vlan name 12-4

clear vlan 12-4

clear vlan name 12-5

set vlan
Use this command to create a new static IEEE 802.1Q VLAN, or to enable or disable an existing
VLAN.

Syntax
set vlan {create | enable | disable} vlan-list

Parameters
create | enable | Creates, enables or disables VLAN(s).
disable
vlan-list Specifies one or more VLAN IDs to be created, enabled or disabled. The ID
value may range between 1 and 4094.

Defaults
None.

Mode
Switch command, read-write.

Usage
Once a VLAN is created, you can assign it a name using the set vlan name command described in
“set vlan name” on page 12-4.
Each VLAN ID must be unique. If a duplicate VLAN ID is entered, the device assumes that the
Administrator intends to modify the existing VLAN.
Enter the VLAN ID using a unique number between 1 and 4094. The VLAN IDs of 0 and 4095 and
higher may not be used for user-defined VLANs. VLAN 0 is the null VLAN ID, indicating that the
tag header in the frame contains priority information rather than a VLAN ID. It cannot be
configured as a port VLAN ID.

Examples
This example shows how to create VLAN 3:
A4(su)->set vlan create 3

Extreme A4 CLI Reference 12-3

set vlan name

set vlan name

Use this command to set or change the ASCII name for a new or existing VLAN.

Syntax
set vlan name vlan-list vlan-name

Parameters
vlan-list Specifies the VLAN ID of the VLAN(s) to be named.
vlan-name Specifies the string used as the name of the VLAN (1 to 32 characters).

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the name for VLAN 7 to green:
A4(su)->set vlan name 7 green

clear vlan
Use this command to remove a static VLAN from the list of VLANs recognized by the device.

Syntax
clear vlan vlan-list

Parameters
vlan-list Specifies the VLAN ID of the VLAN(s) to be removed.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to remove a static VLAN 9 from the device’s VLAN list:
A4(su)->clear vlan 9

12-4 802.1Q VLAN Configuration

 clear vlan name

clear vlan name

Use this command to remove the name of a VLAN from the VLAN list.

Syntax
clear vlan name vlan-list

Parameters
vlan-list Specifies the VLAN ID of the VLAN(s) for which the name will be cleared.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the name for VLAN 9:
A4(su)->clear vlan name 9

Assigning Port VLAN IDs (PVIDs) and Ingress Filtering

Use the following commands to assign default VLAN IDs to untagged frames on one or more
ports, to configure VLAN ingress filtering and constraints, and to set the frame discard mode.

For information about... Refer to page...

show port vlan 12-5

set port vlan 12-6

clear port vlan 12-7

show port ingress filter 12-7

set port ingress filter 12-8

show port discard 12-9

set port discard 12-9

show port vlan

Use this command to display port VLAN identifier (PVID) information. PVID determines the
VLAN to which all untagged frames received on one or more ports will be classified.

Syntax
show port vlan [port-string]

Parameters
port-string (Optional) Displays PVID information for specific port(s).

Extreme A4 CLI Reference 12-5

set port vlan

Defaults
If port -string is not specified, port VLAN information for all ports will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display PVIDs assigned to fe.2.1 through 6. In this case, untagged
frames received on these ports will be classified to VLAN 1:
A4(su)->show port vlan fe.2.1-6
fe.2.1 is set to 1
fe.2.2 is set to 1
fe.2.3 is set to 1
fe.2.4 is set to 1
fe.2.5 is set to 1
fe.2.6 is set to 1

set port vlan

Use this command to configure the PVID (port VLAN identifier) for one or more ports.

Syntax
set port vlan port-string pvid [modify-egress | no-modify-egress]

Parameters
port-string Specifies the port(s) for which to configure a VLAN identifier.
pvid Specifies the VLAN ID of the VLAN to which port(s) will be added.
modify-egress (Optional) Adds port(s) to VLAN's untagged egress list and removes them
from other untagged egress lists.
no-modify-egress (Optional) Does not prompt for or make egress list changes.

Defaults
None.

Mode
Switch command, read-write.

Usage
The PVID is used to classify untagged frames as they ingress into a given port.

Example
This example shows how to add fe.1.10 to the port VLAN list of VLAN 4 (PVID 4).
A4(su)->set vlan create 4
A4(su)->set port vlan fe.1.10 4 modify-egress

12-6 802.1Q VLAN Configuration

 clear port vlan

clear port vlan

Use this command to reset a port’s 802.1Q port VLAN ID (PVID) to the host VLAN ID 1.

Note: The following command will reset the specified port’s egress status to tagged. To set the
specified ports back to the default egress status of untagged, you must issue the set port vlan
command as described on page 12-6.

Syntax
clear port vlan port-string

Parameters
port-string Specifies the port(s) to be reset to the host VLAN ID 1.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset ports fe.1.3 through 11 to a VLAN ID of 1 (Host VLAN):
A4(su)->clear port vlan fe.1.3-11

show port ingress-filter

Use this command to show all ports that are enabled for port ingress filtering, which limits
incoming VLAN ID frames according to a port VLAN egress list. If the VLAN ID specified in the
received frame is not on the port’s VLAN egress list, then that frame is dropped and not
forwarded.

Syntax
show port ingress-filter [port-string]

Parameters
port-string (Optional) Specifies the port(s) for which to display ingress filtering status.

Defaults
If port-string is not specified, ingress filtering status for all ports will be displayed.

Mode
Switch command, read-only.

Extreme A4 CLI Reference 12-7

set port ingress-filter

Example
This example shows how to display the port ingress filter status for ports 10 through 15 in unit 1.
In this case, the ports are disabled for ingress filtering:
A4(su)->show port ingress-filter fe.1.10-15
Port State
-------- ---------
fe.1.10 disabled
fe.1.11 disabled
fe.1.12 disabled
fe.1.13 disabled
fe.1.14 disabled
fe.1.15 disabled

set port ingress-filter

Use this command to discard all frames received with a VLAN ID that don’t match the port’s
VLAN egress list.

Syntax
set port ingress-filter port-string {disable | enable}

Parameters
port-string Specifies the port(s) on which to enable of disable ingress filtering.
disable | enable Disables or enables ingress filtering.

Defaults
None.

Mode
Switch command, read-write.

Usage
When ingress filtering is enabled on a port, the VLAN IDs of incoming frames are compared to the
port’s egress list. If the received VLAN ID does not match a VLAN ID on the port’s egress list, then
the frame is dropped.
Ingress filtering is implemented according to the IEEE 802.1Q standard.

Example
This example shows how to enable port ingress filtering on fe.1.3:
A4(su)->set port ingress-filter fe.1.3 enable

12-8 802.1Q VLAN Configuration

 show port discard

show port discard

Use this command to display the frame discard mode for one or more ports. Ports can be set to
discard frames based on whether or not the frame contains a VLAN tag. They can also be set to
discard both tagged and untagged frames, or neither.

Syntax
show port discard [port-string]

Parameters
port-string (Optional) Displays the frame discard mode for specific port(s).

Defaults
If port-string is not specified, frame discard mode will be displayed for all
ports.

Mode
Switch command, read-only.

Example
This example shows how to display the frame discard mode for fe.2.7. In this case, the port has
been set to discard all tagged frames:
A4(su)->show port discard fe.2.7
Port Discard Mode
------------ -------------
fe.2.7 tagged

set port discard

Use this command to set the frame discard mode on one or more ports.

Syntax
set port discard port-string {tagged | untagged | both | none}

Parameters
port-string Specifies the port(s) for which to set frame discard mode.
tagged | • Tagged - Discard all incoming (received) tagged packets on the defined
untagged | both | port(s).
none
• Untagged - Discard all incoming untagged packets.
• Both - All traffic will be discarded (tagged and untagged).
• None - No packets will be discarded.

Defaults
None.

Extreme A4 CLI Reference 12-9

Configuring the VLAN Egress List

Mode
Switch command, read-write.

Usage
The options are to discard all incoming tagged frames, all incoming untagged frames, neither
(essentially allow all traffic), or both (essentially discarding all traffic).
A common practice is to discard all tagged packet on user ports. Typically an Administrator does
not want the end users defining what VLAN they use for communication.

Example
This example shows how to discard all tagged frames received on port fe.3.3:
A4(su)->set port discard fe.3.3 tagged

Configuring the VLAN Egress List

Use the following commands to assign or remove ports on the egress list of a particular VLAN.
This determines which ports on the switch will be eligible to transmit frames for a particular
VLAN.
The port egress type for all ports can be set to tagged, forbidden, or untagged. In general, VLANs
have no egress (except for VLAN 1) until they are configured by static administration, or through
dynamic mechanisms such as GVRP.
Setting a port to forbidden prevents it from participating in the specified VLAN and ensures that
any dynamic requests (either through GVRP or dynamic egress) for the port to join the VLAN will
be ignored. Setting a port to untagged allows it to transmit frames without a tag header. This
setting is usually used to configure a port connected to an end user device. Frames sent between
VLAN aware switches are typically tagged.
The default VLAN defaults its egress to untagged for all ports.

For information about... Refer to page...

show port egress 12-10

set vlan forbidden 12-11

set vlan egress 12-12

clear vlan egress 12-12

show vlan dynamicegress 12-13

set vlan dynamicegress 12-14

show port egress

Use this command to display the VLAN membership for one or more ports.

Syntax
show port egress [port-string]

12-10 802.1Q VLAN Configuration

 set vlan forbidden

Parameters
port-string (Optional) Displays VLAN membership for specific port(s).

Defaults
If port-string is not specified, VLAN membership will be displayed for all ports.

Mode
Switch command, read-write.

Example
This example shows you how to show VLAN egress information for fe.1.1 through 3. In this case,
all three ports are allowed to transmit VLAN 1 frames as tagged and VLAN 10 frames as
untagged. Both are static VLANs:
A4(su)->show port egress fe.1.1-3
Port Vlan Egress Registration
Number Id Status Status
-------------------------------------------------------
fe.1.1 1 tagged static
fe.1.1 10 untagged static
fe.1.2 1 tagged static
fe.1.2 10 untagged static
fe.1.3 1 tagged static
fe.1.3 10 untagged static

set vlan forbidden

Use this command to prevent one or more ports from participating in a VLAN. This setting
instructs the device to ignore dynamic requests (either through GVRP or dynamic egress) for the
port to join the VLAN.

Syntax
set vlan forbidden vlan-id port-string

Parameters
vlan-id Specifies the VLAN for which to set forbidden port(s).
port-string Specifies the port(s) to set as forbidden for the specified vlan-id.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows you how to set fe.1.3 to forbidden for VLAN 6:
A4(su)->set vlan forbidden 6 fe.1.3

Extreme A4 CLI Reference 12-11

set vlan egress

set vlan egress

Use this command to add ports to the VLAN egress list for the device, or to prevent one or more
ports from participating in a VLAN. This determines which ports will transmit frames for a
particular VLAN.

Syntax
set vlan egress vlan-list port-string [untagged | forbidden | tagged]

Parameters
vlan-list Specifies the VLAN where a port(s) will be added to the egress list.
port-string Specifies one or more ports to add to the VLAN egress list of the specified
vlan-list.
untagged | (Optional) Adds the specified ports as:
forbidden |
• untagged — Causes the port(s) to transmit frames without an IEEE
tagged
802.1Q header tag.
• forbidden — Instructs the device to ignore dynamic requests (either
through GVRP or dynamic egress) from the port(s) to join the VLAN
and disallows egress on that port.
• tagged — Causes the port(s) to transmit 802.1Q tagged frames.

Defaults
If untagged, forbidden or tagged is not specified, the port will be added to the VLAN egress list
as tagged.

Mode
Switch command, read-write.

Examples
This example shows how to add fe.1.5 through 10 to the egress list of VLAN 7. Since no “tag”
parameter is specified, these ports will transmit VLAN 7 frames as tagged, the default condition:
A4(su)->set vlan egress 7 fe.1.5-10
This example shows how to forbid ports 13 through 15 in unit 1 from joining VLAN 7 and
disallow egress on those ports:
A4(su)->set vlan egress 7 fe.1.13-15 forbidden
This example shows how to allow port 2 in unit 1 to transmit VLAN 7 frames as untagged:
A4(su)->set vlan egress 7 fe.1.2 untagged

clear vlan egress

Use this command to remove ports from a VLAN’s egress list.

Note: The following command will reset the specified port’s egress status to tagged. To set the
specified ports back to the default egress status of untagged, you must issue the set vlan egress
command as described on page 12-12.

12-12 802.1Q VLAN Configuration

 show vlan dynamicegress

Syntax
clear vlan egress vlan-list port-string [forbidden]

Parameters
vlan-list Specifies the number of the VLAN from which a port(s) will be removed
from the egress list.
port-string Specifies one or more ports to be removed from the VLAN egress list of the
specified vlan-list.
forbidden (Optional) Clears the forbidden setting from the specified port(s) and resets
the port(s) as able to egress frames if so configured by either static or
dynamic means.

Defaults
If forbidden is not specified, tagged and untagged settings will be cleared.

Mode
Switch command, read-write.

Examples
This example shows how to remove fe.3.14 from the egress list of VLAN 9:
A4(su)->clear vlan egress 9 fe.3.14

This example shows how to remove all Ethernet ports in unit 2 from the egress list of VLAN 4:
A4(su)->clear vlan egress 4 fe.2.*

show vlan dynamicegress

Use this command to display the status of dynamic egress (enabled or disabled) for one or more
VLANs.

Syntax
show vlan dynamicegress [vlan-list]

Parameters
vlan-list (Optional) Displays dynamic egress status for specific VLAN(s).

Defaults
If vlan-list is not specified, the dynamic egress status for all VLANs will be displayed.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 12-13

set vlan dynamicegress

Example
This example shows how to display the dynamic egress status for VLANs 50-55:
A4(rw)->show vlan dynamicegress 50-55
VLAN 50 is disabled
VLAN 51 is disabled
VLAN 52 is disabled
VLAN 53 is enabled
VLAN 54 is enabled
VLAN 55 is enabled

set vlan dynamicegress

Use this command to administratively set the dynamic egress status for one or more VLANs.

Syntax
set vlan dynamicegress vlan-list {enable | disable}

Parameters
vlan-list Specifies the VLANs by ID to enable or disable dynamic egress.
enable | disable Enables or disables dynamic egress. Dynamic egress is disabled by default.

Defaults
None.

Mode
Switch command, read-write.

Usage
If dynamic egress is enabled for a particular VLAN, when a port receives a frame tagged with that
VLAN’s ID, the switch will add the receiving port to that VLAN’s egress list. Dynamic egress is
disabled on the A4 by default.
For example, assume you have 20 AppleTalk users on your network who are mobile users (that is,
use different ports every day), but you want to keep the AppleTalk traffic isolated in its own
VLAN. You can create an AppleTalk VLAN with a VLAN ID of 55 with a classification rule that all
AppleTalk traffic gets tagged with VLAN ID 55. Then, you enable dynamic egress for VLAN 55.
Now, when an AppleTalk user plugs into port fe.3.5 and sends an AppleTalk packet, the switch
will tag the packet to VLAN 55 and also add port fe.3.5 to VLAN 55’s egress list, which allows the
AppleTalk user to receive AppleTalk traffic.

Example
This example shows how to enable dynamic egress on VLAN 55:
A4(rw)->set vlan dynamicegress 55 enable

12-14 802.1Q VLAN Configuration

 Setting the Host VLAN

Setting the Host VLAN

Use the following commands to configure a host VLAN that only select devices are allowed to
access. This secures the host port for management-only tasks.

Note: The host port is the management entity of the device.

Commands

For information about... Refer to page...

show host vlan 12-15

set host vlan 12-15

clear host vlan 12-16

show host vlan

Use this command to display the current host VLAN.

Syntax
show host vlan

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the host VLAN:
A4(su)->show host vlan
Host vlan is 7.

set host vlan

Use this command to assign host status to a VLAN.

Syntax
set host vlan vlan-id

Extreme A4 CLI Reference 12-15

clear host vlan

Parameters
vlan-id Specifies the number of the VLAN to set as the host VLAN.

Defaults
None.

Mode
Switch command, read-write.

Usage
The host VLAN should be a secure VLAN where only designated users are allowed access. For
example, a host VLAN could be specifically created for device management. This would allow a
management station connected to the management VLAN to manage all ports on the device and
make management secure by preventing management via ports assigned to other VLANs.

Note: Before you can designate a VLAN as the host VLAN, you must create a VLAN using the set
of commands described in “Creating and Naming Static VLANs” on page 12-3.

Example
This example shows how to set VLAN 7 as the host VLAN:
A4(su)->set host vlan 7

clear host vlan

Use this command to reset the host VLAN to the default setting of 1.

Syntax
clear host vlan

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the host VLAN to the default setting:
A4(su)->clear host vlan

12-16 802.1Q VLAN Configuration

 Enabling/Disabling GVRP (GARP VLAN Registration Protocol)

Enabling/Disabling GVRP (GARP VLAN Registration Protocol)

Use the following commands to dynamically create VLANs across a switched network. The GVRP
command set is used to display GVRP configuration information, the current global GVRP state
setting, individual port settings (enable or disable) and timer settings.
Refer to Chapter 9, “Configuring VLANs,” in the Fixed Switching Configuration Guide for more
information about GVRP.

For information about... Refer to page...

show gvrp 12-17

show garp timer 12-18

set gvrp 12-19

clear gvrp 12-19

set garp timer 12-20

clear garp timer 12-20

show gvrp
Use this command to display GVRP configuration information.

Syntax
show gvrp [port-string]

Parameters
port-string (Optional) Displays GVRP configuration information for specific port(s).

Defaults
If port-string is not specified, GVRP configuration information will be displayed for all ports and
the device.

Mode
Switch command, read-only.

Example
This example shows how to display GVRP status for the device and for fw.2.1:
A4(su)->show gvrp fe.2.1
Global GVRP status is enabled.

Port Number GVRP status

----------- -----------
fe.2.1 disabled

Extreme A4 CLI Reference 12-17

show garp timer

show garp timer

Use this command to display GARP timer values for one or more ports.

Syntax
show garp timer [port-string]

Parameters
port-string (Optional) Displays GARP timer information for specific port(s).

Defaults
If port-string is not specified, GARP timer information will be displayed for all ports.

Mode
Switch command, read-only.

Example
This example shows how to display GARP timer information on ports 1 through 10 in unit 1:

Note: For a functional description of the terms join, leave, and leaveall timers, refer to the
standard IEEE 802.1Q documentation, which is not supplied with this device.

A4(su)->show garp timer fe.1.1-10

Port based GARP Configuration: (Timer units are centiseconds)
Port Number Join Leave Leaveall
----------- ---------- ---------- ----------
fe.1.1 20 60 1000
fe.1.2 20 60 1000
fe.1.3 20 60 1000
fe.1.4 20 60 1000
fe.1.5 20 60 1000
fe.1.6 20 60 1000
fe.1.7 20 60 1000
fe.1.8 20 60 1000
fe.1.9 20 60 1000
fe.1.10 20 60 1000
Table 12-2 provides an explanation of the command output. For details on using the set gvrp
command to enable or disable GVRP, refer to “set gvrp” on page 12-19. For details on using the set
garp timer command to change default timer values, refer to “set garp timer” on page 12-20.

Table 12-2 show gvrp configuration Output Details

Output Field What It Displays...

Port Number Port designation.

Join Join timer setting.

Leave Leave timer setting.

Leaveall Leavall timer setting.

12-18 802.1Q VLAN Configuration

 set gvrp

set gvrp
Use this command to enable or disable GVRP globally on the device or on one or more ports.

Syntax
set gvrp {enable | disable} [port-string]

Parameters
disable | Disables or enables GVRP on the device.
enable
port-string (Optional) Disables or enables GVRP on specific port(s).

Defaults
If port-string is not specified, GVRP will be disabled or enabled for all ports.

Mode
Switch command, read-write.

Examples
This example shows how to enable GVRP globally on the device:
A4(su)->set gvrp enable
This example shows how to disable GVRP globally on the device:
A4(su)->set gvrp disable
This example shows how to enable GVRP on fe.1.3:
A4(su)->set gvrp enable fe.1.3

clear gvrp
Use this command to clear GVRP status on one or more ports.

Syntax
clear gvrp [port-string]

Parameters
port-string (Optional) Clears GVRP status on specific port(s).

Defaults
If port-string is not specified, GVRP status will be cleared to the default condition for all ports.

Mode
Switch command, read-write.

Usage
This command does not affect the global state of GVRP. To enable or disable GVRP globally, use
the set gvrp enable | disable command.

Extreme A4 CLI Reference 12-19

set garp timer

Example
This example shows how to clear GVRP status on all ports on the device:
A4(su)->clear gvrp

set garp timer

Use this command to adjust the values of the join, leave, and leaveall timers.

Syntax
set garp timer {[join timer-value] [leave timer-value] [leaveall timer-value]}
port-string

Parameters
join timer-value Sets the GARP join timer in centiseconds (Refer to 802.1Q standard.)
leave timer-value Sets the GARP leave timer in centiseconds (Refer to 802.1Q standard.)
leaveall timer- Sets the GARP leaveall timer in centiseconds (Refer to 802.1Q standard.)
value
port-string Specifies the port(s) on which to configure GARP timer settings.

Defaults
None.

Mode
Switch command, read-write.

Usage
The setting of these timers is critical and should only be changed by personnel familiar with the
802.1Q standards documentation, which is not supplied with this device.

Examples
This example shows how to set the GARP join timer value to 100 centiseconds for all ports:
A4(su)->set garp timer join 100 *.*.*
This example shows how to set the leave timer value to 300 centiseconds for all ports:
A4(su)->set garp timer leave 300 *.*.*
This example shows how to set the leaveall timer value to 20000 centiseconds for all ports:
A4(su)->set garp timer leaveall 20000 *.*.*

clear garp timer

Use this command to reset GARP timers back to default values.

Syntax
clear garp timer {[join] [leave] [leaveall]} port-string

12-20 802.1Q VLAN Configuration

 Configuring VLAN Associations

Parameters
join (Optional) Resets the join timer to 20 centiseconds.
leave (Optional) Resets the leave timer to 60 centiseconds.
leaveall (Optional) Resets the leaveall time to 1000 centiseconds.
port-string Specifies the port or ports on which to reset the GARP timer(s).

Defaults
At least one optional parameter must be entered.

Mode
Switch command, read-write.

Example
The example shows how to reset the GARP leave timer to 60 centiseconds.
A4(su)->clear garp timer leave fe.1.1

Configuring VLAN Associations

A VLAN association is a classification rule based on either MAC address, IP subnet, or protocol.
Packets matching the applied rule are assigned to the configured VLAN.

Note: On the A4, only protocol-based VLAN associations are supported.

IP subnet and protocol-based rules work for IPv4 only.

The precedence order for MAC-based VLAN assignment is:
1. Policy
2. 802.1x VLAN tunnel
3. MAC-based VLAN Association
In most cases, dynamic egress is used along with VLAN association in order to ensure that user
traffic can egress on the receiving port. For example, if a VLAN association assigns a user's IP
traffic to VLAN 29, some method is needed to allow VLAN 29 to egress out the port that the user
is on. Dynamic egress is the most flexible way to do this. Refer to “set vlan dynamicegress” on
page 12-14 for more information.

For information about... Refer to page...

set vlan association 12-22

clear vlan association 12-22

show vlan association 12-23

Extreme A4 CLI Reference 12-21

set vlan association

set vlan association

Use this command to create a new 802.1Q VLAN classification association.

Syntax
set vlan association {mac mac-addr | subnet ip-addr ip-mask | protocol protocol-
list} vlan-id

Parameters
mac mac-addr Specifies the MAC address for the VLAN association. The MAC address
can be formatted as xx:xx:xx:xx:xx:xx or xx-xx-xx-xx-xx-xx.
subnet ip-addr ip-mask Specifies the IP address and subnet mask for the VLAN association.
protocol protocol-list Specifies the protocol or list of protocols for the VLAN association.
Specify the protocols by keyword or hexadecimal or decimal values,
separated by commas (,).
Keywords can be: arp, ip, or ipx.
Hexidecimal or decimal values can be in the range of 0x0600(1536) to
0xFFFF(65535).
vlan-id Specifies the VLAN.

Defaults
None.

Mode
Switch command, read-write.

Usage
Only protocol-based VLAN associations are supported on A4 switches. Use the set vlan
dynamicegress command to ensure that the receiving port is added to the egress list for the
VLAN.

Examples
This example classifies a MAC address to VLAN 2.
A4(su)->set vlan association mac 00-00-0c-40-0f-bc 2
A4(su)->set vlan dynamicegress 2 enable
This example classifies two protocols to VLAN 3.
A4(su)->set vlan association protocol arp,ip 3
A4(su)->set vlan dynamicegress 3 enable
This example classifies subnet 192.168.10.0 to VLAN 4.
A4(su)->set vlan association subnet 192.168.10.0 255.255.255.0 4
A4(su)->set vlan dynamicegress 4 enable

clear vlan association

Use this command to clear, or delete, VLAN associations.

12-22 802.1Q VLAN Configuration

 show vlan association

Syntax
clear vlan association [mac [mac-addr]] | [subnet [ip-addr ip-mask]] | [protocol
[protocol-list]]

Parameters
mac [mac-addr] (Optional) Specifies the MAC address for the VLAN association to clear.
The MAC address can be formatted as xx:xx:xx:xx:xx:xx or xx-xx-xx-xx-
xx-xx.
If a specific MAC address is not entered, all MAC VLAN associations
are cleared.
subnet [ip-addr ip- (Optional) Specifies the IP address and subnet mask for the VLAN
mask ] association to clear.
If no subnet address and mask are specified, all subnet VLAN
associations are cleared.
protocol [protocol-list] (Optional) Specifies the protocol or list of protocols for the VLAN
association to clear. Specify the protocols by keyword or hexadecimal or
decimal values, separated by commas (,).
Keywords can be: arp, ip, or ipx.
Hexidecimal or decimal values can be in the range of 0x0600(1536) to
0xFFFF(65535).
If no protocol is specified, all protocol VLAN associations are cleared.

Defaults
If no optional parameter is specified, all VLAN associations are cleared.
If mac is specified but no MAC address is specified, all MAC VLAN associations are cleared.
If subnet is specified but no IP address and mask is specified, all IP subnet VLAN associations are
cleared.
If protocol is specified but no protocols are specified, all protocol VLAN associations are cleared.

Mode
Switch command, read-write.

Example
This example clears all MAC VLAN associations.
A4(su)->clear vlan association mac

show vlan association

Use this command to display configured VLAN associations.

Syntax
show vlan association [mac] | [subnet} | [protocol]

Extreme A4 CLI Reference 12-23

show vlan association

Parameters
mac (Optional) Display MAC VLAN associations.
subnet (Optional) Display IP subnet VLAN associations.
protocol (Optional) Display protocol VLAN associations.

Defaults
If no optional parameter is specified, all configured VLAN associations are displayed.

Mode
Switch mode, read-only.

Example
This example displays all VLAN associations.
A4(su)->show vlan association
VLAN ID IP Mask IP Subnet
------- ---------------- ----------------
4 192.168.10.0 255.255.255.0

MAC Address VLAN ID

----------------- -------
00:00:0c:40:0f:bc 2

Protocol(s) VLAN ID
------------ -----
arp 3

12-24 802.1Q VLAN Configuration

 13
Policy Classification Configuration

This chapter describes the Policy Classification set of commands and how to use them. Refer to
Chapter 16, “Configuring Policy,” in the Fixed Switching Configuration Guide for configuration
procedures, examples, and other information.

For information about... Refer to page...

Configuring Policy Profiles 13-1

Configuring Classification Rules 13-5

Assigning Ports to Policy Profiles 13-14

Configuring Policy Class of Service (CoS) 13-17

Configuring Policy Profiles

Uses the following commands to review, create, change and remove user profiles that relate to
business-driven policies for managing network resources.

Note: This device supports profile-based CoS traffic rate limiting only. Policy rules specifying CoS
will not support inbound rate limiting.

For information about... Refer to page...

show policy profile 13-1

set policy profile 13-3

clear policy profile 13-4

show policy profile

Use this command to display policy profile information.

Syntax
show policy profile {all | profile-index [consecutive-pids] [-verbose]}

Parameters
all | profile-index Displays policy information for all profile indexes or a specific profile index.
consecutive-pids (Optional) Displays information for specified consecutive profile indexes.
-verbose (Optional) Displays detailed information.

Extreme A4 CLI Reference 13-1

show policy profile

Defaults
If optional parameters are not specified, summary information will be displayed for the specified
index or all indices.

Mode
Switch command, read-only.

Example
This example shows how to display policy information for profile 11:
A4(su)->show policy profile 11
Profile Index : 11
Profile Name : Auth1
Row Status : active
Port VID Status : Enable
Port VID Override : 11
CoS : 0
CoS Status : Disable
Egress Vlans : none
Forbidden Vlans : none
Untagged Vlans : none
Rule Precedence : 1-31
:MACSource(1),MACDest(2),IPSource(12),
:IPDest(13),UDPSrcPort(15),UDPDestPort(16),
:TCPSrcPort(17),TCPDestPort(18),IPTOS(21),
:IPProto(22),Ether(25),VLANTag(27)
Admin Profile Usage : none
Oper Profile Usage : none
Dynamic Profile Usage : none
Table 13-1 provides an explanation of the command output.

Table 13-1 show policy profile Output Details

Output Field What It Displays...

Profile Index Number of the profile.

Profile Name User-supplied name assigned to this policy profile.

Row Status Whether or not the policy profile is enabled (active) or disabled.

Port VID Status Whether or not PVID override is enabled or disabled for this profile. If all
classification rules associated with this profile are missed, then this parameter, if
specified, determines default behavior.

Port VID Override The PVID assigned to packets, if PVID override is enabled.

CoS CoS priority value to assign to packets, if CoS override is enabled.

CoS Status Whether or not Class of Service override is enabled or disabled for this profile. If all
classification rules associated with this profile are missed, then this parameter, if
specified, determines default behavior.

Egress VLANs VLAN(s) that ports to which the policy profile is assigned can use for tagged egress.

Forbidden VLANs VLAN(s) forbidden to ports to which the policy profile is assigned.

Untagged VLANs VLAN(s) that ports to which the policy profile is assigned can use for untagged
egress.

Rule Precedence Displays the precedence of types of rules.

13-2 Policy Classification Configuration

 set policy profile

Table 13-1 show policy profile Output Details (Continued)

Output Field What It Displays...

Admin Profile Usage Ports administratively assigned to use this policy profile.

Oper Profile Usage Ports currently assigned to use this policy profile.

Dynamic Profile Port dynamically assigned to use this policy profile.

Usage

set policy profile

Use this command to create a policy profile entry.

Syntax
set policy profile profile-index [name name] [pvid-status {enable | disable}]
[pvid pvid] [cos-status {enable | disable}] [cos cos] [egress-vlans egress-
vlans][forbidden-vlans forbidden-vlans] [untagged-vlans untagged-vlans]
[precedence precedence-list] [append] [clear]

Parameters
profile-index Specifies an index number for the policy profile. Valid values are 1 - 255.
name name (Optional) Specifies a name for the policy profile. This is a string from 1 to
64 characters.
pvid-status (Optional) Enables or disables PVID override for this profile. If all
enable | disable classification rules associated with this profile are missed, then this
parameter, if specified, determines default behavior.
pvid pvid (Optional) Specifies the PVID to packets, if PVID override is enabled and
invoked as default behavior.
cos-status enable (Optional) Enables or disables Class of Service override for this profile. If all
| disable classification rules associated with this profile are missed, then this
parameter, if specified, determines default behavior.
Note: A maximum of 99 rules can be supported per policy profile for policy profiles
that have cos-status enabled.
cos cos (Optional) Specifies a CoS value to assign to packets, if CoS override is
enabled and invoked as default behavior. Valid values are 0 to 7.
egress-vlans (Optional) Specifies that the port to which this policy profile is applied
egress-vlans should be added to the egress list of the VLANs defined by egress-vlans.
Packets will be formatted as tagged.
forbidden-vlans (Optional) Specifies that the port to which this policy profile is applied
forbidden-vlans should be added as forbidden to the egress list of the VLANs defined by
forbidden-vlans. Packets from this port will not be allowed to participate in
the listed VLANs.
untagged-vlans (Optional) Specifies that the port to which this policy profile is applied
untagged-vlans should be added to the egress list of the VLANs defined by untagged-vlans.
Packets will be formatted as untagged.
append (Optional) Appends this policy profile setting to settings previously
specified for this policy profile by the egress-vlans,forbidden-vlans, or
untagged-vlans parameters.
If append is not used, previous VLAN settings are replaced.

Extreme A4 CLI Reference 13-3

clear policy profile

clear (Optional) Removes this policy profile setting from settings previously
specified for this policy profile by the egress-vlans,forbidden-vlans, or
untagged-vlans parameters.
precedence (Optional) Assigns a rule precedence to this profile. Lower values will be
precedence-list given higher precedence. For a list of values, refer to the show policy
profile command output.

Defaults
If optional parameters are not specified, none will be applied.

Mode
Switch command, read-write.

Example
This example shows how to create a policy profile 1 named “netadmin” with PVID override
enabled for PVID 10, and Class-of-Service override enabled for CoS 5. This profile can use VLAN
10 for untagged egress:
A4(su)->set policy profile 1 name netadmin pvid-status enable pvid 10 cos-status
enable cos 5 untagged-vlans 10

clear policy profile

Use this command to delete a policy profile entry.

Syntax
clear policy profile profile-index

Parameters
profile-index Specifies the index number of the profile entry to be deleted. Valid values
are 1 to 255.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to delete policy profile 8:
A4(su)->clear policy profile 8

13-4 Policy Classification Configuration

 Configuring Classification Rules

Configuring Classification Rules

Use these commands to review, create, assign, and unassign classification rules to policy profiles.
This maps user profiles to protocol-based frame filtering policies.

Note: A4, B3, B5, C3, C5, and G3 devices support profile-based CoS traffic rate limiting but do not
support rule-based rate limiting.

For information about... Refer to page...

show policy rule 13-5

show policy capability 13-7

set policy rule 13-9

clear policy rule 13-12

clear policy all-rules 13-14

show policy rule

Use this command to display policy classification rule information.

Syntax
show policy rule [all | admin-profile | profile-index] [ether | ipproto |
ipdestsocket | ipsourcesocket | iptos | macdest | macsource | tcpdestport |
tcpsourceport | udpdestport | udpsourceport] [data] [mask mask] [port-string port-
string] [rule-status {active | not-in-service | not-ready}] [storage-type {non-
volatile | volatile}] [vlan vlan] | [drop | forward] [dynamic-pid dynamic-pid]
[cos cos] [admin-pid admin-pid] [-verbose] [usage-list] [display-if-used]

Parameters
all | admin- Displays policy classification rules for all profiles, the admin-profile, or for
profile | profile- a specific profile index number. Valid values are 1 - 1023.
index
ether Displays Ethernet type II rules.
ipproto Displays IP protocol field in IP packet rules.
ipdestsocket Displays IP destination address rules.
ipsourcesocket Displays IP source address rules.
iptos Displays Type of Service rules.
macdest Displays MAC destination address rules.
macsource Displays MAC source address rules.
tcpdestport Displays TCP destination port rules.
tcpsourceport Displays TCP source port rules.
udpdestport Displays UDP destination port rules.
udpsourceport Displays UDP source port rules.

Extreme A4 CLI Reference 13-5

show policy rule

data Displays rules for a predefined classifier. This value is dependent on the
classification type entered. Refer to Table 13-3 for valid values for each
classification type.
mask mask (Optional) Displays rules for a specific data mask. Refer to Table 13-3 for
valid values for each classification type and data value.
port-string port- (Optional) Displays rules related to a specific ingress port.
string
rule-status active (Optional) Displays rules related to a specific rules status.
| not-in-service |
not-ready
storage-type non- (Optional) Displays rules configured for either non-volatile or volatile
volatile | volatile storage.
vlan vlan (Optional) Displays rules for a specific VLAN ID.
drop | forward Displays rules based on whether matching packets will be dropped or
forwarded.
dynamic-pid Displays rules associated with a specific dynamic policy ID.
dynamic-pid
cos cos (Optional) Displays rules for a Class-of-Service value.
admin-pid Displays rules associated with a specific administrative policy ID [1..1023].
admin-pid
-verbose (Optional) Displays detailed information.
usage-list (Optional) If selected, each rule's usage-list shall be checked and shall
display only those ports which have applied this rule.
display-if-used (Optional) Displays rule(s) only if they are applied to at least one port.

Defaults
If verbose is not specified, summary information will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display policy classification information for Ethernet type 2 rules
A4(su)->show policy rule ether
|PID |Rule Type |Rule Data |Mk|PortStr |RS|ST|VLAN|CoS |U|
|02 |Ether |2048 (0x0800) |16|All | A|NV|fwrd| |?|
|02 |Ether |2049 (0x0801) |16|All | A|NV|drop| |?|
|02 |Ether |2989 (0x0bad) |16|All | A|NV|drop| |?|
|02 |Ether |33079 (0x8137) |16|All | A|NV|drop| |?|
This example shows how to display policy classification information for administrative rule 1
A4(su)->show policy rule admin-pid 1
|Admin|Rule Type |Rule Data |Mk|PortStr |RS|ST|dPID|aPID|U|
|admin|Port |fe.1.1 |16|fe.1.1 | A|NV| | 1|?|
|admin|Port |fe.1.2 |16|fe.1.2 | A|NV| | 1|?|
|admin|Port |fe.1.3 |16|fe.1.3 | A|NV| | 1|?|
|admin|Port |fe.1.4 |16|fe.1.4 | A|NV| | 1|?|
|admin|Port |fe.1.5 |16|fe.1.5 | A|NV| | 1|?|
|admin|Port |fe.1.6 |16|fe.1.6 | A|NV| | 1|?|

13-6 Policy Classification Configuration

 show policy capability

|admin|Port |fe.1.7 |16|fe.1.7 | A|NV| | 1|?|

|admin|Port |fe.1.8 |16|fe.1.8 | A|NV| | 1|?|
|admin|Port |fe.1.9 |16|fe.1.9 | A|NV| | 1|?|
|admin|Port |fe.1.10 |16|fe.1.10 | A|NV| | 1|?|
|admin|Port |fe.1.11 |16|fe.1.11 | A|NV| | 1|?|
|admin|Port |fe.1.12 |16|fe.1.12 | A|NV| | 1|?|
Table 13-2 provides an explanation of the command output.

Table 13-2 show policy rule Output Details

Output Field What It Displays...

PID Profile index number. Assigned to this classification rule with the set policy profile
command (“set policy profile” on page 13-3).

Rule Type Type of classification rule. Refer to Table 13-3 for valid types.

Rule Data Rule data value. Refer to Table 13-3 for valid values for each classification type.

Mk Rule data mask. Refer to Table 13-3 for valid values for each classification data
value.
PortStr Ingress port(s) to which this rule applies.

RS Whether or not the status of this rule is active (A), not in service or not ready.

ST Whether or not this rule’s storage type is non-volatile (NV) or volatile (V).

VLAN VLAN ID to which this rule applies and whether or not matching packets will be
dropped or forwarded.

CoS If applicable, Class of Service value to which this rule applies.

U Whether or not this rule has been used.

dPID Whether or not this is a dynamic profile ID.

aPID Whether or not this is an administrative profile ID.

show policy capability

Use this command to display detailed policy classification capabilities supported by your A4
device.

Syntax
show policy capability

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Extreme A4 CLI Reference 13-7

show policy capability

Usage
Use this command to display detailed policy classification capabilities supported by your A4
device. The output of this command shows a table listing classifiable traffic attributes and the type
of actions, by rule type, that can be executed relative to each attribute. Above the table is a list of
all the actions possible on this device.
The left-most column of the table lists all possible classifiable traffic attributes. The next two
columns from the left indicate how policy profiles may be assigned, either administratively or
dynamically. The next four columns from the left indicate the actions that may be performed. The
last three columns indicate auditing options.
An x in an action column for a traffic attribute row indicates that your system has the capability to
perform that action for traffic classified by that attribute.

Example
This example shows how to display the device’s policy classification capabilities. Refer to “set
policy rule” on page 13-9 for a description of the parameters displayed:
A4(su)->show policy capability
The following rules related to policy are supported in this device:
VLAN Forwarding Priority Permit
Deny Rules Table Rule-Use Notification
CosTable Longest Prefix Rules
=============================================================
| | D | | | | | F | | | D |
| | Y | | | | | O | S | | I |
| | N | A | | | | R | Y | | S |
| | A | D | V | | D | W | S | T | A |
| | M | M | L | C | R | A | L | R | B |
| | I | I | A | O | O | R | O | A | L |
| SUPPORTED RULE TYPES | C | N | N | S | P | D | G | P | E |
=============================================================
|MAC source address | | | | X | X | X | | | |
|MAC destination address | | | | X | X | X | | | |
|IPX source address | | | | | | | | | |
|IPX destination address | | | | | | | | | |
|IPX source socket | | | | | | | | | |
|IPX destination socket | | | | | | | | | |
|IPX transmission control | | | | | | | | | |
|IPX type field | | | | | | | | | |
|IPv6 source address | | | | | | | | | |
|IPv6 destination address | | | | | | | | | |
|IPv6 flow label | | | | | | | | | |
|IP source address | | | | X | X | X | | | |
|IP destination address | | | | X | X | X | | | |
|IP fragmentation | | | | | | | | | |
|UDP port source | | | | X | X | X | | | |
|UDP port destination | | | | X | X | X | | | |
|TCP port source | | | | X | X | X | | | |
|TCP port destination | | | | X | X | X | | | |
|ICMP packet type | | | | | | | | | |
|TTL | | | | | | | | | |
|IP type of service | | | | X | X | X | | | |

13-8 Policy Classification Configuration

 set policy capability ipv6dest

|IP proto | | | | X | X | X | | | |
|Ether II packet type | | | X | X | X | X | | | |
|LLC DSAP/SSAP/CTRL | | | | | | | | | |
|VLAN tag | | | | | | | | | |
|Replace tci | | | | | | | | | |
|Port string | X | X | X | X | X | X | | | |
=============================================================

set policy capability ipv6dest

Use this command to enable or disable the IPv6 destination capability for policy rules on the
device.

Syntax
set policy capability ipv6dest {enable | disable}

Parameters
enable Enables the IPv6 destination policy capability.
disable Disables the IPv6 destination policy capability.

Defaults
The IPv6 destination policy capability is disabled by default.

Mode
Switch command, read-write.

Example
This example shows how to enable the IPv6 destination policy capability on the device:
A4(su)->set policy capability enable

set policy rule

Use this command to assign incoming untagged frames to a specific policy profile and to VLAN or
Class-of-Service classification rules.

Note: Refer to the latest Release Notes for information about limits on certain rule types for this
platform.

Syntax
This command has two forms of syntax—one to create an admin rule, and the other to create a
traffic classification rule and attach it to a policy profile.
set policy rule admin-profile vlantag data admin-pid profile-index [port-string
port-string]

set policy rule profile-index {ether | ipproto | ipdestsocket | ipsourcesocket |

iptos | macdest | macsource | tcpdestport | tcpsourceport | udpdestport |
udpsourceport} data [mask mask] {[vlan vlan] [cos cos] | [drop | forward]}

Extreme A4 CLI Reference 13-9

set policy rule

Note: Classification rules are automatically enabled when created.

Parameters
The following parameters apply to creating an admin rule. See the Usage section below for more
information about admin rules.

admin-profile Specifies that this is an admin rule.

vlantag data Classifies based on VLAN tag specified by data. Value of data can range
from 1 to 4094 or 0xFFF.
admin-pid Associates this admin rule with a policy profile, identified by its index
profile-index number. Policy profiles are configured with the set policy profile
command as described in “set policy profile” on page 13-3.
Valid profile-index values are 1- 255.
port-string port-string (Optional) Assigns this rule to specific ingress port(s) and sets tagged
egress for the VLAN on the ports.
If this parameter is not used, the rule will be applied to all ports, but no
tagged egress will be set.

The following parameters apply to creating a traffic classification rule.

profile-index Specifies a policy profile number to which this rule will be assigned.
Policy profiles are configured with the set policy profile command as
described in “set policy profile” on page 13-3. Valid profile-index values
are 1- 255.
ether Specifies that the rule should apply to traffic with the specified type field
in Ethernet II packet.
ipproto Specifies that the rule should apply to traffic with the specified Protocol
field in IP packet.
ipdestsocket Specifies that the rule should apply to traffic with the specified
destination IP address with optional post-fixed TCP or UDP port.
ipsourcesocket Specifies that the rule should apply to traffic with the specified source IP
address, with optional post-fixed TCP or UDP port.
iptos Specifies that the rule should apply to traffic with the specified Type of
Service field in IP packet.
macdest Specifies that the rule should apply to traffic with the specified MAC
destination address.
macsource Specifies that the rule should apply to traffic with the specified MAC
source address.
tcpdestport Specifies that the rule should apply to traffic with the specified TCP
destination port.
tcpsourceport Specifies that the rule should apply to traffic with the specified TCP
source port.
udpdestport Specifies that the rule should apply to traffic with the specified UDP
destination port.

13-10 Policy Classification Configuration

 set policy rule

udpsourceport Specifies that the rule should apply to traffic with the specified UDP
source port.
data Specifies the code for the specified traffic classifier (listed above). This
value is dependent on the classification type entered. Refer to Table 13-3
for valid values for each classification type.
mask mask (Optional) Specifies the number of significant bits to match, dependent on
the data value entered. Refer to Table 13-3 for valid values for each
classification type and data value.
vlan vlan Specifies the action of the rule is to classify to a VLAN ID.
cos cos Specifies the action of the rule is to classify to a Class-of-Service ID. Valid
values are 0 - 4095. A value of -1 indicates that no CoS forwarding
behavior modification is desired.
drop | forward Specifies that packets within this classification will be dropped or
forwarded.

Defaults
None.

Mode
Switch command, read-write.

Usage
An admin rule can be used to map incoming tagged frames to a policy role (profile). There can be
only one admin rule configured globally per system (stack), although other admin rules can be
applied to specific ports. Typically, this rule is used to implement the “User + IP phone” feature.
You would configure a policy profile/role for IP phones (for example, assigning a high priority
and TOS/DSCP), then associate that policy profile with the admin rule, and associate the admin
rule with the desired ports. Users authenticating over the same port will typically use a
dynamically assigned policy role.

Note: Refer to Chapter 10, “Configuring User Authentication,” in the Fixed Switching Configuration
Guide for a more detailed discussion of the User + IP phone feature.

A policy classification rule has two main parts: Traffic Description and Actions. The Traffic
Description identifies the type of traffic to which the rule will pertain. Actions specify whether
that traffic will be assigned class of service, assigned to a VLAN, or both.
Table 13-3 provides the set policy rule data values that can be entered for a particular parameter,
and the mask bits that can be entered for each classifier associated with that parameter.

Table 13-3 Valid Values for Policy Classification Rules

Classification Rule Parameter data value mask bits

ether Type field in Ethernet II packet: Not applicable.

1536 - 65535 or 0x600 - 0xFFFF

ipproto Protocol field in IP packet: Not applicable.

0 - 255 or 0 - 0xFF

Extreme A4 CLI Reference 13-11

clear policy rule

Table 13-3 Valid Values for Policy Classification Rules (Continued)

Classification Rule Parameter data value mask bits

Destination or Source IP Address: IP Address in dotted decimal 1 - 48

ipdestsocket format: 000.000.000.000 and Note: If no mask is specified, a
ipsourcesocket (Optional) post-fixed port: 0 - default mask of 32 is applied to
65535 IP addresses and a default
mask of 48 is applied to IP
addresses plus port.

iptos Type of Service field in IP packet: Not applicable.

0 - 252 or 0 - 0xFC

Destination or Source MAC: MAC Address: 00-00-00-00-00- 1 - 48

macdest 00
macsource

Destination or Source TCP port: TCP Port Number: 1 - 16

tcpdestport 0 - 65535 or 0 - 0xFFFF
tcpsourceport

Destination or Source UDP port: UDP Port Number: 1 - 16

udpsourceport 0 - 65535 or 0 - 0xFFFF
udpdestport

vlantag VLAN tag: 1- 4094 Not applicable.

Examples
This example shows how to use Table 13-3 to assign a rule to policy profile 3 that will filter
Ethernet II Type 1526 frames to VLAN 7:
A4(su)->set policy rule 3 ether 1526 vlan 7
This example shows how to use Table 13-3 to assign a rule to policy profile 5 that will forward
UDP packets from source port 45:
A4(su)->set policy rule 5 udpsourceport 45 forward
This example shows how to use Table 13-3 to assign a rule to policy profile 1 that will drop IP
source traffic from IP address 1.2.3.4, UDP port 67.
A4(su)->set policy rule 1 ipsourcesocket 1.2.3.4:67 mask 48 drop

clear policy rule

Use this command to delete policy classification rule entries.

Syntax
This command has two forms of syntax—one to clear an admin rule (for policy ID 0), and the other
to clear a classification rule.
clear policy rule admin-profile vlantag data [port-string port-string]

clear policy rule profile-index {all-pid-entries | {ether | ipproto | ipdestsocket

| ipsourcesocket | iptos | macdest | macsource | tcpdestport | tcpsourceport |
udpdestport | udpsourceport}}

13-12 Policy Classification Configuration

 clear policy rule

Parameters
The following parameters apply to deleting an admin rule.

admin-profile Specifies that the rule to be deleted is an admin rule for policy ID 0.
vlantag data Deletes the rule based on VLAN tag specified by data. Value of data can
range from 1 to 4094 or 0xFFF.
port-string port-string (Optional) Specifies the port or ports to clear the rule from.

The following parameters apply to deleting a classification rule.

profile-index Specifies a policy profile for which to delete classification rules. Valid
profile-index values are 1 - 255.
all-pid-entries Deletes all entries associated with the specified policy profile.
ether Deletes associated Ethernet II classification rule.
ipproto Deletes associated IP protocol classification rule.
ipdestsocket Deletes associated IP destination classification rule.
ipsourcesocket Deletes associated IP source classification rule.
iptos Deletes associated IP Type of Service classification rule.
macdest Deletes associated MAC destination address classification rule.
macsource Deletes associated MAC source address classification rule.
tcpdestport Deletes associated TCP destination port classification rule.
tcpsourceport Deletes associated TCP source port classification rule.
udpdestport Deletes associated UDP destination port classification rule.
udpsourceport Deletes associated UDP source port classification rule.

Defaults
When applicable, data and mask must be specified for individual rules to be cleared.

Mode
Switch command, read-write.

Examples
This example shows how to delete Ethernet II Type 1526 classification rule entries associated with
policy profile 1 from all ports.
A4(su)->clear policy rule 1 ether 1526
This example shows how to remove a rule from policy profile 5 that will forward UDP frames
from source port 45.
A4(su)->clear policy rule 5 udpsourceport 45

Extreme A4 CLI Reference 13-13

clear policy all-rules

clear policy all-rules

Use this command to remove all policy classification rules.

Syntax
clear policy all-rules

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to remove all administrative and policy index rules:
A4(su)->clear policy all-rules

Assigning Ports to Policy Profiles

Note: Refer to the latest firmware Release Notes for this platform for information about policy limits
for this platform.

Use the following commands to assign and unassign ports to policy profiles.

For information about... Refer to page...

set policy port 13-14

clear policy port 13-15

show policy port 13-15

set policy port

Use this command to assign ports to a policy profile.

Syntax
set policy port port-string profile-index

Parameters
port-string Specifies the port(s) to add to the policy profile.
profile-index Specifies the ID of the policy profile (role) to which the port(s) will be
added. This value must match the profile-index value assigned using the
set policy profile command (“set policy profile” on page 13-3) in order
for a policy profile to be active on the specified port.

13-14 Policy Classification Configuration

 clear policy port

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to allow Ethernet ports 5 through 15 in unit 1 to transmit frames
according to policy profile 1:
A4(su)->set policy port fe.1.5-15 1

clear policy port

Use this command to remove a policy profile from one or more ports.

Syntax
clear policy port port-string profile-index

Parameters
port-string Specifies the port(s) from which to remove the policy profile.
profile-index Specifies the ID of the policy profile (role) to which the port(s) will be
added. This value must match the profile-index value assigned using the
set policy profile command (“set policy profile” on page 13-3) in order
for a policy profile to be active on the specified port.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to remove policy profile 10 from port 21 in unit 1:
A4(rw)->clear policy port fe.1.21 10

show policy port

Use this command to display policy information per port.

Syntax
show policy port [port-string]

Parameters
port-string {Optional) Specifies the port(s) for which to display policy information.

Extreme A4 CLI Reference 13-15

show policy port

Defaults
If no port is specified, information about all ports will be displayed.

Mode
Switch command, read-only.

Example
This example displays information about all physical ports.
A4 switch(su)->show policy port
Port Admin Pid Oper Pid
-------- --------- --------
fe.1.1 - -
fe.1.2 - -
fe.1.3 - -
fe.1.4 - -
fe.1.5 - -
fe.1.6 - -
fe.1.7 - -
fe.1.8 - -
fe.1.9 - -
fe.1.10 - -
fe.1.11 - -
fe.1.12 - -
fe.1.13 - -
fe.1.14 - -
fe.1.15 - -
fe.1.16 - -
ge.1.17 - -
ge.1.18 - -
ge.1.19 - -
ge.1.20 - -

13-16 Policy Classification Configuration

 Configuring Policy Class of Service (CoS)

Configuring Policy Class of Service (CoS)

Note: It is recommended that you use Extreme Networks NetSight Policy Manager as an
alternative to CLI for configuring policy-based CoS on the switches.

The A4 supports Class of Service (CoS), which allows you to assign mission-critical data to a
higher priority through the device by delaying less critical traffic during periods of congestion.
The higher priority traffic going through the device is serviced first (before lower priority traffic).
The Class of Service capability of the device is implemented by a priority queueing mechanism.
Class of Service is based on the IEEE 802.1D (802.1p) standard specification, and allows you to
define eight priorities (0-7, with 7 granted highest priority) and up to 8 transmit queues (0-7) for
each port.
By default, policy-based CoS is disabled on the device, and default or user-assigned port-based
802.1D (802.1p) settings are used to determine traffic prioritization. When policy-based CoS is
enabled, the default and user-assigned policy-based settings will override port-based settings
described in Chapter 14, Port Priority and Rate Limiting Configuration.
Class of Service functionality can also be used to control broadcast, unknown unicast, and/or
multicast flooding. This feature prevents configured ports from being disrupted by a traffic storm
by rate-limiting specific types of packets through those ports.
Refer to Chapter 17, “Configuring Quality of Service,” in the Fixed Switching Configuration Guide
for configuration procedures, examples, and more information about CoS.

For information about... Refer to page...

set cos state 13-18

show cos state 13-18

clear cos state 13-19

set cos settings 13-19

clear cos settings 13-20

show cos settings 13-21

set cos port-config 13-21

show cos port-config 13-23

clear cos port-config 13-24

set cos port-resource irl 13-24

set cos port-resource flood-ctrl 13-26

show cos port-resource 13-26

clear cos port-resource irl 13-28

clear cos port-resource flood-ctrl 13-28

set cos reference 13-29

show cos reference 13-30

clear cos reference 13-31

show cos unit 13-31

Extreme A4 CLI Reference 13-17

set cos state

For information about... Refer to page...

clear cos all-entries 13-32

show cos port-type 13-33

set cos state

Use this command to enable or disable Class of Service.

Syntax
set cos state {enable | disable}

Parameters
enable | disable Enables or disables Class of Service on the switch. Default state is
disabled.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to enable Class of Service:
A4(rw)->set cos state enable

show cos state

Use this command to display the Class of Service enable state.

Syntax
show cos state

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to show the Class of Service enable state:
A4(rw)->show cos state
Class-of-Service application is enabled

13-18 Policy Classification Configuration

 clear cos state

clear cos state

Use this command to set CoS state back to its default setting of disabled.

Syntax
clear cos state

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the CoS state back to its default setting of disabled:
A4(su)->clear cos state

set cos settings

Use this command to configure a Class of Service entry in the CoS settings table.

Syntax
set cos settings cos-index priority priority [tos-value tos-value] [irl-reference
irl-reference]

Parameters
cos-index Specifies a Class of Service entry. Valid values are 0 to 255.
priority priority Specifies an 802.1d priority value. Valid values are 0 to 7, with 0 being the
lowest priority. See Usage section below for more information.
tos-value tos-value (Optional) Specifies a Type of Service value. Valid values are 0 to 255. See
Usage section below for more information.
irl-reference (Optional) Set the inbound rate limiter associated with this entry. Valid
irl-reference values are 0 to 99. See Usage section below for more information.

Defaults
If no optional parameters are specified, none will be applied.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 13-19

clear cos settings

Usage
The CoS settings table takes individual class of service features and displays them as belonging to
a CoS entry. Essentially, it is used for CoS feature assignment. Each class of service entry consists
of an index, 802.1p priority, an optional ToS value, and an IRL reference.
• CoS Index
Indexes are unique identifiers for each CoS setting. CoS indexes 0 through 7 are created by
default and mapped directly to 802.1p priority for backwards compatibility. These entries
cannot be removed, and 802.1p priority values cannot be changed. When CoS is enabled,
indexes are assigned. Up to 256 CoS indexes or entries can be configured.
• Priority
802.1p priority can be applied per CoS index. For each new CoS index created, the user has the
option to assign an 802.1p priority value 0 to 7 for the class of service. CoS indexes 0 through 7
map directly to 802.1p priorities and cannot be changed as they exist for backward
compatibility.
• ToS
This value can be set per class of service, but is not required. When a frame is assigned to a
class of service for which this value is configured, the ToS field of the incoming IP packet will
be overwritten to the user-defined value. All but the last two bits of the ToS field are
rewritable. ToS can be set for CoS indexes 0 through 7.
• IRL Reference
The CoS IRL reference field is optional, as rate limits are not required. The IRL reference does
not assign an inbound rate limit but points to the CoS IRL Reference Mapping Table. This
reference may be thought of as the virtual rate limiter that will assign the physical rate limiter
defined by the IRL Reference Mapping Table.

Example
This example shows how to create CoS entry 8 with a priority value of 3:
A4(rw)->set cos settings 8 priority 3

clear cos settings

Use this command to clear Class of Service entry settings.

Syntax
clear cos settings cos-list {[all] | [priority] [tos-value] [irl-reference]}

Parameters
cos-list Specifies a Class of Service entry to clear.
all Clears all settings associated with this entry.
priority Clears the priority value associated with this entry.
tos-value Clears the Type of Service value associated with this entry.
irl-reference Clear the IRL reference associated with this entry.

Defaults
None.

13-20 Policy Classification Configuration

 show cos settings

Mode
Switch command, read-write.

Example
This example shows how to clear the priority for CoS entry 8:
A4(rw)->clear cos settings 8 priority

show cos settings

Use this command to display Class of Service parameters.

Syntax
show cos settings [cos-list]

Parameters
cos-list (Optional) Specifies a Class of Service entry to display.

Defaults
If not specified, all CoS entries will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to show all CoS settings:
A4(su)->show cos settings
CoS Index Priority ToS IRL flood-ctrl
--------- ---------- ------- ------- ----------
0 0 48 * enabled
1 1 * * enabled
2 2 * * enabled
3 3 * * enabled
4 4 * * enabled
5 5 * * enabled
6 6 * * enabled
7 7 * * enabled

set cos port-config

Use this command to create a port group for inbound rate limiting or flood control and add or
remove ports from the group.

Syntax
set cos port-config {irl|flood-ctrl} group-type-index [name name] [ports port-
list] [append] | [clear]

Extreme A4 CLI Reference 13-21

set cos port-config

Parameters
irl Specifies that this is an inbound rate limiting (IRL) port group.
flood-ctrl Specifies that this is a flood control port group.
group-type-index Specifies an inbound rate limiting port group/type index. Valid entries are
in the form of group#.port-type.
Valid values for group# can range from 0 to 7. Valid values for port-type
can range from 0 to 1, although only port type 0 is currently supported.
For example, port group 3 would be specified as 3.0.
name name (Optional) User defined name for the group.
ports port-list (Optional) Ports assigned to the group. All ports must be of the same port
type (Fast Ethernet, Gigabit Ethernet).
append (Optional) Append (add) the ports to the ports that are already in the
group.
clear (Optional) Clear the given ports from those assigned to the group.

Defaults
None.

Mode
Switch command, read-write.

Usage
CoS port groups are identified by group number and the type of ports in the group, in the form of
group#.port-type. The port group 0.0 exists by default. This default port group cannot be removed
and all physical ports in the system are assigned to it. Up to seven additional port groups (1
through 7) can be configured. Currently, only one port type (type 0) is supported. This port type
supports 100 limiters.
Additional port groups may be created for flexibility. Ports assigned to a new port group must be
mutually exclusive from the other port group entries—ports are automatically removed from the
default port group—and must be comprised of the same port type as defined by the port group.
The creation of additional port groups could be used to combine similar ports by their function for
flexibility. For instance, ports associated to users can be added to a port group called “Users” and
ports associated to uplink ports can be added to a port group called “Uplink.” Using these port
groups, a single class of service can assign different rate limits to each port group. “User” ports
can be assigned one rate limit, while “Uplink” ports can be assigned another.
The command show cos port-config displays each port group configured by group and type, with
the group name and associated (assigned) ports. The command show cos port-type displays the
available inbound rate limiting resources for the port type.

Example
This example configures two port groups, one for user ports and one for uplink ports and assign
ports to the groups. Port group 1.0 will represent user ports, group 2.0 will represent uplink ports.
A4(su)->set cos port-config irl 1.0 name Users ports fe.1.1-46
A4(su)->set cos port-config irl 2.0 name Uplink ports fe.1.47-48

13-22 Policy Classification Configuration

 show cos port-config

show cos port-config

Use this command to show CoS port groups and the assigned ports.

Syntax
show cos port-config [irl|flood-ctrl [group-type-index]]

Parameters
irl (Optional) Specifies that inbound rate limiting configuration information
should be displayed.
flood-ctrl (Optional) Specifies that flood control rate configuration information
should be displayed.
group-type-index (Optional) Show assigned ports for a specific port group. Valid entries are
in the form of group#.port-type.
Valid values for group# can range from 0 to 7. Valid values for port-type
can range from 0 to 1, although only port type 0 is currently supported.
For example, port group 3 would be specified as 3.0.

Defaults
The show cos port-config command by itself will show all Port Groups.

Mode
Switch command, read-only.

Example
This example shows all inbound rate limiting port groups. Note that ports fe.1.1 through fe.1.48
were removed from the default port group 0.0 when they were added to port groups 1.0 and 2.0.
A4(su)->show cos port-config irl

Inbound Rate Limiting Port Configuration Entries

----------------------------------------------------------------------
Port Group Name :Default
Port Group :0
Port Type :0
Assigned Ports :none
----------------------------------------------------------------------
Port Group Name :Users
Port Group :1
Port Type :0
Assigned Ports :fe.1.1-46
----------------------------------------------------------------------
Port Group Name :Uplink
Port Group :2
Port Type :0
Assigned Ports :fe.1.47-48
----------------------------------------------------------------------

Extreme A4 CLI Reference 13-23

clear cos port-config

clear cos port-config

Use this command to clear CoS port groups or assigned ports.

Syntax
clear cos port-config {irl|flood-ctrl} {all | group-type-index [entry] | [name]
[ports]}

Parameters
irl Clear an IRL port group configuration.
flood-ctrl Clear a flood control port group configuration.
all Clear all inbound rate limiting port-config non-default entries.
group-type-index Delete a specific port group or group name, or clear the ports from that
group. Valid entries are in the form of group#.port-type.
Valid values for group# can range from 0 to 7. Valid values for port-type
can range from 0 to 1, although only port type 0 is currently supported.
For example, port group 3 would be specified as 3.0.
entry Delete this non-default inbound rate limiter entry.
name Clear the administratively assigned textual description of this port group
entry to its default.
ports Clear the ports assigned to this group to its default.

Defaults
None.

Mode
Switch command, read-write.

Usage
The default port group 0.0 cannot be deleted.

Example
This example deletes all IRL Port Groups except for the Default group 0.0:
A4(su)->clear cos port-config irl all

set cos port-resource irl

Use this command to set the inbound rate limit parameters for a specific IRL resource for a specific
port group.

Syntax
set cos port-resource irl group-type-index irl-index {[unit {kbps}] [rate rate]
[type {drop}]}[syslog enable | disable] [trap enable|disable]

13-24 Policy Classification Configuration

 set cos port-resource irl

Parameters
group-type-index Specifies an inbound rate limiting port group/type index. Valid entries are
in the form of group#.port-type.
Valid values for group# can range from 0 to 7. Valid values for port-type
can range from 0 to 1, although only port type 0 is currently supported.
For example, port group 3 would be specified as 3.0.
irl-index Index number of the inbound rate limiter resource associated with this
entry. Valid values range from 0 to 99.
unit Unit of measure for the inbound rate limiter (only option is kbps).
kbps kilobits per second.
rate rate Data rate for this inbound rate limiter. This is the actual rate limit. Valid
values range from 64 to 1,000,000 kbps for a Gigabit port.
type drop Action for the rate limiter. The only action option is drop the frame if all
limiters are exceeded.
syslog Enable or disable reporting a syslog entry if limiters are exceeded.
enable|disable
trap enable|disable Enable or disable sending a trap if limiters are exceeded.

Defaults
None.

Mode
Switch command, read-write.

Usage
CoS port resources are where actual physical rate limiters are configured. Resources map directly
to the number of rate limiters supported by the port type. (Port type 0 supports 100 IRL resources.)
Resources exist for each port group and are indexed as group#.port-type.irl-index. Port resources
are not initially configured as rate limiting.
Inbound rate limiting, or rate policing, simply drops or clips traffic inbound if a configured rate is
exceeded. CoS inbound rate limiting allows the user to configure rate limits based on kilobits per
second.
The show cos port-resource command displays the resources available for each port group. By
default, no IRL resources are configured. The default Rate Limiting algorithm is drop and cannot
be configured otherwise.

Example
This example sets the inbound rate limit resource index number 1 for port group 2.0 to 10000 Kbps
or 1 MB:
A4(su)->set cos port-resource irl 2.0 1 unit kbps rate 10000 type drop

Extreme A4 CLI Reference 13-25

set cos port-resource flood-ctrl

set cos port-resource flood-ctrl

Use this command to create a CoS-based flood control port resource. This resource specifies flood
control rate limiters that can be mapped to specific ports.

Syntax
set cos port-resource flood-ctrl group-type-index {unicast | multicast | broadcast
| all} rate rate

Parameters
group-type-index Specifies a port group/type index. Valid entries are in the form of
group#.port-type.
Valid values for group# can range from 0 to 7. Valid values for port-type
can range from 0 to 1, although only port type 0 is currently supported.
For example, port group 3 would be specified as 3.0.
unicast Specifies rate limiting will be applied to unknown unicast traffic.
multicast Specifies rate limiting will be applied to multicast traffic.
broadcast Specifies rate limiting will be applied to broadcast traffic.
all Specifies rate limiting will be applied to unknown unicast, multicast,
and broadcast traffic.
rate rate Specifies a rate limit in packets per second.

Defaults
None.

Mode
Switch command, read-write.

Usage
CoS port resources are where actual physical rate limiters are configured. This command can be
used to create up to three different flood control limit resources for the port-type index of 0. The
resources are assigned to specific ports with the set cos port-config command.

Example
This example creates a port resource broadcast rate limiter of 5 packets per second for the port
group type index of 1.0 (group # 1 of port-type index 0).
A4(su)->set cos port-resource flood-ctrl 1.0 broadcast rate 5

show cos port-resource

Use this command to display the configured port resources.

Syntax
show cos port-resource [irl [group-type-index [irl-index]]] | [flood-ctrl [group-
type-index]]

13-26 Policy Classification Configuration

 show cos port-resource

Parameters
irl (Optional) Specifies that inbound rate limiting port resources should be
displayed.
flood-ctrl (Optional) Specifies that flood control port resources should be displayed.
group-type-index (Optional) Specifies a port group/type index. Valid entries are in the form
of group#.port-type.
Valid values for group# can range from 0 to 7. Valid values for port-type
can range from 0 to 1, although only port type 0 is currently supported.
For example, port group 3 would be specified as 3.0.
irl-index (Optional) Inbound rate limiter resource index configured for the
specified port group. Valid values range from 0 to 99.

Defaults
If irl or flood-ctrl are not specified, all port resources are shown.
If a port group and IRL index are not specified, the IRL configuration for all resources (0-99) for all
configured port groups will be shown.
If a port group is not specified with the flood-ctrl parameter, flood control resources for all
configured port groups will be shown.

Mode
Switch command, read-only.

Examples
This example displays the IRL resource index number 1 configuration for group 2.0.
A4(su)->show cos port-resource irl 2.0 1

'?' after the rate value indicates an invalid rate value

Group Index Resource Type Unit Rate Rate Limit Type Action
----------- -------- ---- ---- ---------- --------------- ------
2.0 1 irl kbps 10000 drop none

This example displays the flood control resources configured for group 1.0.
A4(su)->show cos port-resource flood-ctrl 1.0

'?' after the rate value indicates an invalid rate value

Group Resource Type Unit Rate Rate Limit Action

Index type
--------- ----------- ---------- ---- ---------- --------------- ------
1.0 ucast flood-ctrl pps 20 drop none
1.0 mcast flood-ctrl pps 10 drop none
1.0 bcast flood-ctrl pps 5 drop none

Extreme A4 CLI Reference 13-27

clear cos port-resource irl

clear cos port-resource irl

Use this command to clear inbound rate limit resources to default values.

Syntax
clear cos port-resource irl {all | group-type-index [irl-index [unit] [rate]
[type]]}

Parameters
all Clear all IRL resources for all port groups.
group-type-index Specifies an inbound rate limiting port group/type index. Valid entries are
in the form of group#.port-type.
Valid values for group# can range from 0 to 7. Valid values for port-type
can range from 0 to 1, although only port type 0 is currently supported.
For example, port group 3 would be specified as 3.0.
irl-index (Optional) Inbound rate limiter resource index associated with the
specified port group. Valid values range from 0 to 99.
unit Clear the unit of measure for the inbound rate limiter.
rate Clear the data rate for this inbound rate limiter.
type Clear the action for the rate limiter.

Defaults
None.

Mode
Switch command, read-write.

Example
This example clears the data rate to 0 for IRL resource index 1 for group 2.0.
A4(su)->clear cos port-resource irl 2.0 1 rate

clear cos port-resource flood-ctrl

Use this command to clear flood control port resources to default values.

Syntax
clear cos port-resource flood-ctrl {all | group-type-index {unicast | multicast |
broadcast | all [rate]}}

Parameters
all Clear all flood control resources for all port groups.
group-type-index Specifies a port group/type index. Valid entries are in the form of
group#.port-type.
Valid values for group# can range from 0 to 7. Valid values for port-type
can range from 0 to 1, although only port type 0 is currently supported.
For example, port group 3 would be specified as 3.0.

13-28 Policy Classification Configuration

 set cos reference

unicast Clear unicast port resources for the specified port group.
multicast Clear multicast port resources for the specified port group.
broadcast Clear broadcast port resources for the specified port group.
all Clear all flood control port resources for the specified port group.
rate (Optional) Clear the data rate limiter of the specified type of port
resource to the default (none or disabled).

Defaults
None.

Mode
Switch command, read-write.

Example
This example clears the unicast port resource for port group 1.0 to default values.
A4(su)->clear cos port-resource flood-ctrl 1.0 unicast

set cos reference

Use this command to set the Class of Service inbound rate limiting reference configuration.

Syntax
set cos reference irl group-type-index reference rate-limit irl-index

Parameters
irl Specifies that an IRL reference is being configured.
group-type-index Specifies an inbound rate limiting port group/type index. Valid entries are
in the form of group#.port-type.
Valid values for group# can range from 0 to 7. Valid values for port-type
can range from 0 to 1, although only port type 0 is currently supported.
For example, port group 3 would be specified as 3.0.
reference IRL reference number associated with this entry.
rate-limit irl-index Rate limiter (IRL resource index) to bind this reference to. Valid values
range from 0 to 99.

Defaults
None.

Mode
Switch command, read-write.

Usage
The CoS reference table maps the user-defined IRL references found in the CoS settings table (see
“set cos settings” on page 13-19) to rate limiters created in the port resource table (see “set cos
port-resource irl” on page 13-24). The CoS reference table indexes can be thought of as virtual rate

Extreme A4 CLI Reference 13-29

show cos reference

limiters. The table accounts for the maximum number of rate limiters supported by the device.
The virtual limiters then map to the physical rate limiters. The CoS IRL Reference Table is not
configured by default.
The CoS IRL reference table uses 100 indexes or virtual rate limiters, and maps each virtual limiter
to a physical limiter or resource. An IRL reference table exists for each port group configured, and
is indexed similarly to port resources, as port group#, port-type, reference. IRL references are not
populated with limiters (resources), but can be configured by the user. The IRL reference table can
be displayed using the show cos reference command.

Example
In the CoS IRL reference mapping table for port groups 1.0 and 2.0, create a reference for the IRL
resource number 1 created for each group. The reference number 1 is used.
A4(su)->set cos reference irl 1.0 1 rate-limit 1
A4(su)->set cos reference irl 2.0 1 rate-limit 1

show cos reference

Use this command to show the Class of Service inbound rate limiting reference configuration.

Syntax
show cos reference [irl [group-type-index]]

Parameters
irl (Optional) Specifies that inbound rate limiting reference information
should be displayed.
group-type-index (Optional) Specifies an inbound rate limiting port group/type index. Valid
entries are in the form of group#.port-type.
Valid values for group# can range from 0 to 7. Valid values for port-type
can range from 0 to 1, although only port type 0 is currently supported.
For example, port group 3 would be specified as 3.0.

Defaults
If irl is not specified, all CoS reference information is displayed.
If a specific port group is not specified, information for all port groups is displayed.

Mode
Switch command, read-only.

Example
This example shows the Class of Service IRL references for port group 1.0. Note that not all of the
100 possible references are displayed in this output example.
A4(su)->show cos reference irl 1.0

Group Index Reference Type Rate Limiter

----------- --------- ---- ------------
1.0 0 irl none
1.0 1 irl 1
1.0 2 irl none
1.0 3 irl none

13-30 Policy Classification Configuration

 clear cos reference

...
1.0 97 irl none
1.0 98 irl none
1.0 99 irl none

clear cos reference

Use this command to clear the Class of Service inbound rate limiting reference configuration.

Syntax
clear cos reference irl {all | group-type-index reference}

Parameters
irl Specifies that IRL references are being cleared.
all Clear all groups indexes and references.
group-type-index Specifies an inbound rate limiting port group/type index. Valid entries are
in the form of group#.port-type.
Valid values for group# can range from 0 to 7. Valid values for port-type
can range from 0 to 1, although only port type 0 is currently supported.
For example, port group 3 would be specified as 3.0.
reference Clear a specific reference for the specified port group.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the CoS inbound rate limiting reference configuration for all
groups:
A4(su)->clear cos reference irl all

show cos unit

Use this command to show possible CoS unit entries.

Syntax
show cos unit [irl [port-type index] [kbps]] [flood-ctrl [port-type index] [pps]]

Parameters
irl (Optional) Display only IRL unit information.
port-type index (Optional) Display information about the specified port type. (Only
port-type index 0 is supported.)
kbps (Optional) Display kbps information.
flood-ctrl (Optional) Display only flood control unit information.

Extreme A4 CLI Reference 13-31

clear cos all-entries

pps (Optional) Display pps information.

Defaults
If no parameters are entered, all Cos unit information is displayed.

Mode
Switch command, read-only.

Examples
This example shows possible unit entries for inbound rate limiting:
A4(su)->show cos unit irl

Type: Unit:
irl = inbound rate limiting Kbps = Kilobits per second

Port Type Type Unit Maximum Rate Minimum Rate Granularity

--------- ---- ---- ------------ ------------ -----------
0 irl Kbps 1000000 64 1

This examples shows flood control unit information.

A4(su)->show cos unit flood-ctrl

Type: Unit:
flood-ctrl = flood control type pps = packets per second

Port Type Type Unit Maximum Rate Minimum Rate Granularity

----------- ----------- ---- ------------ ------------ -----------
0 flood-ctrl pps 148810 0 1

clear cos all-entries

Use this command to clear all Class of Service entries except entries 0-7.

Syntax
clear cos all-entries

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the CoS configuration for all entries except entries 0-7:
A4(su)->clear cos all-entries

13-32 Policy Classification Configuration

 show cos port-type

show cos port-type

Use this command to display Class of Service port type configurations.

Syntax
show cos port-type [irl [port-type]] [flood-ctrl [port-type]]

Parameters
irl (Optional) Displays inbound rate limiting information.
flood-ctrl (Optional) Displays flood control information.
port-type (Optional) Displays information for a specific port type. (Only port type
0 is supported.)

Defaults
If no parameters are specified, inbound rate limiting and flood control information for all port
types is displayed.

Mode
Switch command, read-only.

Usage
The A4 implementation provides one default port type (0) for designating available inbound rate
limiting or flood control resources. Port type 0 includes all ports.
The port type 0 IRL description is “A4 100 IRL,” which indicates that this port type provides a
maximum of 100 inbound rate limiting resources per port group. The port type 0 flood control
description is “A4 3 flood-ctrl” which indicates that this port type provides a maximum of 3 flood
control resources per port group.

Examples
This example shows inbound rate limiting information for port type 0.

A4(su)->show cos port-type irl 0

Number of resources: Supported rate types:

irl = inbound rate limiter(s) Kbps = kilobits per second

Port type Number of Supported Eligible Unselected

Index description limiters rate type ports ports
----- ------------ --------- --------- ----------------- -----------------
0 A4 100 IRL 100 kbps fe.1.1-48 fe.1.1-4

This example shows flood control information for port type 0.

A4(su)->show cos port-type flood-ctrl 0

Number of resources: Supported rate types:

flood-ctrl = flood control type Pps = Packets per second

Port type Number of Supported Eligible Unselected

Index description limiters rate type ports ports
----- ------------ --------- --------- ---------------- ------------

Extreme A4 CLI Reference 13-33

show cos port-type

0 A4 3 flood-ctrl 3 pps fe.1.1-24 fe.1.1-24

13-34 Policy Classification Configuration

 14
Port Priority and Rate Limiting Configuration

This chapter describes the Port Priority and Rate Limiting set of commands and how to use them.
Refer to Chapter 17, “Configuring Quality of Service,” in the Fixed Switching Configuration Guide
for configuration procedures, examples, and other information relating to port priority and
transmit queue configuration.

For information about... Refer to page...

Configuring Port Priority 14-1

Configuring Priority to Transmit Queue Mapping 14-3

Configuring Port Transmit Queues 14-6

Configuring Port Traffic Rate Limiting 14-9

Note: When CoS override is enabled using the set policy profile command as described in “set
policy profile” on page 13-3, CoS-based classification rules will take precedence over priority
settings configured with the set port priority command described in this section.

Configuring Port Priority

Use the following commands to view or configure port priority characteristics as follows:
• Display or change the port default Class-of Service (CoS) transmit priority (0 through 7) of
each port for frames that are received (ingress) without priority information in their tag
header.
• Display the current traffic class mapping-to-priority of each port.
• Set each port to transmit frames according to 802.1D (802.1p) priority set in the frame header.

For information about... Refer to page...

show port priority 14-4

set port priority 14-2

clear port priority 14-3

show port priority

Use this command to display the 802.1D priority for one or more ports.

Syntax
show port priority [port-string]

Extreme A4 CLI Reference 14-1

set port priority

Parameters
port-string (Optional) Displays priority information for a specific port.

Defaults
If port-string is not specified, priority for all ports will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display the port priority for the fe.2.1 through 5.
A4(su)->show port priority fe.2.1-5
fe.2.1 is set to 0
fe.2.2 is set to 0
fe.2.3 is set to 0
fe.2.4 is set to 0
fe.2.5 is set to 0

set port priority

Use this command to set the 802.1D (802.1p) Class-of-Service transmit priority (0 through 7) on
each port. A port receiving a frame without priority information in its tag header is assigned a
priority according to the priority setting on the port. For example, if the priority of a port is set to
5, the frames received through that port without a priority indicated in their tag header are
classified as a priority 5.
A frame with priority information in its tag header is transmitted according to that priority.

Syntax
set port priority port-string priority

Parameters
port-string Specifies the port for which to set priority.
priority Specifies a value of 0 to 7 to set the CoS priority for the port entered in the
port-string. Priority value of 0 is the lowest priority.

Defaults
None.

Mode
Switch command, read-write.

Usage
The set port priority command will not change the 802.1p priority tag on tagged traffic with a
default priority tag. The command only has an effect on how untagged traffic will be prioritized
as it passes internally through the device.

14-2 Port Priority and Rate Limiting Configuration

 clear port priority

Example
This example shows how to set a default priority of 6 on fe.1.3. Frames received by this port
without priority information in their frame header are set to the default setting of 6:
A4(su)->set port priority fe.1.3 6

clear port priority

Use this command to reset the current CoS port priority setting to 0. This will cause all frames
received without a priority value in its header to be set to priority 0.

Syntax
clear port priority port-string

Parameters
port-string Specifies the port for which to clear priority.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset fe.1.11 to the default priority:
A4(rw)->clear port priority fe.1.11

Configuring Priority to Transmit Queue Mapping

Use the following commands to:
• View the current priority to transmit queue mapping of each physical port.
• Configure each port to either transmit frames according to the port priority, set using the set
port priority command described in “set port priority” on page 14-2, or according to a priority
based on a percentage of port transmission capacity, assigned to transmit queues using the set
port txq command described in “set port txq” on page 14-7.
• Clear current port priority queue settings for one or more ports.

Note: Priority to transmit queue mapping on an individual port basis can only be configured on
Gigabit Ethernet ports (ge.x.x). When you use the set port priority-queue command to configure a
Fast Ethernet port (fe.x.x), the mapping values are applied globally to all Fast Ethernet ports on the
system.

For information about... Refer to page...

show port priority-queue 14-4

set port priority-queue 14-4

clear port priority-queue 14-5

Extreme A4 CLI Reference 14-3

show port priority-queue

show port priority-queue

Use this command to display the port priority levels (0 through 7, with 0 as the lowest level)
associated with the current transmit queues (0 being the lowest priority) for each selected port. A
frame with a certain port priority is transmitted according to the settings entered using the set
port priority-queue command described in “set port priority-queue” on page 14-4.

Syntax
show port priority-queue [port-string]

Parameters
port-string (Optional) Displays the mapping of priorities to transmit queues for one
or more ports.

Defaults
If port-string is not specified, priority queue information for all ports will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display priority queue information for fe.1.1. In this case, frames with
a priority of 0 are associated with transmit queue 1; frames with 1 or 2 priority, are associated with
transmit queue 0; and so forth:
A4(su)->show port priority-queue ge.1.1
Port P0 P1 P2 P3 P4 P5 P6 P7
--------- -- -- -- -- -- -- -- --
ge.1.1 1 0 0 2 3 4 5 5

set port priority-queue

Use this command to map 802.1D (802.1p) priorities to transmit queues.

Syntax
set port priority-queue port-string priority queue

Parameters
port-string Specifies the port(s) for which to set priority-to-queue mappings.
priority Specifies a value of 0 through 7 (0 is the lowest level) that determines
what priority frames will be transmitted on the transmit queue entered in
this command.
queue Specifies a value of 0 through 5 (0 is the lowest level) that determines the
queue on which to transmit the frames with the port priority entered in
this command.
Note: Although there are 8 queues, only queues 0 through 5 may be configured.
Queues 6 and 7 are reserved for management traffic.

14-4 Port Priority and Rate Limiting Configuration

 clear port priority-queue

Defaults
None.

Mode
Switch command, read-write.

Usage
This command enables you to change the transmit queue (0 to 5, with 0 being the lowest priority
queue) for each port priority of the selected port. You can apply the new settings to one or more
ports.

Example
This example shows how to set priority 5 frames received on ge.2.12 to transmit on queue 0.
A4(su)->set port priority-queue ge.2.12 5 0

clear port priority-queue

Use this command to reset port priority queue settings back to defaults for one or more ports.

Syntax
clear port priority-queue port-string

Parameters
port-string Specifies the port for which to clear priority-to-queue mappings.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the priority queue settings on fe.2.12:
A4(su)->clear port priority-queue fe.2.12

Extreme A4 CLI Reference 14-5

Configuring Port Transmit Queues

Configuring Port Transmit Queues

Eight transmit queues are implemented in the switch hardware for each port. The commands in
this section allow you to set the priority mode and weight for each of the available queues (0
through 5) for each physical port on the switch.
Priority queues 6 and 7 are reserved for stacking and control protocols and are run in strict
priority. They cannot be modified by the set port txq or clear port txq commands. Their settings
are displayed by the show port txq command.
Priority mode and weight cannot be configured on LAGs, only on the physical ports that make up
the LAG.
Refer to Chapter 17, “Configuring Quality of Service,” in the Fixed Switching Configuration Guide
for configuration procedures, examples, and other information.

For information about... Refer to page...

show port txq 14-6

set port txq 14-7

clear port txq 14-8

show port txq

Use this command to display QoS transmit queue information for one or more physical ports.

Syntax
show port txq [port-string]

Parameters
port-string (Optional) Specifies port(s) for which to display QoS settings.
Only physical ports will be displayed. LAG ports have no transmit queue
information.

Defaults
If the port-string is not specified, the QoS setting of all physical ports will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display the current algorithm and transmit queue weights configured
on port fe.1.1:
A4(su)->show port txq fe.1.1
Port Alg Q0 Q1 Q2 Q3 Q4 Q5 Q6 Q7
----- --- --- --- --- --- --- --- --- ---
ge.1.1 WRR 2 10 15 20 24 29 SP SP

14-6 Port Priority and Rate Limiting Configuration

 set port txq

set port txq

Use this command to set QoS transmit queue arbitration values for queues 0 through 5 on physical
ports. Queues can be configured for Weighted Round Robin (WRR) or strict priority (SP) or a
combination of both.

Syntax
set port txq port-string value0 value1 value2 value3 value4 value5

Parameters
port-string Specifies port(s) on which to set queue arbitration values.
Only physical ports can be configured with this command. LAG ports
cannot be configured.
value0 - value5 Specifies percentage to allocate to a specific transmit queue (WRR), or SP
for strict priority.
The values assigned to non-strict queues must total 100 percent.
Strict priority cannot be assigned to a queue if a higher queue is not strict.
Strict priority can be set on all five queues by setting the value for queue 5
to 100 percent.

Defaults
None.

Mode
Switch command, read-write.

Usage
Queues 0 through 5 can be set for strict priority (SP) or weighted round-robin (WRR), or a
combination of both. Queues 6 and 7 are reserved for stacking and control protocols and cannot
be modified by this command.
When configured for WRR, weights must total 100 percent. Strict priority may be assigned to all
queues by setting value5 to 100 percent. When combining SP and WRR, the values of those ports
running in WRR must total 100 percent.
You can mix WRR and SP by assigning SP to the higher numbered queues and assigning WRR to
the lower numbered queues, making sure that the values assigned to the WRR queues totals 100
percent. For example, you could assign WRR to queues 0 through 4 by assigning 20 percent to
each of those queues, and then setting queue 5 to SP.

Examples
This example shows how to change the arbitration values for the queues belonging to ge.1.1 to
Strict Priority. Note that, although you can’t set queues 6 and 7 with this command, their values
are shown by the show port txq command.
A4(su)->set port txq fe.1.1 0 0 0 0 0 100

A4(su)->show port txq fe.1.1

Port Alg Q0 Q1 Q2 Q3 Q4 Q5 Q6 Q7
----- --- --- --- --- --- --- --- --- ---
fe.1.1 STR SP SP SP SP SP SP SP SP

Extreme A4 CLI Reference 14-7

clear port txq

This example shows how to change the arbitration values for the queues belonging to ge.1.1 to
WRR:
A4(su)->set port txq ge.1.1 10 10 20 20 20 20

A4(su)->show port txq ge.1.1

Port Alg Q0 Q1 Q2 Q3 Q4 Q5 Q6 Q7
----- --- --- --- --- --- --- --- --- ---
ge.1.1 WRR 10 10 20 20 20 20 SP SP
This example shows how to change the arbitration values for the queues belonging to ge.1.1 to
WRR with SP:
A4(su)->set port txq ge.1.1 10 10 20 20 40 SP

A4(su)->show port txq ge.1.1

Port Alg Q0 Q1 Q2 Q3 Q4 Q5 Q6 Q7
----- --- --- --- --- --- --- --- --- ---
ge.1.1 WRR 10 10 20 20 40 SP SP SP

clear port txq

Use this command to clear port transmit queue values back to their default values.

Syntax
clear port txq port-string

Parameters
port-string Clears transmit queue values on specific port(s) back to their default
values.
Only physical ports can be configured with this command. LAG ports
cannot be configured.

Defaults
Queues 6 and 7 are reserved strict priority queues unaffected by this command. By default
transmit queues 0 through 5 are WRR and defined as follows:
Q0 Q1 Q2 Q3 Q4 Q5
--- --- --- --- --- ---
2 10 15 20 24 29

Mode
Switch command, read-write.

Example
This example shows how to clear transmit queue values on fe.1.1:
A4(su)->clear port txq fe.1.1

A4(su)(su)->show port txq ge.1.1

Port Alg Q0 Q1 Q2 Q3 Q4 Q5 Q6 Q7
----- --- --- --- --- --- --- --- --- ---

14-8 Port Priority and Rate Limiting Configuration

 ge.1.1 WRR 2 10 15 20 24 29 SP SP

ge.1.1 WRR 2 10 15 20 24 29 SP SP

Configuring Port Traffic Rate Limiting

Use the following commands to limit the rate of inbound traffic on the A4 device on a per port/
priority basis. The allowable range for the rate limiting is 64 kilobytes per second minimum up to
the maximum transmission rate allowable on the interface type.
Rate limit is configured for a given port and list of priorities. The list of priorities can include one,
some, or all of the eight 802.1p priority levels. Once configured, the rate of all traffic entering the
port with the priorities configured to that port is not allowed to exceed the programmed limit. If
the rate exceeds the programmed limit, frames are dropped until the rate falls below the limit.

For information about... Refer to page...

show port ratelimit 14-9

set port ratelimit 14-10

clear port ratelimit 14-11

show port ratelimit

Use this command to show the traffic rate limiting configuration on one or more ports.

Syntax
show port ratelimit [port-string]

Parameters
port-string (Optional) Displays rate limiting information for specific port(s).

Defaults
If port-string is not specified, rate limiting information will be displayed for all ports.

Mode
Switch command, read-only.

Example
This example shows how to display the current rate limiting information for fe.2.1:
A4(su)->show port ratelimit fe.2.1
Global Ratelimiting status is disabled.

Port Threshold Priority

Number Index (kB/s) Action Direction List Status
----------- ----- --------- ------------ --------- ----------- --------
fe.2.1 1 64 discard inbound 0-3 disabled
fe.2.1 2 64 discard inbound 4-7 disabled
Table 14-1 shows a detailed explanation of the command output.

Extreme A4 CLI Reference 14-9

set port ratelimit

Table 14-1 show port ratelimit Output Details

Output What It Displays...

Port Number Port designation. For a detailed description of possible port-string

values, refer to the Fixed Switching Configuration Guide.

Index Resource index for this port.

Threshold (kB/s) Port rate limiting threshold in kilobytes per second.

Action Whether or not frames not conforming to rate limiting will be discarded.

Direction Currently rules can only be applied to inbound traffic.

Priority List 802.1D (802.1p) port priority level.

Status Whether or not this rule is active or disabled.

set port ratelimit

Use this command to configure the traffic rate limiting status and threshold (in kilobytes per
second) for one or more ports.

Syntax
set port ratelimit {disable | enable} | port-string priority threshold
{disable | enable} [inbound] [index]

Parameters
disable | enable When entered without a port-string, globally disables or enables the port
rate limiting function. When entered with a port-string, disables or
enables rate limiting on specific port(s) when the global function is
enabled.
port-string Specifies a port on which to set the rate limiting threshold and other
parameters.
priority Specifies the 802.1D (802.1p) port priority level associated with the port-
string. The value can be 0 to 7, with 0 specifying the lowest priority.
threshold Specifies a port rate limiting threshold in kilobytes per second. Range is
64 up to a maximum of 2,147,483,647 kilobytes per second.
inbound (Optional) Applies this rate policing rule to inbound traffic.
index (Optional) Assigns a resource index for this port.

Defaults
Threshold will be applied to inbound traffic on the port/priority.
If index is not specified, settings will be applied to index 1, and will overwrite index 1 for any
subsequent rate limits configured.

Mode
Switch command, read-write.

Example
This example shows how to:

14-10 Port Priority and Rate Limiting Configuration

 clear port ratelimit

• globally enable rate limiting

• configure rate limiting for inbound traffic on port fe.2.1, index 1, priority 5, to a threshold of
125 KBps:
A4(rw)->set port ratelimit enable
A4(rw)->set port ratelimit fe.2.1 5 125 enable inbound

clear port ratelimit

Use this command to clear rate limiting parameters for one or more ports.

Syntax
clear port ratelimit port-string [index]

Parameters
port-string Specifies the port(s) on which to clear rate limiting. For a detailed
description of possible port-string values, refer to Fixed Switching
Configuration Guide.
index (Optional) Specifies the associated resource index to be reset.

Defaults
If not specified, all index entries will be reset.

Mode
Switch command, read-write.

Example
This example shows how to clear all rate limiting parameters on port fe.2.1.
A4(su)->clear port ratelimit fe.2.1

Extreme A4 CLI Reference 14-11

clear port ratelimit

14-12 Port Priority and Rate Limiting Configuration

 15
IGMP Configuration

This chapter describes the IGMP Configuration set of commands and how to use them. Refer to
Chapter 19, “Configuring Multicast,” in the Fixed Switching Configuration Guide for configuration
procedures, examples, and other information about IGMP.

For information about... Refer to page...

Configuring IGMP Snooping at Layer 2 15-1

Configuring IGMP Snooping Querier 15-19

Configuring IGMP on Routing Interfaces 15-27

Configuring IGMP Snooping at Layer 2

Use the following commands to configure IGMP snooping from the switch CLI.

For information about... Refer to page...

show igmpsnooping 15-2

show igmpsnooping port 15-3

set igmpsnooping adminmode 15-4

set igmpsnooping interfacemode 15-5

set igmpsnooping groupmembershipinterval 15-5

set igmpsnooping maxresponse 15-6

set igmpsnooping mcrtrexpiretime 15-7

set igmpsnooping mrouter 15-7

set igmpsnooping add-static 15-8

set igmpsnooping remove-static 15-9

set igmpsnooping fast-leave 15-9

set igmpsnooping <vlan-id> 15-10

set igmpsnooping <vlan-id> fast-leave 15-10

set igmpsnooping <vlan-id> groupmembership-interval 15-11

set igmpsnooping <vlan-id> maxresponse 15-12

set igmpsnooping <vlan-id> mcrtrexpiretime 15-13

show igmpsnooping static 15-13

Extreme A4 CLI Reference 15-1

show igmpsnooping

For information about... Refer to page...

show igmpsnooping mfdb 15-14

show igmpsnooping vlan 15-14

show igmpsnooping mrouter 15-15

clear igmpsnooping 15-16

clear igmpsnooping groupmembershipinterval 15-16

clear igmpsnooping maxresponse 15-17

clear igmpsnooping mcrtexpiretime 15-17

clear igmpsnooping <vlan-id> groupmembership-interval 15-18

clear igmpsnooping <vlan-id> maxresponse 15-18

clear igmpsnooping <vlan-id> mcrtexpiretime 15-19

show igmpsnooping
Use this command to display IGMP snooping global and per port information.

Syntax
show igmpsnooping

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Usage
Configured information is displayed whether or not IGMP snooping is enabled. Timer values are
shown for each port.

15-2 IGMP Configuration

 show igmpsnooping port

Example
This example shows partial output from the show igmpsnooping command.
A4(su)->show igmpsnooping

IGMP Snooping Admin Mode - Enabled

Group Max Mcrt

IGMP Membership Response Expiry Fast
Interface Snooping Interval Time Time Leave Mrouter
--------- -------- ---------- -------- ------ ------- -------
fe.1.1 Enable 260 10 0 Disable Disable
fe.1.2 Enable 260 10 0 Disable Disable
fe.1.3 Enable 260 10 0 Disable Disable
fe.1.4 Enable 260 10 0 Disable Disable
fe.1.5 Enable 260 10 0 Disable Disable
fe.1.6 Enable 260 10 0 Disable Disable
fe.1.7 Enable 260 10 0 Disable Disable
fe.1.8 Enable 260 10 0 Disable Disable
fe.1.9 Enable 260 10 0 Disable Disable
fe.1.10 Enable 260 10 0 Disable Disable
fe.1.11 Enable 260 10 0 Disable Disable
.
.
.
fe.2.17 Enable 260 10 0 Disable Disable
fe.2.18 Enable 260 10 0 Disable Disable
fe.2.19 Enable 260 10 0 Disable Disable
fe.2.20 Enable 260 10 0 Disable Disable
fe.2.21 Enable 260 10 0 Disable Disable
fe.2.22 Enable 260 10 0 Disable Disable
fe.2.23 Enable 260 10 0 Disable Disable
fe.2.24 Enable 260 10 0 Disable Disable
ge.2.27 Enable 260 10 0 Disable Disable
ge.2.28 Enable 260 10 0 Disable Disable
lag.0.1 Enable 260 10 0 Disable Disable
lag.0.2 Enable 260 10 0 Disable Disable
lag.0.3 Enable 260 10 0 Disable Disable
lag.0.4 Enable 260 10 0 Disable Disable
lag.0.5 Enable 260 10 0 Disable Disable
lag.0.6 Enable 260 10 0 Disable Disable

Multicast Control Frame Count.................. 32800715

Data Frames Forwarded by the CPU 0

show igmpsnooping port

Use this command to display IGMP snooping information for one or more ports.

Syntax
show igmpsnooping port [port-sting]

Parameters
port-string (Optional) Specifies the port or ports to display information about.

Extreme A4 CLI Reference 15-3

set igmpsnooping adminmode

Defaults
If a port-string is not specified, information is displayed for all ports in the system or stack.

Mode
Switch command, read-only.

Example
This example displays information for fe.1.1.
A4(su)->show igmpsnooping port fe.1.1

IGMP Snooping Port info fe.1.1

IGMP Snooping Admin Mode Enable
Fast Leave Mode Disable
Group Membership Interval (secs) 260
Max Response Time (secs) 100
Multicast Router Expiry Time (secs) 0

set igmpsnooping adminmode

Use this command to enable or disable IGMP on the system.

Syntax
set igmpsnooping adminmode {enable | disable}

Parameters
enable | disable Enables or disables IGMP snooping on the system.

Defaults
None.

Mode
Switch command, read-write.

Usage
In order for IGMP snooping to be enabled on one or all ports, it must be globally enabled on the
device with this command, and then enabled on a port(s) using the set igmpsnooping interface
mode command as described in “set igmpsnooping interfacemode” on page 15-5.

Note: IGMP snooping cannot be controlled via WebView.

Example
This example shows how to enable IGMP on the system:
A4(su)->set igmpsnooping adminmode enable

15-4 IGMP Configuration

 set igmpsnooping interfacemode

set igmpsnooping interfacemode

Use this command to enable or disable IGMP on one or all ports.

Syntax
set igmpsnooping interfacemode port-string {enable | disable}

Parameters
port-string Specifies one or more ports on which to enable or disable IGMP.
enable | disable Enables or disables IGMP.

Defaults
None.

Mode
Switch command, read-write.

Usage
In order for IGMP snooping to be enabled on one or all ports, it must be globally enabled on the
device using the set igmpsnooping adminmode command as described in “set igmpsnooping
adminmode” on page 15-4, and then enabled on a port(s) using this command.

Example
This example shows how to enable IGMP on ports fe.1.1 through fe.1.10:
A4(su)->set igmpsnooping interfacemode fe.1.1-10 enable

set igmpsnooping groupmembershipinterval

Use this command to configure the IGMP group membership refresh time for the system.

Syntax
set igmpsnooping groupmembershipinterval time [port-string]

Parameters
time Specifies the IGMP group membership interval in seconds. Valid values are
2 - 3600 seconds. Default is 260 seconds.
This value works together with the set igmpsnooping maxresponsetime
command to remove ports from an IGMP group and must be greater than
the max response time value.
port-string (Optional) Specifies the port or ports to which to apply the interval.

Defaults
If a port string is not specified, the group membership interval time is set for all ports on the
system.

Extreme A4 CLI Reference 15-5

set igmpsnooping maxresponse

Mode
Switch command, read-write.

Usage
The IGMP group membership interval value sets the refresh time for reporting multicast group
membership. If the timer expires, the multicast group is removed from the table.
This interval must be greater than the IGMP maximum response time as described in “set
igmpsnooping maxresponse” on page 15-6.

Example
This example shows how to set the IGMP group membership interval to 250 seconds: for the
system.
A4(su)->set igmpsnooping groupmembershipinterval 250

set igmpsnooping maxresponse

Use this command to configure the IGMP query maximum response time for the system.

Syntax
set igmpsnooping maxresponse time [port-string]

Parameters
time Specifies the IGMP maximum query response time. Valid values are 10 - 25
seconds. The default value is 10 seconds.
This value works together with the set igmpsnooping
groupmembershipinterval command to remove ports from an IGMP group
and must be less than the group membership interval value.
port-string (Optional) Specifies the port or ports to which to apply the time value.

Defaults
If a port string is not specified, the maximum response time is set for all ports on the system.

Mode
Switch command, read-write.

Usage
If an IGMP leave group message is received on an interface, the IGMP snooping switch will send a
general query on that interface and wait the configured maximum response time. If no response is
received within that time, that interface is removed from the group.
This value must be less than the IGMP group membership time described in “set igmpsnooping
groupmembershipinterval” on page 15-5.

Example
This example shows how to set the IGMP maximum response time to 60 seconds:
A4(su)->set igmpsnooping maxresponse 60

15-6 IGMP Configuration

 set igmpsnooping mcrtrexpiretime

set igmpsnooping mcrtrexpiretime

Use this command to configure the IGMP multicast router expiration time for the system.

Syntax
set igmpsnooping mcrtrexpire time [port-string]

Parameters
time Specifies the IGMP multicast router expiration time. Valid values are 0 -
3600 seconds. A value of 0 will configure the system with an infinite
expiration time. The default value is 0.
port-string (Optional) Specifies the port or ports to which to apply the time value.

Defaults
If a port string is not specified, the multicast router expiration time is set for all ports on the
system.

Mode
Switch command, read-write.

Usage
If a query or a multicast routing protocol packet such as a PIM hello or DVMRP probe from the
upstream IGMP multicast router is not received on an interface within the configured multicast
router present expiry time, that interface is removed from the list of interfaces with multicast
routers attached (mrouter ports).

Example
This example shows how to set the IGMP multicast router expiration time to infinity:
A4(su)->set igmpsnooping mcrtrexpiretime 0

set igmpsnooping mrouter

Use this command to manually enable or disable an mrouter port for a VLAN.

Syntax
set igmpsnooping mrouter port-string vlan-id {enable | disable}

Parameters
port-string Specifies the port to enable or disable as an mrouter port.
vlan-id Specifies the VLAN to which this port is assigned.
enable | disable Enables or disables the port as an mrouter port for the specified VLAN.

Defaults
None.

Extreme A4 CLI Reference 15-7

set igmpsnooping add-static

Mode
Switch command, read-write.

Usage
An mrouter port is an interface which has an upstream L3 IGMP querier (multicast router). The
switch forwards IGMP membership reports only to those ports where multicast routers are
attached.
The system automatically configures an mrouter port for each VLAN that has received an IGMP
general query with an IP source address other than 0.0.0.0. Use the show igmpsnooping querier
detail command to display the addresses of upstream queriers by VLAN.
You can use this command to manually enable or disable a port as an mrouter port. To display the
mrouter ports statically configured, use the show igmpsnooping mrouter command.

Example
This example disables port fe.1.20 as an mrouter port for VLAN 100.
A4(su)->set igmpsnooping mrouter fe.1.20 100 disable

set igmpsnooping add-static

This command creates a new static IGMP entry or adds one or more new ports to an existing entry.

Syntax
set igmpsnooping add-static group vlan-list [modify] [port-string]

Parameters
group Specifies the multicast group IP address for the entry.
vlan-list Specifies the VLANs on which to configure the entry.
modify (Optional) Adds the specified port or ports to an existing entry.
port-string (Optional) Specifies the port or ports to add to the entry.

Defaults
If no ports are specified, no ports are added, creating a negative entry.
If modify is not specified, a new entry is created.

Mode
Switch command, read-write.

Usage
Use this command to create and configure static Layer 2 IGMP entries. The number of dynamic
and static entries supported is platform dependent. Refer to the Release Notes for your platform
for the number supported on your platform.

15-8 IGMP Configuration

 set igmpsnooping remove-static

Examples
This example creates an IGMP entry for the multicast group with IP address of 233.11.22.33
configured on VLAN 20 configured with the port fe.1.1.
A4(su)->set igmpsnooping add-static 233.11.22.33 20 fe.1.1
This example adds a port to an existing entry.
A4(su)->set igmpsnooping add-static 233.11.22.33 20 modify fe.1.2

set igmpsnooping remove-static

This command deletes a static IGMP entry or removes one or more new ports from an existing
entry.

Syntax
set igmpsnooping remove-static group vlan-list [modify port-string]

Parameters
group Specifies the multicast group IP address of the entry.
vlan-list Specifies the VLANs on which the entry is configured.
modify (Optional) Removes the specified port or ports from an existing entry.
port-string (Optional) Specifies the port or ports to remove from the entry.

Defaults
If no ports are specified, all ports are removed from the entry.

Mode
Switch command, read-write.

Example
This example removes port fe.1.1 from the entry for the multicast group with IP address of
233.11.22.33 configured on VLAN 20.
A4(su)->set igmpsnooping remove-static 233.11.22.33 20 modify fe.1.1

set igmpsnooping fast-leave

Use this command to enable or disable IGMP snooping fast-leave mode on selected interfaces.

Syntax
set igmpsnooping fast-leave port-string {enable | disable}

Parameters
port-string Specifies the port or ports to apply command to.
enable | disable Enable or disable IGMP snooping fast-leave mode.

Extreme A4 CLI Reference 15-9

set igmpsnooping <vlan-id>

Defaults
IGMP snooping fast-leave mode is disabled by default.

Mode
Switch command, read-write.

Usage
Enabling fast-leave allows the switch to immediately remove the layer 2 LAN interface from its
forwarding table entry upon receiving an IGMP leave message for that multicast group without
first sending out MAC-based general queries to the interface. You should enable fast-leave admin
mode only on interfaces where only one host is connected to each layer 2 LAN port, which
prevents the inadvertent dropping of other hosts that were connected to the same layer 2 LAN
port but were still interested in receiving multicast traffic directed to that group.
Also, fast-leave processing is supported only with IGMP version 2 hosts.

Example
This example enables IGMP snooping fast-leave mode on ports fe.1.1 through fe.1.10.
A4(su)->set igmpsnooping fast-leave fe.1.1-fe.1.10 enable

set igmpsnooping <vlan-id>

Use this command to enable or disable IGMP snooping on all interfaces associated with a
particular VLAN.

Syntax
set igmpsnooping vlan-id {enable | disable}

Parameters
vlan-id Specifies the VLAN on which to enable or disable IGMP snooping.
enable | disable Enables or disables IGMP snooping on the specified VLAN.

Defaults
IGMP snooping is disabled on VLAN interfaces by default.

Mode
Switch command, read-write.

Example
This example enables IGMP snooping on VLAN 20.
A4(su)->set igmpsnooping 20 enable

set igmpsnooping <vlan-id> fast-leave

Use this command to enable or disable IGMP snooping fast-leave mode on a VLAN.

15-10 IGMP Configuration

 set igmpsnooping <vlan-id> groupmembership-interval

Syntax
set igmpsnooping vlan-id fast-leave {enable | disable}

Parameters
vlan-id Specifies the VLAN on which to enable or disable IGMP snooping fast-
leave mode.
enable | disable Enables or disables IGMP snooping fast-leave mode on the specified
VLAN.

Defaults
IGMP snooping fast-leave mode is disabled on VLAN interfaces by default.

Mode
Switch command, read-write.

Usage
This command enables or disables IGMP Snooping fast-leave mode on a selected VLAN. Enabling
fast-leave allows the switch to immediately remove the layer 2 LAN interface from its forwarding
table entry upon receiving an IGMP leave message for that multicast group without first sending
out MAC-based general queries to the interface. You should enable fast-leave admin mode only
on VLANs where only one host is connected to each layer 2 LAN port, which prevents the
inadvertent dropping of other hosts that were connected to the same layer 2 LAN port but were
still interested in receiving multicast traffic directed to that group.
Also, fast-leave processing is supported only with IGMP version 2 hosts.

Example
This example enables fast-leave mode on VLAN 20.
A4(su)->set igmpsnooping 20 fast-leave enable

set igmpsnooping <vlan-id> groupmembership-interval

Use this command to set the IGMP group membership interval time on a VLAN.

Syntax
set igmpsnooping vlan-id groupmembership-interval seconds

Parameters
vlan-id Specifies the VLAN on which to set the group membership interval
time.
seconds Specifies the interval. Value can range from 2 to 3600 seconds. This
interval should be greater than the response time for the VLAN.

Defaults
The default group membership interval time is 260 seconds.

Extreme A4 CLI Reference 15-11

set igmpsnooping <vlan-id> maxresponse

Mode
Switch command, read-write.

Usage
The IGMP group membership interval value sets the frequency of host-query frame transmissions.
That is, this value is the time interval after which the switch removes the group entry for an
interface from the forwarding table if it has not received a corresponding report from a host on
that interface.
This interval must be greater than the IGMP maximum response time as described in “set
igmpsnooping <vlan-id> maxresponse” on page 15-12.

Example
This example changes the group membership interval on VLAN 20 to 300 seconds.
A4(su)->set igmpsnooping 20 groupmembership-interval 300

set igmpsnooping <vlan-id> maxresponse

Use this command to set the IGMP maximum response time on a specific VLAN.

Syntax
set igmpsnooping vlan-id maxresponse seconds

Parameters
vlan-id Specifies the VLAN on which to set the maximum response time.
seconds Specifies the IGMP maximum response time in seconds. Value can
range from 1 to 25 seconds.

Defaults
The default maximum response time is 10 seconds.

Mode
Switch command, read-write.

Usage
If an IGMP leave group message is received on an interface, the IGMP snooping switch will send a
general query on that interface and wait the configured maximum response time. If no response is
received within that time, that interface is removed from the group.
This value must be less than the IGMP group membership time described in “set igmpsnooping
<vlan-id> groupmembership-interval” on page 15-11.
When using IGMP Snooping Querier, this parameter should be less than the value for the IGMP
Snooping Querier query interval.

Example
This example changes the maximum response time on VLAN 20 to 15 seconds.
A4(su)->set igmpsnooping 20 maxresponse 15

15-12 IGMP Configuration

 set igmpsnooping <vlan-id> mcrtrexpiretime

set igmpsnooping <vlan-id> mcrtrexpiretime

Use this command to set the multicast router expiration time on a particular VLAN.

Syntax
set igmpsnooping vlan-id mcrtrexpire time

Parameters
time Specifies the IGMP multicast router expiration time. Valid values are 0 -
3600 seconds. A value of 0 will configure the system with an infinite
expiration time. The default value is 0.

Defaults
The default value is 0, infinite expiration time.

Mode
Switch command, read-write.

Usage
If a query from the IGMP multicast router is not received on an interface within the configured
multicast router present expiry time, that interface is removed from the list of interfaces with
multicast routers attached (mrouter ports).

Example
This example sets the multicast router expiration time to 100 seconds for VLAN 20.
A4(su)->set igmpsnooping 20 mcrtrexpiretime 100

show igmpsnooping static

This command displays static IGMP groups for one or more VLANs or ports.

Syntax
show igmpsnooping static [vlan-list] [group group]

Parameters
vlan-list (Optional) Specifies the VLAN for which to display static IGMP groups.
group group (Optional) Specifies the IGMP group for which to display information.

Defaults
If no group is specified, information for all groups is displayed.

Mode
Switch command, read-only.

Extreme A4 CLI Reference 15-13

show igmpsnooping mfdb

Example
This example displays the static IGMP group for VLAN 20.
A4(su)->show igmpsnooping static 20
--------------------------------------------------------------------------------
Vlan Id = 20 Static Multicast Group Address = 233.11.22.33 Type = IGMP
IGMP Port List = fe.1.1

show igmpsnooping mfdb

Use this command to display multicast forwarding database (MFDB) information.

Syntax
show igmpsnooping mfdb [stats]

Parameters
stats (Optional) Displays MFDB statistics.

Defaults
If stats is not specified, all MFDB table entries will be displayed.

Mode
Switch command, read-only.

Examples
This example shows how to display multicast forwarding database entries:
A4(su)->show igmpsnooping mfdb
VLAN MAC Address Type Description Interfaces
---- ----------------- ------- ---------------- -------------------------
5 33:33:FF:00:01:00 Dynamic Network Assist ge.2.28
5 33:33:FF:00:02:00 Dynamic Network Assist ge.2.28
5 33:33:FF:00:02:01 Dynamic Network Assist ge.2.28
5 33:33:FF:00:02:04 Dynamic Network Assist ge.3.1
5 33:33:FF:40:BC:D9 Dynamic Network Assist ge.3.1
5 33:33:FF:47:17:A3 Dynamic Network Assist ge.3.1
5 33:33:FF:54:E9:44 Dynamic Network Assist ge.3.1
5 33:33:FF:6B:88:00 Dynamic Network Assist ge.3.1
5 33:33:FF:8D:81:CF Dynamic Network Assist ge.3.1
5 33:33:FF:93:B8:EA Dynamic Network Assist ge.3.1
This example shows how to display multicast forwarding database statistics:
A4(su)->show igmpsnooping mfdb stats
Max MFDB Table Entries......................... 256
Most MFDB Entries Since Last Reset............. 1
Current Entries................................ 0

show igmpsnooping vlan

Use this command to display IGMP snooping information about a specific VLAN.

15-14 IGMP Configuration

 show igmpsnooping mrouter

Syntax
show igmpsnooping vlan vlan-id

Parameters
vlan-id Specifies the VLAN to show information about.

Defaults
None.

Mode
Switch command, read-only.

Example
This example displays IGMP information about VLAN 20, which does not have IGMP snooping
enabled.
A4(su)->show igmpsnooping vlan 20
Vlan ID 20
IGMP Snooping Admin Mode Disabled
Fast Leave Mode Disabled
Group Membership Interval (secs) 260
Max Response Time (secs) 10
Multicast Router Expiry Time (secs) 0

show igmpsnooping mrouter

Use this command to display information on dynamically learned multicast router interfaces.

Syntax
show igmpsnooping mrouter port-string [vlan-id]

Parameters
port-string Specifies the port or ports to display information about.
vlan-id (Optional) Specifies the VLAN to show information about.

Defaults
If a VLAN is not specified, no VLAN information is shown.

Mode
Switch command, read-only.

Example
This example displays information about fe.1.4 and VLAN 175.
A4(su)->show igmpsnooping mrouter fe.1.4 175
vlanId port mrouter status
------- ---------- --------------
175 ge.1.4 Enable

Extreme A4 CLI Reference 15-15

clear igmpsnooping

clear igmpsnooping
Use this command to clear all IGMP snooping entries.

Syntax
clear igmpsnooping

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear all IGMP snooping entries:
A4(su)->clear igmpsnooping
Are you sure you want to clear all IGMP snooping entries? (y/n) y

IGMP Snooping Entries Cleared.

clear igmpsnooping groupmembershipinterval

Use this command to clear the group membership interval to the default.

Syntax
clear igmpsnooping groupmembershipinterval [port-string]

Parameters
port-string (Optional) Clear the group membership interval for the specified port or
ports to the default of 260 seconds.

Defaults
If no port string is entered, the group membership interval is cleared to the default of 260 seconds
for all ports on the system.

Mode
Switch command, read-write.

Example
This example clears the group membership interval to the default on port fe.1.1.

15-16 IGMP Configuration

 clear igmpsnooping maxresponse

A4(su)->clear igmpsnooping groupmembershipinterval fe.1.1

clear igmpsnooping maxresponse

Use this command to clear the maximum response time to the default.

Syntax
clear igmpsnooping maxresponse [port-string]

Parameters
port-string (Optional) Clear the maximum response time for the specified port or
ports to the default of 10 seconds.

Defaults
If no port string is entered, the group membership interval is cleared to the default of 10 seconds
for all ports on the system.

Mode
Switch command, read-write.

Example
This example clears the maximum response time to the default on port fe.1.1.
A4(su)->clear igmpsnooping maxresponse fe.1.1

clear igmpsnooping mcrtexpiretime

Use this command to clear the multicast router expiration time to the default.

Syntax
clear igmpsnooping mcrtexpiretime [port-string]

Parameters
port-string (Optional) Clear the multicast router expiration time for the specified
port or ports to the default of 0 seconds.

Defaults
If no port string is entered, the multicast router expiration time is cleared to the default of 0
seconds for all ports on the system.

Mode
Switch command, read-write.

Example
This example clears the multicast router expiration time to the default on port fe.1.1.

Extreme A4 CLI Reference 15-17

clear igmpsnooping <vlan-id> groupmembership-interval

A4(su)->clear igmpsnooping mcrtexpiretim fe.1.1

clear igmpsnooping <vlan-id> groupmembership-interval

Use this command to clear the group membership interval to the default for the specified VLAN.

Syntax
clear igmpsnooping vlan-id groupmembership-interval

Parameters
vlan-id Specifies the VLAN for which to clear the group membership interval to
the default of 260 seconds.

Defaults
None.

Mode
Switch command, read-write.

Example
This example returns the group membership interval time to the default of 260 seconds for VLAN
20.
A4(su)->clear igmpsnooping 20 groupmembership-interval

clear igmpsnooping <vlan-id> maxresponse

Use this command to clear the maximum response time to the default for the specified VLAN.

Syntax
clear igmpsnooping vlan-id maxresponse

Parameters
vlan-id Specifies the VLAN for which to clear the maximum response time to
the default of 10 seconds.

Defaults
None.

Mode
Switch command, read-write.

Example
This example returns the maximum response time to the default of 10 seconds for VLAN 20.
A4(su)->clear igmpsnooping 20 maxresponse

15-18 IGMP Configuration

 clear igmpsnooping <vlan-id> mcrtexpiretime

clear igmpsnooping <vlan-id> mcrtexpiretime

Use this command to clear the multicast router expiration time to the default for the specified
VLAN.

Syntax
clear igmpsnooping vlan-id mcrtexpiretime

Parameters
vlan-id Specifies the VLAN for which to clear the multicast router expiratiion
time to the default of 0 seconds.

Defaults
None.

Mode
Switch command, read-write.

Example
This example returns the maximum response time to the default of 0 seconds for VLAN 20.
A4(su)->clear igmpsnooping 20 mcrtexpiretime

Configuring IGMP Snooping Querier

IGMP Snooping Querier is an extension to the IGMP Snooping feature. It enhances the switch
capability to simulate an IGMP router in a Layer 2 network, removing the need to have an IGMP
Router in a Layer2 network to collect the Multicast group membership information.
IGMP Snooping Querier and MLD Snooping Querier are interoperable and can be enabled
simultaneously.
Use the following commands to configure IGMP snooping querier functionality at Layer 2.

For information about... Refer to page...

show igmpsnooping querier 15-20

set igmpsnooping querier 15-21

set igmpsnooping querier <vlan-id> 15-21

set igmpsnooping querier address 15-22

set igmpsnooping querier <vlan-id> address 15-23

set igmpsnooping querier election participate 15-23

set igmpsnooping querier query-interval 15-24

set igmpsnooping querier timer expiry 15-25

set igmpsnooping querier version 15-25

clear igmpsnooping querier <vlan-id> 15-26

clear igmpsnooping querier 15-26

Extreme A4 CLI Reference 15-19

show igmpsnooping querier

show igmpsnooping querier

Use this command to display IGMP snooping querier information.

Syntax
show igmpsnooping querier [detail | vlan vlan-id]

Parameters
detail (Optional) Display detailed information.
vlan vlan-id (Optional) Display querier information for the specified VLAN.

Defaults
If no optional parameters are entered, global querier status is displayed.

Mode
Switch command, read-only.

Usage
Configured information is displayed whether or not IGMP snooping querier is enabled. If a
querier is active in the network and IGMP snooping querier is enabled, the querier's IP address is
shown in the Last Querier Address field.

Examples
This example displays global querier status only.
A4(su)->show igmpsnooping querier
Global IGMP Snooping querier status
-----------------------------------
IGMP Snooping Querier Mode Disable
Querier Address 0.0.0.0
IGMP Version 2
Querier Query Interval 60
Querier Expiry Interval 60
This example displays detailed information.
A4(su)->show igmpsnooping querier detail
Last Querier
VLAN ID Address IGMP Version
------- ---------------- ------------
100 192.168.100.1 v2
101 192.168.101.1 v2

Global IGMP Snooping querier status

-----------------------------------
IGMP Snooping Querier Mode Disable
Querier Address 0.0.0.0
IGMP Version 2
Querier Query Interval 60
Querier Expiry Interval 60
This example displays VLAN 100 querier status.
A4(su)->show igmpsnooping querier vlan 100
VLAN 100 : IGMP Snooping querier status

15-20 IGMP Configuration

 set igmpsnooping querier

----------------------------------------------
IGMP Snooping Querier VLAN Mode Disable
Querier Election Participate Mode Disable
Querier VLAN Address 0.0.0.0
Operational State Disabled
Last Querier Address 192.168.100.1
Operational version 2

set igmpsnooping querier

Use this command to enable or disable IGMP snooping querier globally on the system.

Syntax
set igmpsnooping querier {enable | disable}

Parameters
enable | disable Enables or disables the IGMP snooping querier functionality on the
system. This feature is disabled by default.

Defaults
IGMP snooping querier functionality is disabled by default.

Mode
Switch command, read-write.

Usage
IGMP snooping must be enabled globally and on the VLAN, and IGMP snooping querier must be
enabled globally, before enabling IGMP snooping querier on a VLAN.

Example
This example enables IGMP snooping querier globally on the switch.
A4(su)->set igmpsnooping adminmode enable
A4(su)->set igmpsnooping 20 enable
A4(su)->set igmpsnooping querier enable

set igmpsnooping querier <vlan-id>

Use this command to enable or disable IGMP snooping querier on a VLAN.

Syntax
set igmpsnooping querier vlan-id {enable | disable}

Parameters
vlan-id Specifies the VLAN on which to enable or disable IGMP snooping
querier functionality.
enable | disable Enables or disables the IGMP snooping querier functionality on the
specified VLAN. This feature is disabled by default.

Extreme A4 CLI Reference 15-21

set igmpsnooping querier address

Defaults
IGMP snooping querier functionality is disabled by default. When enabled, the IGMP snooping
querier disables itself if it detects IGMP traffic from a multicast-enabled router.

Mode
Switch command, read-write.

Usage
IGMP snooping must be enabled globally and on the VLAN, and IGMP snooping querier must be
enabled globally, for IGMP snooping querier to operate on a VLAN.
When IGMP snooping is operationally enabled, it will send out a general membership query on
the forwarding, non-multicast router member ports of the VLAN at every query interval.

Example
This example enables IGMP snooping querier on VLAN 20.
A4(su)->set igmpsnooping adminmode enable
A4(su)->set igmpsnooping 20 enable
A4(su)->set igmpsnooping querier enable
A4(su)->set igmpsnooping querier 20 enable

set igmpsnooping querier address

Use this command to specify the IP address that the snooping querier switch should use as the
source address when generating periodic queries to solicit membership reports.

Syntax
set igmpsnooping querier address IPv4-addr

Parameters
IPv4-addr Specifies the IPv4 address that the switch should use as the source
address when it generates periodic queries.

Defaults
None.

Mode
Switch command, read-write.

Usage
This command configures the global snooping querier source address. You can use the command
set igmpsnooping querier <vlan-id> address to configure a snooping querier source address for a
VLAN.
If there are no global or VLAN querier addresses configured, then the switch’s management IP
address is used as the IGMP snooping querier source address. The VLAN IP address takes
precedence over the global IP address. If no management IP address is configured, no queries are
sent.

15-22 IGMP Configuration

 set igmpsnooping querier <vlan-id> address

Using all zeros for the querier IP address removes a configured address, or you can use the clear
igmpsnooping querier address command to return the address to 0.0.0.0.

Example
This example sets the IGMP snooping querier global address to 10.10.10.10.
A4(su)->set igmpsnooping querier address 10.10.10.10

set igmpsnooping querier <vlan-id> address

Use this command to specify the IP address that the snooping querier enabled on the specified
VLAN should use as the source address when generating periodic queries to solicit membership
reports.

Syntax
set igmpsnooping querier vlan-id address IPv4-addr

Parameters
vlan-id Specifies the VLAN on which to configure the source address.
IPv4-addr Specifies the IPv4 address that the switch should use as the source
address when it generates periodic queries.

Defaults
None.

Mode
Switch command, read-write.

Usage
This command configures the snooping querier source address on a VLAN. You can use the
command set igmpsnooping querier address to configure a snooping querier source address
globally.
If there are no global or VLAN querier addresses configured, then the switch’s management IP
address is used as the IGMP snooping querier source address. The VLAN IP address takes
precedence over the global IP address.
Using all zeros for the querier IP address removes a configured address, or you can use the clear
igmpsnooping querier <vlan-id> address command to return the address to 0.0.0.0 on the VLAN.

Example
This example sets the IGMP snooping querier address to 20.20.20.20 for VLAN 20.
A4(su)->set igmpsnooping querier 20 address 20.20.20.20

set igmpsnooping querier election participate

Use this command to enable or disable the snooping querier to participate in the querier election
process when it discovers the presence of another querier in the VLAN.

Extreme A4 CLI Reference 15-23

set igmpsnooping querier query-interval

Syntax
set igmpsnooping querier election participate vlan-id {enable | disable}

Parameters
vlan-id Specifies the VLAN on which to enable or disable participation in the
querier election process.
enable | disable Enables or disables participation.

Defaults
Participation in the querier election process is disabled by default.

Mode
Switch command, read-write.

Usage
When this mode is enabled, if the snooping querier discovers the presence of another querier on
the VLAN and the other querier source address is higher than the snooping querier’s own
address, the local querier stops sending periodic queries.
If the local snooping querier wins the election, then it continues sending periodic queries.
Disabling participation with this command causes the snooping querier to not participate in the
querier election but to go into a non-querier mode as soon as it discovers the presence of another
querier in the same VLAN.

Example
This example enables querier election process participation for VLAN 20.
A4(su)->set igmpsnooping querier election participation 20 enable

set igmpsnooping querier query-interval

Use this command to set the IGMP querier query interval time, which is the amount of time in
seconds that the switch waits before sending another periodic query.

Syntax
set igmpsnooping querier query-interval time

Parameters
time Sets the query interval, in seconds. Value can range from 1 to 1800
seconds.

Defaults
The default query interval time is 60 seconds.

Mode
Switch command, read-write.

15-24 IGMP Configuration

 set igmpsnooping querier timer expiry

Example
This example sets the query interval to 1800 seconds.
A4(su)->set igmpsnooping querier query-interval 1800

set igmpsnooping querier timer expiry

Use this command to set the IGMP querier timer expiration period which is the time period that
the switch remains in Non-Querier mode after it has discovered that there is a Multicast Querier in
the network.

Syntax
set igmpsnooping querier timer expiry time

Parameters
time Sets the timer expiration, in seconds. Value can range from 60 to 300
seconds.

Defaults
The default timer expiry interval time is 60 seconds.

Mode
Switch command, read-write.

Example
This example sets the timer expiry interval to 80 seconds.
A4(su)->set igmpsnooping querier timer expiry 80

set igmpsnooping querier version

Use this command to set the IGMP version of the query that the snooping switch sends
periodically.

Syntax
set igmpsnooping querier version {1 | 2}

Parameters
1|2 Sets the IGMP version.

Defaults
The default IGMP version is 2.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 15-25

clear igmpsnooping querier <vlan-id>

Example
This example sets the IGMP version to 1.
A4(su)->set igmpsnooping querier version 1

clear igmpsnooping querier <vlan-id>

Use this command to return the IGMP querier source address for the specified VLAN to the
default of 0.0.0.0.

Syntax
clear igmpsnooping querier vlan-id address

Parameters
vlan-id Specifies the VLAN for which to clear the IGMP querier source address
to the default of 0.0.0.0.

Defaults
The default source address is 0.0.0.0.

Mode
Switch command, read-write.

Example
This example clears the IGMP querier source address for VLAN 20.
A4(su)->clear igmpsnooping querier 20 address

clear igmpsnooping querier

Use this command to return the IGMP querier global settings to their default values.

Syntax
clear igmpsnooping querier {address | query-interval | timer expiry| version}

Parameters
address Clear the IGMP querier source address to the default of 0.0.0.0.
query-interval Clear the query interval to the default of 60 seconds.
timer expiry Clear the expiry interval to the default of 60 seconds.
version Clear the IGMP version to the default of 2.

Defaults
The default
• source address is 0.0.0.0
• query interval is 60 seconds
• expiry interval is 60 seconds

15-26 IGMP Configuration

 Configuring IGMP on Routing Interfaces

• IGMP version is 2

Mode
Switch command, read-write.

Example
This example clears the global IGMP querier source address.
A4(su)->clear igmpsnooping querier address

Configuring IGMP on Routing Interfaces

Router: The commands covered in this section can be executed only when the device is in router
mode.

Use the following commands to configure IGMP on routing interfaces.

For information about... Refer to page...

ip igmp 15-27

show ip igmp 15-28

ip igmp enable 15-29

ip igmp version 15-29

show ip igmp interface 15-30

show ip igmp groups 15-31

ip igmp query-interval 15-31

ip igmp query-max-response-time 15-32

ip igmp startup-query-interval 15-33

ip igmp startup-query-count 15-33

ip igmp last-member-query-interval 15-34

ip igmp last-member-query-count 15-34

ip igmp robustness 15-35

show ip igmp interface membership 15-36

show ip igmp interface stats 15-37

ip igmp
Use this command to enable the L3 IGMP Querier functionality on the switch or to enable Router
Alert options checking. The no form of this command disables IGMP Querier functionality or
disables Router Alert options checking.

Syntax
ip igmp [router-alert-check]
no ip igmp

Extreme A4 CLI Reference 15-27

show ip igmp

Parameters
router-alert-check (Optional) Specifies that the router should ignore Report messages
without Router Alert options and not forward Report messages. Disable
this feature with the no version of this command.

Defaults
Router Alert options checking is disabled by default.

Mode
Global configuration: A4(su)->router(Config)#

Usage
Enabling IGMP on a routing interface requires both the ip igmp command (page 15-27), which
enables it on the router, and the ip igmp enable command (page 15-29), which enables it on an
interface. Once these commands are executed, the device will start sending and processing IGMP
multicast traffic. IGMP is disabled by default, both globally and on a per interface basis.
If you enable Router Alert options checking, you will break backwards compatibility with
implementations of IGMPv1 or earlier versions of IGMPv2 which did not require Router Alerts.
Refer to RFC 3376 for more details.

Examples
This example shows how to enable IGMP on the router:
A4(su)->router(Config)#ip igmp
This example enables Router Alert options checking.
A4(su)->router(Config)#ip igmp router-alert-check

show ip igmp
Use this command to display system-wide IGMP information.

Syntax
show ip igmp

Parameters
None.

Defaults
None.

Mode
Router privileged exec: A4(su)->router#
Global configuration: A4(su)->router(Config)#

Example
This example shows the output of this command.

15-28 IGMP Configuration

 ip igmp enable

A4(su)->router(Config)#show ip igmp

IGMP Admin Mode Enabled

IGMP Router-Alert check Disabled

IGMP INTERFACE STATUS

Interface Interface Mode Protocol State
--------- -------------- ----------------
vlan2 Enabled Non-Operational
vlan3 Enabled Non-Operational

ip igmp enable
Use this command to enable IGMP on an interface. The no form of this command disables IGMP
on an interface.

Syntax
ip igmp enable
no ip igmp enable

Parameters
None.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Usage
Enabling IGMP on a routing interface requires both the ip igmp command (page 15-27), which
enables it on the router, and the ip igmp enable command (page 15-29), which enables it on an
interface. Once these commands are executed, the device will start sending and processing IGMP
multicast traffic. IGMP is disabled by default, both globally and on a per interface basis.

Example
This example shows how to enable IGMP on the VLAN 1 interface:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip igmp enable

ip igmp version
Use this command to set the version of IGMP running on the router. The no form of this command
resets IGMP to the default version of 3 (IGMPv3).

Syntax
ip igmp version version
no ip igmp

Extreme A4 CLI Reference 15-29

show ip igmp interface

Parameters
version Specifies the IGMP version number to run on the router. Valid values are
1, 2, or 3.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to set the IGMP version to version 1 on VLAN 1:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip igmp version 1

show ip igmp interface

Use this command to display information about one or more IGMP routing interfaces.

Syntax
show ip igmp interface vlan vlan-id

Parameters
vlan vlan-id Specifies the VLAN or range of VLANs to display information for.

Defaults
None.

Mode
Router privileged exec: A4(su)->router#
Global configuration: A4(su)->router(Config)#

Example
This example shows how to display IGMP routing information for VLAN 2:
A4(su)->router#show ip igmp interface vlan 2

Interface vlan2
IP Address 3.3.3.3
Subnet Mask 255.0.0.0
IGMP Admin Mode Enabled
Interface Mode Enabled
IGMP Version 3
Query Interval (secs) 125
Query Max Response Time(1/10 th of a sec) 100
Robustness 2
Startup Query Interval (secs) 31
Startup Query Count 2
Last Member Query Interval (1/10 of a second) 10

15-30 IGMP Configuration

 show ip igmp groups

Last Member Query Count 2

show ip igmp groups

Use this command to display a list of IGMP streams and client connection ports per VLAN
interface.

Syntax
show ip igmp groups interface vlan vlan-id [detail]

Parameters
vlan-id Specifies the VLAN for which to display information.
detail (Optional) Display detailed information.

Defaults
If detail is not specified, group details are not displayed.

Mode
Router privileged exec: A4(su)->router#
Global configuration: A4(su)->router(Config)#

Examples
This example shows how to display information about IGMP groups on VLAN 2:
A4(su)->router#show ip igmp groups interface vlan 2
IP Address 1.2.3.4
Subnet Mask 255.255.255.0
Interface Mode Enabled
Querier Status Querier
This example displays detailed group information for VLAN 2.
A4(su)->router#show ip igmp groups interface vlan 2 detail

REGISTERED MULTICAST GROUP DETAILS

Version1 Version2 Group
Multicast Last Up Expiry Host Host Compat
IP Address Reporter Time Time Timer Timer Mode
--------------- ------------ ---------- ---------- ---------- ---------- ------
228.1.1.1 12.12.12.2 00:00:05 00:04:15 ------ 00:04:15 v2

ip igmp query-interval
Use this command to set the IGMP query interval on a routing interface. The no form of this
command resets the IGMP query interval to the default value of 125 seconds.

Syntax
ip igmp query-interval time
no ip igmp query-interval

Extreme A4 CLI Reference 15-31

ip igmp query-max-response-time

Parameters
time Specifies the IGMP query interval. Valid values are from 1 to 3600
seconds. Default is 125 seconds.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to set the IGMP query interval to 1800 seconds on VLAN 1:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip igmp query-interval 1800

ip igmp query-max-response-time
Use this command to set the maximum response time interval advertised in IGMPv2 queries. The
no form of this command resets the IGMP maximum response time to the default value
of 100 deciseconds, or 10 seconds.

Syntax
ip igmp query-max-response-time time
no ip igmp query-max-response-time

Parameters
time Specifies the IGMP maximum response time interval. Valid values are
from 1 to 255 tenths of a second. The default value is 100 deciseconds (10
seconds).

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to set the IGMP query maximum response time interval to 200
deciseconds (20 seconds) on VLAN 1:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip igmp query-max-response-time 200

15-32 IGMP Configuration

 ip igmp startup-query-interval

ip igmp startup-query-interval
Use this command to set the interval between general IGMP queries sent on startup. The no form
of this command resets the IGMP startup query interval to the default value of 31 seconds.

Syntax
ip igmp startup-query-interval time
no ip igmp startup-query-interval

Parameters
time Specifies the IGMP startup query interval. Valid values are from 1 to 300
seconds. The default value is 31 seconds.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to set the IGMP startup query interval to 100 seconds on VLAN 1:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip igmp startup-query-interval 100

ip igmp startup-query-count
Use this command to set the number of IGMP queries sent out on startup, separated by the
startup-query-interval as described in ip igmp startup-query-interval (page 15-33). The no form of
this command resets the IGMP startup query count to the default value of 2.

Syntax
ip igmp startup-query-count count
no ip igmp startup-query-count

Parameters
count Specifies the number of IGMP startup queries. Valid values are from 1 to
20. The default value is 2.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Extreme A4 CLI Reference 15-33

ip igmp last-member-query-interval

Example
This example shows how to set the IGMP startup query count to 10 onVLAN 1:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip igmp startup-query-count 10

ip igmp last-member-query-interval
Use this command to set the maximum response time being inserted into group-specific queries
sent in response to leave group messages. The no form of this command resets the IGMP last
member query interval to the default value of 1 second (10 deciseconds).

Syntax
ip igmp last-member-query-interval time
no ip igmp last-member-query-interval

Parameters
time Specifies the IGMP last member query interval. Valid values are from 1 to
255 tenths of a second. The default value is 10 deciseconds, equivalent to 1
second.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to set the IGMP last member query interval to 20 deciseconds (or 2
seconds) on VLAN 1:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip igmp last-member-query-interval 20

ip igmp last-member-query-count
Use this command to set the number of group-specific queries sent before assuming there are no
local members. The no form of this command resets the IGMP last member query count to the
default value of 2.

Syntax
ip igmp last-member-query-count count
no ip igmp last-member-query-count

Parameters
count Specifies the number of IGMP startup queries. Valid values are from 1 to
20. The default value is 2.

15-34 IGMP Configuration

 ip igmp robustness

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to set the IGMP last member query count to 10 on VLAN 1:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip igmp last-member-query-count 10

ip igmp robustness
Use this command to configure the robustness tuning for expected packet loss on an IGMP
routing interface. The no form of this command resets the IGMP robustness value to the default of
2.

Syntax
ip igmp robustness robustness
no ip igmp robustness

Parameters
robustness Specifies the IGMP robustness value. Valid values are from 1 to 255. The
default value is 2.

Defaults
None.

Mode
Interface configuration: A4 (su)->router(Config-if(Vlan 1))#

Usage
This value determines how many times IGMP messages will be sent. A higher number will mean
that end stations will be more likely to see the packet. After the robustness value is reached, IGMP
will assume there is no response to queries.

Example
This example shows how to set the IGMP robustness value to 5 on VLAN 1:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip igmp robustness 5

Extreme A4 CLI Reference 15-35

show ip igmp interface membership

show ip igmp interface membership

Use this command to display the list of interfaces that have registered in the multicast group. If
detail is specified, this command displays detailed information about the listed interfaces.

Syntax
show ip igmp interface membership groupaddr [detail]

Parameters
groupaddr Specifies the multicast group address to show information about.
detail (Optional) Display detailed information.

Defaults
None.

Mode
Router privileged exec: A4(su)->router#
Global configuration: A4(su)->router(Config)#

Examples
This example displays the list of interfaces that have registered in the multicast group
224.100.100.1. IGMP snooping is disabled.
A4(su)->router(Config)#show ip igmp interface membership 224.100.100.1

IGMP INTERFACE MEMBERSHIP INFO

Interface Interface IP State Group Compat Source Filter
Mode Mode
--------- --------------- ------------ ------------ -------------
vlan134 192.168.134.1 Querier v2 -----
This example displays detailed information for the same multicast group. IGMP snooping is
disabled.
A4(su)->router(Config)#show ip igmp interface membership 224.100.100.1 detail

IGMP INTERFACE DETAILED MEMBERSHIP INFO

Interface Group Compat Source Filter Source Hosts Expiry Time
Mode Mode
---------- ------------- -------------- -------------- ------------
vlan134 v2 ----- ----- -----
This example shows the detailed output when IGMP snooping is enabled.
A4(su)->router(Config)#show ip igmp interface membership 230.1.2.1 detail

IGMP INTERFACE DETAILED MEMBERSHIP INFO

Interface Group Compat Source Filter Source Hosts Expiry Time
Mode Mode
---------------- ------------- -------------- -------------- ------------
vlan200-ge.1.14 v3 Include 10.3.1.20 00:00:51
vlan200-ge.1.16 v3 Exclude 10.3.1.11 00:00:14

15-36 IGMP Configuration

 show ip igmp interface stats

show ip igmp interface stats

Use this command to display the IGMP statistical information for one or more VLANs. The
statistics are only displayed when the interface is enabled for IGMP and operational.

Syntax
show ip igmp interface stats vlan vlan-id

Parameters
vlan vlan-id Specifies the VLAN or range of VLANs to display statistics for.

Defaults
None.

Mode
Router privileged exec: A4(su)->router#
Global configuration: A4(su)->router(Config)#

Example
The following example displays the IGMP statistical information for VLAN 7:
A4(su)->router#show ip igmp interface stats vlan 7
Querier Status................................. Querier
Querier IP Address............................. 7.7.7.7
Querier Up Time (secs) ........................ 55372
Querier Expiry Time (secs) .................... 0
Wrong Version Queries.......................... 0
Number of Joins................................ 7
Number of Groups............................... 1

Extreme A4 CLI Reference 15-37

show ip igmp interface stats

15-38 IGMP Configuration

 16
MLD Configuration

This chapter describes the IPv6 Multicast Listener Discovery (MLD) configuration set of
commands. Refer to Chapter 26, “Configuring IPv6 Multicast,” in the Fixed Switching Configuration
Guide for configuration procedures, examples, and other information about MLD.

For information about... Refer to page...

Configuring MLD Snooping at Layer 2 16-1

Configuring MLD Snooping Querier 16-18

Configuring MLD Snooping at Layer 2

In IPv4, Layer 2 switches can use IGMP snooping to limit the flooding of multicast traffic by
dynamically configuring Layer 2 interfaces so that multicast traffic is forwarded to only those
interfaces associated with IP multicast addresses. In IPv6, MLD snooping performs a similar
function. With MLD snooping, IPv6 multicast data is selectively forwarded to a list of ports that
want to receive the data, instead of being flooded to all ports in a VLAN. This list is constructed by
snooping IPv6 multicast control packets.
MLD is a protocol used by IPv6 multicast routers to discover the presence of multicast listeners
(nodes wishing to receive IPv6 multicast packets) on its directly attached links and to discover
which multicast packets are of interest to neighboring nodes. MLD is derived from IGMP – MLD
version 1 (MLDv1, RFC 2710) is equivalent to IGMPv2 and MLD version 2 (MLDv2, RFC 3810) is
equivalent to IGMPv3. MLD is a subprotocol of Internet Control Message Protocol version 6
(ICMPv6), and MLD messages are a subset of ICMPv6 messages, identified in IPv6 packets by a
preceding Next Header value of 58.
Fast-leave processing is supported only with MLDv1 hosts and IGMP version 2 hosts. Enabling
fast-leave allows the switch to immediately remove a layer 2 LAN interface from its forwarding
table entry upon receiving a leave message for that multicast group without first sending out a
MAC-based general query to the interface. Fast-leave should be enabled only on interfaces where
only one host is connected to each layer 2 LAN port, which prevents the inadvertent dropping of
other hosts connected to the same layer 2 LAN port who are still interested in receiving multicast
traffic directed to that group.

Note: If fast-leave functionality is desired in an IPv6 network, it must be configured using the IGMP
snooping commands set igmpsnooping fast-leave and set igmpsnooping vlan-id fast-leave
described in Chapter 15, IGMP Configuration.

Use the following commands to configure MLD snooping from the switch CLI.

Extreme A4 CLI Reference 16-1

show mldsnooping

For information about... Refer to page...

show mldsnooping 16-2

show mldsnooping port 16-3

set mldsnooping adminmode 16-4

set mldsnooping interfacemode 16-5

set mldsnooping groupmembershipinterval 16-5

set mldsnooping maxresponse 16-6

set mldsnooping mcrtrexpiretime 16-7

set mldsnooping mrouter 16-8

set mldsnooping add-static 16-8

set mldsnooping remove-static 16-9

set mldsnooping <vlan-id> 16-10

set mldsnooping <vlan-id> groupmembership-interval 16-10

set mldsnooping <vlan-id> maxresponse 16-11

set mldsnooping <vlan-id> mcrtrexpiretime 16-11

show mldsnooping mfdb 16-12

show mldsnooping vlan 16-13

show mldsnooping mrouter 16-13

show mldsnooping static 16-14

clear mldsnooping 16-15

clear mldsnooping groupmembershipinterval 16-15

clear mldsnooping maxresponse 16-16

clear mldsnooping mcrtexpiretime 16-16

clear mldsnooping <vlan-id> groupmembership-interval 16-17

clear mldsnooping <vlan-id> maxresponse 16-17

clear mldsnooping <vlan-id> mcrtexpiretime 16-18

show mldsnooping
Use this command to display MLD snooping global and per port information.

Syntax
show mldsnooping

Parameters
None.

Defaults
None.

16-2 MLD Configuration

 show mldsnooping port

Mode
Switch command, read-only.

Usage
Configured information is displayed whether or not MLD snooping is enabled. Timer values are
shown for each port.

Example
This example shows part;ial output from the show mldsnooping command.
A4(su)->show mldsnooping
Admin Mode Disable
Group Membership Interval 260 fe.1.1
Group Membership Interval 260 fe.1.2
Group Membership Interval 260 fe.1.3
Group Membership Interval 260 fe.1.4
Group Membership Interval 260 fe.1.5
Group Membership Interval 260 fe.1.6
. . .

Max Response Time 10 fe.1.1

Max Response Time 10 fe.1.2
Max Response Time 10 fe.1.3
Max Response Time 10 fe.1.4
Max Response Time 10 fe.1.5
Max Response Time 10 fe.1.6
. . .

Multicast Router Present Expiration Time 0 fe.1.1

Multicast Router Present Expiration Time 0 fe.1.2
Multicast Router Present Expiration Time 0 fe.1.3
Multicast Router Present Expiration Time 0 fe.1.4
Multicast Router Present Expiration Time 0 fe.1.5
Multicast Router Present Expiration Time 0 fe.1.6
. . .

Interfaces Enabled for MLD Snooping........... ge.1.1

ge.1.2
ge.1.3
ge.1.4
ge.1.5
ge.1.6
...

Interfaces fast leave mode Enabled for MLD.... None

Interfaces mrouter Enabled for MLD snooping... ge.1.6
Multicast Control Frame Count.................. 43457
Data Frames Forwarded by the CPU 0

show mldsnooping port

Use this command to display MLD snooping information for one or more ports.

Syntax
show mldsnooping port [port-sting]

Extreme A4 CLI Reference 16-3

set mldsnooping adminmode

Parameters
port-string (Optional) Specifies the port or ports to display information about.

Defaults
If a port-string is not specified, information is displayed for all ports in the system or stack.

Mode
Switch command, read-only.

Example
This example displays information for fe.1.1.
A4(su)->show mldsnooping port fe.1.1

MLD Snooping Port info fe.1.1

MLD Snooping Admin Mode Enable
Fast Leave Mode Disable
Group Membership Interval (secs) 260
Max Response Time (secs) 10
Multicast Router Expiry Time (secs) 0

set mldsnooping adminmode

Use this command to enable or disable MLD globally on the system.

Syntax
set mldsnooping adminmode {enable | disable}

Parameters
enable | disable Enables or disables MLD snooping globally on the system.

Defaults
None.

Mode
Switch command, read-write.

Usage
In order for MLD snooping to be enabled on one or all ports, it must be globally enabled on the
device with this command, and then enabled on a port(s) using the set mldsnooping interface
mode command as described in “set mldsnooping interfacemode” on page 16-5.

Note: MLD snooping cannot be controlled via WebView.

16-4 MLD Configuration

 set mldsnooping interfacemode

Example
This example shows how to enable MLD on the system:
A4(su)->set mldsnooping adminmode enable

set mldsnooping interfacemode

Use this command to enable or disable MLD on one or all ports.

Syntax
set mldsnooping interfacemode port-string {enable | disable}

Parameters
port-string Specifies one or more ports on which to enable or disable MLD.
enable | disable Enables or disables MLD.

Defaults
None.

Mode
Switch command, read-write.

Usage
In order for MLD snooping to be enabled on one or all ports, it must be globally enabled on the
device using the set mldsnooping adminmode command as described in “set mldsnooping
adminmode” on page 16-4, and then enabled on a port(s) using this command.
If an interface has MLD Snooping enabled and it becomes a member of a lag (LACP), MLD
snooping functionality is disabled on that interface. MLD snooping functionality is re-enabled if
the interface is removed from a LAG.

Example
This example shows how to enable MLD on ports fe.1.1 through fe.1.10:
A4(su)->set mldsnooping interfacemode fe.1.1-10 enable

set mldsnooping groupmembershipinterval

Use this command to configure the MLD group membership interval time for the system.

Syntax
set mldsnooping groupmembershipinterval time [port-string]

Extreme A4 CLI Reference 16-5

set mldsnooping maxresponse

Parameters
time Specifies the MLD group membership interval in seconds. Valid values are 2
to 3600 seconds. Default is 260 seconds.
This value works together with the set mldsnooping maxresponsetime
command to remove ports from an MLD group and must be greater than
the max response time value.
port-string (Optional) Specifies the port or ports to which to apply the interval.

Defaults
If a port string is not specified, the group membership interval time is set for all ports on the
system.
Default interval is 260 seconds.

Mode
Switch command, read-write.

Usage
The Group Membership Interval time is the amount of time in seconds that a switch waits for a
report from a particular group on a particular interface before deleting the interface from the
entry. This value must be greater than the MLDv2 Maximum Response time value as described in
“set mldsnooping maxresponse” on page 16-6.

Example
This example shows how to set the MLD group membership interval to 250 seconds: for the
system.
A4(su)->set mldsnooping groupmembershipinterval 250

set mldsnooping maxresponse

Use this command to configure the MLD query maximum response time for the system.

Syntax
set mldsnooping maxresponse time [port-string]

Parameters
time Specifies the MLD maximum query response time. Valid values are 1 - 25
seconds. The default value is 10 seconds.
This value works together with the set mldsnooping
groupmembershipinterval command to remove ports from an MLD group
and must be less than the group membership interval value.
port-string (Optional) Specifies the port or ports to which to apply the time value.

Defaults
If a port string is not specified, the maximum response time is set for all ports on the system.
Default value is 10 seconds.

16-6 MLD Configuration

 set mldsnooping mcrtrexpiretime

Mode
Switch command, read-write.

Usage
If an MLD leave group message is received on an interface, the MLD snooping switch will send a
general query on that interface and wait the configured maximum response time. If no response is
received within that time, that interface is removed from the group.
This value must be less than the MLD group membership time described in “set mldsnooping
groupmembershipinterval” on page 16-5.

Example
This example shows how to set the MLD maximum response time to 20 seconds:
A4(su)->set mldsnooping maxresponse 20

set mldsnooping mcrtrexpiretime

Use this command to configure the MLD multicast router expiration time for the system.

Syntax
set mldsnooping mcrtrexpire time [port-string]

Parameters
time Specifies the MLD multicast router expiration time. Valid values are 0 - 3600
seconds. A value of 0 will configure the system with an infinite expiration
time. The default value is 0.
port-string (Optional) Specifies the port or ports to which to apply the time value.

Defaults
If a port string is not specified, the multicast router expiration time is set for all ports on the
system.
Default value is 0.

Mode
Switch command, read-write.

Usage
If a query from the MLD multicast router is not received on an interface within the configured
multicast router present expiry time, that interface is removed from the list of interfaces with
multicast routers attached (mrouter ports).

Example
This example shows how to set the MLD multicast router expiration time to infinity:
A4(su)->set mldsnooping mcrtrexpiretime 0

Extreme A4 CLI Reference 16-7

set mldsnooping mrouter

set mldsnooping mrouter

Use this command to manually enable or disable an mrouter port for a VLAN.

Syntax
set mldsnooping mrouter port-string vlan-id {enable | disable}

Parameters
port-string Specifies the port to enable or disable as an mrouter port.
vlan-id Specifies the VLAN to which this port is assigned.
enable | disable Enables or disables the port as an mrouter port for the specified VLAN.

Defaults
None.

Mode
Switch command, read-write.

Usage
An mrouter port is an interface which has an upstream L3 MLD querier (multicast router). The
switch forwards MLD membership reports only to those ports where multicast routers are
attached.
The system automatically configures an mrouter port for each VLAN that has received an MLD
general query with an IPv6 source address other than the unspecified address. Use the show
mldsnooping querier detail command to display the addresses of upstream queriers by VLAN.
You can use this command to manually enable or disable a port as an mrouter port. To display the
mrouter ports automatically configured by the system or manually configured, use the show
mldsnooping mrouter port-string vlan vid command.

Example
This example disables port fe.1.20 as an mrouter port for VLAN 100.
A4(su)->set mldsnooping mrouter fe.1.20 100 disable

set mldsnooping add-static

This command creates a new static MLD entry or adds one or more new ports to an existing entry.

Syntax
set mldsnooping add-static group vlan-list [modify] [port-string]

Parameters
group Specifies the multicast group IPv6 address for the entry.
vlan-list Specifies the VLANs on which to configure the entry.
modify (Optional) Adds the specified port or ports to an existing entry.
port-string (Optional) Specifies the port or ports to add to the entry.

16-8 MLD Configuration

 set mldsnooping remove-static

Defaults
If no ports are specified, the multicast group is black-holed, although users can dynamically join
the stream.
If modify is not specified, a new entry is created.

Mode
Switch command, read-write.

Usage
Use this command to create and configure static Layer 2 MLD entries. A maximum of 100 static
MLD groups can be configured. Refer to the Release Notes for your platform for the maximum
number of dynamic MLD groups that can be created.

Examples
This example creates an MLD entry for the multicast group with IPv6 address of FF43::5
configured on VLAN 20 configured with the port fe.1.1.
A4(su)->set mldsnooping add-static FF43::5 20 fe.1.1
This example adds a port to an existing entry.
A4(su)->set mldsnooping add-static FF43::5 20 modify fe.1.2

set mldsnooping remove-static

This command deletes a static MLD entry or removes one or more new ports from an existing
entry.

Syntax
set mldsnooping remove-static group vlan-list [modify port-string]

Parameters
group Specifies the multicast group IPv6 address of the entry.
vlan-list Specifies the VLANs on which the entry is configured.
modify (Optional) Removes the specified port or ports from an existing entry.
port-string (Optional) Specifies the port or ports to remove from the entry.

Defaults
If no ports are specified, all ports are removed from the entry.

Mode
Switch command, read-write.

Example
This example removes port fe.1.1 from the entry for the multicast group with IP address of FF43::4
configured on VLAN 20.
A4(su)->set mldsnooping remove-static FF43::4 20 modify fe.1.1

Extreme A4 CLI Reference 16-9

set mldsnooping <vlan-id>

set mldsnooping <vlan-id>

Use this command to enable or disable MLD snooping on all interfaces associated with a
particular VLAN.

Syntax
set mldsnooping vlan-id {enable | disable}

Parameters
vlan-id Specifies the VLAN on which to enable or disable MLD snooping.
enable | disable Enabl;es or disables MLD snooping on the specified VLAN.

Defaults
MLD snooping is disabled on VLAN interfaces by default.

Mode
Switch command, read-write.

Example
This example enables MLD snooping on VLAN 20.
A4(su)->set mldsnooping 20 enable

set mldsnooping <vlan-id> groupmembership-interval

Use this command to set the MLD group membership interval time on a VLAN.

Syntax
set mldsnooping vlan-id groupmembership-interval seconds

Parameters
vlan-id Specifies the VLAN on which to set the group membership interval
time.
seconds Specifies the interval. Value can range from 2 to 3600 seconds. This
interval should be greater than the response time for the VLAN.

Defaults
The default group membership interval time is 260 seconds.

Mode
Switch command, read-write.

Usage
The MLD group membership interval value sets the frequency of host-query frame transmissions.
That is, this value is the time interval after which the switch removes the group entry for an
interface from the forwarding table if it has not received a corresponding report from a host on
that interface.

16-10 MLD Configuration

 set mldsnooping <vlan-id> maxresponse

This interval must be greater than the MLD maximum response time as described in “set
mldsnooping <vlan-id> maxresponse” on page 16-11.

Example
This example changes the group membership interval on VLAN 20 to 300 seconds.
A4(su)->set mldsnooping 20 groupmembership-interval 300

set mldsnooping <vlan-id> maxresponse

Use this command to set the MLD maximum response time on a specific VLAN.

Syntax
set mldsnooping vlan-id maxresponse seconds

Parameters
vlan-id Specifies the VLAN on which to set the maximum response time.
seconds Specifies the MLD maximum response time in seconds. Value can range
from 1 to 25 seconds.

Defaults
The default maximum response time is 10 seconds.

Mode
Switch command, read-write.

Usage
If an MLD leave group message is received on an interface, the MLD snooping switch will send a
general query on that interface and wait the configured maximum response time. If no response is
received within that time, that interface is removed from the group.
This value must be less than the MLD group membership time described in “set mldsnooping
<vlan-id> groupmembership-interval” on page 16-10.
When using MLD Snooping Querier, this parameter should be less than the value for the MLD
Snooping Querier query interval.

Example
This example changes the maximum response time on VLAN 20 to 15 seconds.
A4(su)->set mldsnooping 20 maxresponse 15

set mldsnooping <vlan-id> mcrtrexpiretime

Use this command to set the multicast router expiration time on a particular VLAN.

Syntax
set mldsnooping vlan-id mcrtrexpire time

Extreme A4 CLI Reference 16-11

show mldsnooping mfdb

Parameters
time Specifies the MLD multicast router expiration time. Valid values are 0 -
3600 seconds. A value of 0 will configure the system with an infinite
expiration time. The default value is 0.

Defaults
The default value is 0, infinite expiration time.

Mode
Switch command, read-write.

Usage
If a query from the MLD multicast router is not received on an interface within the configured
multicast router present expiry time, that interface is removed from the list of interfaces with
multicast routers attached (mrouter ports).

Example
This example sets the multicast router expiration time to 100 seconds for VLAN 20.
A4(su)->set mldsnooping 20 mcrtrexpiretime 100

show mldsnooping mfdb

Use this command to display multicast forwarding database (MFDB) information.

Syntax
show mldsnooping mfdb [stats]

Parameters
stats (Optional) Displays MFDB statistics.

Defaults
If stats is not specified, all MFDB table entries will be displayed.

Mode
Switch command, read-only.

Examples
This example shows how to display multicast forwarding database entries:
A4(su)->show mldsnooping mfdb
VLAN MAC Address Type Description Interfaces
---- ----------------- ------- ---------------- -------------------------
20 33:33:00:00:00:77 Dynamic Network Assist ge.1.6, ge.1.22-24
20 33:33:00:00:00:78 Dynamic Network Assist ge.1.6, ge.1.22-24
20 33:33:00:00:00:79 Dynamic Network Assist ge.1.6, ge.1.22-24
20 33:33:00:00:00:7A Dynamic Network Assist ge.1.6, ge.1.22-24

16-12 MLD Configuration

 show mldsnooping vlan

20 33:33:00:00:00:7B Dynamic Network Assist ge.1.6, ge.1.22-24

20 33:33:00:00:00:7C Dynamic Network Assist ge.1.6, ge.1.22-24
20 33:33:00:00:00:7D Dynamic Network Assist ge.1.6, ge.1.22-24
20 33:33:00:00:00:7E Dynamic Network Assist ge.1.6, ge.1.22-24
20 33:33:00:00:00:7F Dynamic Network Assist ge.1.6, ge.1.22-24
20 33:33:00:00:00:80 Dynamic Network Assist ge.1.6, ge.1.22-24
This example shows how to display multicast forwarding database statistics:
A4(su)->show mldsnooping mfdb stats
Max MFDB Table Entries 1024
Most MFDB Entries Since Last Reset 14
Current Entries 14

show mldsnooping vlan

Use this command to display MLD snooping information about a specific VLAN.

Syntax
show mldsnooping vlan vlan-id

Parameters
vlan-id Specifies the VLAN to show information about.

Defaults
None.

Mode
Switch command, read-only.

Example
This example displays MLD information about VLAN 20, which does not have MLD snooping
enabled.
A4(su)->show mldsnooping vlan 20
Vlan ID 20
MLD Snooping Admin Mode Disabled
Fast Leave Mode Disabled
Group Membership Interval (secs) 260
Max Response Time (secs) 10
Multicast Router Expiry Time (secs) 0

show mldsnooping mrouter

Use this command to display information on statically learned multicast mrouter ports.

Syntax
show mldsnooping mrouter port-string [vlan-id]

Extreme A4 CLI Reference 16-13

show mldsnooping static

Parameters
port-string Specifies the port or ports to display information about.
vlan-id (Optional) Specifies the VLAN to show information about.

Defaults
If a VLAN is not specified, no VLAN information is shown.

Mode
Switch command, read-only.

Examples
This example displays information about ports fe.1.21 through fe.1.24, which have been enabled
as mroute ports.
A4(su)->show mldsnooping mrouter fe.1.21-24
port mrouter status
------- --------------
fe.1.21 Enable
fe.1.22 Enable
fe.1.23 Enable
fe.1.24 Enable
This example displays information about port fe.1.4 and VLAN 175. Port fe.1.4 has been
dynamically learned as an mroute port for VLAN 175.
A4(su)->show mldsnooping mrouter fe.1.4 175
vlanId port mrouter status
------- ---------- --------------
175 fe.1.4 Enable

show mldsnooping static

Use this command to display information about statically configured groups.

Syntax
show mldsnooping static [vlan-list] [group grp-addr]

Parameters
vlan-list (Optional) Specifies the VLAN or range of VLANs.
group grp-addr (Optional) Specifies the group to display information about.

Defaults
If no optional parameters are entered. configuration information about all statically configured
groups for all VLANs is displayed.

Mode
Switch command, read-only.

16-14 MLD Configuration

 clear mldsnooping

Example
This example displays information about all statically configured groups.
A4(su)->show mldsnooping static
--------------------------------------------------------------------------------
Vlan Id = 15 Group = ff38:40::beef:201:1111:f5 Type = MLD
MLD Port List = fe.1.4
--------------------------------------------------------------------------------
Vlan Id = 5 Group = ff38:40::beef:201:1111:1 Type = MLD
MLD Port List = fe.1.5
--------------------------------------------------------------------------------
Vlan Id = 5 Group = ff38:40::beef:201:1111:2 Type = MLD
MLD Port List = fe.1.5
--------------------------------------------------------------------------------
Vlan Id = 5 Group = ff38:40::beef:201:1111:3 Type = MLD
MLD Port List = fe.1.5
--------------------------------------------------------------------------------
Vlan Id = 5 Group = ff38:40::beef:201:1111:4 Type = MLD
MLD Port List = fe.1.5
--------------------------------------------------------------------------------
Vlan Id = 15 Group = ff38:40::beef:201:1111:3333 Type = MLD
MLD Port List = fe.1.15

clear mldsnooping
Use this command to clear all MLD snooping entries.

Syntax
clear mldsnooping

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear all MLD snooping entries:
A4(su)->clear mldsnooping
Are you sure you want to clear all snooping entries? (y/n) y

MLD Snooping Entries Cleared.

clear mldsnooping groupmembershipinterval

Use this command to clear the group membership interval to the default.

Syntax
clear mldsnooping groupmembershipinterval [port-string]

Extreme A4 CLI Reference 16-15

clear mldsnooping maxresponse

Parameters
port-string (Optional) Clear the group membership interval for the specified port or
ports to the default of 260 seconds.

Defaults
If no port string is entered, the group membership interval is cleared to the default of 260 seconds
for all ports on the system.

Mode
Switch command, read-write.

Example
This example clears the group membership interval to the default on port fe.1.1.
A4(su)->clear mldsnooping groupmembershipinterval fe.1.1

clear mldsnooping maxresponse

Use this command to clear the maximum response time to the default.

Syntax
clear mldsnooping maxresponse [port-string]

Parameters
port-string (Optional) Clear the maximum response time for the specified port or
ports to the default of 10 seconds.

Defaults
If no port string is entered, the group membership interval is cleared to the default of 10 seconds
for all ports on the system.

Mode
Switch command, read-write.

Example
This example clears the maximum response time to the default on port fe.1.1.
A4(su)->clear mldsnooping maxresponse fe.1.1

clear mldsnooping mcrtexpiretime

Use this command to clear the multicast router expiration time to the default.

Syntax
clear mldsnooping mcrtexpiretime [port-string]

16-16 MLD Configuration

 clear mldsnooping <vlan-id> groupmembership-interval

Parameters
port-string (Optional) Clear the multicast router expiration time for the specified
port or ports to the default of 0 seconds.

Defaults
If no port string is entered, the multicast router expiration time is cleared to the default of 0
seconds for all ports on the system.

Mode
Switch command, read-write.

Example
This example clears the multicast router expiration time to the default on port fe.1.1.
A4(su)->clear mldsnooping mcrtexpiretim fe.1.1

clear mldsnooping <vlan-id> groupmembership-interval

Use this command to clear the group membership interval to the default for the specified VLAN.

Syntax
clear mldsnooping vlan-id groupmembership-interval

Parameters
vlan-id Specifies the VLAN for which to clear the group membership interval to
the default of 260 seconds.

Defaults
None.

Mode
Switch command, read-write.

Example
This example returns the group membership interval time to the default of 260 seconds for VLAN
20.
A4(su)->clear mldsnooping 20 groupmembership-interval

clear mldsnooping <vlan-id> maxresponse

Use this command to clear the maximum response time to the default for the specified VLAN.

Syntax
clear mldsnooping vlan-id maxresponse

Extreme A4 CLI Reference 16-17

clear mldsnooping <vlan-id> mcrtexpiretime

Parameters
vlan-id Specifies the VLAN for which to clear the maximum response time to
the default of 10 seconds.

Defaults
None.

Mode
Switch command, read-write.

Example
This example returns the maximum response time to the default of 10 seconds for VLAN 20.
A4(su)->clear mldsnooping 20 maxresponse

clear mldsnooping <vlan-id> mcrtexpiretime

Use this command to clear the multicast router expiration time to the default for the specified
VLAN.

Syntax
clear mldsnooping vlan-id mcrtexpiretime

Parameters
vlan-id Specifies the VLAN for which to clear the multicast router expiratiion
time to the default of 0 seconds.

Defaults
None.

Mode
Switch command, read-write.

Example
This example returns the maximum response time to the default of 0 seconds for VLAN 20.
A4(su)->clear mldsnooping 20 mcrtexpiretime

Configuring MLD Snooping Querier

MLD Snooping Querier is an extension to the MLD Snooping feature. It enhances the switch
capability to simulate an MLD router in a Layer 2 network, removing the need to have an MLD
Router in a Layer 2 network to collect the Multicast group membership information.
MLD Snooping Querier and IGMP Snooping Querier are interoperable and can be enabled
simultaneously.

16-18 MLD Configuration

 show mldsnooping querier

Use the following commands to configure MLD snooping querier functionality at Layer 2.

For information about... Refer to page...

show mldsnooping querier 16-19

set mldsnooping querier 16-20

set mldsnooping querier <vlan-id> 16-21

set mldsnooping querier address 16-21

set mldsnooping querier <vlan-id> address 16-22

set mldsnooping querier election participate 16-23

set mldsnooping querier query-interval 16-24

set mldsnooping querier timer expiry 16-24

clear mldsnooping querier <vlan-id> address 16-25

clear mldsnooping querier 16-25

show mldsnooping querier

Use this command to display MLD snooping querier information.

Syntax
show mldsnooping querier [detail | vlan vlan-id]

Parameters
detail (Optional) Display detailed information.
vlan vlan-id (Optional) Display querier information for the specified VLAN.

Defaults
If no optional parameters are entered, global querier status is displayed.

Mode
Switch command, read-only.

Usage
Configured information is displayed whether or not MLD snooping querier is enabled. If a querier
is active in the network and MLD snooping querier is enabled, the querier's link-local address is
shown in the Last Querier Address field.

Examples
This example displays global querier status only.
A4(su)->show mldsnooping querier
Global MLD Snooping querier status
-----------------------------------
MLD Snooping Querier Mode Disable
Querier Address ::
MLD Version 1

Extreme A4 CLI Reference 16-19

set mldsnooping querier

Querier Query Interval 60

Querier Expiry Interval 60
This example displays detailed information.
A4(su)->show mldsnooping querier detail
VLAN ID Last Querier Address MLD Version
------- ---------------------------------------- -----------
5 fe80::21f:45ff:fe54:e78a v1

Global MLD Snooping querier status

----------------------------------
MLD Snooping Querier Mode Enable
Querier Address ::
MLD Version 1
Querier Query Interval 60
Querier Expiry Interval 60

VLAN 5 : MLD Snooping querier status

----------------------------------------------
MLD Snooping Querier VLAN Mode Enable
Querier Election Participate Mode Enable
Querier VLAN Address ::
Operational State Non-Querier
Last Querier Address fe80::21f:45ff:fe54:e78a
Operational version 1
Operational Max Resp Time 11

This example displays VLAN 100 querier status. This VLAN is an MLD snooping querier.
A4(su)->show mldsnooping querier vlan 100
VLAN 100 : MLD Snooping querier status
----------------------------------------------
MLD Snooping Querier VLAN Mode Enable
Querier Election Participate Mode Enable
Querier VLAN Address ::
Operational State Querier
Operational version 1
Operational Max Resp Time 10

set mldsnooping querier

Use this command to enable or disable MLD snooping querier globally on the system.

Syntax
set mldsnooping querier {enable | disable}

Parameters
enable | disable Enables or disables the MLD snooping querier functionality on the
system. This feature is disabled by default.

Defaults
MLD snooping querier functionality is disabled by default. When enabled, the MLD snooping
querier disables itself if it detects MLD traffic from a multicast-enabled router.

16-20 MLD Configuration

 set mldsnooping querier <vlan-id>

Mode
Switch command, read-write.

Example
This example enables MLD snooping querier globally on the switch.
A4(su)->set mldsnooping querier enable

set mldsnooping querier <vlan-id>

Use this command to enable or disable MLD snooping querier on a VLAN.

Syntax
set mldsnooping querier vlan-id {enable | disable}

Parameters
vlan-id Specifies the VLAN on which to enable or disable MLD snooping
querier functionality.
enable | disable Enables or disables the MLD snooping querier functionality on the
specified VLAN. This feature is disabled by default.

Defaults
MLD snooping querier functionality is disabled by default. When enabled, the MLD snooping
querier disables itself if it detects MLD traffic from a multicast-enabled router.

Mode
Switch command, read-write.

Example
This example enables MLD snooping querier on VLAN 20.
A4(su)->set mldsnooping querier 20 enable

set mldsnooping querier address

Use this command to specify the IPv6 link-local address that the snooping querier switch should
use as the source address when generating periodic queries to solicit membership reports.

Syntax
set mldsnooping querier address IPv6-lladdr

Parameters
IPv6-lladdr Specifies the IPv6 link-local address that the switch should use as the
source address when it generates periodic queries.

Defaults
None.

Extreme A4 CLI Reference 16-21

set mldsnooping querier <vlan-id> address

Mode
Switch command, read-write.

Usage
This command configures the global snooping querier source address. Queries must be sourced
by a link-local address. You can use the command set mldsnooping querier <vlan-id> address to
configure a snooping querier source address for a VLAN.
If there are no global or VLAN querier addresses configured, then the switch’s management IPv6
link-local address is used as the MLD snooping querier source address. The VLAN IPv6 link-local
address takes precedence over the global address.
Using the IPv6 unspecified address (::) for the querier IP address removes a configured address, or
you can use the clear mldsnooping querier address command to return the address to ::.

Example
This example sets the MLD snooping querier address to FE08::05
A4(su)->set mldsnooping querier address fe08::05

set mldsnooping querier <vlan-id> address

Use this command to specify the IPv6 link-local address that the snooping querier enabled on the
specified VLAN should use as the source address when generating periodic queries to solicit
membership reports.

Syntax
set mldsnooping querier vlan-id address IPv6-lladdr

Parameters
vlan-id Specifies the VLAN on which to configure the source address.
IPv6-lladdr Specifies the IPv6 link-local address that the switch should use as the
source address when it generates periodic queries.

Defaults
None.

Mode
Switch command, read-write.

Usage
This command configures the snooping querier source address on a VLAN. Queries must be
sourced by a link-local address. You can use the command set mldsnooping querier address to
configure a snooping querier source address globally.
If there are no global or VLAN querier addresses configured, then the switch’s management IPv6
link-local address is used as the MLD snooping querier source address. The VLAN IPv6 link-local
address takes precedence over the global IP address.

16-22 MLD Configuration

 set mldsnooping querier election participate

Using the IPv6 unspecified address (::) for the querier IP address removes a configured address, or
you can use the clear mldsnooping querier <vlan-id> address command to return the address to ::
on the VLAN.

Example
This example sets the MLD snooping querier address to FE08::5 for VLAN 20.
A4(su)->set mldsnooping querier 20 address fe08::5

set mldsnooping querier election participate

Use this command to enable or disable snooping querier participation in the querier election
process when it discovers the presence of another querier in the VLAN.

Syntax
set mldsnooping querier election participate wlan-id {enable | disable}

Parameters
vlan-id Specifies the VLAN on which to enable or disable participation in the
querier election process.
enable | disable Enables or disables participation.

Defaults
Participation in the querier election process is disabled by default.

Mode
Switch command, read-write.

Usage
Selection of the querier for a VLAN is determined by the link-local addresses of the devices
participating in the election process. The device with the lowest link-local address wins the
election.
If the local snooping querier wins the election, then it continues sending periodic queries.
Disabling participation with this command causes the snooping querier to not participate in the
querier election but to go into a non-querier mode as soon as it discovers the presence of another
querier in the same VLAN.

Example
This example enables querier election process participation for VLAN 20.
A4(su)->set mldsnooping querier election participation 20 enable

Extreme A4 CLI Reference 16-23

set mldsnooping querier query-interval

set mldsnooping querier query-interval

Use this command to set the MLD querier query interval time, which is the amount of time in
seconds that the switch waits before sending another periodic query.

Syntax
set mldsnooping querier query-interval time

Parameters
time Sets the query interval, in seconds. Value can range from 1 to 1800
seconds.

Defaults
The default query interval time is 60 seconds.

Mode
Switch command, read-write.

Example
This example sets the query interval to 1800 seconds.
A4(su)->set mldsnooping querier query-interval 1800

set mldsnooping querier timer expiry

Use this command to set the MLD querier timer expiration period which is the time period that
the switch remains in Non-Querier mode after it has discovered that there is a Multicast Querier in
the network.

Syntax
set mldsnooping querier timer expiry time

Parameters
time Sets the timer expiration, in seconds. Value can range from 60 to 300
seconds.

Defaults
The default timer expiry interval time is 60 seconds.

Mode
Switch command, read-write.

Example
This example sets the timer expiry interval to 80 seconds.
A4(su)->set mldsnooping querier timer expiry 80

16-24 MLD Configuration

 clear mldsnooping querier <vlan-id> address

clear mldsnooping querier <vlan-id> address

Use this command to return the MLD querier source address for the specified VLAN to the default
of the IPv6 unspecified address (::).

Syntax
clear mldsnooping querier vlan-id address

Parameters
vlan-id Specifies the VLAN for which to clear the MLD querier source address
to the default of the IPv6 unspecified address (::).

Defaults
The default source address is ::.

Mode
Switch command, read-write.

Example
This example clears the MLD querier source address for VLAN 20.
A4(su)->clear mldsnooping querier 20 address

clear mldsnooping querier

Use this command to return the MLD querier global settings to their default values.

Syntax
clear mldsnooping querier {address | query-interval | timer expiry}

Parameters
address Clear the MLD querier source address to the default of the IPv6
unspecified address (::).
query-interval Clear the query interval to the default of 60 seconds.
timer expiry Clear the expiry interval to the default of 60 seconds.

Defaults
• The default source address is ::
• The default query-interval is 60 seconds
• The default timer expiry interval is 60 seconds

Mode
Switch command, read-write.

Example
This example clears the global MLD querier source address.

Extreme A4 CLI Reference 16-25

clear mldsnooping querier

A4(su)->clear mldsnooping querier address

16-26 MLD Configuration

 17
Network Management

This chapter describes switch-related network management commands and how to use them.

Note: The commands in this chapter pertain to network management of the A4 device from the
switch CLI only. For information on router-related network management tasks, including
reviewing router ARP tables and IP traffic, refer to Chapter 23.

For information about... Refer to page...

Monitoring Network Events and Status 17-1

Managing Switch Network Addresses and Routes 17-6

Configuring Node Aliases 17-16

Monitoring Network Events and Status

Use the following commands to display switch events and command history, to set the size of the
history buffer, and to display and disconnect current user sessions.

For information about... Refer to page...

history 17-1

show history 17-2

set history 17-2

ping 17-3

show users 17-4

disconnect 17-4

show netstat 17-5

history
Use this command to display the contents of the command history buffer. The command history
buffer includes all the switch commands entered up to a maximum of 100, as specified in the set
history command (“set history” on page 17-2).

Syntax
history

Extreme A4 CLI Reference 17-1

show history

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the contents of the command history buffer. It shows there are
five commands in the buffer:
A4(su)->history
1 hist
2 show gvrp
3 show vlan
4 show igmp
5 show ip address

show history
Use this command to display the size (in lines) of the history buffer.

Syntax
show history

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the size of the history buffer:
A4(su)->show history
History buffer size: 20

set history
Use this command to set the size of the history buffer.

Syntax
set history size [default]

17-2 Network Management

 ping

Parameters
size Specifies the size of the history buffer in lines. Valid values are 1 to 100.
default (Optional) Makes this setting persistent for all future sessions.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the size of the command history buffer to 30 lines:
A4(su)->set history 30

ping
Use this command to send ICMP echo-request packets to another node on the network from the
switch CLI.

Syntax
ping host

Parameters
host Specifies the IP address of the device to which the ping will be sent.

Defaults
None.

Mode
Switch command, read-write.

Examples
This example shows how to ping IP address 134.141.89.29. In this case, this host is alive:
A4(su)->ping 134.141.89.29
134.141.89.29 is alive
In this example, the host at IP address is not responding:
A4(su)->ping 134.141.89.255
no answer from 134.141.89.255

Extreme A4 CLI Reference 17-3

show users

show users
Use this command to display information about the active console port or Telnet session(s) logged
in to the switch.

Syntax
show users

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to use the show users command. In this output, there are two Telnet
users logged in with Read-Write access privileges from IP addresses 134.141.192.119 and
134.141.192.18:
A4(su)->show users
Session User Location
-------- ----- --------------------------
* telnet rw 134.141.192.119
telnet rw 134.141.192.18

disconnect
Use this command to close an active console port or Telnet session from the switch CLI.

Syntax
disconnect {ip-addr | console}

Parameters
ip-addr Specifies the IP address of the Telnet session to be disconnected. This
address is displayed in the output shown in “show users” on page 12-15.
console Closes an active console port.

Defaults
None.

Mode
Switch command, read-write.

17-4 Network Management

 show netstat

Examples
This example shows how to close a Telnet session to host 134.141.192.119:
A4(su)->disconnect 134.141.192.119
This example shows how to close the current console session:
A4(su)->disconnect console

show netstat
Use this command to display network layer statistics.

Syntax
show netstat [icmp | ip | routes | stats | tcp | udp]

Parameters
icmp (Optional) Shows Internet Control Message Protocol (ICMP) statistics.
ip (Optional) Shows Internet Protocol (IP) statistics.
routes (Optional) Shows the IP routing table.
stats (Optional) Shows all statistics for TCP, UDP, IP, and ICMP.
tcp (Optional) Shows Transmission Control Protocol (TCP) statistics.
udp (Optional) Shows User Datagram Protocol (UDP) statistics.

Defaults
If no parameters are specified, show netstat will be executed as shown in the example below.

Mode
Switch command, read-only.

Example
The following example shows how to display statistics for all the current active network
connections.
A4(su)->show netstat
Prot Local Address Foreign Address State
---- ----------------------------- ----------------------------- -----------
TCP 127.0.0.1.2222 0.0.0.0.* LISTEN
TCP 0.0.0.0.80 0.0.0.0.* LISTEN
TCP 0.0.0.0.23 0.0.0.0.* LISTEN
TCP 10.1.56.17.23 134.141.99.104.47718 ESTABLISHED
UDP 0.0.0.0.17185 0.0.0.0.*
UDP 127.0.0.1.49152 127.0.0.1.17185
UDP 0.0.0.0.161 0.0.0.0.*
UDP 0.0.0.0.* 0.0.0.0.*
UDP 0.0.0.0.514 0.0.0.0.*

The following table describes the output of this command.

Extreme A4 CLI Reference 17-5

Managing Switch Network Addresses and Routes

Table 17-1 show netstat Output Details

Output... What it displays...

Prot Type of protocol running on the connection.

Local Address IP address of the connection’s local host.

Foreign Address IP address of the connection’s foreign host.

State Communications mode of the connection.

Managing Switch Network Addresses and Routes

Use the following commands to display or delete switch ARP table entries, and to display MAC
address information.

For information about... Refer to page...

show arp 17-6

set arp 17-7

clear arp 17-8

traceroute 17-8

show mac 17-9

show mac agetime 17-10

set mac agetime 17-11

clear mac agetime 17-11

set mac algorithm 17-12

show mac algorithm 17-13

clear mac algorithm 17-13

set mac multicast 17-14

clear mac address 17-14

show mac unreserved-flood 17-15

set mac unreserved-flood 17-15

show arp
Use this command to display the switch’s ARP table.

Syntax
show arp

Parameters
None.

Defaults
None.

17-6 Network Management

 set arp

Mode
Switch command, read-only.

Example
This example shows how to display the ARP table:
A4(su)->show arp

LINK LEVEL ARP TABLE

IP Address Phys Address Flags Interface
-----------------------------------------------------
10.20.1.1 00-00-5e-00-01-1 S host
134.142.21.194 00-00-5e-00-01-1 S host
134.142.191.192 00-00-5e-00-01-1 S host
134.142.192.18 00-00-5e-00-01-1 S host
134.142.192.119 00-00-5e-00-01-1 S host
-----------------------------------------------------
Table 17-2 provides an explanation of the command output.

Table 17-2 show arp Output Details

Output Field What It Displays...

IP Address IP address mapped to MAC address.

Phys Address MAC address mapped to IP address.

Flags Route status. Possible values and their definitions include:

S - manually configured entry (static)
P - respond to ARP requests for this entry

set arp
Use this command to add mapping entries to the switch’s ARP table.

Syntax
set arp ip-address mac-address

Parameters
ip-address Specifies the IP address to map to the MAC address and add to the ARP
table.
mac-address Specifies the MAC address to map to the IP address and add to the ARP
table. The MAC address can be formatted as xx:xx:xx:xx:xx:xx or xx-xx-
xx-xx-xx-xx.

Defaults
None.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 17-7

clear arp

Example
This example shows how to map IP address 192.168.219.232 to MAC address 00-00-0c-40-0f-bc:
A4(su)->set arp 192.168.219.232 00-00-0c-40-0f-bc

clear arp
Use this command to delete a specific entry or all entries from the switch’s ARP table.

Syntax
clear arp {ip-address | all}

Parameters
ip-address | all Specifies the IP address in the ARP table to be cleared, or clears all ARP
entries.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to delete entry 10.1.10.10 from the ARP table:
A4(su)->clear arp 10.1.10.10

traceroute
Use this command to display a hop-by-hop path through an IP network from the device to a
specific destination host. Three UDP or ICMP probes will be transmitted for each hop between the
source and the traceroute destination.

Syntax
traceroute [-w waittime] [-f first-ttl] [-m max-ttl] [-p port] [-q nqueries] [-r]
[-d] [-n] [-v] host

Parameters
-w waittime (Optional) Specifies time in seconds to wait for a response to a probe.
-f first-ttl (Optional) Specifies the time to live (TTL) of the first outgoing probe
packet.
-m max-ttl (Optional) Specifies the maximum time to live (TTL) used in outgoing
probe packets.
-p port (Optional) Specifies the base UDP port number used in probes.
-q nqueries (Optional) Specifies the number of probe inquiries.
-r (Optional) Bypasses the normal host routing tables.
-d (Optional) Sets the debug socket option.

17-8 Network Management

 show mac

-n (Optional) Displays hop addresses numerically. (Supported in a future

release.)
-v (Optional) Displays verbose output, including the size and destination of
each response.
host Specifies the host to which the route of an IP packet will be traced.

Defaults
If not specified, waittime will be set to 5 seconds.
If not specified, first-ttl will be set to 1 second.
If not specified, max-ttl will be set to 30 seconds.
If not specified, port will be set to 33434.
If not specified, nqueries will be set to 3.
If -r is not specified, normal host routing tables will be used.
If -d is not specified, the debug socket option will not be used.
If -v is not specified, summary output will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to use traceroute to display a round trip path to host 192.167.252.17. In
this case, hop 1 is the A4 switch, hop 2 is 14.1.0.45, and hop 3 is back to the host IP address. Round
trip times for each of the three UDP probes are displayed next to each hop:
A4(su)->traceroute 192.167.252.17
traceroute to 192.167.252.17 (192.167.252.17), 30 hops max, 40 byte packets
1 matrix.enterasys.com (192.167.201.40) 20.000 ms 20.000 ms 20.000 ms
2 14.1.0.45 (14.1.0.45) 40.000 ms 10.000 ms 20.000 ms
3 192.167.252.17 (192.167.252.17) 50.000 ms 0.000 ms 20.000 ms

show mac
Use this command to display MAC addresses in the switch’s filtering database. These are
addresses learned on a port through the switching process.

Syntax
show mac [address mac-address] [fid fid] [port port-string] [type {other | learned
| self | mgmt | mcast}]

Parameters
address mac-address (Optional) Displays a specific MAC address (if it is known by the
device).
fid fid (Optional) Displays MAC addresses for a specific filter database
identifier.

Extreme A4 CLI Reference 17-9

show mac agetime

port port-string (Optional) Displays MAC addresses for specific port(s).

type other |learned | (Optional) Displays information related to other, learned, self, mgmt
self | mgmt | mcast (management), or static multicast (mcast) address type.

Defaults
If no parameters are specified, all MAC addresses for the device will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display MAC address information for ge.3.1:
A4(su)->show mac port ge.3.1

MAC Address FID Port Type

----------------- ---- ------------- --------
00-09-6B-0F-13-E6 15 ge.3.1 Learned

MAC Address VLAN Port Type Status Egress Ports

----------------- ---- ------------- ------- ------- ---------------------------
01-01-23-34-45-56 20 any mcast perm ge.3.1

Table 17-3 provides an explanation of the command output.

Table 17-3 show mac Output Details

Output Field What It Displays...

MAC Address MAC addresses mapped to the port(s) shown.

FID Filter database identifier.

Port Port designation.

Type Address type. Valid types are:

• Learned
• Self
• Management
• Other (this will include any static MAC locked addresses as described in
“Configuring MAC Locking” on page 27-51).
• mcast (multicast)

VLAN The VLAN ID configured for the multicast MAC address.

Status The status of the multicast address.

Egress Ports The ports which have been added to the egress ports list.

show mac agetime

Use this command to display the timeout period for aging learned MAC entries.

Syntax
show mac agetime

17-10 Network Management

 set mac agetime

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the MAC timeout period:
A4(su)->show mac agetime
Aging time: 300 seconds

set mac agetime

Use this command to set the timeout period for aging learned MAC entries.

Syntax
set mac agetime time

Parameters
time Specifies the timeout period in seconds for aging learned MAC
addresses. Valid values are 10 to 1,000,000 seconds. Default value is 300
seconds.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to set the MAC timeout period:
A4(su)->set mac agetime 250

clear mac agetime

Use this command to reset the timeout period for aging learned MAC entries to the default value
of 300 seconds.

Syntax
clear mac agetime

Parameters
None.

Extreme A4 CLI Reference 17-11

set mac algorithm

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to reset the MAC timeout period to the default value of 300 seconds.
A4(su)->clear mac agetime

set mac algorithm

Use this command to set the MAC algorithm mode, which determines the hash mechanism used
by the device when performing Layer 2 lookups on received frames.

Syntax
set mac algorithm {mac-crc16-lowerbits | mac-crc16-upperbits |
mac-crc32-lowerbits | mac-crc32-upperbits}

Parameters
mac-crc16-lowerbits Select the MAC CRC 16 lower bits algorithm for hashing.
mac-crc16-upperbits Select the MAC CRC 16 upper bits algorithm for hashing.
mac-crc32-lowerbits Select the MAC CRC 32 lower bits algorithm for hashing.
mac-crc32-upperbits Select the MAC CRC 32 upper bits algorithm for hashing.

Defaults
The default MAC algorithm is mac-crc16-upperbits.

Mode
Switch command, read-write.

Usage
Each algorithm is optimized for a different spread of MAC addresses. When changing this mode,
the switch will display a warning message and prompt you to restart the device.
The default MAC algorithm is mac-crc16-upperbits.

Example
This example sets the hashing algorithm to mac-crc32-upperbits.
A4(rw)->set mac algorithm mac-crc32-upperbits

17-12 Network Management

 show mac algorithm

show mac algorithm

This command displays the currently selected MAC algorithm mode.

Syntax
show mac algorithm

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows the output of this command.
A4(su)->show mac algorithm
Mac hashing algorithm is mac-crc16-upperbits.

clear mac algorithm

Use this command to return the MAC hashing algorithm to the default value of mac-crc16-
upperbits.

Syntax
clear mac algorithm

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example resets the MAC hashing algorithm to the default value.
A4(su)->clear mac algorithm

Extreme A4 CLI Reference 17-13

set mac multicast

set mac multicast

Use this command to define on what ports within a VLAN a multicast address can be dynamically
learned on, or on what ports a frame with the specified MAC address can be flooded. Also, use
this command to append ports to or clear ports from the egress ports list.

Syntax
set mac multicast mac-address vlan-id [port-string] [{append | clear} port-string]

Parameters
mac-address Specifies the multicast MAC address. The MAC address can be
formatted as xx:xx:xx:xx:xx:xx or xx-xx-xx-xx-xx-xx.
vlan-id Specifies the VLAN ID containing the ports.
port-string Specifies the port or range of ports the multicast MAC address can be
learned on or flooded to.
append | clear Appends or clears the port or range of ports from the egress port list.

Defaults
If no port-string is defined, the command will apply to all ports.

Mode
Switch command, read-write.

Example
This example configures multicast MAC address 01-01-22-33-44-55 for VLAN 24.
A4(su)->set mac multicast 01-01-22-33-44-55 24

clear mac address

Use this command to remove a multicast MAC address.

Syntax
clear mac address mac-address [vlan-id]

Parameters
mac-address Specifies the multicast MAC address to be cleared. The MAC address
can be formatted as xx:xx:xx:xx:xx:xx or xx-xx-xx-xx-xx-xx.
vlan-id (Optional) Specifies the VLAN ID from which to clear the static
multicast MAC address.

Defaults
If no vlan-id is specified, the multicast MAC address is cleared from all VLANs.

Mode
Switch command, read-write.

17-14 Network Management

 show mac unreserved-flood

Example
This example clears multicast MAC address 01-01-22-33-44-55 from VLAN 24.
A4(su)->clear mac address 01-01-22-33-44-55 24

show mac unreserved-flood

Use this command to display the state of forwarding of several standard group multicast MAC
addresses.

Syntax
show mac unreserved-flood

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example displays the state of forwarding of the group multicast MAC addresses.
A4(su)->show mac unreserved-flood
mac unreserved flood is disabled.

set mac unreserved-flood

Use this command to enable or disable forwarding of several standard group multicast MAC
addresses. See the Usage section below for details.

Syntax
set mac unreserved-flood {disable | enable}

Parameters
disable | enable Disables or enables forwarding of several standard group multicast
MAC addresses. .

Defaults
None.

Mode
Switch command, read-write.

Usage
The following addresses will be forwarded when this function is enabled:

Extreme A4 CLI Reference 17-15

Configuring Node Aliases

01:80:C2:00:00:11
01:80:C2:00:00:14
01:80:C2:00:00:15
The default state is disabled, and these addresses will not be forwarded.
Enabling forwarding of these addresses on the A4 uses a mask resource normally dedicated for
policy.

Example
This example enables forwarding of the standard group multicast MAC addresses.
A4(su)->set mac unreserved-flood enable

Configuring Node Aliases

The node alias feature enables administrators to determine the MAC address and location of a
given end-station (or node) using the node’s Layer 3 alias information (IP address) as a key. With
this method, it is possible to determine that, for instance, IP address 123.145.2.23 is located on
switch 5 port 3.
The passive accumulation of a network's node/alias information is accomplished by “snooping”
on the contents of network traffic as it passes through the switch fabric.
In the A4, node data is automatically accumulated into the ct-alias mib, and by default this feature
is enabled. The NetSight Console Compass utility and Automated Security Manager (ASM) use
the information in the node/alias MIB table.
It's important to make sure that inter-switch links are not learning node/alias information, as it
would slow down searches by the NetSight Compass and ASM tools and give inaccurate results.
Use the following commands to review, disable, and re-enable node (port) alias functionality on
the switch.

For information about... Refer to page...

show nodealias config 17-16

set nodealias 17-17

clear nodealias config 17-18

show nodealias config

Use this command to display node alias configuration settings on one or more ports.

Syntax
show nodealias config [port-string]

Parameters
port-string (Optional) Displays node alias configuration settings for specific port(s).

Defaults
If port-string is not specified, node alias configurations will be displayed for all ports.

17-16 Network Management

 set nodealias

Mode
Switch command, read-only.

Example
This example shows how to display node alias configuration settings for ports fe.2.1 through 9:
A4(rw)->show nodealias config fe.2.1-9
Port Number Max Entries Used Entries Status
----------- ----------- ------------ ------
fe.2.1 16 0 Enable
fe.2.2 47 0 Enable
fe.2.3 47 2 Enable
fe.2.4 47 0 Enable
fe.2.5 47 0 Enable
fe.2.6 47 2 Enable
fe.2.7 47 0 Enable
fe.2.8 47 0 Enable
fe.2.9 4000 1 Enable

Table 17-4 provides an explanation of the command output.

Table 17-4 show nodealias config Output Details

Output Field What It Displays...

Port Number Port designation.

Max Entries Maximum number of alias entries configured for this port.

Used Entries Number of alias entries (out of the maximum amount configured) already used by
this port.

Status Whether or not a node alias agent is enabled (default) or disabled on this port.

set nodealias
Use this command to enable or disable a node alias agent on one or more ports, or set the
maximum number of alias entries stored per port.

Syntax
set nodealias {enable | disable | maxentries maxentries} port-string

Parameters
enable | disable Enables or disables a node alias agent.
maxentries maxentries Set the maximum number of alias entries stored per port. Valid range
is 0 to 4096. The default value is 32.
port-string Specifies the port(s) on which to enable/disable node alias agent or set
a maximum number of stored entries.

Defaults
None.

Extreme A4 CLI Reference 17-17

clear nodealias config

Mode
Switch command, read-write.

Usage
Upon packet reception, node aliases are dynamically assigned to ports enabled with an alias
agent, which is the default setting on A4 devices. Node aliases cannot be statically created, but can
be deleted using the command “clear nodealias config” (page 17-18).
It's important to make sure that inter-switch links are not learning node/alias information, as it
would slow down searches by the NetSight Compass and ASM tools and give inaccurate results.

Example
This example shows how to disable the node alias agent on fe.1.3:
A4(su)->set nodealias disable fe.1.3

clear nodealias config

Use this command to reset node alias state to enabled and clear the maximum entries value.

Syntax
clear nodealias config port-string

Parameters
port-string Specifies the port(s) on which to reset the node alias configuration.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset the node alias configuration on fe.1.3:
A4(su)->clear nodealias config fe.1.3

17-18 Network Management

 18
Configuring System Logging

This chapter describes the commands used to display and configure system logging, including
Syslog server settings, Syslog default settings, and the logging buffer.
Refer to Chapter 14, “Configuring Syslog,” in the Fixed Switching Configuration Guide for
configuration procedures, examples, and more information.

For information about... Refer to page...

show logging server 18-1

set logging server 18-2

clear logging server 18-3

show logging default 18-4

set logging default 18-4

clear logging default 18-5

show logging application 18-6

set logging application 18-7

clear logging application 18-8

show logging local 18-9

set logging local 18-9

clear logging local 18-10

show logging buffer 18-11

show logging interface 18-11

set logging interface 18-12

clear logging interface 18-13

show logging server

Use this command to display the Syslog configuration for a particular server.

Syntax
show logging server [index]

Extreme A4 CLI Reference 18-1

Configuring System Logging set logging server

Parameters
index (Optional) Displays Syslog information pertaining to a specific server
table entry. Valid values are 1-8.

Defaults
If index is not specified, all Syslog server information will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display Syslog server configuration information:
A4(ro)->show logging server

IP Address Facility Severity Description Port Status

-------------------------------------------------------------------------
1 132.140.82.111 local4 warning(5) default 514 enabled
2 132.140.90.84 local4 warning(5) default 514 enabled
Table 18-1 provides an explanation of the command output.

Table 18-1 show logging server Output Details

Output Field What It Displays...

IP Address Syslog server’s IP address. For details on setting this using the set logging server
command, refer to “set logging server” on page 18-2.

Facility Syslog facility that will be encoded in messages sent to this server. Valid values are:
local0 to local7.

Severity Severity level at which the server is logging messages.

Description Text string description of this facility/server.

Port UDP port the client uses to send to the server.

Status Whether or not this Syslog configuration is currently enabled or disabled.

set logging server

Use this command to configure a Syslog server.

Syntax
set logging server index [ip-addr ip-addr] [facility facility] [severity severity]
[descr descr] [port port] [state {enable | disable}]

Parameters
index Specifies the server table index number for this server. Valid values are 1 -
8.
ip-addr ip-addr (Optional) Specifies the Syslog message server’s IP address.
facility facility (Optional) Specifies the server’s facility name. Valid values are: local0 to
local7.

18-2
clear logging server Configuring System Logging

severity severity (Optional) Specifies the severity level at which the server will log
messages. Valid values and corresponding levels are:
1 — emergencies (system is unusable)
2 — alerts (immediate action required)
3 — critical conditions
4 — error conditions
5 — warning conditions
6 — notifications (significant conditions)
7 — informational messages
8 — debugging messages
descr descr (Optional) Specifies a textual string description of this facility/server.
port port (Optional) Specifies the default UDP port the client uses to send to the
server.
state enable | (Optional) Enables or disables this facility/server configuration.
disable

Defaults
If ip-addr is not specified, an entry in the Syslog server table will be created with the specified
index number and a message will display indicating that no IP address has been assigned.
If not specified, facility, severity and port will be set to defaults configured with the set logging
default command (“set logging default” on page 18-4).
If state is not specified, the server will not be enabled or disabled.

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2

Example
This command shows how to enable a Syslog server configuration for index 1, IP address
134.141.89.113, facility local4, severity level 3 on port 514:
A4(su)->set logging server 1 ip-addr 134.141.89.113 facility local4 severity 3
port 514 state enable

clear logging server

Use this command to remove a server from the Syslog server table.

Syntax
clear logging server index

Parameters
index Specifies the server table index number for the server to be removed.
Valid values are 1 - 8.

Extreme A4 CLI Reference 18-3

Configuring System Logging show logging default

Defaults
None.

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2

Example
This command shows how to remove the Syslog server with index 1 from the server table:
A4(su)->clear logging server 1

show logging default

Use this command to display the Syslog server default values.

Syntax
show logging default

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This command shows how to display the currently configured Syslog server default values. For an
explanation of the command output, refer back to Table 18-1 on page 18-2.
A4(su)->show logging default

Facility Severity Port

-----------------------------------------
Defaults: local4 warning(5) 514

set logging default

Use this command to set logging default values.

Syntax
set logging default {[facility facility] [severity severity] port port]}

18-4
clear logging default Configuring System Logging

Parameters
facility facility Specifies the default facility name. Valid values are: local0 to local7.
severity severity Specifies the default logging severity level. Valid values and
corresponding levels are:
1 — emergencies (system is unusable)
2 — alerts (immediate action required)
3 — critical conditions
4 — error conditions
5 — warning conditions
6 — notifications (significant conditions)
7 — informational messages
8 — debugging messages
port port Specifies the default UDP port the client uses to send to the server.

Defaults
None.

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2

Example
This example shows how to set the Syslog default facility name to local2 and the severity level to 4
(error logging):
A4(su)->set logging default facility local2 severity 4

clear logging default

Use this command to reset logging default values.

Syntax
clear logging default {[facility] [severity] [port]}

Parameters
facility (Optional) Resets the default facility name to local4.
severity (Optional) Resets the default logging severity level to 3 (critical).
port (Optional) Resets the default UDP port the client uses to send to the server
to 514.

Defaults
At least one optional parameter must be entered.
All three optional keywords must be entered to reset all logging values to defaults.

Extreme A4 CLI Reference 18-5

Configuring System Logging show logging application

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2

Example
This example shows how to reset the Syslog default severity level to 3:
A4(su)->clear logging default severity

show logging application

Use this command to display the severity level of Syslog messages for one or all applications
configured for logging on your system.

Syntax
show logging application [mnemonic | all]

Parameters
mnemonic (Optional) Displays severity level for one application configured for
logging. Mnemonics will vary depending on the number and types of
applications running on your system. Sample mnemonics and their
corresponding applications are listed in Table 18-3 on page 18-8.
Note: Mnemonic values are case sensitive and must be typed as they appear in
Table 18-3.
all (Optional) Displays severity level for all applications configured for
logging.

Defaults
If no parameter is specified, information for all applications will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display system logging information pertaining to the SNMP
application.
A4(ro)->show logging application SNMP

Application Current Severity Level Server List

------------------------------------------------------------------
90 SNMP 6 1-8, console

1(emergencies) 2(alerts) 3(critical)

4(errors) 5(warnings) 6(notifications)
7(information) 8(debugging)
Table 18-2 provides an explanation of the command output.

18-6
set logging application Configuring System Logging

Table 18-2 show logging application Output Details

Output Field What it displays...

Application A mnemonic abbreviation of the textual description for

applications being logged.

Current Severity Level Severity level at which the server is logging messages for the
listed application. This range (from 1 to 8) and its associated
severity list is shown in the CLI output. For a description of these
entries, which are set using the set logging application
command, refer to “set logging application” on page 18-7.

Server List Displays all the destinations of all logging messages for that
application. Destination servers are specified with the command
“set logging application” on page 18-7. A destination of “console”
or “file” is set with the command “set logging local” on page 18-9.

set logging application

Use this command to set the severity level of log messages for one or all applications and the
servers to which messages will be sent for one or all applications.

Syntax
set logging application {[mnemonic | all]} [level level] [servers servers]

Parameters
mnemonic Specifies a case sensitive mnemonic abbreviation of an application to be
logged. This parameter will vary depending on the number and types of
applications running on your system. To display a complete list, use the
show logging application command as described in “show logging
application” on page 18-6. Sample mnemonics and their corresponding
applications are listed in Table 18-3 on page 18-8.
Note: Mnemonic values are case sensitive and must be typed as they appear in
Table 18-3.
all Sets the logging severity level for all applications.
level level (Optional) Specifies the severity level at which the server will log
messages for applications. Valid values and corresponding levels are:
1 — emergencies (system is unusable)
2 — alerts (immediate action required)
3 — critical conditions
4 — error conditions
5 — warning conditions
6 — notifications (significant conditions)
7 — informational messages
8 — debugging messages
servers servers (Optional) Specifies by index number the Syslog servers to which
messages will be sent. Valid values range from 1 to 8 and are set using
the set logging server (page 18-2) command.

Extreme A4 CLI Reference 18-7

Configuring System Logging clear logging application

Table 18-3 Mnemonic Values for Logging Applications

Mnemonic Application

CLIWEB Command Line Interface and Webview management

SNMP Simple Network Management Protocol

STP Spanning Tree Protocol

Driver Hardware drivers

System Non-application items such as general chassis management

Stacking Stacking management (if applicable)

UPN User Personalized Networking

Router Router

Security Security audit logging

Defaults
If level is not specified, none will be applied.
If no servers are specified, messages will be sent to all configured Syslog servers.

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2

Example
This example shows how to set the severity level for SNMP to 4 so that error conditions will be
logged for that application and sent to Syslog server 1.
A4(rw)->set logging application SNMP level 4 server 1

clear logging application

Use this command to reset the logging severity level for one or all applications to the default value
of 6 (notifications of significant conditions).

Syntax
clear logging application {mnemonic | all}

Parameters
mnemonic Resets the severity level for a specific application to 6. Valid mnemonic
values and their corresponding applications are listed in Table 18-3 on
page 18-8.
all Resets the severity level for all applications to 6.

Defaults
None.

18-8
show logging local Configuring System Logging

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2

Example
This example shows how to reset the logging severity level to 6 for SNMP.
A4(rw)->clear logging application SNMP

show logging local

Use this command to display the state of message logging to the console, the Syslog persistent file,
and to the security audit log.

Syntax
show logging local

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the state of message logging. In this case, logging to the
console is enabled and logging to the Syslog persistent file and security audit log file is disabled.
A4(su)->show logging local
Syslog Console Logging enabled
Syslog File Logging disabled
Syslog Security Audit Logging disabled

set logging local

Use this command to configure log messages to the console and a persistent file. Optionally, you
can also enable or disable the security audit log if you have super-user access.

Syntax
set logging local console {enable | disable} file {enable | disable} [sfile {enable
| disable}]

Parameters
console enable | disable Enables or disables logging to the console. Enabled is the default
condition.
file enable | disable Enables or disables logging to a Syslog persistent file. Disabled is
the default condition.

Extreme A4 CLI Reference 18-9

Configuring System Logging clear logging local

sfile enable | disable (Optional) Enables or disables logging to the security audit log
file. Disabled is the default condition.
This parameter is available only if you have super-user access.

Defaults
You must enter both the console and file parameters with this command. If you do not enter the
sfile parameter, the security audit log status remains unchanged.

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2
Switch command, super-user for security audit log.

Usage
If you do not use this command to change the default settings, logging to the console is enabled
logging to the Syslog persistent file is disabled, and logging to the security audit log is disabled by
default.

Examples
This command shows how to disable logging to the console and enable logging to a persistent file:
A4(su)->set logging local console disable file enable
This example shows how to enable logging to the security audit log.
A4(su)->set logging local console disable file enable sfile enable

clear logging local

Use this command to reset the console, Syslog file, and security audit log logging settings for the
local session back to their default settings. The default settings are local console enabled, Syslog
persistent store file disabled, and security audit log file disabled.

Syntax
clear logging local

Parameters
None.

Defaults
None.

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2
Switch command, super-user for security audit log.

18-10
show logging buffer Configuring System Logging

Example
This example shows how to return local logging settings to their default settings.:
A4(su)->clear logging local

show logging buffer

Use this command to display the last 256 messages logged.

Syntax
show logging buffer

Parameters
None.

Defaults
None.

Mode
Switch command, read-only, if security profile = normal.
Switch command, super-user, if security profile = c2

Example
This example shows an example of the output displayed with the show logging buffer command.
The type of information displayed depends on your logging settings.
A4(su)->show logging buffer
<165>Sep 4 07:43:09 10.42.71.13 CLI[5]User:rw logged in from 10.2.1.122 (telnet)
<165>Sep 4 07:43:24 10.42.71.13 CLI[5]User: debug failed login from 10.4.1.100
(telnet)

show logging interface

Use this command to display the interface used for the source IP address of the system logging.

Syntax
show logging interface

Parameters
None.

Defaults
None.

Mode
Switch mode, read-only.

Extreme A4 CLI Reference 18-11

Configuring System Logging set logging interface

Example
This example displays the output of this command. In this case, the IP address assigned to
loopback interface 1 will be used as the source IP address of the system logging.
A4(rw)->show logging interface
loopback 1 192.168.10.1

set logging interface

Use this command to specify the interface used for the source IP address of the system logging.

Syntax
set logging interface {loopback loop-ID | vlan vlan-ID}

Parameters
loopback loop-ID Specifies the loopback interface to be used. The value of loop-ID can
range from 0 to 7.
vlan vlan-ID Specifies the VLAN interface to be used. The value of vlan-ID can range
from 1 to 4093.

Defaults
None.

Mode
Switch command, read-write.

Usage
This command allows you to configure the source IP address used by the system logging
application when generating packets for management purposes. Any of the management
interfaces, including VLAN routing interfaces, can be configured as the source IP address used in
packets generated by the system logging.
An interface must have an IP address assigned to it before it can be set by this command.
If no interface is specified, then the IP address of the Host interface will be used.
If a non-loopback interface is configured with this command, application packet egress is
restricted to that interface if the server can be reached from that interface. Otherwise, the packets
are transmitted over the first available route. Packets from the application server are received on
the configured interface.
If a loopback interface is configured, and there are multiple paths to the application server, the
outgoing interface (gateway) is determined based on the best route lookup. Packets from the
application server are then received on the sending interface. If route redundancy is required,
therefore, a loopback interface should be configured.

Example
This example configures an IP address on VLAN interface 100 and then sets that interface as the
system logging source IP address.
A4(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0
A4(rw)->router(Config-if(Vlan 100))#exit
A4(rw)->router(Config)#exit

18-12
clear logging interface Configuring System Logging

A4(rw)->router#exit
A4(rw)->router>exit
A4(rw)->set logging interface vlan 100

A4(rw)->show logging interface

vlan 100 192.168.10.1

clear logging interface

Use this command to clear the interface used for the source IP address of the system logging back
to the default of the Host interface.

Syntax
clear logging interface

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This command returns the interface used for the source IP address of the system logging back to
the default of the Host interface.
A4(rw)->show logging interface
vlan 100 192.168.10.1
A4(rw)->clear logging interface
A4(rw)->

Extreme A4 CLI Reference 18-13

Configuring System Logging clear logging interface

18-14
 19
Configuring SNTP

This chapter describes how to use CLI commands to configure the Simple Network Time Protocol
(SNTP), which synchronizes device clocks in a network. Also included are SNTP authentication
commands.
Refer to Chapter 4, “System Configuration,” in the Fixed Switching Configuration Guide for
configuration procedures, examples, and more information about SNTP.

Note: A management IP (host, routing interface, or loopback) address must be configured for SNTP
to work..

For information about... Refer to page...

General SNTP Commands 19-1

SNTP Authentication Commands 19-11

General SNTP Commands

For information about... Refer to page...

show sntp 19-2

set sntp client 19-3

clear sntp client 19-4

set sntp server 19-4

clear sntp server 19-5

set sntp poll-interval 19-5

clear sntp poll-interval 19-6

set sntp poll-retry 19-6

clear sntp poll-retry 19-7

set sntp poll-timeout 19-7

clear sntp poll-timeout 19-7

set timezone 19-8

show sntp interface 19-9

set sntp interface 19-10

clear sntp interface 19-11

Extreme A4 CLI Reference 19-1

Configuring SNTP show sntp

show sntp
Use this command to display SNTP client settings.

Syntax
show sntp

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display SNTP client settings:
A4(su)->show sntp
SNTP Version: 3
Current Time: FRI MAY 13 06:11:19 2011
Timezone: 'EST' offset from UTC is -5 hours and 0 minutes
Client Mode: unicast
Trusted Keys : 1 2
Broadcast Count: 1
Poll Interval: 6 (64 seconds)
Poll Retry: 4
Poll Timeout: 10 seconds
SNTP Poll Requests: 0
Last SNTP Update: THU JAN 01 00:00:00 1970
Last SNTP Request: THU JAN 01 00:00:00 1970
Last SNTP Status: Other

SNTP-Server Precedence Key Status

----------------------------------------------------
2001::20:1:180:45 1 1 Active
10.2.8.6 2 2 Active

Table 19-1 provides an explanation of the command output.

Table 19-1 show sntp Output Details

Output Field What It Displays...

SNTP Version SNTP version number.

Current Time Current time on the system clock.

Timezone Time zone name and amount it is offset from UTC (Universal Time). Set using the
set timezone command (page 19-8).

Client Mode Whether SNTP client is operating in unicast or broadcast mode. Set using set sntp
client command (page 19-3).

19-2
set sntp client Configuring SNTP

Table 19-1 show sntp Output Details (Continued)

Output Field What It Displays...

Trusted Keys List of authentication keys added to the trusted key list. In the above example, keys
“1” and “2” have been added to the trusted key list.
Authentication keys are created using the set sntp authentication-key command
(page 19-12). Authentication keys are added to the trusted key list with the set sntp
trusted-key command (page 19-13).

Broadcast Count Number of SNTP broadcast frames received.

Poll Interval Interval between SNTP unicast requests. Default of 512 seconds can be reset using
the set sntp poll-interval command (page 19-5).

Poll Retry Number of poll retries to a unicast SNTP server. Default of 1 can be reset using the
set sntp poll-retry command (“set sntp poll-retry” on page 19-6).

Poll Timeout Timeout for a response to a unicast SNTP request. Default of 5 seconds can be
reset using set sntp poll-timeout command (“set sntp poll-timeout” on page 19-7).

SNTP Poll Requests Total number of SNTP poll requests.

Last SNTP Update Date and time of most recent SNTP update.

Last SNTP Request Date and time of most recent SNTP request.

Last SNTP Status Whether or not broadcast reception or unicast transmission and reception was
successful.

SNTP-Server IP address(es) of SNTP server(s).

Precedence Precedence level of SNTP server in relation to its peers. Highest precedence is 1
and lowest is 10. Default of 1 can be reset using the set sntp server command (“set
sntp server” on page 19-4).

Key The key ID of the authentication key associated with this server.

Status Whether or not the SNTP server is active.

set sntp client

Use this command to set the SNTP operation mode.

Syntax
set sntp client {broadcast | unicast | disable}

Parameters
broadcast Enables SNTP in broadcast client mode.
unicast Enables SNTP in unicast (point-to-point) client mode. In this mode, the
client must supply the IP address from which to retrieve the current time.
disable Disables SNTP.

Defaults
None.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 19-3

Configuring SNTP clear sntp client

Example
This example shows how to enable SNTP in broadcast mode:
A4(su)->set sntp client broadcast

clear sntp client

Use this command to clear the SNTP client’s operational mode.

Syntax
clear sntp client

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the SNTP client’s operational mode:
A4(su)->clear sntp client

set sntp server

Use this command to add a server from which the SNTP client will retrieve the current time when
operating in unicast mode. Up to 10 servers can be set as SNTP servers.

Syntax
set sntp server ip-address [precedence precedence] [key key-id]

Parameters
ip-address Specifies the SNTP server’s IP address.
precedence (Optional) Specifies this SNTP server’s precedence in relation to its peers.
precedence Valid values are 1 (highest) to 10 (lowest).
key key-id (Optional) Specifies the authentication key to use when sending packets to
this server. Value values range from 1 to 4294967295.

Defaults
If precedence is not specified, 1 will be applied.

Mode
Switch command, read-write.

19-4
clear sntp server Configuring SNTP

Example
This example shows how to set the server at IP address 10.21.1.100 as an SNTP server, with a
precedence of 1 and an authentication key of 1.
A4(su)->set sntp server 10.21.1.100 precedence 1 key 1

clear sntp server

Use this command to remove one or all servers from the SNTP server list.

Syntax
clear sntp server {ip-address | all}

Parameters
ip-address Specifies the IP address of a server to remove from the SNTP server list.
all Removes all servers from the SNTP server list.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to remove the server at IP address 10.21.1.100 from the SNTP server list:
A4(su)->clear sntp server 10.21.1.100

set sntp poll-interval

Use this command to set the poll interval between SNTP unicast requests.

Syntax
set sntp poll-interval value

Parameters
value The poll interval is 2 to the power of value in seconds, where value can range
from 6 to 10. Default poll interval is 512 seconds (value = 9).

Defaults
None.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 19-5

Configuring SNTP clear sntp poll-interval

Example
This example shows how to set the SNTP poll interval to 64 seconds:
A4(su)->set sntp poll-interval 6

clear sntp poll-interval

Use this command to clear the poll interval between unicast SNTP requests back to the default
value of 512 seconds.

Syntax
clear sntp poll-interval

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the SNTP poll interval:
A4(su)->clear sntp poll-interval

set sntp poll-retry

Use this command to set the number of poll retries to a unicast SNTP server.

Syntax
set sntp poll-retry retry

Parameters
retry Specifies the number of retries. Valid values are 0 to 10.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the number of SNTP poll retries to 5:
A4(su)->set sntp poll-retry 5

19-6
clear sntp poll-retry Configuring SNTP

clear sntp poll-retry

Use this command to clear the number of poll retries to a unicast SNTP server.

Syntax
clear sntp poll-retry

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the number of SNTP poll retries:
A4(su)->clear sntp poll-retry

set sntp poll-timeout

Use this command to set the poll timeout (in seconds) for a response to a unicast SNTP request.

Syntax
set sntp poll-timeout timeout

Parameters
timeout Specifies the poll timeout in seconds. Valid values are 1 to 30.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the SNTP poll timeout to 10 seconds:
A4(su)->set sntp poll-timeout 10

clear sntp poll-timeout

Use this command to clear the SNTP poll timeout.

Syntax
clear sntp poll-timeout

Extreme A4 CLI Reference 19-7

Configuring SNTP set timezone

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the SNTP poll timeout:
A4(su)->clear sntp poll-timeout

set timezone
Use this command to configure the current timezone as an offset from UTC.

Syntax
set timezone name [hours] [minutes]

Parameters
name The name of the timezone. Typically, this name is a standard
abbreviation such as EST (Eastern Standard Time) or EDT (Eastern
Daylight Time).
hours (Optional) Specifies the offset in hours from UTC. The value can range
from -13 to 13. The default is 0 hours.
minutes (Optional) Specifies additional offset in minutes from UTC. The value
can range from 0 to 59. The default is 0 minutes.

Defaults
If you enter a timezone name without specifying an offset in hours and minutes, the default is an
offset from UTC of 0 hours and 0 minutes.

Mode
Switch command, read-write.

Usage
Typically, this command is used to configure the local timezone offset from UTC (Univeral Time)
when SNTP is used to synchronize the time used by devices on the network.
To display the current timezone setting used by SNTP, use the show sntp command. To clear an
existing offset to zero, enter the command without specifying any hours or minutes.
Standard timezone names and offsets can be found at the following URL, among others:
http://www.timeanddate.com/library/abbreviations/timezones/

19-8
show sntp interface Configuring SNTP

Example
The following example sets the timezone name to EST and the offset to North American Eastern
Standard Time offset of -5 hours from UTC, then displays the timezone used with SNTP.
A4(su)->set timezone EST -5

A4(su)->show sntp
SNTP Version: 3
Current Time: FRI MAY 13 06:11:19 2011
Timezone: 'EST' offset from UTC is -5 hours and 0 minutes
Client Mode: unicast
Trusted Keys : 1 2
Broadcast Count: 1
Poll Interval: 6 (64 seconds)
Poll Retry: 4
Poll Timeout: 10 seconds
SNTP Poll Requests: 0
Last SNTP Update: THU JAN 01 00:00:00 1970
Last SNTP Request: THU JAN 01 00:00:00 1970
Last SNTP Status: Other

SNTP-Server Precedence Key Status

----------------------------------------------------
2001::20:1:180:45 1 1 Active
10.2.8.6 2 2 Active

show sntp interface

Use this command to display the interface used for the source IP address of the SNTP client.

Syntax
show sntp interface

Parameters
None.

Defaults
None.

Mode
Switch mode, read-only.

Example
This example displays the output of this command. In this case, the IP address assigned to
loopback interface 1 will be used as the source IP address of the SNTP client.
A4(rw)->show sntp interface
loopback 1 192.168.10.1

Extreme A4 CLI Reference 19-9

Configuring SNTP set sntp interface

set sntp interface

Use this command to specify the interface used for the source IP address of the SNTP client.

Syntax
set sntp interface {loopback loop-ID | vlan vlan-ID}

Parameters
loopback loop-ID Specifies the loopback interface to be used. The value of loop-ID can
range from 0 to 7.
vlan vlan-ID Specifies the VLAN interface to be used. The value of vlan-ID can range
from 1 to 4093.

Defaults
None.

Mode
Switch command, read-write.

Usage
This command allows you to configure the source IP address used by the SNTP application when
generating packets for management purposes. Any of the management interfaces, including
VLAN routing interfaces, can be configured as the source IP address used in packets generated by
the SNTP client.
An interface must have an IP address assigned to it before it can be set by this command.
If no interface is specified, then the IP address of the Host interface will be used.
If a non-loopback interface is configured with this command, application packet egress is
restricted to that interface if the server can be reached from that interface. Otherwise, the packets
are transmitted over the first available route. Packets from the application server are received on
the configured interface.
If a loopback interface is configured, and there are multiple paths to the application server, the
outgoing interface (gateway) is determined based on the best route lookup. Packets from the
application server are then received on the sending interface. If route redundancy is required,
therefore, a loopback interface should be configured.

Example
This example configures an IP address on VLAN interface 100 and then sets that interface as the
SNTP client source IP address.
A4(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0
A4(rw)->router(Config-if(Vlan 100))#exit
A4(rw)->router(Config)#exit
A4(rw)->router#exit
A4(rw)->router>exit
A4(rw)->set sntp interface vlan 100

A4(rw)->show sntp interface

vlan 100 192.168.10.1

19-10
clear sntp interface Configuring SNTP

clear sntp interface

Use this command to clear the interface used for the source IP address of the SNTP client back to
the default of the Host interface.

Syntax
clear sntp interface

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This command returns the interface used for the source IP address of the SNTP client back to the
default of the Host interface.
A4(rw)->show sntp interface
vlan 100 192.168.10.1
A4(rw)->clear sntp interface
A4(rw)->

SNTP Authentication Commands

For information about... Refer to page...

set sntp authenticate 19-11

set sntp authentication-key 19-12

clear sntp authentication-key 19-13

set sntp trusted-key 19-13

clear sntp trusted-key 19-14

set sntp authenticate

Use this command to enable or disable the authentication mechanism for received SNTP traffic
from servers.

Syntax
set sntp authenticate {enable | disable}

Parameters
enable | disable Enable or disable SNTP authentication on the switch.
Authentication is disabled by default.

Extreme A4 CLI Reference 19-11

Configuring SNTP set sntp authentication-key

Defaults
SNTP authentication is disabled by default.

Mode
Switch command, read-write.

Examples
The following example enables SNTP authentication on the switch.
A4(su)->set sntp authenticate enable
The following example configures the switch SNTP client for authentication by configuring two
authentication keys and adding them to the trusted key list, then enabling authentication on the
switch, and finally, configuring one of the SNTP/NTP servers to use one of the keys.
A4(su)->set sntp authentication-key 1 md5 mykey
A4(su)->set sntp trusted-key 1
A4(su)->set sntp authentication-key 2 md5 keytwo
A4(su)->set sntp trusted-key 2
A4(su)->set sntp authenticate
A4(su)->set sntp client unicast
A4(su)->set sntp server 192.168.10.10 key 1 precedence 1

set sntp authentication-key

Use this command to configure an authentication key entry. A maximum of five entries can be
configured.

Syntax
set sntp authentication-key key-id md5 key-value

Parameters
key-id Specifies the ID number for this key entry. Valid range is from 1 to
4294967295, although only a maximum of 5 entries can be configured.
md5 Specifies MD5 as the encryption algorithm to be used for SNTP
authentication.
key-value Specifies the value of the key, which is the authentication password.
Password string can be from 1 to 32 characters in length.

Defaults
None.

Mode
Switch command, read-write.

Usage
After creating an authentication key, you must add it to the trusted key list with the “set sntp
trusted-key” command before configuring it to be used with an SNTP server with the “set sntp
server” command.
Be sure to add this authentication key information to the ntp.key file on the SNTP/NTP server.

19-12
clear sntp authentication-key Configuring SNTP

Example
The following example creates authentication key 1 with a password of “mykey” that uses the
MD5 encryption algorithm.
A4(su)->set sntp authentication-key 1 md5 mykey

clear sntp authentication-key

Use this command to delete an authentication key entry.

Syntax
clear authentication-key key-id

Parameters
key-id Specifies the key ID of the entry to be deleted.

Defaults
None.

Mode
Switch command, read-write.

Example
This example deletes the authentication key entry 2.
A4(su)->clear sntp authentication-key 2

set sntp trusted-key

Use this command to add an authentication key to the trusted key list. An authentication key has
to be trusted to be used with an SNTP server.

Syntax
set sntp trusted-key key-id

Parameters
key-id The key ID of an authentication key to be added to the trusted key list.

Defaults
None.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 19-13

Configuring SNTP clear sntp trusted-key

Usage
You must create an authentication key with the “set sntp authentication-key” command before
you can add it to the trusted key list with this command. An authentication key is configured to be
used with an SNTP server with the “set sntp server” command.
Be sure to add switch authentication key information to the ntp.key file on the SNTP/NTP server.
Use the “show sntp” command to display the authentication keys currently on the trusted key list.

Example
This example adds authentication key 2 to the trusted key list.
A4(su)->set sntp trusted-key 2

clear sntp trusted-key

Use this command to remove an authentication key from the trusted key list.

Syntax
clear sntp trusted-key key-id

Parameters
key-id The key ID of the authentication key to be removed from the trusted key
list.

Defaults
None.

Mode
Switch command, read-write.

Usage
When an authentication key is removed from the trusted key list, it is also removed from the
configuration of any SNTP server to which it was associated.
Use the “show sntp” command to display the authentication keys currently on the trusted key list.

Example
This example removes authentication key 2 from the trusted key list.
A4(su)->clear sntp trusted-key 2

19-14
 20
RMON Configuration

This chapter describes the commands used to configure RMON on a A4 switch. Refer to Chapter
18, “Configuring Network Monitoring,” in the Fixed Switching Configuration Guide for
configuration procedures, examples, and conceptual information about RMON.

For information about... Refer to page...

Statistics Group Commands 20-1

History Group Commands 20-3

Alarm Group Commands 20-5

Event Group Commands 20-9

Filter Group Commands 20-12

Packet Capture Commands 20-17

Statistics Group Commands

Use the following commands to display, configure, and clear RMON statistics.

Note: Due to hardware limitations, the only frame error counted is oversized frames.

For information about... Refer to page...

show rmon stats 20-1

set rmon stats 20-2

clear rmon stats 20-3

show rmon stats

Use this command to display RMON statistics measured for one or more ports.

Syntax
show rmon stats [port-string]

Parameters
port-string (Optional) Displays RMON statistics for specific port(s).

Extreme A4 CLI Reference 20-1

set rmon stats

Defaults
If port-string is not specified, RMON stats will be displayed for all ports.

Mode
Switch command, read-only.

Example
This example shows how to display RMON statistics for Gigabit Ethernet port 1 in switch 1.

A4(su)->show rmon stats fe.1.1

:

Port: fe.1.1
-------------------------------------
Index = 1
Owner = monitor
Data Source = ifIndex.1

Drop Events = 0 Packets = 0

Collisions = 0 Octets = 0
Jabbers = 0 0 - 64 Octets = 0
Broadcast Pkts = 0 65 - 127 Octets = 0
Multicast Pkts = 0 128 - 255 Octets = 0
CRC Errors = 0 256 - 511 Octets = 0
Undersize Pkts = 0 512 - 1023 Octets = 0
Oversize Pkts = 0 1024 - 1518 Octets = 0
Fragments = 0

set rmon stats

Use this command to configure an RMON statistics entry.

Syntax
set rmon stats index port-string [owner]

Parameters
index Specifies an index for this statistics entry.
port-string Specifies port(s) to which this entry will be assigned.
owner (Optional) Assigns an owner for this entry.

Defaults
If owner is not specified, monitor will be applied.

Mode
Switch command, read-write.

Example
This example shows how to configure RMON statistics entry 2 for fe.1.20:
A4(rw)->set rmon stats 2 fe.1.20

20-2 RMON Configuration

 clear rmon stats

clear rmon stats

Use this command to delete one or more RMON statistics entries.

Syntax
clear rmon stats {index-list | to-defaults}

Parameters
index-list Specifies one or more stats entries to be deleted, causing them to disappear
from any future RMON queries.
to-defaults Resets all history entries to default values. This will cause entries to
reappear in RMON queries.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to delete RMON statistics entry 2:
A4(rw)->clear rmon stats 2

History Group Commands

Use the following commands to display, configure, and clear RMON history properties and
statistics.

For information about... Refer to page...

show rmon history 20-3

set rmon history 20-4

clear rmon history 20-5

show rmon history

Use this command to display RMON history properties and statistics. The RMON history group
records periodic statistical samples from a network.

Syntax
show rmon history [port-string]

Parameters
port-string (Optional) Displays RMON history entries for specific port(s).

Extreme A4 CLI Reference 20-3

set rmon history

Defaults
If port-string is not specified, information about all RMON history entries will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display RMON history entries for Gigabit Ethernet port 1 in switch 1.
A control entry displays first, followed by actual entries corresponding to the control entry. In this
case, the default settings for entry owner, sampling interval, and maximum number of entries.
(buckets) have not been changed from their default values. For a description of the types of
statistics shown, refer to Table 20-1.

A4(su)->show rmon history fe.1.1

:

Port: fe.1.1
-------------------------------------
Index 1
Owner = monitor
Status = valid
Data Source = ifIndex.1
Interval = 30
Buckets Requested = 50
Buckets Granted = 10
Sample 2779 Interval Start: 1 days 0 hours 2 minutes 22 seconds
Drop Events = 0 Undersize Pkts = 0
Octets = 0 Oversize Pkts = 0
Packets = 0 Fragments = 0
Broadcast Pkts = 0 Jabbers = 0
Multicast Pkts = 0 Collisions = 0
CRC Align Errors = 0 Utilization(%) = 0

set rmon history

Use this command to configure an RMON history entry.

Syntax
set rmon history index [port-string] [buckets buckets] [interval interval] [owner
owner]

Parameters
index-list Specifies an index number for this entry.
port-string (Optional) Assigns this entry to a specific port.
buckets buckets (Optional) Specifies the maximum number of entries to maintain.
interval interval (Optional) Specifies the sampling interval in seconds.
owner owner (Optional) Specifies an owner for this entry.

Defaults
If buckets is not specified, the maximum number of entries maintained will be 50.
If not specified, interval will be set to 30 seconds.

20-4 RMON Configuration

 clear rmon history

If owner is not specified, monitor will be applied.

Mode
Switch command, read-write.

Example
This example shows how configure RMON history entry 1 on port fe.2.1 to sample every 20
seconds:
A4(rw)->set rmon history 1 fe.2.1 interval 20

clear rmon history

Use this command to delete one or more RMON history entries or reset one or more entries to
default values. For specific values, refer to “set rmon history” on page 20-4.

Syntax
clear rmon history {index-list | to-defaults}

Parameters
index-list Specifies one or more history entries to be deleted, causing them to
disappear from any future RMON queries.
to-defaults Resets all history entries to default values. This will cause entries to
reappear in RMON queries.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to delete RMON history entry 1:
A4(rw)->clear rmon history 1

Alarm Group Commands

Use the following commands to display, configure, and clear RMON alarm entries and properties.

For information about... Refer to page...

show rmon alarm 20-6

set rmon alarm properties 20-7

set rmon alarm status 20-8

clear rmon alarm 20-9

Extreme A4 CLI Reference 20-5

show rmon alarm

show rmon alarm

Use this command to display RMON alarm entries. The RMON alarm group periodically takes
statistical samples from RMON variables and compares them with previously configured
thresholds. If the monitored variable crosses a threshold an RMON event is generated.

Syntax
show rmon alarm [index]

Parameters
index (Optional) Displays RMON alarm entries for a specific entry index ID.

Defaults
If index is not specified, information about all RMON alarm entries will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display RMON alarm entry 3:
A4(rw)->show rmon alarm 3
Index 3
---------------------
Owner = Manager
Status = valid
Variable = 1.3.6.1.4.1.5624.1.2.29.1.2.1.0
Sample Type = delta Startup Alarm = rising
Interval = 30 Value = 0
Rising Threshold = 1 Falling Threshold = 0
Rising Event Index = 2 Falling Event Index = 0

Table 20-1 provides an explanation of the command output.

Table 20-1 show rmon alarm Output Details

Output Field What It Displays...

Index Index number for this alarm entry.

Owner Text string identifying who configured this entry.

Status Whether this event entry is enabled (valid) or disabled.

Variable MIB object to be monitored.

Sample Type Whether the monitoring method is an absolute or a delta sampling.

Startup Alarm Whether alarm generated when this entry is first enabled is rising, falling, or either.

Interval Interval in seconds at which RMON will conduct sample monitoring.

Rising Threshold Minimum threshold for causing a rising alarm.

Falling Threshold Maximum threshold for causing a falling alarm.

20-6 RMON Configuration

 set rmon alarm properties

Table 20-1 show rmon alarm Output Details (Continued)

Output Field What It Displays...

Rising Event Index Index number of the RMON event to be triggered when the rising threshold is
crossed.

Falling Event Index Index number of the RMON event to be triggered when the falling threshold is
crossed.

set rmon alarm properties

Use this command to configure an RMON alarm entry, or to create a new alarm entry with an
unused alarm index number.

Syntax
set rmon alarm properties index [interval interval] [object object] [type
{absolute | delta}] [startup {rising | falling | either}] [rthresh rthresh]
[fthresh fthresh] [revent revent] [fevent fevent] [owner owner]

Parameters
index Specifies an index number for this entry. Maximum number or entries is
50. Maximum value is 65535.
interval interval (Optional) Specifies an interval (in seconds) for RMON to conduct sample
monitoring.
object object (Optional) Specifies a MIB object to be monitored.
Note: This parameter is not mandatory for executing the command, but
must be specified in order to enable the alarm entry configuration.

type absolute | (Optional) Specifies the monitoring method as: sampling the absolute
delta value of the object, or the difference (delta) between object samples.
startup rising | (Optional) Specifies the type of alarm generated when this event is first
falling | either enabled as:
• Rising - Sends alarm when an RMON event reaches a maximum
threshold condition is reached, for example, more than 30 collisions
per second.
• Falling - Sends alarm when RMON event falls below a minimum
threshold condition, for example when the network is behaving
normally again.
• Either - Sends alarm when either a rising or falling threshold is
reached.
rthresh rthresh (Optional) Specifies a minimum threshold for causing a rising alarm.
fthresh fthresh Specifies a maximum threshold for causing a falling alarm.
revent revent Specifies the index number of the RMON event to be triggered when the
rising threshold is crossed.
fevent fevent Specifies the index number of the RMON event to be triggered when the
falling threshold is crossed.
owner owner (Optional) Specifies the name of the entity that configured this alarm
entry.

Extreme A4 CLI Reference 20-7

set rmon alarm status

Defaults
interval - 3600 seconds
type - absolute
startup - rising
rthresh - 0
fthresh - 0
revent - 0
fevent - 0
owner - monitor

Mode
Switch command, read-write.

Example
This example shows how to configure a rising RMON alarm. This entry will conduct monitoring
of the delta between samples every 30 seconds:
A4(rw)->set rmon alarm properties 3 interval 30 object
1.3.6.1.4.1.5624.1.2.29.1.2.1.0 type delta rthresh 1 revent 2 owner Manager

set rmon alarm status

Use this command to enable an RMON alarm entry. An alarm is a notification that a statistical
sample of a monitored variable has crossed a configured threshold.

Syntax
set rmon alarm status index enable

Parameters
index Specifies an index number for this entry. Maximum number or entries is
50. Maximum value is 65535.
enable Enables this alarm entry.

Defaults
None.

Mode
Switch command, read-write.

Usage
An RMON alarm entry can be created using this command, configured using the set rmon alarm
properties command (“set rmon alarm properties” on page 20-7), then enabled using this
command. An RMON alarm entry can be created and configured at the same time by specifying
an unused index with the set rmon alarm properties command.

20-8 RMON Configuration

 clear rmon alarm

Example
This example shows how to enable RMON alarm entry 3:
A4(rw)->set rmon alarm status 3 enable

clear rmon alarm

Use this command to delete an RMON alarm entry.

Syntax
clear rmon alarm index

Parameters
index Specifies the index number of entry to be cleared.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear RMON alarm entry 1:
A4(rw)->clear rmon alarm 1

Event Group Commands

Use the following commands to display and clear RMON events, and to configure RMON event
properties.

For information about... Refer to page...

show rmon event 20-9

set rmon event properties 20-10

set rmon event status 20-11

clear rmon event 20-12

show rmon event

Use this command to display RMON event entry properties.

Syntax
show rmon event [index]

Extreme A4 CLI Reference 20-9

set rmon event properties

Parameters
index (Optional) Displays RMON properties and log entries for a specific entry
index ID.

Defaults
If index is not specified, information about all RMON entries will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display RMON event entry 3:
A4(rw)->show rmon event 3
Index 3
----------------
Owner = Manager
Status = valid
Description = STP Topology change
Type = log-and-trap
Community = public
Last Time Sent = 0 days 0 hours 0 minutes 37 seconds
Table 20-2 provides an explanation of the command output.

Table 20-2 show rmon event Output Details

Output Field What It Displays...

Index Index number for this event entry.

Owner Text string identifying who configured this entry.

Status Whether this event entry is enabled (valid) or disabled.

Description Text string description of this event.

Type Whether the event notification will be a log entry, and SNMP trap, both, or none.
Community SNMP community name if message type is set to trap.

Last Time Sent When an event notification matching this entry was sent.

set rmon event properties

Use this command to configure an RMON event entry, or to create a new event entry with an
unused event index number.

Syntax
set rmon event properties index [description description] [type {none | log | trap
| both}] [community community] [owner owner]

20-10 RMON Configuration

 set rmon event status

Parameters
index Specifies an index number for this entry. Maximum number of entries is
100. Maximum value is 65535.
description (Optional) Specifies a text string description of this event.
description
type none | log | (Optional) Specifies the type of RMON event notification as: none, a log
trap | both table entry, an SNMP trap, or both a log entry and a trap message.
community (Optional) Specifies an SNMP community name to use if the message
community type is set to trap. For details on setting SNMP traps and community
names, refer to Chapter 12, “Configuring SNMP,” in the Fixed Switching
Configuration Guide.
owner owner (Optional) Specifies the name of the entity that configured this entry.

Defaults
If description is not specified, none will be applied.
If not specified, type none will be applied.
If owner is not specified, monitor will be applied.

Mode
Switch command, read-write.

Example
This example shows how to create and enable an RMON event entry called “STP topology
change” that will send both a log entry and an SNMP trap message to the “public” community:
A4(rw)->set rmon event properties 2 description "STP topology change" type both
community public owner Manager

set rmon event status

Use this command to enable an RMON event entry. An event entry describes the parameters of an
RMON event that can be triggered. Events can be fired by RMON alarms and can be configured to
create a log entry, generate a trap, or both.

Syntax
set rmon event status index enable

Parameters
index Specifies an index number for this entry. Maximum number of entries is
100. Maximum value is 65535.
enable Enables this event entry.

Defaults
None.

Extreme A4 CLI Reference 20-11

clear rmon event

Mode
Switch command, read-write.

Usage
An RMON event entry can be created using this command, configured using the set rmon event
properties command (“set rmon event properties” on page 20-10), then enabled using this
command. An RMON event entry can be created and configured at the same time by specifying an
unused index with the set rmon event properties command.

Example
This example shows how to enable RMON event entry 1:
A4(rw)->set rmon event status 1 enable

clear rmon event

Use this command to delete an RMON event entry and any associated log entries.

Syntax
clear rmon event index

Parameters
index Specifies the index number of the entry to be cleared.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear RMON event 1:
A4(rw)->clear rmon event 1

Filter Group Commands

The packet capture and filter function is disabled by default. Only one interface can be configured
for capturing and filtering at a time.
When packet capture is enabled on an interface, the A4 switch will capture 100 frames as close to
sequentially as possible. These 100 frames will be placed into a buffer for inspection. If there is
data in the buffer when the function is started, the buffer will be overwritten. Once 100 frames
have been captured, the capture will stop. Filtering will be performed on the frames captured in
the buffer. Therefore, only a subset of the frames captured will be available for display.

Note: Packet capture is sampling only and does not guarantee receipt of back to back packets.

20-12 RMON Configuration

 show rmon channel

One channel at a time can be supported, with up to three filters. Configured channel, filter, and
buffer control information will be saved across resets, but captured frames within the buffer will
not be saved.
This function cannot be used concurrently with port mirroring. The system will check to prevent
concurrently enabling both functions, and a warning will be generated in the CLI if attempted.

For information about... Refer to page...

show rmon channel 20-13

set rmon channel 20-14

clear rmon channel 20-14

show rmon filter 20-15

set rmon filter 20-16

clear rmon filter 20-16

show rmon channel

Use this command to display RMON channel entries for one or more ports.

Syntax
show rmon channel [port-string]

Parameters
port-string (Optional) Displays RMON channel entries for a specific port(s).

Defaults
If port-string is not specified, information about all channels will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display RMON channel information for fe.2.12:
A4(rw)->show rmon channel fe.2.12
Port fe.2.12 Channel index= 628 EntryStatus= valid
----------------------------------------------------------
Control off AcceptType matched
OnEventIndex 0 OffEventIndex 0
EventIndex 0 Status ready
Matches 4498
Description Thu Dec 16 12:57:32 EST 2004
Owner NetSight smith

Extreme A4 CLI Reference 20-13

set rmon channel

set rmon channel

Use this command to configure an RMON channel entry.

Syntax
set rmon channel index port-string [accept {matched | failed}] [control {on | off}]
[description description] [owner owner]

Parameters
index Specifies an index number for this entry. An entry will automatically be
created if an unused index number is chosen. Maximum number of
entries is 2. Maximum value is 65535.
port-string Specifies the port on which traffic will be monitored.
accept matched | (Optional) Specifies the action of the filters on this channel as:
failed
• matched - Packets will be accepted on filter matches
• failed - Packets will be accepted if they fail a match
control on | off (Optional) Enables or disables control of the flow of data through the
channel.
description (Optional) Specifies a description for this channel.
description
owner owner (Optional) Specifies the name of the entity that configured this entry.

Defaults
If an action is not specified, packets will be accepted on filter matches.
If not specified, control will be set to off.
If a description is not specified, none will be applied.
If owner is not specified, it will be set to monitor.

Mode
Switch command, read-write.

Example
This example shows how to create an RMON channel entry:
A4(rw)->set rmon channel 54313 fe.2.12 accept failed control on description
"capture all"

clear rmon channel

Use this command to clear an RMON channel entry.

Syntax
clear rmon channel index

Parameters
index Specifies the channel entry to be cleared.

20-14 RMON Configuration

 show rmon filter

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear RMON channel entry 2:
A4(rw)->clear rmon channel 2

show rmon filter

Use this command to display one or more RMON filter entries.

Syntax
show rmon filter [index index | channel channel]

Parameters
index index | (Optional) Displays information about a specific filter entry, or about all
channel channel filters which belong to a specific channel.

Defaults
If no options are specified, information for all filter entries will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display all RMON filter entries and channel information:
A4(rw)->show rmon filter
Index= 55508 Channel Index= 628 EntryStatus= valid
----------------------------------------------------------
Data Offset 0 PktStatus 0
PktStatusMask 0 PktStatusNotMask 0
Owner ETS,NAC-D
-----------------------------
Data
ff ff ff ff ff ff
-----------------------------
DataMask
ff ff ff ff ff ff
-----------------------------
DataNotMask
00 00 00 00 00 00

Extreme A4 CLI Reference 20-15

set rmon filter

set rmon filter

Use this command to configure an RMON filter entry.

Syntax
set rmon filter index channel-index [offset offset] [status status] [smask smask]
[snotmask snotmask] [data data] [dmask dmask] [dnotmask dnotmask] [owner owner]

Parameters
index Specifies an index number for this entry. An entry will automatically be
created if an unused index number is chosen. Maximum number of
entries is 10. Maximum value is 65535.
channel-index Specifies the channel to which this filter will be applied.
offset offset (Optional) Specifies an offset from the beginning of the packet to look for
matches.
status status (Optional) Specifies packet status bits that are to be matched.
smask smask (Optional) Specifies the mask applied to status to indicate which bits are
significant.
snotmask snotmask (Optional) Specifies the inversion mask that indicates which bits should
be set or not set
data data (Optional) Specifies the data to be matched.
dmask dmask (Optional) Specifies the mask applied to data to indicate which bits are
significant.
dnotmask dnotmask (Optional) Specifies the inversion mask that indicates which bits should
be set or not set.
owner (Optional) Specifies the name of the entity that configured this entry.

Defaults
If owner is not specified, it will be set to monitor.
If no other options are specified, none (0) will be applied.

Mode
Switch command, read-write.

Example
This example shows how to create RMON filter 1 and apply it to channel 9:
A4(rw)->set rmon filter 1 9 offset 30 data 0a154305 dmask ffffffff

clear rmon filter

Use this command to clear an RMON filter entry.

Syntax
clear rmon filter {index index | channel channel}

20-16 RMON Configuration

 Packet Capture Commands

Parameters
index index | Clears a specific filter entry, or all entries belonging to a specific channel.
channel channel

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear RMON filter entry 1:
A4(rw)->clear rmon filter index 1

Packet Capture Commands

Note that packet capture filter is sampling only and does not guarantee receipt of back-to-back
packets.
Use the following commands to display RMON capture entries, configure, enable, or disable
capture entries, and clear capture entries.

For information about... Refer to page...

show rmon capture 20-17

set rmon capture 20-18

clear rmon capture 20-19

show rmon capture

Use this command to display RMON capture entries and associated buffer control entries.

Syntax
show rmon capture [index [nodata]]

Parameters
index (Optional) Displays the specified buffer control entry and all captured
packets associated with that entry.
nodata (Optional) Displays only the buffer control entry specified by index.

Defaults
If no options are specified, all buffer control entries and associated captured packets will be
displayed.

Mode
Switch command, read-only.

Extreme A4 CLI Reference 20-17

set rmon capture

Example
This example shows how to display RMON capture entries and associated buffer entries:
A4(rw)->show rmon capture
Buf.control= 28062 Channel= 38283 EntryStatus= valid
----------------------------------------------------------
FullStatus avail FullAction lock
Captured packets 251 Capture slice 1518
Download size 100 Download offset 0
Max Octet Requested 50000 Max Octet Granted 50000
Start time 1 days 0 hours 51 minutes 15 seconds
Owner monitor

captureEntry= 1 Buff.control= 28062

--------------------------------------------
Pkt ID 9 Pkt time 1 days 0 hours 51 minutes 15 seconds
Pkt Length 93 Pkt status 0
Data:
00 00 5e 00 01 01 00 01 f4 00 7d ce 08 00 45 00
00 4b b4 b9 00 00 40 11 32 5c 0a 15 43 05 86 8d
bf e5 00 a1 0e 2b 00 37 cf ca 30 2d 02 01 00 04
06 70 75 62 6c 69 63 a2 20 02 02 0c 92 02 01 00
02 01 00 30 14 30 12 06 0d 2b 06 01 02 01 10 07
01 01 0b 81 fd 1c 02 01 01 00 11 0b 00

set rmon capture

Use this command to configure an RMON capture entry.

Syntax
set rmon capture index {channel [action {lock}] [slice slice] [loadsize loadsize]
[offset offset] [asksize asksize] [owner owner]}

Parameters
index Specifies a buffer control entry.
channel Specifies the channel to which this capture entry will be applied.
action lock (Optional) Specifies the action of the buffer when it is full as:
• lock - Packets will cease to be accepted
slice slice (Optional) Specifies the maximum octets from each packet to be saved in
a buffer. Currently, the only value allowed is 1518.
loadsize loadsize (Optional) Specifies the maximum octets from each packet to be
downloaded from the buffer. The default is 100.
offset offset (Optional) Specifies the first octet from each packet that will be retrieved.
asksize asksize (Optional) Specifies the requested maximum octets to be saved in this
buffer. Currently, the only value accepted is -1, which requests as many
octets as possible.
owner (Optional) Specifies the name of the entity that configured this entry.

20-18 RMON Configuration

 clear rmon capture

Defaults
If not specified, action defaults to lock.
If not specified, offset defaults to 0.
If not specified, asksize defaults to -1 (which will request as many octets as possible).
If slice is not specified, 1518 will be applied.
If loadsize is not specified, 100 will be applied.
If owner is not specified, it will be set to monitor.

Mode
Switch command, read-write.

Example
This example shows how to create RMON capture entry 1 to “listen” on channel 628:
A4(rw)->set rmon capture 1 628

clear rmon capture

Use this command to clears an RMON capture entry.

Syntax
clear rmon capture index

Parameters
index Specifies the capture entry to be cleared.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear RMON capture entry 1:
A4(rw)->clear rmon capture 1

Extreme A4 CLI Reference 20-19

clear rmon capture

20-20 RMON Configuration

 21
DHCP Server Configuration

This chapter describes the commands to configure the IPv4 DHCP server functionality on a A4
switch. Refer to Chapter 4, “System Configuration,” in the Fixed Switching Configuration Guide for
configuration procedures, examples, and conceptual information about DHCP.

For information about... Refer to page...

Configuring General DHCP Server Parameters 21-1

Configuring IP Address Pools 21-9

Configuring General DHCP Server Parameters

Use the following commands to configure DHCP server parameters, and to display and clear
address binding information, server statistics, and conflict information.

For information about... Refer to page...

set dhcp 21-2

set dhcp bootp 21-2

set dhcp conflict logging 21-3

show dhcp conflict 21-3

clear dhcp conflict 21-4

set dhcp exclude 21-4

clear dhcp exclude 21-5

set dhcp ping 21-5

clear dhcp ping 21-6

show dhcp binding 21-6

clear dhcp binding 21-7

show dhcp server statistics 21-7

clear dhcp server statistics 21-8

Extreme A4 CLI Reference 21-1

set dhcp

set dhcp
Use this command to enable or disable the DHCP server functionality on the A4.

Syntax
set dhcp {enable | disable}

Parameters
enable | disable Enables or disables DHCP server functionality. By default, DHCP server is
disabled.

Defaults
None.

Mode
Switch command, read-write.

Example
This example enables DHCP server functionality.
A4(rw)->set dhcp enable

set dhcp bootp

Use this command to enable or disable automatic address allocation for BOOTP clients. By
default, address allocation for BOOTP clients is disabled. Refer to RFC 1534, “Interoperation
Between DHCP and BOOTP,” for more information.

Syntax
set dhcp bootp {enable | disable}

Parameters
enable | disable Enables or disables address allocation for BOOTP clients.

Defaults
None.

Mode
Switch command, read-write.

Example
This example enables address allocation for BOOTP clients.
A4(rw)->set dhcp bootp enable

21-2 DHCP Server Configuration

 set dhcp conflict logging

set dhcp conflict logging

Use this command to enable conflict logging. By default, conflict logging is enabled. Use the clear
dhcp conflict logging command to disable conflict logging.

Syntax
set dhcp conflict logging

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example enables DHCP conflict logging.
A4(rw)->set dhcp conflict logging

show dhcp conflict

Use this command to display conflict information, for one address or all addresses.

Syntax
show dhcp conflict [address]

Parameters
address [Optional] Specifies the address for which to display conflict information.

Defaults
If no address is specified, conflict information for all addresses is displayed.

Mode
Read-only.

Example
This example displays conflict information for all addresses. Note that ping is the only detection
method used.
A4(ro)->show dhcp conflict

IP address Detection Method Detection Time

----------- ----------------- ---------------
192.0.0.2 Ping 0 days 19h:01m:23s
192.0.0.3 Ping 0 days 19h:00m:46s
192.0.0.4 Ping 0 days 19h:01m:25s
192.0.0.12 Ping 0 days 19h:01m:26s

Extreme A4 CLI Reference 21-3

clear dhcp conflict

clear dhcp conflict

Use this command to clear conflict information for one or all addresses, or to disable conflict
logging.

Syntax
clear dhcp conflict {logging | ip-address| *}

Parameters
logging Disables conflict logging.
ip-address Clears the conflict information for the specified IP address.
* Clears the conflict information for all IP addresses.

Defaults
None.

Mode
Switch command, read-write.

Examples
This example disables DHCP conflict logging.
A4(rw)->clear dhcp conflict logging
This example clears the conflict information for the IP address 192.0.0.2.
A4(rw)->clear dhcp conflict 192.0.0.2

set dhcp exclude

Use this command to configure the IP addresses that the DHCP server should not assign to DHCP
clients. Multiple address ranges can be configured but the ranges cannot overlap. Up to 128 non-
overlapping address ranges can be excluded.

Syntax
set dhcp exclude low-ipaddr [high-ipaddr]

Parameters
low-ipaddr Specifies the first IP address in the address range to be excluded from
assignment.
high-ipaddr (Optional) Specifies the last IP address in the address range to be
excluded.

Defaults
None.

Mode
Switch command, read-write.

21-4 DHCP Server Configuration

 clear dhcp exclude

Example
This example first configures the address pool named “auto1” with 255 addresses for the Class C
network 172,20.28.0, with the set dhcp pool network command. Then, the example limits the
scope of the addresses that can be assigned by a DHCP server by excluding addresses 172.20.28.80
– 100, with the set dhcp exclude command.
A4(rw)->set dhcp pool auto1 network 172.20.28.0 24
A4(rw)->set dhcp exclude 172.20.28.80 172.20.28.100

clear dhcp exclude

Use this command to clear the configured IP addresses that the DHCP server should not assign to
DHCP clients.

Syntax
clear dhcp exclude low-ipaddr [high-ipaddr]

Parameters
low-ipaddr Specifies the first IP address in the address range to be cleared.
high-ipaddr (Optional) Specifies the last IP address in the address range to be cleared.

Defaults
None.

Mode
Switch command, read-write.

Example
This example clears the previously excluded range of IP addresses between 192.168.1.88 through
192.168.1.100.
A4(rw)->clear dhcp exclude 192.168.1.88 192.168.1.100

set dhcp ping

Use this command to configure the number of ping packets the DHCP server sends to an IP
address before assigning the address to a requesting client.

Syntax
set dhcp ping packets number

Parameters
packets number Specifies the number of ping packets to be sent. The value of number can
be 0, or range from 2 to 10. Entering 0 disables this function. The default
value is 2 packets.

Defaults
None.

Extreme A4 CLI Reference 21-5

clear dhcp ping

Mode
Switch command, read-write.

Example
This example sets the number of ping packets sent to 3.
A4(rw)->set dhcp ping packets 3

clear dhcp ping

Use this command to reset the number of ping packets sent by the DHCP server back to the
default value of 2.

Syntax
clear dhcp ping packets

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example resets the number of ping packets sent back to the default value.
A4(rw)->clear dhcp ping packets

show dhcp binding

Use this command to display binding information for one or all IP addresses.

Syntax
show dhcp binding [ip-address]

Parameters
ip-address (Optional) Specifies the IP address for which to display binding
information.

Defaults
If no IP address is specified, binding information for all addresses is displayed.

Mode
Read-only.

21-6 DHCP Server Configuration

 clear dhcp binding

Example
This example displays binding information about all addresses.
A4(rw)->show dhcp binding
IP address Hardware Address Lease Expiration Type
----------- ----------------- ----------------- -----
192.0.0.6 00:33:44:56:22:39 00:11:02 Automatic
192.0.0.8 00:33:44:56:22:33 00:10:22 Automatic
192.0.0.10 00:33:44:56:22:34 00:09:11 Automatic
192.0.0.11 00:33:44:56:22:35 00:10:05 Automatic
192.0.0.12 00:33:44:56:22:36 00:10:30 Automatic
192.0.0.13 00:33:44:56:22:37 infinite Manual
192.0.0.14 00:33:44:56:22:38 infinite Manual

clear dhcp binding

Use this command to clear (delete) one or all dynamic (automatic) DHCP address bindings.

Syntax
clear dhcp binding {ip-addr | *}

Parameters
ip-addr Specifies the IP address for which to clear/delete the DHCP binding.
* Deletes all dynamic address bindings.

Defaults
None.

Mode
Switch command, read-write.

Usage
This command clears only dynamic (automatic) DHCP bindings. Use the command clear dhcp
pool host to clear manually configured DHCP bindings.

Example
This example deletes the dynamic DHCP address binding for IP address 192.168.1.1.
A4(rw)->clear dhcp binding 192.168.1.1

show dhcp server statistics

Use this command to display DHCP server statistics.

Syntax
show dhcp server statistics

Parameters
None.

Extreme A4 CLI Reference 21-7

clear dhcp server statistics

Defaults
None.

Mode
Read-only.

Example
This example displays server statistics.
A4(ro)->show dhcp server statistics

Automatic Bindings 36
Expired Bindings 6
Malformed Bindings 0
Messages Received
---------- ----------
DHCP DISCOVER 382
DHCP REQUEST 3855
DHCP DECLINE 0
DHCP RELEASE 67
DHCP INFORM 1

Messages Sent
---------- ------
DHCP OFFER 381
DHCP ACK 727
DHCP NACK 2

clear dhcp server statistics

Use this command to clear all DHCP server counters.

Syntax
clear dhcp server statistics

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example clears all DHCP server counters.
A4(rw)->clear dhcp server statistics

21-8 DHCP Server Configuration

 Configuring IP Address Pools

Configuring IP Address Pools

Use the following commands to configure and clear DHCP address pool parameters, and to
display address pool configuration information.

Note: A total of 16 address pools, dynamic and/or static, can be configured on the A4.

For information about... Refer to page...

set dhcp pool 21-10

clear dhcp pool 21-10

set dhcp pool network 21-11

clear dhcp pool network 21-11

set dhcp pool hardware-address 21-12

clear dhcp pool hardware-address 21-13

set dhcp pool host 21-13

clear dhcp pool host 21-14

set dhcp pool client-identifier 21-14

clear dhcp pool client-identifier 21-15

set dhcp pool client-name 21-15

clear dhcp pool client-name 21-16

set dhcp pool bootfile 21-16

clear dhcp pool bootfile 21-17

set dhcp pool next-server 21-17

clear dhcp pool next-server 21-18

set dhcp pool lease 21-18

clear dhcp pool lease 21-19

set dhcp pool default-router 21-20

clear dhcp pool default-router 21-20

set dhcp pool dns-server 21-21

clear dhcp pool dns-server 21-21

set dhcp pool domain-name 21-22

clear dhcp pool domain-name 21-22

set dhcp pool netbios-name-server 21-23

clear dhcp pool netbios-name-server 21-23

set dhcp pool netbios-node-type 21-24

clear dhcp pool netbios-node-type 21-24

set dhcp pool option 21-25

Extreme A4 CLI Reference 21-9

set dhcp pool

For information about... Refer to page...

clear dhcp pool option 21-25

show dhcp pool configuration 21-26

set dhcp pool

Use this command to create and assign a name to a DHCP server pool of addresses. Up to 16
address pools may be configured on a A4. Note that entering this command is not required to
create an address pool before configuring other address pool parameters.

Syntax
set dhcp pool poolname

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example creates an address pool named “auto1.”
A4(rw)->set dhcp pool auto1

clear dhcp pool

Use this command to delete a DHCP server pool of addresses.

Syntax
clear dhcp pool poolname

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

21-10 DHCP Server Configuration

 set dhcp pool network

Example
This example deletes the address pool named “auto1.”
A4(rw)->clear dhcp pool auto1

set dhcp pool network

Use this command to configure the subnet number and mask for an automatic DHCP address
pool.

Syntax
set dhcp pool poolname network number {mask | prefix-length}

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
number Specifies an IP subnet for the address pool.
mask Specifies the subnet mask in dotted quad notation.
prefix-length Specifies the subnet mask as an integer.

Defaults
None.

Mode
Switch command, read-write.

Usage
Use this command to configure a set of IP addresses to be assigned by the DHCP server using the
specified address pool. In order to limit the scope of the addresses configured with this command,
use the set dhcp exclude command on page 21-4.

Examples
This example configures the IP subnet 172.20.28.0 with a prefix length of 24 for the automatic
DHCP pool named “auto1.” Alternatively, the mask could have been specified as 255.255.255.0.
A4(rw)->set dhcp pool auto1 network 172.20.28.0 24
This example limits the scope of 255 addresses created for the Class C network 172,20.28.0 by the
previous example, by excluding addresses 172.20.28.80 – 100.
A4(rw)->set dhcp exclude 172.20.28.80 172.20.28.100

clear dhcp pool network

Use this command to remove the network number and mask of a DHCP server pool of addresses.

Syntax
clear dhcp pool poolname network

Extreme A4 CLI Reference 21-11

set dhcp pool hardware-address

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example deletes the network and mask from the address pool named “auto1.”
A4(rw)->clear dhcp pool auto1 network

set dhcp pool hardware-address

Use this command to configure the MAC address of the DHCP client and create an address pool
for manual binding. You can use either this command or the set dhcp pool client-identifier
command to create a manual binding pool, but using both is not recommended.

Syntax
set dhcp pool poolname hardware-address hw-addr [type]

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
hw-addr Specifies the MAC address of the client’s hardware platform. This value
can be entered using dotted hexadecimal notation or colons.
type (Optional) Specifies the protocol of the hardware platform. Valid values
are 1 for Ethernet or 6 for IEEE 802. Default value is 1, Ethernet.

Defaults
If no type is specified, Ethernet is assumed.

Mode
Switch command, read-write.

Example
This example specifies 0001.f401.2710 as the Ethernet MAC address for the manual address pool
named “manual2.” Alternatively, the MAC address could have be entered as 00:01:f4:01:27:10.
A4(rw)->set dhcp pool manual2 hardware-address 0001.f401.2710

21-12 DHCP Server Configuration

 clear dhcp pool hardware-address

clear dhcp pool hardware-address

Use this command to remove the hardware address of a DHCP client from a manual binding
address pool.

Syntax
clear dhcp pool poolname hardware-address

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example deletes the client hardware address from the address pool named “manual2.”
A4(rw)->clear dhcp pool manual2 hardware-address

set dhcp pool host

Use this command to configure an IP address and network mask for a manual DHCP binding.

Syntax
set dhcp pool poolname host ip-address [mask | prefix-length]

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
ip-address Specifies the IP address for manual binding.
mask (Optional) Specifies the subnet mask in dotted quad notation.
prefix-length (Optional) Specifies the subnet mask as an integer.

Defaults
If a mask or prefix is not specified, the class A, B, or C natural mask will be used.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 21-13

clear dhcp pool host

Example
This example shows how to configure the minimum requirements for a manual binding address
pool. First, the hardware address of the client’s hardware platform is configured, followed by
configuration of the address to be assigned to that client manually.
A4(rw)->set dhcp pool manual2 hardware-address 0001.f401.2710
A4(rw)->set dhcp pool manual2 host 15.12.1.99 255.255.248.0

clear dhcp pool host

Use this command to remove the host IP address from a manual binding address pool.

Syntax
clear dhcp pool poolname host

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example deletes the host IP address from the address pool named “manual2.”
A4(rw)->clear dhcp pool manual2 host

set dhcp pool client-identifier

Use this command to configure the client identifier of the DHCP client and create an address pool
for manual binding. You can use either this command or the set dhcp pool hardware-address
command to create a manual binding pool, but using both is not recommended.

Syntax
set dhcp pool poolname client-identifier id

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
id Specifies the unique client identifier for this client. The value must be
entered in xx:xx:xx:xx:xx:xx format.

Defaults
None.

21-14 DHCP Server Configuration

 clear dhcp pool client-identifier

Mode
Switch command, read-write.

Usage
The client identifier is formed by concatenating the media type and the MAC address. For
example, if the client hardware type is Ethernet (media type code 1) and the client MAC address is
00:01:22:33:44:55, then the client identifier configured with this command must be
01:00:01:22:33:44:55.
For a list of media type codes, refer to the "Address Resolution Protocol Parameters" section of
RFC 1700, Assigned Numbers.

Example
This example shows how to configure the minimum requirements for a manual binding address
pool, using a client identifier rather than the hardware address of the client’s hardware platform.
A4(rw)->set dhcp pool manual2 client-identifier 01:00:01:22:33:44:55
A4(rw)->set dhcp pool manual2 host 10.12.1.10 255.255.255.0

clear dhcp pool client-identifier

Use this command to remove the unique identifier of a DHCP client from a manual binding
address pool.

Syntax
clear dhcp pool poolname client-identifier

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example deletes the client identifier from the address pool named “manual2.”
A4(rw)->clear dhcp pool manual2 client-identifier

set dhcp pool client-name

Use this command to assign a name to a DHCP client when creating an address pool for manual
binding.

Syntax
set dhcp pool poolname client-name name

Extreme A4 CLI Reference 21-15

clear dhcp pool client-name

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
name Specifies the name to be assigned to this client. Client names may be up to
31 characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example configures the client name “appsvr1” to the manual binding pool “manual2.”
A4(rw)->set dhcp pool manual2 client-identifier 01:22:33:44:55:66
A4(rw)->set dhcp pool manual2 host 10.12.1.10 255.255.255.0
A4(rw)->set dhcp pool manual2 client-name appsvr1

clear dhcp pool client-name

Use this command to delete a DHCP client name from an address pool for manual binding.

Syntax
clear dhcp pool poolname client-name

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example deletes the client name from the manual binding pool “manual2.”
A4(rw)->clear dhcp pool manual2 client-name

set dhcp pool bootfile

Use this command to specify a default boot image for the DHCP clients who will be served by the
address pool being configured.

Syntax
set dhcp pool poolname bootfile filename

21-16 DHCP Server Configuration

 clear dhcp pool bootfile

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
filename Specifies the boot image file name.

Defaults
None.

Mode
Switch command, read-write.

Example
This example sets the boot image filename for address pool named “auto1.”
A4(rw)->set dhcp pool auto1 bootfile image1.img

clear dhcp pool bootfile

Use this command to remove a default boot image from the address pool being configured.

Syntax
clear dhcp pool poolname bootfile

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example removes the boot image filename from address pool named “auto1.”
A4(rw)->clear dhcp pool auto1 bootfile

set dhcp pool next-server

Use this command to specify the file server from which the default boot image is to be loaded by
the client.

Syntax
set dhcp pool poolname next-server ip-address

Extreme A4 CLI Reference 21-17

clear dhcp pool next-server

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
ip-address Specifies the IP address of the file server the DHCP client should contact
to load the default boot image.

Defaults
None.

Mode
Switch command, read-write.

Example
This example specifies the file server from which clients being served by address pool “auto1”
should download the boot image file “image1.img.”
A4(rw)->set dhcp pool auto1 bootfile image1.img
A4(rw)->set dhcp pool auto1 next-server 10.1.1.10

clear dhcp pool next-server

Use this command to remove the boot image file server from the address pool being configured.

Syntax
clear dhcp pool poolname next-server

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example removes the file server from address pool “auto1.”
A4(rw)->clear dhcp pool auto1 next-server

set dhcp pool lease

Use this command to specify the duration of the lease for an IP address assigned by the DHCP
server from the address pool being configured.

Syntax
set dhcp pool poolname lease {days [hours [minutes]] | infinite}

21-18 DHCP Server Configuration

 clear dhcp pool lease

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
days Specifies the number of days an address lease will remain valid. Value can
range from 0 to 59.
hours (Optional) When a days value has been assigned, specifies the number of
hours an address lease will remain valid. Value can range from 0 to 1439.
minutes (Optional) When a days value and an hours value have been assigned,
specifies the number of minute an address lease will remain valid. Value
can range from 0 to 86399.
infinite Specifies that the duration of the lease will be unlimited.

Defaults
If no lease time is specified, a lease duration of 1 day is configured.

Mode
Switch command, read-write.

Example
This example configures a lease duration of 12 hours for the address pool being configured. Note
that to configure a lease time less than one day, enter 0 for days, then the number of hours and
minutes.
A4(rw)->set dhcp pool auto1 lease 0 12

clear dhcp pool lease

Use this command to restore the default lease time value of one day for the address pool being
configured.

Syntax
clear dhcp pool poolname lease

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
Clears the lease time for this address pool to the default value of one day.

Mode
Switch command, read-write.

Example
This example restores the default lease duration of one day for address pool “auto1.”
A4(rw)->clear dhcp pool auto1 lease

Extreme A4 CLI Reference 21-19

set dhcp pool default-router

set dhcp pool default-router

Use this command to specify a default router list for the DHCP clients served by the address pool
being configured. Up to 8 default routers can be configured.

Syntax
set dhcp pool poolname default-router address [address2 ... address8]

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
address Specifies the IP address of a default router.
address2 ... address8 (Optional) Specifies, in order of preference, up to 7 additional default
router addresses.

Defaults
None.

Mode
Switch command, read-write.

Example
This example assigns a default router at 10.10.10.1 to the address pool named “auto1.”
A4(rw)->set dhcp pool auto1 default-router 10.10.10.1

clear dhcp pool default-router

Use this command to delete the default routers configured for this address pool.

Syntax
clear dhcp pool poolname default-router

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example removes the default router from the address pool “auto1.”
A4(rw)->clear dhcp pool auto1 default-router

21-20 DHCP Server Configuration

 set dhcp pool dns-server

set dhcp pool dns-server

Use this command to specify one or more DNS servers for the DHCP clients served by the address
pool being configured. Up to 8 DNS servers can be configured.

Syntax
set dhcp pool poolname dns-server address [address2 ... address8]

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
address Specifies the IP address of a DNS server.
address2 ... address8 (Optional) Specifies, in order of preference, up to 7 additional DNS
server addresses.

Defaults
None.

Mode
Switch command, read-write.

Example
This example assigns a DNS server at 10.14.10.1 to the address pool “‘auto1.”
A4(rw)->set dhcp pool auto1 dns-server 10.14.10.1

clear dhcp pool dns-server

Use this command to remove the DNS server list from the address pool being configured.

Syntax
clear dhcp pool poolname dns-server

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example removes the DNS server list from the address pool “auto1.”
A4(rw)->clear dhcp pool auto1 dns-server

Extreme A4 CLI Reference 21-21

set dhcp pool domain-name

set dhcp pool domain-name

Use this command to specify a domain name to be assigned to DHCP clients served by the address
pool being configured.

Syntax
set dhcp pool poolname domain-name domain

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
domain Specifies the domain name string. The domain name can be up to 255
characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example assigns the “mycompany.com” domain name to the address pool “auto1.”
A4(rw)->set dhcp pool auto1 domain-name mycompany.com

clear dhcp pool domain-name

Use this command to remove the domain name from the address pool being configured.

Syntax
clear dhcp pool poolname domain-name

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example removes the domain name from the address pool “auto1.”
A4(rw)->clear dhcp pool auto1 domain-name

21-22 DHCP Server Configuration

 set dhcp pool netbios-name-server

set dhcp pool netbios-name-server

Use this command to assign one or more NetBIOS name servers for the DHCP clients served by
the address pool being configured. Up to 8 NetBIOS name servers can be configured.

Syntax
set dhcp pool poolname netbios-name-server address [address2 ... address8]

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
address Specifies the IP address of a NetBIOS name server.
address2 ... address8 (Optional) Specifies, in order of preference, up to 7 additional NetBIOS
name server addresses.

Defaults
None.

Mode
Switch command, read-write.

Example
This example assigns a NetBIOS name server at 10.15.10.1 to the address pool being configured.
A4(rw)->set dhcp pool auto1 netbios-name-server 10.15.10.1

clear dhcp pool netbios-name-server

Use this command to remove the NetBIOS namer server list from the address pool being
configured.
clear dhcp pool poolname netbios-name-server

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

Example
This example removes the NetBIOS name server list from the address pool auto1.
A4(rw)->clear dhcp pool auto1 netbios-name-server

Extreme A4 CLI Reference 21-23

set dhcp pool netbios-node-type

set dhcp pool netbios-node-type

Use this command to specify a NetBIOS node (server) type for the DHCP clients served by the
address pool being configured.

Syntax
set dhcp pool poolname netbios-node-type {b-node | h-node | p-node | m-node}

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
b-node Specifies the NetBIOs node type to be broadcast (no WINS).
h-node Specifies the NetBIOs node type to be hybrid (WINS, then broadcast).
p-node Specifies the NetBIOs node type to be peer (WINS only).
m-node Specifies the NetBIOs node type to be mixed (broadcast, then WINS).

Defaults
None.

Mode
Switch command, read-write.

Example
This example specifies hybrid as the NetBIOS node type for the address pool “auto1.”
A4(rw)->set dhcp pool auto1 netbios-node-type h-node

clear dhcp pool netbios-node-type

Use this command to remove the NetBIOS node type from the address pool being configured.

Syntax
clear dhcp pool poolname netbios-node-type

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Switch command, read-write.

21-24 DHCP Server Configuration

 set dhcp pool option

Example
This example removes the NetBIOS node type from the address pool “auto1.”
A4(rw)->clear dhcp pool auto1 netbios-node-type

set dhcp pool option

Use this command to configure DHCP options, described in RFC 2132.

Syntax
set dhcp pool poolname option code {ascii string | hex string-list | ip address-
list}

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
code Specifies the DHCP option code, as defined in RFC 2132. Value can range
from 1 to 254.
ascii string Specifies the data in ASCII format. An ASCII character string containing a
space must be enclosed in quotations.
hex string-list Specifies the data in HEX format. Up to 8 HEX strings can be entered.
ip address-list Specifies the data in IP address format. Up to 8 IP addresses can be entered.

Defaults
None.

Mode
Switch command, read-write.

Examples
This example configures DHCP option 19, which specifies whether the client should configure its
IP layer for packet forwarding. In this case, IP forwarding is enabled with the 01 value.
A4(rw)->set dhcp pool auto1 option 19 hex 01
This example configures DHCP option 72, which assigns one or more Web servers for DHCP
clients. In this case, two Web server addresses are configured.
A4(rw)->set dhcp pool auto1 option 72 ip 168.24.3.252 168.24.3.253

clear dhcp pool option

Use this command to remove a DHCP option from the address pool being configured.

Syntax
clear dhcp pool poolname option code

Extreme A4 CLI Reference 21-25

show dhcp pool configuration

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.
code Specifies the DHCP option code, as defined in RFC 2132. Value can range
from 1 to 254.

Defaults
None.

Mode
Switch command, read-write.

Example
This example removes option 19 from address pool “auto1.”
A4(rw)->clear dhcp pool auto1 option 19

show dhcp pool configuration

Use this command to display configuration information for one or all address pools.

Syntax
show dhcp pool configuration {poolname | all}

Parameters
poolname Specifies the name of the address pool. Pool names may be up to 31
characters in length.

Defaults
None.

Mode
Read-only.

Example
This example displays configuration information for all address pools.
A4(rw)->show dhcp pool configuration all

Pool: Atg_Pool
Pool Type Dynamic
Network 192.0.0.0 255.255.255.0
Lease Time 1 days 0 hrs 0 mins
Default Routers 192.0.0.1

Pool: static1
Pool Type Manual
Client Name appsvr1
Client Identifier 01:00:01:f4:01:27:10
Host 10.1.1.1 255.0.0.0

21-26 DHCP Server Configuration

 show dhcp pool configuration

Lease Time infinite

Option 19 hex 01

Pool: static2
Pool Type Manual
Hardware Address 00:01:f4:01:27:10
Hardware Address Type ieee802
Host 192.168.10.1 255.255.255.0
Lease Time infinite

Extreme A4 CLI Reference 21-27

show dhcp pool configuration

21-28 DHCP Server Configuration

 22
DHCP Snooping and
Dynamic ARP Inspection

This chapter describes the commands to configure two security features:

• DHCP snooping, which monitors DHCP messages between a DHCP client and DHCP server
to filter harmful DHCP messages and to build a database of authorized address bindings
• Dynamic ARP inspection, which uses the bindings database created by the DHCP snooping
feature to reject invalid and malicious ARP packets

For information about... Refer to page...

DHCP Snooping Commands 22-1

Dynamic ARP Inspection Commands 22-11

DHCP Snooping Commands

For information about... Refer to page...

set dhcpsnooping 22-2

set dhcpsnooping vlan 22-2

set dhcpsnooping trust 22-3

set dhcpsnooping binding 22-4

set dhcpsnooping verify 22-4

set dhcpsnooping log-invalid 22-5

set dhcpsnooping limit 22-6

show dhcpsnooping 22-7

show dhcpsnooping port 22-7

show dhcpsnooping binding 22-8

show dhcpsnooping statistics 22-9

clear dhcpsnooping binding 22-10

clear dhcpsnooping statistics 22-10

clear dhcpsnooping limit 22-11

Extreme A4 CLI Reference 22-1

set dhcpsnooping

set dhcpsnooping
Use this command to enable or disable DHCP snooping globally.

Syntax
set dhcpsnooping {enable | disable}

Parameters
enable Enable DHCP snooping globally on the switch.
disable Disable DHCP snooping globally on the switch.

Defaults
Disabled globally.

Mode
Switch command, read-write.

Usage
By default, DHCP snooping is disabled globally and on all VLANs. You must enable it globally
with this command, and then enable it on specific VLANs.

Example
The following example enables DHCP snooping globally.
A4(rw)->set dhcpsnooping enable

set dhcpsnooping vlan

Use this command to enable or disable DHCP snooping on a VLAN or range of VLANs.

Syntax
set dhcpsnooping vlan vlan-range {enable | disable}

Parameters
vlan-range Specifies the VLAN or range of VLANs on which DHCP snooping is to
be enabled or disabled.
enable | disable Enables or disables DHCP snooping for the specified VLANs.

Defaults
DHCP snooping is disabled by default on all VLANs.

Mode
Switch command, read-write.

22-2 DHCP Snooping and Dynamic ARP Inspection

 set dhcpsnooping trust

Usage
By default, DHCP snooping is disabled globally and on all VLANs. You must enable it globally
with the set dhcpsnooping command, and then enable it on specific VLANs with this command.

Example
This example enables DHCP snooping on VLANS 10 through 20.
A4(rw)->set dhcpsnooping vlan 10-20 enable

set dhcpsnooping trust

Use this command to enable or disable a port as a DHCP snooping trusted port.

Syntax
set dhcpsnooping trust port port-string {enable | disable}

Parameters
port port-string Specifies the port or ports to be enabled or disabled as trusted ports. The
ports can be physical ports or LAGs that are members of a VLAN.
enable | disable Enables or disables the specified ports as trusted ports.

Defaults
By default, ports are untrusted.

Mode
Switch command, read-write.

Usage
In order for DHCP snooping to operate, snooping has to be enabled globally and on specific
VLANs, and the ports within the VLANs have to be configured as trusted or untrusted. On
trusted ports, DHCP client messages are forwarded directly by the hardware. On untrusted ports,
client messages are given to the DHCP snooping application.
The DHCP snooping application builds the bindings database from client messages received on
untrusted ports. DHCP snooping creates a “tentative binding” from DHCP DISCOVER and
REQUEST messages. Tentative bindings tie a client to the port on which the message packet was
received. Tentative bindings are completed when DHCP snooping learns the client’s IP address
from a DHCP ACK message on a trusted port.
The ports on the switch through which DHCP servers are reached must be configured as trusted
ports so that packets received from those ports will be forwarded to clients. DCHP packets from a
DHCP server (DHCP OFFER, DHCP ACK, DHCP NAK) are dropped if received on an untrusted
port.

Example
This example configures port ge.1.1 as a trusted port.
A4(rw)->set dhcpsnooping trust port ge.1.1 enable

Extreme A4 CLI Reference 22-3

set dhcpsnooping binding

set dhcpsnooping binding

Use this command to add a static DHCP binding to the DHCP snooping database.

Syntax
set dhcpsnooping binding mac-address vlan vlan-id ipaddr port port-string

Parameters
mac-address Specifies the MAC address of the binding entry.
vlan vlan-id Specifies the VLAN of the binding entry.
ipaddr Specifies the IP address of the binding entry.
port port-string Specifies the port of the binding entry.

Defaults
None.

Mode
Switch command, read-write.

Usage
When enabled globally and on VLANs, DHCP snooping builds its bindings database from DHCP
client messages received on untrusted ports. Such entries in the database are dynamic entries
which will be removed in response to valid DECLINE, RELEASE, and NACK messages or when
the absolute lease time of the entry expires.
You can add static entries to the bindings database with this command.

Example
This example creates a static entry, associating MAC address 00:01:02:33:44:55 with IP address
192.168.10.10 and VLAN 10, port ge.1.1.
A4(rw)->set dhcpsnooping binding 00:01:02:33:44:55 vlan 10 192.168.10.10 port
ge.1.1

set dhcpsnooping verify

Use this command to enable or disable DHCP snooping to filter on source MAC address.

Syntax
set dhcpsnooping verify mac-address {enable | disable}

Parameters
enable Enables verification of the source MAC address in client messages
against the client hardware address.
disable Disables verification of the source MAC address in client messages
against the client hardware address.

22-4 DHCP Snooping and Dynamic ARP Inspection

 set dhcpsnooping log-invalid

Defaults
Source MAC address verification is enabled by default.

Mode
Switch command, read-write.

Usage
When this verification is enabled, the DHCP snooping application compares the source MAC
address contained in valid client messages with the client’s hardware address. If there is a
mismatch, DHCP snooping logs the event and drops the packet.
Use the show dhcpsnooping command to display the status (enabled or disabled) of source MAC
address verification for each interface in an enabled VLAN. The show dhcpsnooping statistics
command shows the actual number of MAC verification errors that occurred on untrusted ports.

Example
This example disables source MAC address verification and logging.
A4(rw)->set dhcpsnooping verify mac-address disable

set dhcpsnooping log-invalid

Use this command to enable or disable logging of invalid DHCP messages on ports.

Syntax
set dhcpsnooping log-invalid port port-string {enable | disable}

Parameters
port port-string Specifies the port or ports on which to enable or disable logging of
invalid packets.
enable | disable Enables or disables logging on the specified ports.

Defaults
Disabled.

Mode
Switch command, read-write.

Usage
The DHCP snooping application processes incoming DHCP messages. For DHCPRELEASE and
DHCPDECLINE messages, the application compares the receive interface and VLAN with the
client's interface and VLAN in the bindings database. If the interfaces do not match, the
application logs the event if logging has been enabled.
Use the show dhcpsnooping command to display the status (enabled or disabled) of logging
invalid packets for each interface in an enabled VLAN. The show dhcpsnooping statistics
command shows the actual number of server messages received on untrusted ports.

Extreme A4 CLI Reference 22-5

set dhcpsnooping limit

Example
This example enables logging of invalid DHCP messages on port ge.1.1 and then displays the
DHCP configuration settings.
A4(rw)->set dhcpsnooping log invalid port ge.1.1 enable
A4(su)->show dhcpsnooping
DHCP snooping is Disabled
DHCP snooping source MAC verification is enabled
DHCP snooping is enabled on the following VLANs:
3

Interface Trusted Log Invalid Pkts

----------- ---------- ----------------
ge.1.1 No Yes
ge.1.2 No No
ge.1.3 Yes No

set dhcpsnooping limit

Use this command to configure rate limiting parameters for incoming DHCP packets on a port or
ports.

Syntax
set dhcpsnooping limit port-string {none | rate pps {burst interval secs]}

Parameters
port-string Specifies the port or ports to which to apply these rate limiting
parameters.
none Configures no limit on incoming DHCP packets.
rate pps Specifies a rate limit in packets per second. The value of pps can range
from 0 to 100 packets per second.
burst interval secs Specifies a burst interval in seconds. The value of secs can range from 1
to 15 seconds.

Defaults
Rate = 15 packets per second
Burst Interval = 1 second

Mode
Switch command, read-write.

Usage
To protect the switch from DHCP attacks when DHCP snooping is enabled, the snooping
application enforces a rate limit for DHCP packets received on untrusted interfaces. DHCP
snooping monitors the receive rate on each interface separately. If the receive rate exceeds the
configured limit, DHCP snooping brings down the interface. You can re-enable the interface with
the set port enable command. Both the rate and the burst interval can be configured.
You can display the currently configured rate limit parameters with the show dhcpsnooping port
command.

22-6 DHCP Snooping and Dynamic ARP Inspection

 show dhcpsnooping

Example
This example configures rate limit parameters on port ge.1.1.
A4(rw)->set dhcpsnooping limit ge.1.1 rate 20 burst interval 2
A4(rw)->show dhcpsnooping port ge.1.1
Interface Trust State Rate Limit Burst Interval
(pps) (seconds)
---------- ------------- ------------- ---------------
ge.1.1 No 20 2

show dhcpsnooping
Use this command to display DHCP snooping configuration parameters.

Syntax
show dhcpsnooping

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Usage
This command displays the status (enabled or disabled) of DHCP snooping globally, lists the
VLANs on which DHCP snooping is enabled, displays whether source MAC address verification
is enabled or disabled, and for ports that are enabled for snooping, displays whether they are
trusted or untrusted and whether logging of invalid packets has been enabled.

Example
This example shows the output of the show dhcpsnooping command.
A4(su)->show dhcpsnooping
DHCP snooping is Enabled
DHCP snooping source MAC verification is enabled
DHCP snooping is enabled on the following VLANs:
3

Interface Trusted Log Invalid Pkts

----------- ---------- ----------------
ge.1.47 Yes No
ge.1.48 No No
lag.0.1 No No

show dhcpsnooping port

Use this command to display DHCP snooping configuration parameters for specific ports.

Extreme A4 CLI Reference 22-7

show dhcpsnooping binding

Syntax
show dhcpsnooping port port-string

Parameters
port-string Specifies the port or ports for which to display configuration
information.

Defaults
None.

Mode
Switch command, read-write.

Usage
This command displays the trust state and rate limiting parameters configured on the specified
ports.

Example
This example shows the output of the show dhcpsnooping port command.
A4(su)->show dhcpsnooping port ge.1.1
Interface Trust State Rate Limit Burst Interval
(pps) (seconds)
---------- ------------- ------------- ---------------
ge.1.1 No 20 2

show dhcpsnooping binding

Use this command to display the contents of the DHCP snooping bindings database.

Syntax
show dhcpsnooping binding [dynamic | static] [port port-string] [vlan vlan-id]

Parameters
dynamic | static (Optional) Limits the display of bindings in the database by type of
entry, either dynamic or static.
port port-string (Optional) Limits the display of bindings in the database by port.
vlan vlan-id (Optional) Limits the display of bindings in the database by VLAN id.

Defaults
If no parameters are entered, all bindings in the database are displayed.

Mode
Switch command, read-write.

Usage
This command displays information about the DHCP bindings in the DHCP snooping database.

22-8 DHCP Snooping and Dynamic ARP Inspection

 show dhcpsnooping statistics

Example
This example shows the output of the show dhcpsnooping binding command when no
parameters are entered.
A4(su)->show dhcpsnooping binding
Total number of bindings: 2

MAC Address IP Address VLAN Interface Type Lease (min)

----------------- --------------- ---- ----------- ------- -----------
00:02:B3:06:60:80 192.168.10.10 3 ge.1.1 STATIC
00:0F:FE:00:13:04 192.168.20.1 5 ge.1.30 DYNAMIC 1440

show dhcpsnooping statistics

Use this command to display DHCP snooping statistics for untrusted ports.

Syntax
show dhcpsnooping statistics

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Usage
The DHCP snooping application processes incoming DHCP messages on enabled untrusted
interfaces. For DHCP RELEASE and DHCP DECLINE messages, the application compares the
receive interface and VLAN with the client's interface and VLAN in the bindings database. If the
interfaces do not match, the application logs the event (if logging of invalid messages is enabled)
and drops the message. If source MAC verification is enabled, for valid client messages, DHCP
snooping compares the source MAC address to the DHCP client hardware address. Where there is
a mismatch, DHCP snooping logs and drops the packet.
This command displays, for each enabled untrusted interface, the number of source MAC
verification failures and client interface mismatches that occurred since the last time these
statistics were cleared.
Since DHCP servers should not be connected through an untrusted port, the DHCP snooping
application will drop incoming DHCP server messages on untrusted interfaces and increment a
counter that is displayed with this command.

Example
This example shows the output of the show dhcpsnooping statistics command.
A4(su)->show dhcpsnooping statistics
Interface MAC Verify Client Ifc DHCP Server
Failures Mismatch Msgs Rec'd
----------- ---------- ---------- -----------
ge.1.48 0 0 0

Extreme A4 CLI Reference 22-9

clear dhcpsnooping binding

lag.0.1 0 0 0

clear dhcpsnooping binding

Use this command to remove bindings from the DHCP snooping bindings database.

Syntax
clear dhcpsnooping binding [port port-string | mac mac-addr]

Parameters
port port-string (Optional) Specifies the entry or entries to remove by port identifier.
mac mac-addr (Optional) Specifies the entry to remove by MAC address.

Defaults
If no parameters are entered, all bindings (static and dynamic) are removed.

Mode
Switch command, read-write.

Example
This example clears the static binding entry that includes port ge.1.2.
A4(su)->clear dhcpsnooping binding port ge.1.2

clear dhcpsnooping statistics

Use this command to clear the DHCP snooping statistics counters.

Syntax
clear dhcpsnooping statistics

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example clears the DHCP snooping statistics counters for all enabled untrusted ports.
A4(su)->clear dhcpsnooping statistics

22-10 DHCP Snooping and Dynamic ARP Inspection

 clear dhcpsnooping limit

clear dhcpsnooping limit

Use this command to reset the rate limit values to the defaults of 15 packets per second with a
burst interval of 1 second.

Syntax
clear dhcpsnooping limit port-string

Parameters
port-string Specifies the port or ports to which this command applies.

Defaults
None.

Mode
Switch command, read-write.

Example
This example resets the rate limit values to their defaults on port ge.1.1.
A4(su)->clear dhcpsnooping limit ge.1.1

Dynamic ARP Inspection Commands

For information about... Refer to page...

set arpinspection vlan 22-12

set arpinspection trust 22-12

set arpinspection validate 22-13

set arpinspection limit 22-14

set arpinspection filter 22-15

show arpinspection access-list 22-16

show arpinspection ports 22-16

show arpinspection vlan 22-17

show arpinspection statistics 22-17

clear arpinspection validate 22-18

clear arpinspection vlan 22-19

clear arpinspection filter 22-20

clear arpinspection limit 22-21

clear arpinspection statistics 22-21

Extreme A4 CLI Reference 22-11

set arpinspection vlan

set arpinspection vlan

Use this command to enable dynamic ARP inspection on one or more VLANs, and optionally,
enable logging of invalid ARP packets.

Syntax
set arpinspection vlan vlan-range [logging]

Parameters
vlan-range Specifies the VLAN or range of VLANs on which to enable dynamic
ARP inspection.
logging (Optional) Enables logging of invalid ARP packets for that VLAN.

Defaults
Logging is disabled by default.

Mode
Switch command, read-write.

Usage
This command enables dynamic ARP inspection (DAI) on one or more VLANs. When DAI is
enabled on a VLAN, DAI is effectively enabled on the interfaces (physical ports or LAGs) that are
members of that VLAN.
DAI uses the DHCP snooping bindings database to verify that the sender MAC address and the
source IP address are a valid pair in the database. ARP packets whose sender MAC address and
sender IP address do not match an entry in the database are dropped.
If logging is enabled, invalid ARP packets are also logged.

Example
This example enables DAI on VLANs 2 through 5 and also enables logging of invalid ARP packets
on those VLANs.
A4(su)->set arpinspection vlan 2-5 logging

set arpinspection trust

Use this command to enable or disable a port as a dynamic ARP inspection trusted port.

Syntax
set arpinspection trust port port-string {enable | disable}

Parameters
port-string Specifies the port or ports to be enabled or disabled as DAI trusted
ports. The ports can be physical ports or LAGs that are members of a
VLAN.
enable | disable Enables or disables the specified ports as trusted for DAI.

22-12 DHCP Snooping and Dynamic ARP Inspection

 set arpinspection validate

Defaults
By default, all physical ports and LAGs are untrusted.

Mode
Switch command, read-write.

Usage
Individual interfaces are configured as trusted or untrusted. The trust configuration for DAI is
independent of the trust configuration for DHCP snooping. A trusted port is a port the network
administrator does not consider to be a security threat. An untrusted port is one which could
potentially be used to launch a network attack.
DAI considers all physical ports and LAGs untrusted by default. Packets arriving on trusted
interfaces bypass all DAI validation checks.

Example
This example enables port ge.1.1 as trusted for DAI.
A4(su)->set arpinspection trust port ge.1.1 enable

set arpinspection validate

Use this command to configure additional optional ARP validation parameters.

Syntax
set arpinspection validate {[src-mac] [dst-mac] [ip]}

Parameters
src-mac Specifies that DAI should verify that the sender MAC address equals
the source MAC address in the Ethernet header.
dst-mac Specifies that DAI should verify that the target MAC address equals the
destination MAC address in the Ethernet header.
This check only applies to ARP responses, since the target MAC address
is unspecified in ARP requests.
ip Specifies that DAI should check the IP address and drop ARP packets
with an invalid address. An invalid address is one of the following:
• 0.0.0.0
• 255.255.255.255
• All IP multicast addresses
• All class E addresses (240.0.0.0/4)
• Loopback addresses (in the range 127.0.0.0/8)

Defaults
All parameters are optional, but at least one parameter must be specified.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 22-13

set arpinspection limit

Usage
This command adds additional validation of ARP packets by DAI, beyond the basic validation
that the ARP packet’s sender MAC address and sender IP address match an entry in the DHCP
snooping bindings database.

Example
This example adds the optional verification that sender MAC addresses are the same as the source
MAC addresses in the Ethernet headers of ARP packets.
A4(su)->set arpinspection validate src-mac

set arpinspection limit

Use this command to configure rate limiting parameters for incoming ARP packets on a port or
ports.

Syntax
set arpinspection limit port port-string {none | rate pps {burst interval secs]}

Parameters
port-string Specifies the port or ports to which to apply these rate limiting
parameters.
none Configures no limit on incoming ARP packets.
rate pps Specifies a rate limit in packets per second. The value of pps can range
from 0 to 50 packets per second.
burst interval secs Specifies a burst interval in seconds. The value of secs can range from 1
to 15 seconds.

Defaults
Rate = 15 packets per second
Burst Interval = 1 second

Mode
Switch command, read-write.

Usage
To protect the switch against DHCP attacks when DAI is enabled, the DAI application enforces a
rate limit for ARP packets received on untrusted interfaces. DAI monitors the receive rate on each
interface separately. If the receive rate exceeds the limit configured with this command, DAI
disables the interface, which effectively brings down the interface. You can use the set port enable
command to reenable the port.
You can configure both the rate and the burst interval. The default rate is 15 pps on each untrusted
interface with a range of 0 to 50 pps. The default burst interval is 1 second with a range to 1 to 15
seconds.. The rate limit cannot be set on trusted interfaces since ARP packets received on trusted
interfaces do not come to the CPU.

22-14 DHCP Snooping and Dynamic ARP Inspection

 set arpinspection filter

Example
This example sets the rate to 20 packets per second and the burst interval to 2 seconds on ports
ge.1.1 and ge.1.2.
A4(su)->set arpinspection limit port ge.1.1-2 rate 20 burst interval 2

set arpinspection filter

Use this command to create an ARP ACL and then to assign an ACL to a VLAN, optionally as a
static mapping.

Syntax
set arpinspection filter name {permit ip host sender-ipaddr mac host
sender-macaddr | vlan vlan-range [static]}

Parameters
name Specifies the name of the ARP ACL.
permit Specifies that a permit rule is being created.
ip host sender-ipaddr Specifies the IP address in the rule being created.
mac host Specifies the MAC address in the rule being created.
sender-macaddr
vlan vlan-range Specifies the VLAN or VLANs to which this ARP ACL is assigned.
static (Optional) Specifies that this ARP ACL configures static mappings for
the VLAN or VLANs.

Defaults
None.

Mode
Switch command, read-write.

Usage
ARP ACLs are used to define static mappings for DAI. ARP ACLs are completely independent of
ACLs used for QoS. A maximum of 100 ARP ACLs can be configured. Within an ACL, a
maximum of 20 rules can be configured.
A static mapping associates an IP address to a MAC address on a VLAN. DAI consults its static
mappings before it consults the DHCP snooping bindings database — thus, static mappings have
precedence over DHCP snooping bindings.

Example
This example creates an ACL named staticARP and creates a permit rule for IP address
192.168.1.10. Then, the ACL is assigned to a VLAN as a static mapping.
A4(su)->set arpinspection filter staticARP permit ip host 192.168.1.10 mac host
00:01:22:33:44:55
A4(su)->set arpinspection filter staticARP vlan 10 static

Extreme A4 CLI Reference 22-15

show arpinspection access-list

show arpinspection access-list

Use this command to display ARP access list configuration information.

Syntax
show arpinspection access-list [acl-name]

Parameters
acl-name (Optional) Specifies the ARP ACL to display.

Defaults
If a specific ACL is not specified, information about all configured ARP ACLs is displayed.

Mode
Switch command, read-write.

Example
This example displays information about the ARP ACL named staticARP.
A4(su)->show arpinspection access-list staticARP
ARP access list staticARP
permit ip host 192.168.1.10 mac host 00:01:22:33:44:55
permit ip host 192.168.1.20 mac host 00:0A:11:22:33:66

show arpinspection ports

Use this command to display the ARP configuration of one or more ports.

Syntax
show arpinspection ports [port-string]

Parameters
port-string (Optional) Specifies the port or ports for which to display ARP
configuration information.

Defaults
If a port-string is not specified, information about all DAI-enabled untrusted ports is displayed.

Mode
Switch command, read-write.

Example
This example displays the ARP configuration of lag.0.1.
A4(su)->show arpinspection ports lag.0.1
Interface Trust State Rate Limit Burst Interval
(pps) (seconds)
---------- ------------- ------------- ---------------
lag.0.1 No 15 1

22-16 DHCP Snooping and Dynamic ARP Inspection

 show arpinspection vlan

show arpinspection vlan

Use this command to display the ARP configuration of one or more VLANs.

Syntax
show arpinspection vlan vlan-range

Parameters
vlan-range Specifies the VLANs for which to display configuration information.

Defaults
None.

Mode
Switch command, read-write.

Example
This example displays ARP configuration information for VLAN 5.
A4(su)->show arpinspection vlan 5
Source MAC Validation Disabled
Destination MAC Validation Disabled
IP Address Validation Disabled

Vlan Configuration Log Invalid ACL Name Static flag

---- ------------- ----------- -------------------------------- -----------
5 Disabled Enabled staticARP Enabled

show arpinspection statistics

Use this command to display ARP statistics for all DAI-enabled VLANs or for specific VLANs.

Syntax
show arpinspection statistics [vlan vlan-range]

Parameters
vlan vlan-range (Optional) Specifies the VLANs for which to display statistics.

Defaults
If no VLANs are specified, limited statistics for all DAI-enabled VLANs is displayed.

Mode
Switch command, read-write.

Usage
When no specific VLANs are entered, this command displays the number of Forwarded and
Dropped ARP packets per DAI-enabled VLAN. When one or more VLANs are specified, this
command displays more detailed statistics.

Extreme A4 CLI Reference 22-17

clear arpinspection validate

Examples
This example shows what is displayed when no VLANs are specified.
A4(su)->show arpinspection statistics
VLAN Forwarded Dropped
---- ------------ ---------
5 0 0
This example shows what information is displayed when one or more VLANs are specified.
A4(su)->show arpinspection statistics vlan 5
VLAN DHCP ACL DHCP ACL Bad Src Bad Dest Invalid
Drops Drops Permits Permits MAC MAC IP
---- ---------- ---------- ---------- ---------- ---------- ---------- ---------
5 0 0 0 0 0 0 0

clear arpinspection validate

Use this command to remove additional optional ARP validation parameters that were previously
configured.

Syntax
clear arpinspection validate {[src-mac] [dst-mac] [ip]}

Parameters
src-mac Clear, or remove, the verification that the sender MAC address equals
the source MAC address in the Ethernet header.
dst-mac Clear, or remove, the verification that the target MAC address equals
the destination MAC address in the Ethernet header.
ip Clear, or remove, checking the IP address and dropping ARP packets
with an invalid address.

Defaults
All parameters are optional, but at least one parameter must be specified.

Mode
Switch command, read-write.

Usage
This command removes previously configured additional validation of ARP packets by DAI,
beyond the basic validation that the ARP packet’s sender MAC address and sender IP address
match an entry in the DHCP snooping bindings database.
Use the show arpinspection vlan command to display the current status of the additional
validation rules.

Example
This example removes all 3 additional validation conditions.
A4(su)->clear arpinspection validate src-mac dst-mac ip

22-18 DHCP Snooping and Dynamic ARP Inspection

 clear arpinspection vlan

clear arpinspection vlan

Use this command to disable dynamic ARP inspection on one or more VLANs or to disable
logging of invalid ARP packets on one or more VLANs.

Syntax
clear arpinspection vlan vlan-range [logging]

Parameters
vlan-range Specifies the VLAN or range of VLANs on which to disable dynamic
ARP inspection.
logging (Optional) Disable logging of invalid ARP packets for the specified
VLANs.

Defaults
If logging is enabled for the specified VLAN but logging is not entered with this command,
logging will remain enabled.

Mode
Switch command, read-write.

Usage
You can use this command to disable dynamic ARP inspection on one or more VLANs, or you can
disable logging of invalid ARP packets on specified VLANs. To disable both logging and DAI, you
must enter this command twice.

Example
This example first displays the DAI configuration for VLAN 5, then disables DAI on VLAN 5, then
disables logging of invalid ARP packets on VLAN 5.
A4(su)->show arpinspection vlan 5
Source MAC Validation Disabled
Destination MAC Validation Disabled
IP Address Validation Disabled

Vlan Configuration Log Invalid ACL Name Static flag

---- ------------- ----------- -------------------------------- -----------
5 Enabled Enabled staticARP Enabled

A4(su)->clear arpinspection vlan 5

A4(su)->show arpinspection vlan 5

Source MAC Validation Disabled
Destination MAC Validation Disabled
IP Address Validation Disabled

Vlan Configuration Log Invalid ACL Name Static flag

---- ------------- ----------- -------------------------------- -----------
5 Disabled Enabled staticARP Enabled

A4(su)->clear arpinspection vlan 5 logging

A4(su)->show arpinspection vlan 5
Source MAC Validation Disabled

Extreme A4 CLI Reference 22-19

clear arpinspection filter

Destination MAC Validation Disabled

IP Address Validation Disabled

Vlan Configuration Log Invalid ACL Name Static flag

---- ------------- ----------- -------------------------------- -----------
5 Disabled Disabled staticARP Enabled

clear arpinspection filter

Use this command to remove an ARP ACL from a VLAN or from the switch, or to remove a
permit rule from an existing ACL, or to change the status of static mapping to disabled.

Syntax
clear arpinspection filter name [permit ip host sender-ipaddr mac host
sender-macaddr] | [vlan vlan-range [static]

Parameters
name Specifies the name of the ARP ACL.
permit (Optional) Specifies that a permit rule is being deleted.
ip host sender-ipaddr Specifies the IP address in the rule being deleted.
mac host Specifies the MAC address in the rule being deleted.
sender-macaddr
vlan vlan-range (Optional) Specifies the VLAN or VLANs to which this command
should apply. Remove the ACL from the VLAN, if static is not specified
also.
static (Optional) Specifies that static mapping should be disabled for this ARP
ACL for the specified VLAN or VLANs.

Defaults
If only the name is specified, the ACL is deleted from the switch.

Mode
Switch command, read-write.

Usage
You can use this command to:
• Remove a configured ARP ACL from the switch, or
• Remove a permit rule from a configured ARP ACL, or
• Remove the association of an ARP ACL with a VLAN or VLANs, or
• Disable static mapping of an ARP ACL associated with a VLAN or VLANs.
Use the set arpinspection filter command to create and assign an ARP ACL.
Use the show arpinspection access-list command to display currently configured ARP ACLs.

Examples
This example removes a permit rule from the ARP ACL named staticARP.

22-20 DHCP Snooping and Dynamic ARP Inspection

 clear arpinspection limit

A4(su)->clear arpinspection filter staticARP permit ip host 192.168.1.10 mac host

00:01:22:33:44:55

This example disables static mapping of the ARP ACL named staticARP that is associated with
VLAN 5.
A4(su)->clear arpinspection filter staticARP vlan 5 static

This example removes the ARP ACL named staticARP from VLAN 5.
A4(su)->clear arpinspection filter staticARP vlan 5

This example removes the ARP ACL named staticARP from the switch completely.
A4(su)->clear arpinspection filter staticARP

clear arpinspection limit

Use this command to return the DAI rate limiting values to their default values for a port or range
of ports.

Syntax
clear arpinspection limit port port-string

Parameters
port-string Specifies the ports on which to return the rate limiting values to
defaults.

Defaults
Rate = 15 packets per second
Burst Interval = 1 second

Mode
Switch mode, read-write.

Usage
Use the set arpinspection limit command to change the values of the rate limit and burst interval.
Use the show arpinspection ports command to display the currently configured rate limits.

Example
This example returns the DAI rate limiting values to their defaults for port ge.1.1.
A4(su)->clear arpinspection limit port ge.1.1

clear arpinspection statistics

Use this command to clear all dynamic ARP inspection statistics.

Syntax
clear arpinspection statistics

Extreme A4 CLI Reference 22-21

clear arpinspection statistics

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example clears all DAI statistics from the switch.
A4(su)->clear arpinspection statistics

22-22 DHCP Snooping and Dynamic ARP Inspection

 23
IP Configuration

This chapter describes the Internet Protocol (IP) configuration set of commands and how to use
them.

Router: Unless otherwise noted, the commands covered in this chapter can be executed only
when the device is in router mode. For details on how to enable router configuration modes, refer
to Chapter 20, “IP Configuration,” in the Fixed Switching Configuration Guide.

For information about... Refer to page...

Configuring Routing Interface Settings 23-1

Reviewing and Configuring the ARP Table 23-8

Configuring Broadcast Settings 23-12

Reviewing IP Traffic and Configuring Routes 23-15

Configuring ICMP Redirects 23-18

Configuring Routing Interface Settings

Use the following commands to enable routing interface configuration mode on the device, to
create routing interfaces, to review the usability status of interfaces configured for IP, to set IP
addresses for interfaces, to enable interfaces for IP routing at device startup, and to review the
running configuration.

For information about... Refer to page...

show interface 23-2

interface 23-2

show ip interface 23-4

ip address 23-5

no shutdown 23-6

no ip routing 23-6

show running-config 23-7

Extreme A4 CLI Reference 23-1

show interface

show interface
Use this command to display information about one or more interfaces (VLANs or loopbacks)
configured on the router.

Syntax
show interface [vlan vlan-id] [loopback loop-id]

Parameters
vlan vlan-id (Optional) Displays interface information for a specific VLAN interface.
This interface must be configured for IP routing.
loopback loop-id (Optional) Displays interface information for a specific loopback interface.

Defaults
If interface type is not specified, information for all routing interfaces will be displayed.

Mode
Any router mode.

Examples
This example shows how to display information for all interfaces configured on the router. For a
detailed description of this output, refer to Table 23-1:
A4(su)->router#show interface
Vlan 1 is Administratively DOWN
Vlan 1 is Operationally DOWN
Internet Address is 10.10.1.1 , Subnet Mask is 255.255.255.0
Mac Address is: 001F.4554.EAA5
The name of this device is Vlan 1
The MTU is 1500 bytes
The bandwidth is 0 Mb/s
Encapsulation type Ethernet
ARP Timeout: 14400 seconds
This example shows how to display information for loopback interface 1.
A4(su)->router#show interface loopback 1

Loopback 1 is Administratively UP
Loopback 1 is Operationally UP
Internet Address is 10.1.192.100, Subnet Mask is 255.255.255.0
The name of this device is Loopback 1
The MTU is 1500 bytes

interface
Use this command to configure interfaces for IP routing.

Syntax
interface vlan vlan-id | loopback loop-id

23-2 IP Configuration
 interface

Parameters
vlan vlan-id Specifies the number of the VLAN interface to be configured for routing.
This interface must be configured for IP routing.
loopback loop-id Specifies the number of the loopback interface to be configured for routing.
The value of loop-id can range from 0 to 7.

Defaults
None.

Mode
Router global configuration mode: A4(su)->router(Config)#

Usage
This command enables interface configuration mode from global configuration mode, and, if the
interface has not previously been created, this command creates a new routing interface. For
details on configuration modes supported by the A4 device and their uses, refer to Chapter 20, “IP
Configuration,” in the Fixed Switching Configuration Guide.
VLANs must be created from the switch CLI before they can be configured for IP routing. For
details on creating VLANs, refer to Chapter 12, 802.1Q VLAN Configuration.
Each VLAN interface must be configured for routing separately using the interface command. To
end configuration on one interface before configuring another, type exit at the command prompt.
Enabling interface configuration mode is required for completing interface-specific configuration
tasks. For an example of how these commands are used, refer to Chapter 20, “IP Configuration,”
in the Fixed Switching Configuration Guide.
A loopback interface is always expected to be up. This interface can provide the source address for
sent packets and can receive both local and remote packets. The loopback interface is typically
used by routing protocols, but it can also be used for management or network services such as
RADIUS, SNMP, Syslog, SNTP, or sFlow. By default, if RADIUS is configured with no host IP
address on the device, it will use the loopback interface 0 IP address (if it has been configured) as
its source for the NAS-IP attribute. (Administrators can assign where to source management or
network service IP packets via the set interface commands.)
Each A4 system (stack) can support up to 24 routing interfaces. Each interface can be configured
for the RIP routing protocol.

Examples
This example shows how to enter configuration mode for VLAN 1:
A4(su)->router#configure
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#
This example shows how to enter configuration mode for loopback 1:
A4(su)->router#configure
A4(su)->router(Config)#interface loopback 1
A4(su)->router(Config-if(Lpbk 1))#

Extreme A4 CLI Reference 23-3

show ip interface

show ip interface
Use this command to display information, including administrative status, IP address, MTU
(Maximum Transmission Unit) size and bandwidth, and ACL configurations, for interfaces
configured for IP.

Syntax
show ip interface [vlan vlan-id] [loopback loop-id]

Parameters
vlan vlan-id (Optional) Displays information for a specific VLAN interface. This
interface must be configured for IP routing.
loopback loop-id (Optional) Displays interface information for a specific loopback interface.

Defaults
If interface type is not specified, status information for all routing interfaces will be displayed.

Mode
Any router mode.

Examples
This example shows how to display configuration information for VLAN 1:
A4(su)->router#show ip interface vlan 1

Vlan 1 is Admin DOWN

Vlan 1 is Oper DOWN
Primary IP Address is 192.168.10.1 Mask 255.255.255.0
Frame Type Ethernet
MAC-Address 0001.F45C.C993
Incoming Accesslist is not set
MTU is 6145 bytes
ARP Timeout is 1 seconds
Direct Broadcast Disabled
Proxy ARP is Disabled
Table 23-1 provides an explanation of the command output.

Table 23-1 show ip interface Output Details

Output Field What It Displays...

Vlan N Whether the interface is administratively and operationally up or down.

Primary IP Address Inteface’s primary IP address and mask. Set using the ip address command as
described in “ip address” on page 23-5.

Frame Type Encapsulation type used by this interface. Set using the arp command as described
in “arp” on page 23-9.

MAC-Address MAC address mapped to this interface.

Incoming Access Whether or not an access control list (ACL) has been configured for ingress on this
List interface using the commands described in Chapter 29, Configuring Access
Control Lists.

MTU Interface’s Maximum Transmission Unit size.

23-4 IP Configuration
 ip address

Table 23-1 show ip interface Output Details (Continued)

Output Field What It Displays...
ARP Timeout Duration for entries to stay in the ARP table before expiring. Set using the arp
timeout command as described in “arp timeout” on page 23-11.

Direct Broadcast Whether or not IP directed broadcast is enabled. Set using the ip directed-broadcast
command described in “ip directed-broadcast” on page 23-12.

Proxy Arp Whether or not proxy ARP is enabled or disabled for this interface. Set using the ip
proxy arp command as described in “ip proxy-arp” on page 23-10.

This example shows the output for a loopback interface.

A4(su)->router#show ip interface loopback 2

Loopback 2 is Admin UP
Loopback 2 is Oper DOWN
Primary IP Address is 10.10.10.10 Mask 255.255.255.0

ip address
Use this command to set, remove, or disable a primary or secondary IP address for an interface.
The no form of this command removes the specified IP address and disables the interface for IP
processing.

Syntax
ip address ip-address ip-mask [secondary]
no ip address ip-address ip-mask

Parameters
ip-address Specifies the IP address of the interface to be added or removed.
ip-mask Specifies the mask for the associated IP subnet.
secondary (Optional) Specifies that the configured IP address is a secondary address.

Defaults
If secondary is not specified, the configured address will be the primary address for the interface.

Mode
Router interface configuration: A4(su)->router(Config-if(Vlan 1))#

Usage
Refer to the Router Capacities table in the Release Notes for this product for the number of
primary and secondary IP interfaces supported by this product.

Example
This example sets the IP address to 192.168.1.1 and the network mask to 255.255.255.0 for VLAN 1:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip address 192.168.1.1 255.255.255.0

Extreme A4 CLI Reference 23-5

no shutdown

no shutdown
Use this command to enable an interface for IP routing and to allow the interface to automatically
be enabled at device startup.

Syntax
no shutdown
shutdown

Parameters
None.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Usage
The shutdown form of this command disables an interface for IP routing.

Example
This example shows how to enable VLAN 1 for IP routing:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#no shutdown

no ip routing
Use this command to disable IP routing on the device. By default, IP routing is enabled when
interfaces are configured for it as described in Chapter 20, “IP Configuration,” in the Fixed
Switching Configuration Guide.

Syntax
no ip routing

Parameters
None.

Mode
Global configuration: A4(su)->router(Config)#

Defaults
None.

Example
This example shows how to disable IP routing on the device:
A4(su)->router(Config)#no ip routing

23-6 IP Configuration
 show running-config

show running-config
Use this command to display the non-default, user-supplied commands entered while configuring
the device.

Syntax
show running-config

Parameters
None.

Defaults
None.

Mode
Any router mode.

Example
This example shows how to display the current router operating configuration:
A4(su)->router#show running-config
!
interface vlan 1
interface vlan 10
ip address 192.168.2.10 255.255.255.0
no shutdown
!

Extreme A4 CLI Reference 23-7

Reviewing and Configuring the ARP Table

Reviewing and Configuring the ARP Table

Use the following commands to review and configure the routing ARP table, to enable proxy ARP
on an interface, and to set a MAC address on an interface.

For information about... Refer to page...

show ip arp 23-8

arp 23-9

ip proxy-arp 23-10

arp timeout 23-11

clear arp-cache 23-11

show ip arp
Use this command to display entries in the ARP (Address Resolution Protocol) table. ARP
converts an IP address into a physical address.

Syntax
show ip arp [ip-address]|[vlan vlan-id]|[output-modifier]

Parameters
ip-address (Optional) Displays ARP entries related to a specific IP address.
vlan vlan-id (Optional) Displays only ARP entries learned through a specific VLAN
interface. This VLAN must be configured for IP routing.
output-modifier (Optional) Displays ARP entries within a specific range. Options are:
– | begin ip-address — Displays only ARP entries that begin with the
specified IP address.
– | exclude ip-address — Excludes ARP entries matching the specified
IP address.
– | include ip-address — Includes ARP entries matching the specified
IP address.

Defaults
If no parameters are specified, all entries in the ARP cache will be displayed.

Mode
Any router mode.

Example
This example shows how to use the show ip arp command:
A4(su)->router#show ip arp
Protocol Address Age (min) Hardware Addr Interface
------------------------------------------------------------------------------
Internet 134.141.235.251 0 0003.4712.7a99 Vlan1

23-8 IP Configuration
 arp

Internet 134.141.235.165 - 0002.1664.a5b3 Vlan1

Internet 134.141.235.167 4 00d0.cf00.4b74 Vlan2

A4(su)->router#show ip arp 134.141.235.165

Protocol Address Age (min) Hardware Addr Interface
------------------------------------------------------------------------------
Internet 134.141.235.165 - 0002.1664.a5b3 Vlan2

A4(su)->router#show ip arp vlan 2

Protocol Address Age (min) Hardware Addr Interface
------------------------------------------------------------------------------
Internet 134.141.235.251 0 0003.4712.7a99 Vlan2
Table 23-2 provides an explanation of the command output.

Table 23-2 show ip arp Output Details

Output Field What It Displays...

Protocol ARP entry’s type of network address.

Address Network address mapped to the entry’s MAC address.

Age (min) Interval (in minutes) since the entry was entered in the table.

Hardware Addr MAC address mapped to the entry’s network address.

Interface Interface (VLAN or loopback) through which the entry was learned.

arp
Use this command to add or remove permanent (static) ARP table entries. A multicast MAC
address can be used in a static ARP entry. The no form of this command removes the specified
permanent ARP entry:

Syntax
arp ip-address mac-address
no arp ip-address

Parameters
ip-address Specifies the IP address of a device on the network. Valid values are IP
addresses in dotted decimal notation.
mac-address Specifies the 48-bit hardware address corresponding to the ip-address
expressed in hexadecimal notation.

Defaults
None.

Mode
Global configuration: A4(su)->router(Config)#

Extreme A4 CLI Reference 23-9

ip proxy-arp

Usage
The IP address specified for the static ARP entry must fall within one of the subnets or networks
defined on the routed interfaces of the system ( or stack, if applicable). The system can then match
the IP address of the static ARP entry with the appropriate routed interface and associate it with
the correct VLAN.
Refer to the Router Capacities table in the Release Notes for this product for a listing of the
number of static ARP entries supported by this product.

Example
This example shows how to add a permanent ARP entry for the IP address 130.2.3.1 and MAC
address 0003.4712.7a99:
A4(su)->router(Config)#arp 130.2.3.1 0003.4712.7a99

ip proxy-arp
Use this command to enable proxy ARP on an interface. The no form of this command disables
proxy ARP.

Syntax
ip proxy-arp
no ip proxy-arp

Parameters
None.

Defaults
Disabled.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Usage
This variation of the ARP protocol allows the router to send an ARP response on behalf of an end
node to the requesting host. Proxy ARP can be used to resolve routing issues on end stations that
are unable to route in the subnetted environment. The A4 will answer to ARP requests on behalf
of targeted end stations on neighboring networks. It is disabled by default.

Example
This example shows how to enable proxy ARP on VLAN 1:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip proxy-arp

23-10 IP Configuration
 arp timeout

arp timeout
Use this command to set the duration (in seconds) for dynamically learned entries to remain in the
ARP table before expiring. The no form of this command restores the default value of 14,400
seconds.
arp timeout seconds
no arp timeout

Parameters
seconds Specifies the time in seconds that an entry remains in the ARP cache. Valid
values are 0 - 65535. A value of 0 specifies that ARP entries will never be
aged out.

Defaults
14,400 seconds.

Mode
Global configuration: A4(su)->router(Config)#

Example
This example shows how to set the ARP timeout to 7200 seconds:
A4(su)->router(Config)#arp timeout 7200

clear arp-cache
Use this command to delete all nonstatic (dynamic) entries from the ARP table.
clear arp-cache

Parameters
None.

Mode
Privileged EXEC: A4(su)->router#

Defaults
None.

Example
This example shows how to delete all dynamic entries from the ARP table:
A4(su)->router#clear arp-cache

Extreme A4 CLI Reference 23-11

Configuring Broadcast Settings

Configuring Broadcast Settings

Use the following commands to configure IP broadcast settings. By default, interfaces on the A4
do not forward broadcast packets.

For information about... Refer to page...

ip directed-broadcast 23-12

ip forward-protocol 23-13

ip helper-address 23-14

ip directed-broadcast
Use this command to enable or disable IP directed broadcasts on an interface. By default,
interfaces on the A4 do not forward directed broadcasts. The no form of this command disables IP
directed broadcast on the interface.

Syntax
ip directed-broadcast
no ip directed-broadcast

Parameters
None.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Usage
Directed broadcast is an efficient mechanism for communicating with multiple hosts on a network
while only transmitting a single datagram. A directed broadcast is a packet sent to all hosts on a
specific network or subnet. The directed broadcast address includes the network or subnet fields,
with the binary bits of the host portion of the address set to one. For example, for a network with
the address 192.168.0.0/16, the directed broadcast address would be 192.168.255.255. For a subnet
with the address 192.168.12.0/24, the directed broadcast address would be 192.168.12.255.
In order to minimize broadcast DoS attacks, forwarding of directed broadcasts is disabled by
default on the A4, as recommended by RFC 2644.
If the ability to send directed broadcasts to a network is required, you should enable directed
broadcasts only on the one interface that will be transmitting the datagrams. For example, if a A4
has five routed interfaces for the 10, 20, 30, 40, and 50 networks, enabling directed broadcast only
on the 30 network interface will allow anyone from any other networks (10, 20, 40, 50) to send
directed broadcast to the 30 network.

23-12 IP Configuration
 ip forward-protocol

Example
This example shows how to enable IP directed broadcasts on VLAN 1:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip directed-broadcast

ip forward-protocol
Use this command to enable UDP broadcast forwarding and specify which protocols will be
forwarded.

Syntax
ip forward-protocol udp [port]
no ip forward-protocol udp [port]

Parameters
udp Specifies UDP as the IP forwarding protocol.
port (Optional) Specifies a destination port that controls which UDP services
are forwarded.

Defaults
If port is not specified, the following defaults are used:

Port Number Protocol

0 Reserved

7 Echo

9 Discard

37 Time Service

42 EN-116 Name Service

49 TACACS Service

53 Domain Naming System

69 Trivial File Transfer Protocol (TFTP)

137 NetBIOS Name Server

138 NetBIOS Datagram Server

4011 Alternate Service Boot

Mode
Router command, Global configuration: A4(su)->router(Config)#
Router interface configuration: A4(su)->router(Config-if(Vlan 1)#

Usage
In order to actually forward protocols, you must configure an IP helper address on the individual
router interfaces with the command “ip helper-address” (page 23-14).

Extreme A4 CLI Reference 23-13

ip helper-address

If a certain service exists inside the node, and there is no need to forward the request to remote
networks, the “no” form of this command should be used to disable the forwarding for the specific
port. Such requests will not be automatically blocked from being forwarded just because a service
for them exists in the node.
The no form of this command removes a UDP port or protocol, disabling forwarding.

Examples
The following example globally disables IP forwarding for UDP port 69.
A4(su)->router(Config)#no ip forward-protocol udp 69
The following example disables IP forwarding for UDP port 69 on a specific interface.
A4(su)->router(Config)#interface vlan 10
A4(su)->router(Config-if(Vlan 10))#no ip forward-protocol udp 69

ip helper-address
Use this command to enable the DHCP/BOOTP relay agent on a A4 routed interface and/or to
forward broadcast traffic identified with the ip forward-protocol command to a unicast address.
Enabling the relay agent allows forwarding of client DHCP/BOOTP requests to a DHCP/BOOTP
server that does not reside on the same broadcast domain as the client. Up to 6 IP helper addresses
may be configured per interface.
The no form of this command disables the forwarding of UDP datagrams to the specified address.

Syntax
ip helper-address address
no ip helper-address address

Parameters
address Address of the host where UDP broadcast packets should be forwarded.

Defaults
None.

Mode
Interface configuration: A4(su)->Router1(Config-if(Vlan 1))#

Usage
Typically for DHCP/BootP, when a host requests an IP address, it sends out a DHCP broadcast
packet. Normally, the router drops all broadcast packets. However, by executing this command,
you enable the routed interface to pass DHCP broadcast frames through, sending them directly to
the remote DHCP server’s IP address.
The DHCP/BOOTP relay agent will detect DHCP/BOOTP requests based on UDP source and
destination ports. It will then make the necessary changes to the packet and send the packet to the
DHCP server. The changes include:
• Replacing the destination IP address with the address of the DHCP server,
• Replacing the source IP address with its own address (that is, the IP address of the local
routed interface), and

23-14 IP Configuration
 Reviewing IP Traffic and Configuring Routes

• Within the BOOTP part of the packet, changing the Relay Agent IP address from 0.0.0.0 to the
address of the local routed interface.
The last change to the BootP packet “tells” the DHCP server that it needs to assign an IP address
that is in the same subnet as the Relay Agent IP. When the response comes from the server, the
DHCP/BOOTP relay agent sends it to the host.
For other protocols specified through the ip forward-protocol command, the system forwards
broadcast UDP traffic as a unicast packet to the specified IP addresses.

Example
This example show how to have all client DHCP requests for users in VLAN 1 to be forwarded to
the remote DHCP server with IP address 192.168.1.28.
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip helper-address 192.168.1.28

Reviewing IP Traffic and Configuring Routes

Use the following commands to review IP traffic and configure routes, to send router ICMP (ping)
messages, and to execute traceroute.

For information about... Refer to page...

show ip route 23-15

ip route 23-16

ping 23-17

traceroute 23-17

show ip route
Use this command to display information about IP routes.

Syntax
show ip route [destination-prefix | connected | rip | static | summary]

Parameters
destination-prefix (Optional) Displays any routes that match the prefix.
connected (Optional) Displays connected routes.
rip (Optional) Displays routes configured for the RIP routing protocol. For
details on configuring RIP, refer to “Configuring RIP” on page 24-1.
static (Optional) Displays static routes.
summary (Optional) Displays a summary of the IP routing table.

Defaults
If no parameters are specified, all IP route information will be displayed.

Mode
Any router mode.

Extreme A4 CLI Reference 23-15

ip route

Usage
The routing table contains all active static routes, all the RIP routes, learned for each network.

Example
This example shows how to use the show ip route command to display all IP route information. A
portion of the output is shown:
A4(su)->router#show ip route
Codes: C - connected, S - static, R - RIP, O - OSPF, IA - OSPF interarea
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
E - EGP, i - IS-IS, L1 - IS-IS level-1, LS - IS-IS level-2
* - candidate default, U - per user static route

R 1.1.1.0/24 [120/2] via 19.0.0.2, Vlan 3803

R 1.2.3.0/24 [120/2] via 19.0.0.2, Vlan 3803
R 1.3.4.0/24 [120/2] via 19.0.0.2, Vlan 3803
R 5.0.0.0/25 [120/2] via 19.0.0.2, Vlan 3803
C 19.0.0.0/30 [0/1] directly connected, Vlan 3803
R 21.21.21.0/30 [120/2] via 19.0.0.2, Vlan 3803
R 24.24.24.0/24 [120/2] via 19.0.0.2, Vlan 3803
R 27.27.27.0/24 [120/2] via 19.0.0.2, Vlan 3803
R 33.9.8.0/28 [120/2] via 19.0.0.2, Vlan 3803
R 34.0.10.192/26 [120/2] via 19.0.0.2, Vlan 3803
R 34.0.11.192/26 [120/2] via 19.0.0.2, Vlan 3803
R 34.0.16.192/26 [120/2] via 19.0.0.2, Vlan 3803
R 34.0.17.192/26 [120/2] via 19.0.0.2, Vlan 3803
R 37.37.37.0/24 [120/2] via 19.0.0.2, Vlan 3803
R 40.1.1.0/24 [120/2] via 19.0.0.2, Vlan 3803
R 50.0.0.0/29 [120/2] via 19.0.0.2, Vlan 3803
R 50.1.1.0/24 [120/2] via 19.0.0.2, Vlan 3803

ip route
Use this command to add or remove a static IP route. The no form of this command removes the
static IP route.
ip route dest-prefix dest-prefix-mask forwarding-rtr-addr [distance]
no ip route dest-prefix dest-prefix-mask forwarding-rtr-addr

Parameters
dest-prefix Specifies a destination IP address prefix.
dest-prefix-mask Specifies a destination prefix mask.
forwarding-rtr-addr Specifies a forwarding (gateway) IP address.
distance (Optional) Specifies an administrative distance metric for this route. Valid
values are 1 (default) to 255. Routes with lower values receive higher
preference in route selection.

Defaults
If distance is not specified, the default value of 1 will be applied.

23-16 IP Configuration
 ping

Mode
Global configuration: A4(su)->router(Config)#

Example
This example shows how to set IP address 10.1.2.3 as the next hop gateway to destination address
10.0.0.0:
A4(su)->router(Config)#ip route 10.0.0.0 255.0.0.0 10.1.2.3

ping
Use this command to test routing network connectivity by sending IP ping requests.

Syntax
ping ip-address

Parameters
ip-address Specifies the IP address of the system to ping.

Defaults
None.

Mode
Privileged EXEC: A4(su)->router#

Usage
This command is also available in switch mode.

Examples
This example shows output from a successful ping to IP address 182.127.63.23:
A4(su)->router#ping 182.127.63.23
182.127.63.23 is alive
This example shows output from an unsuccessful ping to IP address 182.127.63.24:
A4(su)->router#ping 182.127.63.24
no answer from 182.127.63.24

traceroute
Use this command to display a hop-by-hop path through an IP network from the device to a
specific destination host. Three ICMP probes will be transmitted for each hop between the source
and the traceroute destination.

Syntax
traceroute host

Extreme A4 CLI Reference 23-17

Configuring ICMP Redirects

Parameters
host Specifies a host to which the route of an IP packet will be traced.

Defaults
None.

Mode
Privileged EXEC: A4(su)->router#

Usage
There is also a traceroute command available in switch mode.

Example
This example shows how to use traceroute to display a round trip path to host 192.141.90.183.
A4(su)->router#traceroute 192.141.90.183
Traceroute to 192.141.90.183, 30 hops max, 40 byte packets
1 10.1.56.1 0.000 ms 0.000 ms 0.000 ms
2 10.1.48.254 10.000 ms 0.000 ms 0.000 ms
3 10.1.0.2 0.000 ms 0.000 ms 0.000 ms
4 192.141.89.17 0.000 ms 0.000 ms 10.000 ms
5 192.141.100.13 0.000 ms 10.000 ms 0.000 ms
6 192.141.100.6 0.000 ms 0.000 ms 10.000 ms
7 192.141.90.183 0.000 ms 0.000 ms 0.000 ms

Configuring ICMP Redirects

Disable or enable sending ICMP redirect packets to the switch CPU for processing at an interface
level. By default, sending ICMP redirects is enabled on all interfaces. Disabling sending ICMP
redirects can reduce CPU usage in certain deployments.

For information about... Refer to page...

ip icmp redirect enable 23-18

show ip icmp redirect 23-19

ip icmp redirect enable

Use this command to enable or disable sending ICMP redirects to the CPU for processing on a
specific interface. The no form of this command disables sending ICMP redirects to the CPU.

Syntax
ip icmp redirect enable
no ip icmp redirect enable

Parameters
None.

23-18 IP Configuration
 show ip icmp redirect

Defaults
By default, sending ICMP redirects to the CPU is enabled on all interfaces.

Mode
Interface configuration mode: A4(su)->Router1(Config-if(Vlan 1))#

Usage
You can use this command in router interface configuration mode to enable or disable sending
ICMP redirects only on specific interfaces.

Examples
This example disables sending ICMP redirects on the interface VLAN 5.
A4(su)->router#configure
A4(su)->router(Config)#interface vlan 5
A4(su)->Router1(Config-if(Vlan 5))# no ip icmp redirect enable

show ip icmp redirect

Use this command to display the status of sending ICMP redirects at interface level.

Syntax
show ip icmp redirect {interface [vlan vlan-id]}

Parameters
interface Display ICMP redirect status for interfaces.
vlan vlan-id (Optional) Display ICMP redirect status for the specified VLAN.

Defaults
If no VLAN is specified with the interface parameter, information for all VLAN interfaces is
displayed.

Mode
Privileged EXEC mode:A4(su)->router#
Router global configuration mode: A4(su)->router(Config)#

Examples
This example displays the ICMP redirect status for VLAN 5.
A4(su)->router#show ip icmp redirect interface vlan 5
Vlan Id Admin Status
------- ------------
5 Enabled

Extreme A4 CLI Reference 23-19

show ip icmp redirect

23-20 IP Configuration
 24
IPv4 Basic Routing Protocol Configuration

This chapter describes how to use the commands for the IPv4 basic routing protocols. These
routing protocols do not require an advanced routing license.

Router: The commands covered in this chapter can be executed only when the device is in router
mode. For details on how to enable router configuration modes, refer to Chapter 20, “IP
Configuration,” in the Fixed Switching Configuration Guide.

For information about... Refer to page...

Configuring RIP 24-1

Configuring IRDP 24-11

Note: The command prompts used in examples throughout this chapter show a system where the
VLAN 1 interface has been configured for routing. The prompt changes depending on your current
configuration mode, your specific device, and the interface types and numbers configured for
routing on your system.

Configuring RIP
For information about... Refer to page...

RIP Router Configuration Commands 24-1

RIP Interface Configuration Commands 24-7

RIP Router Configuration Commands

The following commands are used to enter RIP router configuration mode and to configure RIP
routing.

For information about... Refer to page...

router rip 24-2

distance 24-2

no auto-summary 24-3

split-horizon poison 24-4

passive-interface 24-4

receive-interface 24-5

redistribute 24-6

Extreme A4 CLI Reference 24-1

router rip

For information about... Refer to page...

default-information originate 24-6

router rip
Use this command to enable or disable RIP configuration mode. The no form of this command
disables RIP.

Syntax
router rip
no router rip

Parameters
None.

Defaults
None.

Mode
Global configuration: A4(su)->router(Config)#

Usage
You must execute the router rip command to enable the protocol before completing many RIP-
specific configuration tasks.

Example
This example shows how to enable RIP:
A4(su)->router#configure
A4(su)->router(Config)#router rip
A4(su)->router(Config-router)#

distance
Use this command to configure the administrative distance for RIP routes. The no form of this
command resets RIP administrative distance to the default value of 120.

Syntax
distance weight
no distance [weight]

Parameters
weight Specifies an administrative distance for RIP routes. Valid values are 1 - 255.

Defaults
None.

24-2 IPv4 Basic Routing Protocol Configuration

 no auto-summary

Mode
Router configuration: A4(su)->router(Config-router)#

Usage
If several routes (coming from different protocols) are presented to the A4, the protocol with the
lowest administrative distance will be chosen for route installation. By default, RIP administrative
distance is set to 120. The distance command can be used to change this value, resetting RIP’s
route preference in relation to other routes as shown in the table below.

Route Source Default Distance

Connected 0

Static 1

RIP 120

Example
This example shows how to change the default administrative distance for RIP to 100:
A4(su)->router(Config)#router rip
A4(su)->router(Config-router)#distance 100

no auto-summary
Use this command to disable automatic route summarization.

Syntax
no auto-summary
auto-summary

Parameters
None.

Defaults
None.

Mode
Router configuration: A4(su)->router(Config-router)#

Usage
By default, RIP version 2 supports automatic route summarization, which summarizes
subprefixes to the classful network boundary when crossing network boundaries. Disabling
automatic route summarization enables CIDR, allowing RIP to advertise all subnets and host
routing information on the A4 device. To verify which routes are summarized for an interface, use
the show ip route command as described in “show ip route” on page 23-15. The reverse of the
command re-enables automatic route summarization. By default, RIP auto-summarization affects
both RIPv1 and RIPv2 routes.

Extreme A4 CLI Reference 24-3

split-horizon poison

Note: This command is necessary for enabling CIDR for RIP on the A4 device.

Example
This example shows how to disable RIP automatic route summarization:
A4(su)->router(Config)#router rip
A4(su)->router(Config-router)#no auto-summary

split-horizon poison
Use this command to enable or disable split horizon poison-reverse mode for RIP packets. The no
form of this command disables split horizon poison reverse.

Syntax
split-horizon poison
no split-horizon poison

Parameters
None.

Defaults
None.

Mode
Router configuration: A4(su)->router(Config-router)#

Usage
Split horizon prevents a network from being advertised out the same interface it was received on.
This function is disabled by default.

Example
This example shows how to disable split horizon poison reverse for RIP packets transmitted on
the VLAN 1 interface:
A4(su)->router(Config)#router rip
A4(su)->router(Config-router)#no split-horizon poison

passive-interface
Use this command to prevent RIP from transmitting update packets on an interface. The no form
of this command disables passive interface.

Syntax
passive-interface vlan vlan-id
no passive-interface vlan vlan-id

24-4 IPv4 Basic Routing Protocol Configuration

 receive-interface

Parameters
vlan vlan-id Specifies the number of the VLAN to make a passive interface. This VLAN
must be configured for IP routing.

Defaults
None.

Mode
Router configuration: A4(su)->router(Config-router)#

Usage
This command does not prevent RIP from monitoring updates on the interface.

Example
This example shows how to set VLAN 2 as a passive interface. No RIP updates will be transmitted
on VLAN 2:
A4(su)->router(Config)#router rip
A4(su)->router(Config-router)#passive-interface vlan 2

receive-interface
Use this command to allow RIP to receive update packets on an interface. The no form of this
command denies the reception of RIP updates. By default, receiving is enabled on all routing
interfaces.

Syntax
receive-interface vlan vlan-id
no receive-interface vlan vlan-id

Parameters
vlan vlan-id Specifies the number of the VLAN to make a receive interface. This VLAN
must be configured for IP routing.

Defaults
None.

Mode
Router configuration: A4(su)->router(Config-router)#

Usage
This command does not affect the sending of RIP updates on the specified interface.

Example
This example shows how to deny the reception of RIP updates on VLAN 2:
A4(su)->router(Config)#router rip
A4(su)->router(Config-router)#no receive-interface vlan 2

Extreme A4 CLI Reference 24-5

redistribute

redistribute
Use this command to allow routing information discovered through non-RIP protocols to be
distributed in RIP update messages. The no form of this command clears redistribution
parameters.

Syntax
redistribute {connected | static} [metric metric value]
no redistribute {connected | stat

connected Specifies that non-RIP routing information discovered via directly

connected interfaces will be redistributed.
static Specifies that non-RIP routing information discovered via static routes will
be redistributed. Static routes are those created using the ip route
command detailed in “ip route” on page 23-16.
metric metric value (Optional) Specifies a metric for the connected or static redistribution
route. This value should be consistent with the designation protocol.

Mode
Router configuration: A4(su)->router(Config-router)#

Defaults
If metric value is not specified, 1 will be applied.

Example
This example shows how to redistribute routing information discovered through static routes will
be redistributed into RIP update messages:
A4(su)->router(Config)#router rip
A4(su)->router(Config-router)#redistribute static

default-information originate
Use this command to control the advertisement of default routes into RIP domains.

Syntax
default-information originate
no default-information originate

Parameters
None.

Defaults
Default external routes are not generated.

Mode
Router configuration: A4(su)->router(Config-router)#

24-6 IPv4 Basic Routing Protocol Configuration

 ip rip enable

Usage
Use the “no” command to stop the generation of a default external route into the RIP routing
domain.

Example
This example shows how to generate the default external route into the RIP routing domain:
A4(su)->router(Config)#router rip
A4(su)->router(Config-router)#default-information originate

RIP Interface Configuration Commands

The following commands are used to configure RIP on specific interfaces.

For information about... Refer to page...

ip rip enable 24-7

ip rip send version 24-8

ip rip receive version 24-8

ip rip authentication-key 24-9

ip rip message-digest-key 24-9

ip rip enable
Use this command to enable RIP on an interface. The no form of this command disables RIP on an
interface: By default, RIP is disabled on all interfaces.

Syntax
ip rip enable
no ip rip enable

Parameters
None.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to enable RIP on the VLAN 1 interface:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip rip enable

Extreme A4 CLI Reference 24-7

ip rip send version

ip rip send version

Use this command to set the RIP version for RIP update packets transmitted out an interface. The
no version of this command sets the version of the RIP update packets to RIPv1.

Syntax
ip rip send version {1 | 2 | r1compatible}
no ip rip send version

Parameters
1 Specifies RIP version 1. This is the default setting.
2 Specifies RIP version 2.
r1compatible Specifies that packets be sent as version 2 packets, but transmits these as
broadcast packets rather than multicast packets so that systems which only
understand RIP version 1 can receive them.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to set the RIP send version to 2 for packets transmitted on the VLAN 1
interface:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip rip send version 2

ip rip receive version

Use this command to set the RIP version(s) for RIP update packets accepted on an interface. The
no version of this command sets the acceptable receive version of the RIP update packets to RIPv1.

Syntax
ip rip receive version {1 | 2 | 1 2 | none}
no ip rip receive version

Parameters
1 Specifies RIP version 1. This is the default setting.
2 Specifies RIP version 2.
12 Specifies RIP versions 1 and 2.
none Specifies that no RIP routes will be processed on this interface.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

24-8 IPv4 Basic Routing Protocol Configuration

 ip rip authentication-key

Defaults
None.

Example
This example shows how to set the RIP receive version to 2 for update packets received on the
VLAN 1 interface:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip rip receive version 2

ip rip authentication-key
Use this command to enable or disable a RIP authentication key (password) for use on an
interface. The no form of this command prevents RIP from using authentication.

Syntax
ip rip authentication-key name
no ip rip authentication-key

Parameters
name Specifies the password to enable or disable for RIP authentication.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to set the RIP authentication key chain to “password” on the VLAN 1
interface:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip rip authentication-key password

ip rip message-digest-key
Use this command to enable or disable a RIP MD5 authentication key (password) for use on an
interface. The no form of this command prevents RIP from using authentication.

Syntax
ip rip message-digest-key keyid md5 key
no ip rip message-digest-key keyid

Extreme A4 CLI Reference 24-9

ip rip message-digest-key

Parameters
keyid Specifies the key ID to enable or disable for RIP authentication. Valid values
are 1 to 255.
md5 Specifies use of the MD5 algorithm.
key Specifies the RIP authentication password.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Defaults
None.

Examples
This example shows how to set the MD5 authentication ID to 5 for the RIP authentication key set
on the VLAN 1 interface:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip rip message-digest-key 5 md5 password

24-10 IPv4 Basic Routing Protocol Configuration

 Configuring IRDP

Configuring IRDP
Use the following commands to enable and configure the ICMP Router Discovery Protocol (IRDP)
on an interface. This protocol enables a host to determine the address of a router it can use as a
default gateway. It is disabled by default.

For information about... Refer to page...

ip irdp enable 24-11

ip irdp maxadvertinterval 24-12

ip irdp minadvertinterval 24-12

ip irdp holdtime 24-13

ip irdp preference 24-13

ip irdp broadcast 24-14

show ip irdp 24-14

ip irdp enable
Use this command to enable IRDP on an interface. The no form of this command disables IRDP on
an interface.

Syntax
ip irdp enable
no ip irdp enable

Parameters
None.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to enable IRDP on the VLAN 1 interface:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip irdp enable

Extreme A4 CLI Reference 24-11

ip irdp maxadvertinterval

ip irdp maxadvertinterval
Use this command to set the maximum interval in seconds between IRDP advertisements. The no
form of this command resets the maximum advertisement interval to the default value of 600
seconds.

Syntax
ip irdp maxadvertinterval interval
no irdp maxadvertinterval

Parameters
interval Specifies a maximum advertisement interval in seconds. Valid values are
4 to 1800.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to set the maximum IRDP advertisement interval to 1000 seconds on the
VLAN 1 interface:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip irdp maxadvertinterval 1000

ip irdp minadvertinterval
Use this command to set the minimum interval in seconds between IRDP advertisements. The no
form of this command deletes the custom holdtime setting, and resets the minimum
advertisement interval to the default value of three-fourths of the maxadvertinterval value, which
is equal to 450 seconds.

Syntax
ip irdp minadvertinterval interval
no irdp minadvertinterval

Parameters
interval Specifies a minimum advertisement interval in seconds. Valid values are 3
to 1800.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

24-12 IPv4 Basic Routing Protocol Configuration

 ip irdp holdtime

Example
This example shows how to set the minimum IRDP advertisement interval to 500 seconds on the
VLAN 1 interface:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip irdp minadvertinterval 500

ip irdp holdtime
Use this command to set the length of time in seconds IRDP advertisements are held valid. The no
form of this command resets the hold time to the default value of three times the
maxadvertinterval value, which is equal to 1800 seconds.

Syntax
ip irdp holdtime holdtime
no irdp holdtime

Parameters
holdtime Specifies the hold time in seconds. Valid values are 0 to
9000.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to set the IRDP hold time to 4000 seconds on the VLAN 1 interface:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip irdp holdtime 4000

ip irdp preference
Use this command to set the IRDP preference value for an interface. This value is used by IRDP to
determine the interface’s selection as a default gateway address. The no form of this command
resets the interface’s IRDP preference value to the default of 0.

Syntax
ip irdp preference preference
no irdp preference

Parameters
preference Specifies the value to indicate the interface’s use as a default router
address. Valid values are -2147483648 to 2147483647.
The minimum value indicates that the address, even though it may be
advertised, is not to be used by neighboring hosts as a default router
address.

Extreme A4 CLI Reference 24-13

ip irdp broadcast

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to set IRDP preference on the VLAN 1 interface so that the interface’s
address may still be advertised, but cannot be used by neighboring hosts as a default router
address:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip irdp preference -2147483648

ip irdp broadcast
Use this command to configure IRDP to use the limited broadcast address of 255.255.255.255. The
default is multicast with address 224.0.0.1. The no form of this command resets IRDP to use
multicast on IP address 224.0.0.1.

Syntax
ip irdp broadcast
no ip irdp broadcast

Parameters
None.

Defaults
None.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan 1))#

Example
This example shows how to enable broadcast for IRDP on the VLAN 1 interface:
A4(su)->router(Config)#interface vlan 1
A4(su)->router(Config-if(Vlan 1))#ip irdp broadcast

show ip irdp
Use this command to display IRDP information.

Syntax
show ip irdp [vlan vlan-id]

Parameters
vlan vlan-id (Optional) Displays IRDP information for a specific VLAN. This VLAN
must be configured for IP routing.

24-14 IPv4 Basic Routing Protocol Configuration

 show ip irdp

Defaults
If vlan vlan-id is not specified, IRDP information for all interfaces will be displayed.

Mode
Global configuration: A4(su)->router(Config)#
Exec mode: A4(su)->router#

Example
This example shows how to display IRDP information for the VLAN 1 interface:
A4(su)->router#show ip irdp vlan 1
Interface vlan 1 has router discovery enabled
Advertisements will occur between 450 and 600 seconds
Advertisements are sent with broadcasts
Advertisements are valid for 1800 seconds
Default preference will be 0

Extreme A4 CLI Reference 24-15

show ip irdp

24-16 IPv4 Basic Routing Protocol Configuration

 25
MGMD Proxy Configuration

This chapter describes the commands used to configure the Multicast Group Membership
Discovery Proxy (MGMD Proxy) feature. MGMD proxy is implemented for IPv4 by IGMP proxy
commands and for IPv6 by MLD proxy commands.

Note: MLD proxy commands are supported on the C5 platform only.

Refer to the Fixed Switching Configuration Guide for configuration procedures, examples, and other
information about MGMD proxy.

For information about... Refer to page...

Introduction 25-1

IGMP Proxy Commands 25-1

MLD Proxy Commands 25-6

Introduction
The purpose of the Multicast Group Membership Discovery Proxy (MGMD Proxy) feature is to
enable a multicast router to learn multicast group membership information and to then forward
multicast packets based upon the group membership information. MGMD Proxy can function
only in topologies that do not employ Multicast Routing Protocols (such as DVMRP and PIM-SM)
and that have a tree-like topology, as there is no support for features like spanning tree to correct
packet route loops.
The proxy contains one or more downstream interfaces and a unique upstream interface explicitly
configured. It performs the host side of the MGMD protocol on its upstream interface and the
router side of the MGMD protocol on its downstream interfaces.
MGMD proxy offers a mechanism for multicast forwarding based only upon MGMD membership
information. The router has to decide about forwarding packets on each of its interfaces based on
the MGMD membership information. The proxy creates forwarding entries based on the
membership information and adds them to the multicast forwarding cache (MFC).

IGMP Proxy Commands

Use the following commands to configure IPv4 MGMD Proxy.

For information about... Refer to page...

ip igmp-proxy enable 25-2

Extreme A4 CLI Reference 25-1

ip igmp-proxy enable

For information about... Refer to page...

ip igmp-proxy unsolicit-rprt-interval 25-3

show ip igmp-proxy 25-3

show ip igmp-proxy interface 25-4

show ip igmp-proxy groups 25-5

clear ip igmp-proxy statistics 25-5

ip igmp-proxy enable
Use this command to enable IGMP Proxy on an interface on the router. To enable IGMP Proxy on
the router, multicast forwarding must be enabled and there must be no multicast routing protocols
enabled on the router. Use the no form of the command to disable IGMP Proxy on the interface.

Syntax
ip igmp-proxy enable
no ip igmp-proxy enable

Parameters
None.

Defaults
IGMP Proxy is disabled by default.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan1))#

Usage
When an interface first becomes enabled as an MGMD Proxy interface, the host implementation of
MGMD is enabled in the system. The default mode for MGMD interfaces is router mode. Only one
interface can be configured as an MGMD Proxy interface per switch or stack of switches, as per
RFC4605 requirements. This interface executes the host functionality of the MGMD functionality.
It performs the task of sending membership reports and leave messages based on the membership
database changes.
When MGMD Proxy is enabled on an interface, no other multicast routing protocol can be enabled
on the system. This is a system wide requirement, not just for a particular L3 interface/subnet.
Multicast protocols must be disabled before the MGMD proxy can be enabled on the system.
When a multicast routing protocol is disabled, all the forwarding entries placed by that routing
protocol are purged.
The MGMD proxy interface acts as a proxy for all the router interfaces on the router and responds
to queries from the querier present on the proxy interface's network. The MGMD proxy combines
the group recipient information of all the router interfaces and forwards this info to the querier
present on the proxy interface.
The MGMD proxy also takes the responsibility of building the multicast forwarding database
(MFC). The MFC manages all multicast forwarding to downstream hosts based on the MGMD
membership information.
When MGMD Proxy is disabled, all forwarding entries placed by MGMD Proxy in the MFC are
purged.

25-2 MGMD Proxy Configuration

 ip igmp-proxy unsolicit-rprt-interval

Example
This example enables MGMD Proxy on VLAN 20.
A4(su)->router(Config)#interface vlan 20
A4(su)->router(Config-if(Vlan 20))#ip igmp-proxy enable

ip igmp-proxy unsolicit-rprt-interval
Use this command in Interface Configuration mode to set the unsolicited report interval for the
IGMP Proxy router. This command is valid only if IGMP Proxy is enabled on the interface. Use the
no form of the command to return the value to the default.

Syntax
ip igmp-proxy unsolicit-rprt-interval seconds
no ip igmp-proxy unsolicit-rprt-interval

Parameters
seconds Specifies the unsolicited report interval in seconds. Value can range
from 1 to 260 seconds.

Defaults
Default interval is one second.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan1))#

Usage
The MGMD proxy sends unsolicited reports to the upstream MGMD querier when the
membership database changes.

Example
This example sets the unsolicited report interval for the MGMD proxy interface to 10 seconds.
A4(su)->router(Config)#interface vlan 20
A4(su)->router(Config-if(Vlan 20))#ip igmp-proxy unsolicit-rprt-interval 10

show ip igmp-proxy
Use this command to display a summary of the host interface status parameters. It displays status
parameters only when IGMP Proxy is enabled.

Syntax
show ip igmp-proxy

Parameters
None.

Defaults
None.

Extreme A4 CLI Reference 25-3

show ip igmp-proxy interface

Mode
Global configuration: A4(su)->router(Config)#
Router Exec: A4(su)->router#

Example
The following example displays a summary of the host interface status parameters.
A4(su)->router#show ip igmp-proxy

Interface Index vlan11

Admin Mode Enabled
Operational Mode Enabled
Version 2
Number of Multicast Groups 5
Unsolicited Report Interval 1
Querier Address on Proxy Interface 11.1.1.1
Proxy Start Frequency 1

show ip igmp-proxy interface

Use this command to display a detailed list of the host interface status parameters. This command
displays information only when IGMP Proxy is enabled.

Syntax
show ip igmp-proxy interface

Parameters
None.

Defaults
None.

Mode
Global configuration: A4(su)->router(Config)#
Router Exec: A4(su)->router#

Example
A4(su)->router#show ip igmp-proxy interface
Interface Index vlan11

Ver Query Rcvd Report Rcvd Report Sent Leave Rcvd Leave Sent
-----------------------------------------------------------------

1 0 0 0 ----- -----
2 15536 0 77660 0 1
3 0 0 0 ----- -----

25-4 MGMD Proxy Configuration

 show ip igmp-proxy groups

show ip igmp-proxy groups

Use this command to display a table of information about multicast groups that IGMP Proxy
reported. It displays parameters only when IGMP Proxy is enabled.

Syntax
show ip igmp-proxy groups [detail]

Parameters
detail (Optional) Displays complete information about multicast groups that
IGMP Proxy has reported.

Defaults
None.

Mode
Global configuration: A4(su)->router(Config)#
Router Exec: A4(su)->router#

Example
The following example displays a table of information about multicast groups that IGMP Proxy
reported.
A4(su)->router#show ip igmp-proxy groups
Interface Index vlan11

Group Address Last Reporter Up Time Member State Filter Mode Sources
--------------- --------------- ------- ------------ ----------- -------
224.0.1.24 11.1.1.2 23:34:37 IDLE-MEMBER Exclude 0
230.1.1.1 11.1.1.2 15:10:48 IDLE-MEMBER Exclude 0
231.1.1.1 11.1.1.2 14:37:26 IDLE-MEMBER Exclude 0
239.255.12.41 11.1.1.2 15:10:53 IDLE-MEMBER Exclude 0
239.255.255.250 11.1.1.2 15:10:46 IDLE-MEMBER Exclude 0

clear ip igmp-proxy statistics

Use this command to clear the igmp-proxy statistics collected on the host interface.

Syntax
clear ip igmp-proxy statistics

Parameters
None.

Defaults
None.

Mode
Global configuration: A4(su)->router(Config)#

Extreme A4 CLI Reference 25-5

MLD Proxy Commands

Router Exec: A4(su)->router#

Example
This example clears the host interface statistics.
A4(su)->router#clear ip igmp-proxy statistics

MLD Proxy Commands

Note: MLD proxy commands are supported on the C5 platform only.

Use the following commands to configure IPv6 MGMD Proxy.

For information about... Refer to page...

ipv6 mld-proxy enable 25-6

ipv6 mld-proxy unsolicit-rprt-interval 25-7

show ipv6 mld-proxy 25-8

show ipv6 mld-proxy interface 25-8

show ipv6 mld-proxy groups 25-9

clear ipv6 mld-proxy statistics 25-10

ipv6 mld-proxy enable

Use this command to enable MLD Proxy on an interface on the router. To enable MLD Proxy on
the router, multicast forwarding must be enabled and there must be no multicast routing protocols
enabled on the router. Use the no form of the command to disable MLD Proxy on the interface.

Syntax
ipv6 mld-proxy enable
no ipv6 mld-proxy enable

Parameters
None.

Defaults
MLD Proxy is disabled by default.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan1))#

Usage
When an interface first becomes enabled as an MGMD Proxy interface, the host implementation of
MGMD is enabled in the system. The default mode for MGMD interfaces is router mode. Only one
interface can be configured as an MGMD Proxy interface per switch or stack of switches, as per
RFC requirements. This interface executes the host functionality of the MGMD functionality. It

25-6 MGMD Proxy Configuration

 ipv6 mld-proxy unsolicit-rprt-interval

performs the task of sending membership reports and leave messages based on the membership
database changes.
When MGMD Proxy is enabled on an interface, no other multicast routing protocol can be enabled
on the system. This is a system wide requirement, not just for a particular L3 interface/subnet.
Multicast protocols must be disabled before the MGMD proxy can be enabled on the system.
When a Multicast routing protocol is disabled, all the forwarding entries placed by that routing
protocol are purged.
The MGMD proxy interface acts as a proxy for all the router interfaces on the router and responds
to queries from the querier present on the proxy interface's network. The MGMD proxy combines
the group recipient information of all the router interfaces and forwards this info to the querier
present on the proxy interface.
The MGMD proxy also takes the responsibility of building the multicast forwarding database
(MFC). As all the multicast routing protocols are disabled, it is the MFC that manages all multicast
forwarding to downstream hosts based on the MGMD membership information.
When MGMD Proxy is disabled, all forwarding entries placed by MGMD Proxy in the MFC are
purged.

Example
This example enables IPv6 MGMD Proxy on VLAN 20.
A4(su)->router(Config)#interface vlan 20
A4(su)->router(Config-if(Vlan 20))#ipv6 mld-proxy enable

ipv6 mld-proxy unsolicit-rprt-interval

Use this command in Interface Configuration mode to set the unsolicited report interval for the
MLD Proxy router. This command is valid only if MLD Proxy is enabled on the interface. Use the
no form of the command to return the value to the default.

Syntax
ipv6 mld-proxy unsolicit-rprt-interval seconds
no ipv6 mld-proxy unsolicit-rprt-interval

Parameters
seconds Specifies the unsolicited report interval in seconds. Value can range
from 1 to 260 seconds. Default value is 1.

Defaults
Default interval is one second.

Mode
Interface configuration: A4(su)->router(Config-if(Vlan1))#

Usage
The MGMD proxy sends unsolicited reports to the upstream MGMD querier when the
membership database changes.

Example
This example sets the unsolicited report interval for the MGMD proxy interface to 10 seconds.

Extreme A4 CLI Reference 25-7

show ipv6 mld-proxy

A4(su)->router(Config)#interface vlan 20
A4(su)->router(Config-if(Vlan 20))#ipv6 mld-proxy unsolicit-rprt-interval 10

show ipv6 mld-proxy

Use this command to display a summary of the host interface status parameters. It displays status
parameters only when MLD Proxy is enabled.

Syntax
show ipv6 mld-proxy

Parameters
None.

Defaults
None.

Mode
Global configuration: A4(su)->router(Config)#
Router Exec: A4(su)->router#

Example
The following example displays a summary of the host interface status parameters.
A4(su)->router#show ipv6 mld-proxy

Interface Index vlan626

Admin Mode Enabled
Operational Mode Enabled
Version 2
Number of Multicast Groups 3
Unsolicited Report Interval 1
Querier Address on Proxy Interface fe80::21f:45ff:fe8c:10d5
Proxy Start Frequency 1

show ipv6 mld-proxy interface

Use this command to display a detailed list of the host interface status parameters. This command
displays information only when MLD Proxy is enabled.

Syntax
show ipv6 mld-proxy interface

Parameters
None.

Defaults
None.

25-8 MGMD Proxy Configuration

 show ipv6 mld-proxy groups

Mode
Global configuration: A4(su)->router(Config)#
Router Exec: A4(su)->router#

Example
A4(su)->router#show ipv6 mld-proxy interface

Interface Index vlan626

Ver Query Rcvd Report Rcvd Report Sent Leave Rcvd Leave Sent
-----------------------------------------------------------------

1 0 6 0 0 0
2 1286 0 1263 ----- -----

show ipv6 mld-proxy groups

Use this command to display a table of information about multicast groups that MLD Proxy
reported. It displays parameters only when MLD Proxy is enabled.

Syntax
show ipv6 mld-proxy groups [detail]

Parameters
detail (Optional) Displays complete information about multicast groups that
MLD Proxy has reported.

Defaults
None.

Mode
Global configuration: A4(su)->router(Config)#
Router Exec: A4(su)->router#

Examples
The following example displays a table of information about multicast groups that MLD Proxy
reported.
A4(su)->router#show ipv6 mld-proxy groups

Interface Index vlan626

Group Address Last Reporter Up Time

Member State Filter Sources
Mode
--------------- ------------------------- -------- ------------ ------- --------
ff0e:2001:2031: fe80::21f:45ff:fe47:5059 00:47:18 IDLE-MEMBER Exclude 0
1::2000
ff0e:2001:2031: fe80::21f:45ff:fe47:5059 13:29:07 IDLE-MEMBER Exclude 0
1::3000

This example displays the detailed information.

Extreme A4 CLI Reference 25-9

clear ipv6 mld-proxy statistics

A4(su)->router#show ipv6 mld-proxy groups detail

Interface Index vlan626

Group Address Last Reporter Up Time

Member State Filter Sources
Mode
--------------- ------------------------- -------- ------------ ------- --------
ff3e:baad:beef: fe80::21f:45ff:fe47:5059 00:03:46 IDLE-MEMBER Exclude 1
1::1
Source Address Expiry Time
--------------- -----------

2005:691::10 00:04:19
ff3e:baad:beef: fe80::21f:45ff:fe47:5059 00:03:46 IDLE-MEMBER Include 1
1::2
Source Address Expiry Time
--------------- -----------

2005:692::20 00:04:19
ff3e:baad:beef: fe80::21f:45ff:fe47:5059 00:03:46 IDLE-MEMBER Include 1
1::3
Source Address Expiry Time
--------------- -----------

2005:693::30 00:04:19

clear ipv6 mld-proxy statistics

Use this command to clear the mld-proxy statistics collected on the host interface.

Syntax
clear ipv6 mld-proxy statistics

Parameters
None.

Defaults
None.

Mode
Global configuration: A4(su)->router(Config)#
Router Exec: A4(su)->router#

Example
This example clears the host interface statistics.
A4(su)->router#clear ipv6 mld-proxy statistics

25-10 MGMD Proxy Configuration

 26
IPv6 Management

This chapter describes the switch mode set of commands used to manage IPv6.
Use the following commands to enable or disable the IPv6 management function, to configure and
display the IPv6 host address and IPv6 gateway for the switch, and to display IPv6 status
information.

For information about... Refer to page...

show ipv6 status 26-1

set ipv6 26-2

set ipv6 address 26-2

show ipv6 address 26-3

clear ipv6 address 26-4

set ipv6 gateway 26-5

clear ipv6 gateway 26-6

show ipv6 neighbors 26-6

show ipv6 netstat 26-7

ping ipv6 26-8

traceroute ipv6 26-9

show ipv6 status

Use this command to display the status of the IPv6 management function.

Syntax
show ipv6 status

Parameters
None.

Defaults
None.

Mode
Switch mode, read-only.

Extreme A4 CLI Reference 26-1

set ipv6

Example
This example shows how to display IPv6 management function status.
A4(ro)->show ipv6 status
IPv6 Administrative Mode: Disabled

set ipv6
Use this command to globally enable or disable the IPv6 management function.

Syntax
set ipv6 {enable | disable}

Parameters
enable | disable Enable or disable the IPv6 management function.

Defaults
By default, IPv6 management is disabled.

Mode
Switch mode, read-write.

Usage
When you enable IPv6 management on the switch, the system automatically generates a link-local
host address for the switch from the host MAC address and a link-local address for the default
gateway. You can set a different host IPv6 address with the set ipv6 address command and a
different gateway address with the set ipv6 gateway command.

Example
This example shows how to enable IPv6 management.
A4(su)-> set ipv6 enable

A4(su)->show ipv6 status

IPv6 Administrative Mode: Enabled

A4(su)->show ipv6 address

Name IPv6 Address
------------ ----------------------------------------
host FE80::201:F4FF:FE5C:2880/64
gateway FE80::21F:45FF:FE8C:10D5

set ipv6 address

Use this command to configure IPv6 global addressing information.

Syntax
set ipv6 address ipv6-addr/prefix-length [eui64]

26-2 IPv6 Management

 show ipv6 address

Parameters
ipv6-addr The IPv6 address or prefix to be configured. This parameter must be in the
form documented in RFC 4291, with the address specified in hexadecimal
using 16-bit values between colons.
prefix-length The length of the IPv6 prefix for this address. The value of prefix-length is a
decimal number indicating the number of high-order contiguous bits of the
address that comprise the network portion of the address.
eui64 (Optional) Formulate the IPv6 address using an EUI-64 ID in the lower
order 64 bits of the address.

Defaults
No global unicast IPv6 address is defined by default.

Mode
Switch mode, read-write.

Usage
Use this command to manually configure a global unicast IPv6 address for IPv6 management. You
can specify the address completely, or you can use the optional eui64 parameter to allow the
switch to generate the lower order 64 bits of the address.
When using the eui64 parameter, you specify only the network prefix and length.

Examples
This example shows how to completely specify an IPv6 address by entering all 128 bits and the
prefix:
A4(su)->set ipv6 address 2001:0db8:1234:5555::9876:2/64

A4(su)->show ipv6 address

Name IPv6 Address
------------ ----------------------------------------
host FE80::201:F4FF:FE5C:2880/64
host 2001:DB8:1234:5555::9876:2/64
This example shows how to use the eui64 parameter to configure the lower order 64 bits:
A4(su)->set ipv6 address 2001:0db8:1234:5555::/64 eui64

A4(su)->show ipv6 address

Name IPv6 Address
------------ ----------------------------------------
host FE80::201:F4FF:FE5C:2880/64
host 2001:DB8:1234:5555:201:F4FF:FE5C:2880/64

show ipv6 address

Use this command to display the system IPv6 address(es) and IPv6 gateway address (default
router), if configured.

Syntax
show ipv6 address

Extreme A4 CLI Reference 26-3

clear ipv6 address

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Usage
This command displays the IPv6 addresses configured automatically and with the set ipv6
address and set ipv6 gateway commands.

Example
This example displays two IPv6 management (host) addresses configured for the switch. The first
listed is the link local address that was automatically created when IPv6 was enabled for the host.
The second address is a global address that was manually configured. The gateway address was
also automatically created for the link local address.
A4(su)->show ipv6 address
Name IPv6 Address
------------ ----------------------------------------
host FE80::201:F4FF:FE5C:2880/64
host 2001:DB8:1234:5555:201:F4FF:FE5C:2880/64
gateway FE80::201:F4FF:FE5D:1234

clear ipv6 address

Use this command to clear IPv6 global addresses.

Syntax
clear ipv6 [address {all|ipv6-addr/prefix-length}]

Parameters
ipv6-addr The IPv6 address to be cleared. This parameter must be in the form
documented in RFC 4291, with the address specified in hexadecimal using
16-bit values between colons.
prefix-length The length of the IPv6 prefix for this address. The value of prefix-length is a
decimal number indicating the number of high-order contiguous bits of the
address that comprise the network portion of the address.
all Deletes all IPv6 global addresses.

Defaults
If address is not entered, all manually configured global IPv6 addresses are cleared.

Mode
Switch mode, read-write.

26-4 IPv6 Management

 set ipv6 gateway

Usage
This command clears addresses manually configured with the set ipv6 address command. Use the
clear ipv6 gateway command to clear the IPv6 gateway address.

Example
This example illustrates that this command clears only those IPv6 addresses configured with the
set ipv6 address command. The link-local address for the host interface and the gateway address
are not removed with this command.
A4(su)->show ipv6 address
Name IPv6 Address
------------ ----------------------------------------
host FE80::201:F4FF:FE5C:2880/64
host 2001:DB8:1234:5555:201:F4FF:FE5C:2880/64
host 2001:DB8:1234:5555::9876:2/64
gateway FE80::201:F4FF:FE5D:1234

A4(su)->clear ipv6 address all

A4(su)->show ipv6 address

Name IPv6 Address
------------ ----------------------------------------
host FE80::201:F4FF:FE5C:2880/64
gateway FE80::201:F4FF:FE5D:1234

set ipv6 gateway

Use this command to configure the IPv6 gateway (default router) address.

Syntax
set ipv6 gateway ipv6-addr

Parameters
ipv6-addr The IPv6 address to be configured. The address can be a global unicast or
link-local IPv6 address, in the form documented in RFC 4291, with the
address specified in hexadecimal using 16-bit values between colons.

Defaults
None.

Mode
Switch mode, read-write.

Usage
This command configures the IPv6 gateway address. Only one IPv6 gateway address can be
configured for the switch, so executing this command when a gateway address has already been
configured will overwrite the previously configured address.
Use the show ipv6 address command to display a configured IPv6 gateway address.

Extreme A4 CLI Reference 26-5

clear ipv6 gateway

Example
This example shows how to configure an IPv6 gateway address using a link-local address.
A4(su)->set ipv6 gateway fe80::201:f4ff:fe5d:1234
A4(su)->show ipv6 address
Name IPv6 Address
------------ ----------------------------------------
host FE80::201:F4FF:FE5C:2880/64
gateway FE80::201:F4FF:FE5D:1234

clear ipv6 gateway

Use this command to clear an IPv6 gateway address.

Syntax
clear ipv6 gateway

Parameters
None.

Defaults
None.

Mode
Switch mode, read-write.

Example
This example shows how to remove a configured IPv6 gateway address.
A4(su)->show ipv6 address
Name IPv6 Address
------------ ----------------------------------------
host FE80::201:F4FF:FE5C:2880/64
gateway FE80::201:F4FF:FE5D:1234

A4(su)->clear ipv6 gateway

A4(su)->show ipv6 address

Name IPv6 Address
------------ ----------------------------------------
host FE80::201:F4FF:FE5C:2880/64

show ipv6 neighbors

Use this command to display the system IPv6 Neighbor Discovery Protocol cache.

Syntax
show ipv6 neighbors

Parameters
None.

26-6 IPv6 Management

 show ipv6 netstat

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows example output of this command.
A4(su)->show ipv6 neighbors
Last
IPv6 Address MAC Address isRtr State Updated
--------------------------------------- ----------------- ----- ------- -------
2001:db8:1234:6666::2310:3 00:04:76:73:42:31 True Reachable 00:01:16

show ipv6 netstat

Use this command to display IPv6 netstat information.

Syntax
show ipv6 netstat

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Usage
The network connection information displayed by this command can be used to find problems in
the network.

Example
This example shows the output of this command. Table 26-1 describes the output of this
command.
A4(su)->show ipv6 netstat
Prot Local Address State
Foreign Address
---- -------------------------------------------- -----------
TCP 3333::211:88FF:FE59:4424.22 ESTABLISHED
2020::D480:1384:F58C:B114.1049
TCP 3333::211:88FF:FE59:4424.443 TIME_WAIT
2020::D480:1384:F58C:B114.1056
TCP ::.23 LISTEN
::.*
TCP 3333::211:88FF:FE59:4424.22 ESTABLISHED
2020::D480:1384:F58C:B114.1050
TCP 3333::211:88FF:FE59:4424.22 ESTABLISHED

Extreme A4 CLI Reference 26-7

ping ipv6

3333::2117:F1C0:90B:910D.1045
TCP ::.80 LISTEN
::.*
TCP ::.22 LISTEN
::.*

TCP 3333::211:88FF:FE59:4424.80 ESTABLISHED

2020::D480:1384:F58C:B114.1053
TCP 3333::211:88FF:FE59:4424.80 ESTABLISHED
2020::D480:1384:F58C:B114.1054
TCP ::.443 LISTEN
::.*
TCP 3333::211:88FF:FE59:4424.22 ESTABLISHED
2020::D480:1384:F58C:B114.1048
TCP 3333::211:88FF:FE59:4424.443 TIME_WAIT
2020::D480:1384:F58C:B114.1055

Table 26-1 show ipv6 netstat Output Display

Output... What it displays...

Prot The name of the protocol, TCP or UDP

Local Address The IPv6 address of the local device and the port number being
used. If the port is not yet established, the port number is shown
as an asterisk (*)

Foreign Address The IPv6 address and port number of the remote device to which
the socket is connected. If the port is not yet established, the port
number is shown as an asterisk (*)

State Indicates the state of a TCP connection. The possible states are:
• CLOSE_WAIT
• CLOSED
• ESTABLISHED
• FIN_WAIT_1
• FIN_WAIT_2
• LAST_ACK
• LISTEN
• SYN_RECEIVED
• SYN_SEND

• TIME_WAIT
For more information about the states of a TCP connection, see
RFC 793.

ping ipv6
Use this command to test routing network connectivity by sending IP ping requests to a specific
IPv6 address or to a link local address.

Syntax
ping ipv6 {ipv6-addr | interface host link-local-addr}[size num]

26-8 IPv6 Management

 traceroute ipv6

Parameters
ipv6-addr Specifies the IPv6 address of the system to ping. Enter the address in the
form documented in RFC 4291, with the address specified in hexadecimal
using 16-bit values between colons.
interface host Specifies that a single port link local address is to be pinged.
link-local-addr Specifies the link local address to ping.
size num (Optional) Specifies the size of the datagram packet. The value of num can
range from 48 to 2048 bytes.

Defaults
None.

Mode
Switch mode, read-write.

Usage
Ping commands are also available in IPv6 routing mode.

Usage
This command is also available in router mode.

Examples
This example shows output from a successful ping to IPv6 address 2001:0db8:1234:5555::1234:1.
A4(su)->ping ipv6 2001:0db8:1234:5555::1234:1
2001:DB8:1234:5555::1234:1 is alive
This example shows output from an unsuccessful ping to IPv6 address
2001:0db8:1234:5555::1234:1.
A4(su)->ping ipv6 2001:0db8:1234:5555::1234:1
no answer from 2001:DB8:1234:5555::1234:1
This example pings a link local address.
A4(su)->ping ipv6 interface host FE80::21F:45FF:FE09:E757

traceroute ipv6
Use this command to discover the routes that packets actually take when traveling to their
destination through the network on a hop-by-hop basis.

Syntax
traceroute ipv6 ipv6-addr

Parameters
ipv6-addr Specifies a host to which the route of an IPv6 packet will be traced. Enter the
address in the form documented in RFC 4291, with the address specified in
hexadecimal using 16-bit values between colons.

Extreme A4 CLI Reference 26-9

traceroute ipv6

Defaults
None.

Mode
Switch mode, read-write.

Usage
This command is also available in router mode.

Example
This example shows how to use traceroute to display a round trip path to host
2001:0db8:1234:5555
A4(su)->traceroute ipv6 2001:0db8:1234:5555::1
Traceroute to 2001:0db8:1234:5555, 30 hops max, 40 byte packets
1 2001:0db8:1234:5555 1.000000e+00 ms 1.000000e+00 ms 1.000000e+00 ms

26-10 IPv6 Management

 27
Authentication and Authorization
Configuration

This chapter describes the following authentication and authorization commands and how to use
them. For information about using the TACACS+ authentication method for management, see
Chapter 31, TACACS+ Configuration.
Refer to Chapter 10, “Configuring User Authentication,” in the Fixed Switching Configuration Guide
for configuration procedures, example, and other information.

For information about... Refer to page...

Configuring RADIUS 27-1

Configuring 802.1X Authentication 27-12

Configuring MAC Authentication 27-21

Configuring Multiple Authentication Methods 27-32

Configuring VLAN Authorization (RFC 3580) 27-45

Configuring Policy Maptable Response 27-48

Configuring MAC Locking 27-51

Configuring Port Web Authentication (PWA) 27-65

Configuring Convergence End Points Phone Detection 27-75

Configuring RADIUS
Use the following commands to configure RADIUS on the switch.

For information about... Refer to page...

show radius 27-2

set radius 27-3

set radius ipsec 27-5

clear radius 27-5

clear radius ipsec 27-6

show radius accounting 27-7

set radius accounting 27-7

clear radius accounting 27-8

Extreme A4 CLI Reference 27-1

show radius

For information about... Refer to page...

show radius interface 27-9

set radius interface 27-9

clear radius interface 27-10

set radius attribute mgmt password 27-11

show radius attribute mgmt password 27-12

show radius
Use this command to display the current RADIUS client/server configuration.

Syntax
show radius [status | retries | timeout | server [index | all]]

Parameters
status (Optional) Displays the RADIUS server’s enable status.
retries (Optional) Displays the number of retry attempts before the RADIUS server
times out.
timeout (Optional) Displays the maximum amount of time (in seconds) to establish
contact with the RADIUS server before retry attempts begin.
server (Optional) Displays RADIUS server configuration information.
index | all For use with the server parameter to show server configuration for all
servers or a specific RADIUS server as defined by an index.

Defaults
If no parameters are specified, all RADIUS configuration information will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display RADIUS configuration information:
A4(rw)->show radius
RADIUS status: Enabled
RADIUS retries: 3
RADIUS timeout: 20 seconds
RADIUS attribute mgmt password: standard
RADIUS Server IP Address Auth-Port Realm-Type IPsec
-------------- ---------- --------- ----------------- --------
10 172.16.20.10 1812 management-access disabled
Table 27-1 provides an explanation of the command output.

27-2 Authentication and Authorization Configuration

 set radius

Table 27-1 show radius Output Details

Output Field What It Displays...

RADIUS status Whether RADIUS is enabled or disabled.

RADIUS retries Number of retry attempts before the RADIUS server times out. The default value of 3
can be reset using the set radius command as described in “set radius” on
page 27-3.

RADIUS timeout Maximum amount of time (in seconds) to establish contact with the RADIUS server
before retry attempts begin. The default value of 20 can be reset using the set
radius command as described in “set radius” on page 27-3.

RADIUS attribute Whether RADIUS password authentication management is configured as standard

mgmt password: or MS-CHAPv2. Configured with the command “set radius attribute mgmt password”
on page 27-11.

RADIUS Server RADIUS server’s index number, IP address, and UDP authentication port.

Realm-Type Realm defines who has to go through the RADIUS server for authentication.
• Management-access: This means that anyone trying to access the switch (Telnet,
SSH, Local Management) has to authenticate through the RADIUS server.
• Network-access: This means that all the users have to authenticate to a RADIUS
server before they are allowed access to the network.
• Any-access: Means that both Management-access and Network-access have
been enabled.
IPsec Whether IPsec is enabled or disabled for that RADIUS server. Configured with the
command “set radius ipsec” on page 27-5.

set radius
Use this command to enable, disable, or configure RADIUS authentication.

Syntax
set radius {enable | disable} | {retries number-of-retries} | {timeout timeout} |
{server index ip-address port [secret-value] [realm {management-access | any |
network-access}} | {realm {management-access | any | network-access} {index| all}}

Parameters
enable | disable Enables or disables the RADIUS client.
retries number-of- Specifies the number of retry attempts before the RADIUS server times out.
retries Valid values are from 0 to 10. Default is 3.
timeout timeout Specifies the maximum amount of time (in seconds) to establish contact
with the RADIUS server before retry attempts begin. Valid values are from 1
to 30. Default is 20 seconds.
server index Specifies the index number, IP address and the UDP authentication port for
ip_address port the RADIUS server.
secret-value (Optional) Specifies an encryption key to be used for authentication
between the RADIUS client and server.

Extreme A4 CLI Reference 27-3

set radius

realm Realm allows you to define who has to go through the RADIUS server for
management- authentication.
access | any |
• management-access: This means that anyone trying to access the switch
network-access
(Telnet, SSH, Local Management) has to authenticate through the
RADIUS server.
• network-access: This means that all the users have to authenticate to a
RADIUS server before they are allowed access to the network.
• any: Means that both management-access and network-access have
been enabled.
Note: If the management-access or any access realm has been configured, the
local “admin” account is disabled for access to the switch using the console, Telnet,
or Local Management. Only the network-access realm allows access to the local
“admin” account.
index | all Applies the realm setting to a specific server or to all servers.

Defaults
If secret-value is not specified, none will be applied.
If realm is not specified, the any access realm will be used.

Mode
Switch command, read-write.

Usage
The A4 device allows up to 10 RADIUS servers to be configured, with up to two servers active at
any given time.
The RADIUS client can only be enabled on the switch once a RADIUS server is online, and its IP
address(es) has been configured with the same password the RADIUS client will use.

Note: If RADIUS is configured with no host IP address on the device, it will use the loopback
interface 0 IP address (if it has been configured) as its source for the NAS-IP attribute. For
information about configuring loopback interfaces, refer to “interface” on page 23-2.

Examples
This example shows how to enable the RADIUS client for authenticating with RADIUS server 1 at
IP address 192.168.6.203, UDP authentication port 1812, and an authentication password of
“pwsecret.” As previously noted, the “server secret” password entered here must match that
already configured as the Read-Write (rw) password on the RADIUS server:
A4(su)->set radius server 1 192.168.6.203 1812 pwsecret

This example shows how to set the RADIUS timeout to 5 seconds:

A4(su)->set radius timeout 5

This example shows how to set RADIUS retries to 10:

A4(su)->set radius retries 10

27-4 Authentication and Authorization Configuration

 set radius ipsec

This example shows how to force any management-access to the switch (Telnet, web, SSH) to
authenticate through a RADIUS server. The all parameter at the end of the command means that
any of the defined RADIUS servers can be used for this Authentication.
A4(rw)->set radius realm management-access all

set radius ipsec

Use this command to enable or disable IPsec on one or all RADIUS servers.

Syntax
set radius ipsec {enable | disable} [index]

Parameters
enable | disable Enables or disables IPsec for one or all RADIUS servers.
index (Optional) Specifies a RADIUS server for which to enable or disable
IPsec.

Defaults
If no RADIUS server is specified by an index, all RADIUS servers configured for this switch are
enabled or disabled for IPsec.

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2

Usage
IPsec is disabled by default for RADIUS transactions. Refer to Chapter 28, Configuring IPsec, for
information about configuring IPsec globally.
The "clear radius ipsec" command, given without options will disable RADIUS IPsec on all
servers.

Example
This example enables IPsec for the RADIUS server with index number 2. Then, the server’s
configuration is displayed with the show radius server command.
A4(rw)->set radius ipsec enable 2
A4(rw)->show radius server 2
RADIUS Server IP Address Auth-Port Realm-Type IPsec
-------------- ---------- --------- ----------------- --------
2 192.168.10.10 1812 any enabled

clear radius
Use this command to clear RADIUS server settings.

Syntax
clear radius {[retries] | [timeout] | [server {index | all | realm {index | all}}]}

Extreme A4 CLI Reference 27-5

clear radius ipsec

Parameters
retries (Optional) Resets the maximum number of attempts a user can contact the
RADIUS server before timing out to 3.
timeout (Optional) Resets the maximum amount of time to establish contact with
the RADIUS server before timing out to 20 seconds.
server (Optional) Deletes server settings.
index | all For use with the server parameter to clear the server configuration for all
servers or a specific RADIUS server as defined by an index.
realm Resets the realm setting for all servers or a specific RADIUS server as
defined by an index.

Mode
Switch command, read-write.

Defaults
At least one of the optional parameters must be entered with this command.

Examples
This example shows how to clear all settings on all RADIUS servers:
A4(su)->clear radius server all
This example shows how to reset the RADIUS timeout to the default value of 20 seconds:
A4(su)->clear radius timeout

clear radius ipsec

Use this command to disable IPsec for one or all RADIUS servers.

Syntax
clear radius ipsec [index]

Parameters
index (Optional) Disables IPsec for the configured RADIUS server specified
by index.

Defaults
If no RADIUS server is specified, IPsec is disabled on all RADIUS servers.

Mode
Switch command, read-write, if security profile = normal.
Switch command, super-user, if security profile = c2

Example
This example disables IPsec on the RADIUS server specified by index 2.
A4(su)->clear radius ipsec 2

27-6 Authentication and Authorization Configuration

 show radius accounting

show radius accounting

Use this command to display the RADIUS accounting configuration. This transmits accounting
information between a network access server and a shared accounting server.

Syntax
show radius accounting [server] | [counter ip-address] | [retries] | [timeout]

Parameters
server (Optional) Displays one or all RADIUS accounting server configurations.
counter ip-address (Optional) Displays counters for a RADIUS accounting server.
retries (Optional) Displays the maximum number of attempts to contact the
RADIUS accounting server before timing out.
timeout (Optional) Displays the maximum amount of time before timing out.

Mode
Switch command, read-only.

Defaults
If no parameters are specified, all RADIUS accounting configuration information will be
displayed.

Example
This example shows how to display RADIUS accounting configuration information. In this case,
RADIUS accounting is not currently enabled and global default settings have not been changed.
One server has been configured.
For details on enabling and configuring RADIUS accounting, refer to “set radius accounting” on
page 27-7:
A4(ro)->show radius accounting

RADIUS accounting status: Disabled

RADIUS Acct Server IP Address Acct-Port Retries Timeout Status
------------------ ---------- --------- ------- ------- ------
1 172.16.2.10 1856 3 20 Disabled

set radius accounting

Use this command to configure RADIUS accounting.

Syntax
set radius accounting {[enable | disable] [retries retries] [timeout timeout]
[server ip_address port [server-secret]

Parameters
enable | disable Enables or disables the RADIUS accounting client.
retries retries Sets the maximum number of attempts to contact a specified RADIUS
accounting server before timing out. Valid retry values are 0 - 10.

Extreme A4 CLI Reference 27-7

clear radius accounting

timeout timeout Sets the maximum amount of time (in seconds) to establish contact with a
specified RADIUS accounting server before timing out. Valid timeout
values are 1 - 30.
server ip_address Specifies the accounting server’s:
port server-secret
• IP address
• UDP authentication port (0 - 65535)
• server-secret (Read-Write password to access this accounting server.
Device will prompt for this entry upon creating a server instance, as
shown in the example below.)

Mode
Switch command, read-write.

Defaults
None.

Examples
This example shows how to enable the RADIUS accounting client for authenticating with the
accounting server at IP address 10.2.4.12, UDP authentication port 1800. As previously noted, the
“server secret” password entered here must match that already configured as the Read-Write (rw)
password on the RADIUS accounting server:
A4(su)->set radius accounting server 10.2.4.12 1800
Enter secret:
Re-enter secret:
This example shows how to set the RADIUS accounting timeout to 30 seconds:
A4(su)->set radius accounting timeout 30
This example shows how to set RADIUS accounting retries to 10:
A4(su)->set radius accounting retries 10

clear radius accounting

Use this command to clear RADIUS accounting configuration settings.

Syntax
clear radius accounting {server {ip-address | all} | retries | timeout | counter}

Parameters
server ip-address | Clears the configuration on one or all accounting servers.
all
retries Resets the retries to the default value of 3.
timeout Resets the timeout to 5 seconds.
counter Clears counters.

Mode
Switch command, read-write.

27-8 Authentication and Authorization Configuration

 show radius interface

Defaults
None.

Example
This example shows how to reset the RADIUS accounting timeout to 5 seconds.
A4(su)->clear radius accounting timeout

show radius interface

Use this command to display the interface used for the source IP address of the RADIUS
application when generating RADIUS packets.

Syntax
show radius interface

Parameters
None.

Defaults
None.

Mode
Switch mode, read-only.

Example
This example displays the output of this command. In this case, the IP address assigned to
loopback interface 1 will be used as the source IP address of the RADIUS application.
A4(rw)->show radius interface
loopback 1 192.168.10.1

set radius interface

Use this command to specify the interface used for the source IP address of the RADIUS
application when generating RADIUS packets.

Syntax
set radius interface {loopback loop-ID | vlan vlan-ID}

Parameters
loopback loop-ID Specifies the loopback interface to be used. The value of loop-ID can
range from 0 to 7.
vlan vlan-ID Specifies the VLAN interface to be used. The value of vlan-ID can range
from 1 to 4093.

Defaults
None.

Extreme A4 CLI Reference 27-9

clear radius interface

Mode
Switch command, read-write.

Usage
This command allows you to configure the source IP address used for the source IP address of the
RADIUS application when generating RADIUS packets. Any of the management interfaces,
including VLAN routing interfaces, can be configured as the source IP address used in packets
generated by the RADIUS application.
An interface must have an IP address assigned to it before it can be set by this command.
If no interface is specified, then the IP address of the Host interface, if configured, will be used for
both the source IP address and NAS-IP. If no interface is specified and no Host address is
configured, the source IP address will be the address of the routed interface on which the packet
egresses. If loopback 0 has been configured, the NAS-IP will be set to the IP address of loopback 0.
Otherwise, the NAS-IP will be zero.

Example
This example configures an IP address on VLAN interface 100 and then sets that interface as the
RADIUS application source IP address.
A4(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0
A4(rw)->router(Config-if(Vlan 100))#exit
A4(rw)->router(Config)#exit
A4(rw)->router#exit
A4(rw)->router>exit
A4(rw)->set radius interface vlan 100

A4(rw)->show radius interface

vlan 100 192.168.10.1

clear radius interface

Use this command to clear the interface used for the source IP address of the RADIUS application
back to the default of the Host interface, if configured. If no Host address is configured, the source
IP address will be the address of the routed interface on which the packet egresses.

Syntax
clear radius interface

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

27-10 Authentication and Authorization Configuration

 set radius attribute mgmt password

Example
This command returns the interface used for the source IP address of the RADIUS application
back to the default of the Host interface.
A4(rw)->show radius interface
vlan 100 192.168.10.1
A4(rw)->clear radius interface
A4(rw)->

set radius attribute mgmt password

Use this command to configure RADIUS management authentication.

Syntax
set radius attribute mgmt password {standard | mschapv2}

Parameters
standard Enable standard RADIUS management authentication. This is the
default.
mschapv2 Enable RADIUS management authentication with MS-CHAPv2.

Defaults
None. Note that although standard is the factory default mode, once you change the mode to MS-
CHAPv2, you must execute this command to change the mode back to standard.

Mode
Switch command, read-write.

Usage
MS-CHAP is the Microsoft version of the Challenge-Handshake Authentication Protocol (CHAP).
MS-CHAPv2 is defined in RFC 2759. Refer to Chapter 26, “Configuring Security Features,” in the
Fixed Switching Configuration Guide for a detailed discussion of RADIUS management
authentication.

Example
This example changes the RADIUS management authentication mode to MS-CHAPv2, then
displays the RADIUS configuration.
A4(su)->set radius attribute mgmt password mschapv2
A4(su)->show radius
RADIUS status: Disabled
RADIUS retries: 2
RADIUS timeout: 5 seconds
RADIUS attribute mgmt password: mschapv2
RADIUS Server IP Address Auth-Port Realm-Type IPsec
-------------- ---------- --------- ----------------- --------
1 10.1.0.27 1812 any disabled
2 192.168.10.10 1812 any enabled

Extreme A4 CLI Reference 27-11

show radius attribute mgmt password

show radius attribute mgmt password

Use this command to display the currently configured RADIUS management authentication
mode. The current state can also be displayed with the show radius command.

Syntax
show radius attribute mgmt password

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example displays the current RADIUS management authentication mode.
A4(su)->show radius attribute mgmt password
Attribute mgmt password is mschapv2

Configuring 802.1X Authentication

Use the following commands to configure 802.1X authentication.

Note: To configure EAP pass-through, which allows client authentication packets to be forwarded
through the switch to an upstream device, 802.1X authentication must be globally disabled with the
set dot1x command (“set dot1x” on page 27-15).

For information about... Refer to page...

show dot1x 27-13

show dot1x auth-config 27-14

set dot1x 27-15

set dot1x auth-config 27-16

clear dot1x auth-config 27-17

show eapol 27-18

set eapol 27-20

clear eapol 27-20

27-12 Authentication and Authorization Configuration

 show dot1x

show dot1x
Use this command to display 802.1X status, diagnostics, statistics, and reauthentication or
initialization control information for one or more ports.

Syntax
show dot1x [auth-diag] [auth-stats] [port [init | reauth]] [port-string]

Parameters
auth-diag (Optional) Displays authentication diagnostics information.
auth-stats (Optional) Displays authentication statistics.
port init | reauth (Optional) Displays the status of port initialization and reauthentication
control for the port.
port-string (Optional) Displays information for specific port(s).

Defaults
If no parameters are specified, 802.1X status will be displayed.
If port-string is not specified, information for all ports will be displayed.

Mode
Switch command, read-only.

Examples
This example shows how to display 802.1X status:
A4(su)->show dot1x
DOT1X is disabled.
This example shows how to display authentication diagnostics information for fe.1.1:
A4(su)->show dot1x auth-diag fe.1.1

Port : 1 Auth-Diag
Enter Connecting: 0
EAP Logoffs While Connecting: 0
Enter Authenticating: 0
Success While Authenticating 0
Timeouts While Authenticating: 0
Fails While Authenticating: 0
ReAuths While Authenticating: 0
EAP Starts While Authenticating: 0
EAP logoff While Authenticating: 0
Backend Responses: 0
Backend Access Challenges: 0
Backend Others Requests To Supp: 0
Backend NonNak Responses From: 0
Backend Auth Successes: 0
Backend Auth Fails: 0
This example shows how to display authentication statistics for fe.1.1:
A4(su)->show dot1x auth-stats fe.1.1
Port: 1 Auth-Stats
EAPOL Frames Rx: 0

Extreme A4 CLI Reference 27-13

show dot1x auth-config

EAPOL Frames Tx: 0

EAPOL Start Frames Rx: 0
EAPOL Logoff Frames Rx: 0
EAPOL RespId Frames Rx: 0
EAPOL Resp Frames Rx: 0
EAPOL Req Frames Tx: 0
EAP Length Error Frames Rx: 0
Last EAPOL Frame Version: 0
Last EAPOL Frame Source: 00:00:00:00:00:00
This example shows how to display the status of port reauthentication control for fe.1.1 through
fe.1.6:
A4(su)->show dot1x port reauth fe.1.1-6
Port 1: Port reauthenticate: FALSE
Port 2: Port reauthenticate: FALSE
Port 3: Port reauthenticate: FALSE
Port 4: Port reauthenticate: FALSE
Port 5: Port reauthenticate: FALSE
Port 6: Port reauthenticate: FALSE

show dot1x auth-config

Use this command to display 802.1X authentication configuration settings for one or more ports.

Syntax
show dot1x auth-config [authcontrolled-portcontrol] [maxreq] [quietperiod]
[reauthenabled] [reauthperiod] [servertimeout] [supptimeout] [txperiod]
[port-string]

Parameters
authcontrolled- (Optional) Displays the current value of the controlled Port control
portcontrol parameter for the port.
maxreq (Optional) Displays the value set for maximum requests currently in use by
the backend authentication state machine.
quietperiod (Optional) Displays the value set for quiet period currently in use by the
authenticator PAE state machine.
reauthenabled (Optional) Displays the state of reauthentication control used by the
Reauthentication Timer state machine.
reauthperiod (Optional) Displays the value, in seconds, set for the reauthentication
period used by the reauthentication timer state machine.
servertimeout (Optional) Displays the server timeout value, in seconds, currently in use
by the backend authentication state machine.
supptimeout (Optional) Displays the authentication supplicant timeout value, in
seconds, currently in use by the backend authentication state machine.
txperiod (Optional) Displays the transmission period value, in seconds, currently in
use by the authenticator PAE state machine.
port-string (Optional) Limits the display of desired information information to specific
port(s).

Defaults
If no parameters are specified, all 802.1X settings will be displayed.

27-14 Authentication and Authorization Configuration

 set dot1x

If port-string is not specified, information for all ports will be displayed.

Mode
Switch command, read-only.

Examples
This example shows how to display the EAPOL port control mode for fe.1.1:
A4(su)->show dot1x auth-config authcontrolled-portcontrol fe.1.1
Port 1: Auth controlled port control: Auto
This example shows how to display the 802.1X quiet period settings for fe.1.1:
A4(su)->show dot1x auth-config quietperiod fe.1.1
Port 1: Quiet period: 30
This example shows how to display all 802.1X authentication configuration settings for ge.1.1:
A4(ro)->show dot1x auth-config ge.1.1
Port : 1 Auth-Config
PAE state: Initialize
Backend auth state: Initialize
Admin controlled directions: Both
Oper controlled directions: Both
Auth controlled port status: Authorized
Auth controlled port control: Auto
Quiet period: 60
Transmission period: 30
Supplicant timeout: 30
Server timeout: 30
Maximum requests: 2
Reauthentication period: 3600
Reauthentication control: Disabled

set dot1x
Use this command to enable or disable 802.1X authentication, to reauthenticate one or more access
entities, or to reinitialize one or more supplicants.

Syntax
set dot1x {enable | disable | port {init | reauth} {true | false} [port-string]}

Parameters
enable | disable Enables or disables 802.1X.
port Enable or disable 802.1X reauthentication or initialization control on one or
more ports.
init | reauth Configure initialization or reauthentication control.
true | false Enable (true) or disable (false) reinitialization/reauthentication.
port-string (Optional) Specifies the port(s) to reinitialize or reauthenticate.

Defaults
If no ports are specified, the reinitialization or reauthentication setting will be applied to all ports.

Extreme A4 CLI Reference 27-15

set dot1x auth-config

Mode
Switch command, read-write.

Usage
Disabling 802.1X authentication globally, by not entering a specific port-string value, will enable
the EAP pass-through feature. EAP pass-through allows client authentication packets to be
forwarded unmodified through the switch to an upstream device.

Examples
This example shows how to enable 802.1X:
A4(su)->set dot1x enable
This example shows how to reinitialize ge.1.2:
A4(rw)->set dot1x port init true ge.1.2

set dot1x auth-config

Use this command to configure 802.1X authentication.

Syntax
set dot1x auth-config {[authcontrolled-portcontrol {auto | forced-auth |
forced-unauth}] [maxreq value] [quietperiod value] [reauthenabled {false | true}]
[reauthperiod value] [servertimeout timeout] [supptimeout timeout] [txperiod
value]} [port-string]

Parameters
authcontrolled- Specifies the 802.1X port control mode.
portcontrol
• auto – Set port control mode to auto controlled port control. This
auto | forced-auth |
is the default value.
forced-unauth
• forced-auth – Set port control mode to ForcedAuthorized
controlled port control.
• forced-unauth – Set port control mode to ForcedUnauthorized
controlled port control.
maxreq value Specifies the maximum number of authentication requests allowed
by the backend authentication state machine. Valid values are 1 – 10.
Default value is 2.
quietperiod value Specifies the time (in seconds) following a failed authentication
before another attempt can be made by the authenticator PAE state
machine. Valid values are 0 – 65535. Default value is 60 seconds.
reauthenabled false | Enables (true) or disables (false) reauthentication control of the
true reauthentication timer state machine. Default value is false.
reauthperiod value Specifies the time lapse (in seconds) between attempts by the
reauthentication timer state machine to reauthenticate a port. Valid
values are 0 – 65535. Default value is 3600 seconds.
servertimeout timeout Specifies a timeout period (in seconds) for the authentication server,
used by the backend authentication state machine. Valid values are 1
– 300. Default value is 30 seconds.

27-16 Authentication and Authorization Configuration

 clear dot1x auth-config

supptimeout timeout Specifies a timeout period (in seconds) for the authentication
supplicant used by the backend authentication state machine. Valid
values are 1 – 300. Default value is 30 seconds.
txperiod value Specifies the period (in seconds) which passes between authenticator
PAE state machine EAP transmissions. Valid values are 0 – 65535.
Default value is 30 seconds.
port-string (Optional) Limits the configuration of desired settings to specified
port(s).

Defaults
If port-string is not specified, authentication parameters will be set on all ports.

Mode
Switch command, read-write.

Examples
This example shows how to enable reauthentication control on ports fe.1.1-3:
A4(su)->set dot1x auth-config reauthenabled true fe.1.1-3
This example shows how to set the 802.1X quiet period to 120 seconds on ports fe.1.1-3:
A4(su)->set dot1x auth-config quietperiod 120 fe.1.1-3

clear dot1x auth-config

Use this command to reset 802.1X authentication parameters to default values on one or more
ports.

Syntax
clear dot1x auth-config [authcontrolled-portcontrol] [maxreq] [quietperiod]
[reauthenabled] [reauthperiod] [servertimeout] [supptimeout] [txperiod] [port-
string]

Parameters
authcontrolled- (Optional) Resets the 802.1X port control mode to auto.
portcontrol
maxreq (Optional) Resets the maximum requests value to 2.
quietperiod (Optional) Resets the quiet period value to 60 seconds.
reauthenabled (Optional) Resets the reauthentication control state to disabled (false).
reauthperiod (Optional) Resets the reauthentication period value to 3600 seconds.
servertimeout (Optional) Resets the server timeout value to 30 seconds.
supptimeout (Optional) Resets the authentication supplicant timeout value to 30
seconds.
txperiod (Optional) Resets the transmission period value to 30 seconds.
port-string (Optional) Resets settings on specific port(s).

Extreme A4 CLI Reference 27-17

show eapol

Defaults
If no parameters are specified, all authentication parameters will be reset.
If port-string is not specified, parameters will be set on all ports.

Mode
Switch command, read-write.

Examples
This example shows how to reset the 802.1X port control mode to auto on all ports:
A4(su)->clear dot1x auth-config authcontrolled-portcontrol
This example shows how to reset reauthentication control to disabled on ports fe.1.1-3:
A4(su)->clear dot1x auth-config reauthenabled fe.1.1-3
This example shows how to reset the 802.1X quiet period to 60 seconds on ports fe.1.1-3:
A4(su)->clear dot1x auth-config quietperiod fe.1.1-3

show eapol
Use this command to display EAPOL status or settings for one or more ports.

Syntax
show eapol [port-string]

Parameters
port-string (Optional) Displays EAPOL status for specific port(s). For a detailed
description of possible port-string values, refer to Chapter 8, “Port
Configuration,” in the Fixed Switching Configuration Guide.

Defaults
If port-string is not specified, only EAPOL enable status will be displayed.

Mode
Switch command, read-only.

Example
This example shows how to display EAPOL status for ports fe.1.1-3:
A4(su)->show eapol fe.1.1-3
EAPOL is disabled.

Port Authentication State Authentication Mode

-------- -------------------- --------------------
fe.1.1 Initialize Auto
fe.1.2 Initialize Auto
fe.1.3 Initialize Auto
Table 27-2 provides an explanation of the command output. For details on using the set eapol
command to enable the protocol and assign an authentication mode, refer to “set eapol” on
page 27-20.

27-18 Authentication and Authorization Configuration

 show eapol

Table 27-2 show eapol Output Details

Output Field What It Displays...

Port Port designation. For a detailed description of possible port-string values, refer to
Chapter 8, “Port Configuration,” in the Fixed Switching Configuration Guide.
Authentication State Current EAPOL authentication state for each port. Possible internal states for the
authenticator (switch) are:
• initialize: A port is in the initialize state when:
– authentication is disabled,
– authentication is enabled and the port is not linked, or
– authentication is enabled and the port is linked. (In this case very
little time is spent in this state, it immediately transitions to the
connecting state, via disconnected.
• disconnected: The port passes through this state on its way to connected
whenever the port is reinitialized, via link state change, reauthentication failure, or
management intervention.
• connecting: While in this state, the authenticator sends request/ID messages to
the end user.
• authenticating: The port enters this state from connecting after receiving a
response/ID from the end user. It remains in this state until the entire
authentication exchange between the end user and the authentication server
completes.
• authenticated: The port enters this state from authenticating state after the
exchange completes with a favorable result. It remains in this state until linkdown,
logoff, or until a reauthentication begins.
• aborting: The port enters this state from authenticating when any event occurs
that interrupts the login exchange.
• held: After any login failure the port remains in this state for the number of
seconds equal to quietPeriod (can be set using MIB).
• forceAuth: Management is allowing normal, unsecured switching on this port.
• forceUnauth: Management is preventing any frames from being forwarded to or
from this port.

Authentication Mode Mode enabling network access for each port. Modes include:
• Auto: Frames are forwarded according to the authentication state of each port.
• Forced Authorized Mode: Meant to disable authentication on a port. It is
intended for ports that support ISLs and devices that cannot authenticate, such
as printers and file servers. If a default policy is applied to the port via the policy
profile MIB, then frames are forwarded according to the configuration set by that
policy, otherwise frames are forwarded according to the current configuration for
that port. Authentication using 802.1X is not possible on a port in this mode.
• Forced Unauthorized Mode: All frames received on the port are discarded by a
filter. Authentication using 802.1X is not possible on a port in this mode.

Extreme A4 CLI Reference 27-19

set eapol

set eapol
Use this command to enable or disable EAPOL port-based user authentication with the RADIUS
server and to set the authentication mode for one or more ports.

Syntax
set eapol [enable | disable] [auth-mode {auto | forced-auth | forced-unauth}
port-string

Parameters
enable | disable Enables or disables EAPOL.
auth-mode Specifies the authentication mode as:
auto | • auto - Auto authorization mode. This is the default mode and will
forced-auth | forward frames according to the authentication state of the port. For
forced-unauth details on this mode, refer to Table 27-2.
• forced-auth - Forced authorized mode, which disables authentication
on the port.
• forced-unauth - Forced unauthorized mode, which filters and discards
all frames received on the port.
port-string Specifies the port(s) on which to set EAPOL parameters. For a detailed
description of possible port-string values, refer to Chapter 8, “Port
Configuration,” in the Fixed Switching Configuration Guide.

Defaults
None.

Mode
Switch command, read-write.

Examples
This example shows how to enable EAPOL:
A4(su)->set eapol enable

This example shows how to enable EAPOL with forced authorized mode on port fe.1.1:
A4(su)->set eapol auth-mode forced-auth fe.1.1

clear eapol
Use this command to globally clear the EAPOL authentication mode, or to clear settings for one or
more ports.

Syntax
clear eapol [auth-mode] [port-string]

27-20 Authentication and Authorization Configuration

 Configuring MAC Authentication

Parameters
auth-mode (Optional) Globally clears the EAPOL authentication mode.
port-string Specifies the port(s) on which to clear EAPOL parameters. For a detailed
description of possible port-string values, refer to Chapter 8, “Port
Configuration,” in the Fixed Switching Configuration Guide.

Defaults
If auth-mode is not specified, all EAPOL settings will be cleared.
If port-string is not specified, settings will be cleared for all ports.

Mode
Switch command, read-write.

Example
This example shows how to clear the EAPOL authentication mode for port ge.1.3:
A4(su)->clear eapol auth-mode ge.1.3

Configuring MAC Authentication

Use the following commands to review, disable, enable and configure MAC authentication.

For information about... Refer to page...

show macauthentication 27-22

show macauthentication session 27-23

set macauthentication 27-24

set macauthentication password 27-24

clear macauthentication password 27-25

set macauthentication port 27-25

set macauthentication portinitialize 27-26

set macauthentication portquietperiod 27-26

clear macauthentication portquietperiod 27-27

set macauthentication macinitialize 27-28

set macauthentication reauthentication 27-28

set macauthentication portreauthenticate 27-29

set macauthentication macreauthenticate 27-29

set macauthentication reauthperiod 27-30

clear macauthentication reauthperiod 27-30

set macauthentication significant-bits 27-31

clear macauthentication significant-bits 27-31

Extreme A4 CLI Reference 27-21

show macauthentication

show macauthentication
Use this command to display MAC authentication information for one or more ports.

Syntax
show macauthentication [port-string]

Parameters
port-string (Optional) Displays MAC authentication information for specific port(s).
For a detailed description of possible port-string values, refer to Chapter 8,
“Port Configuration,” in the Fixed Switching Configuration Guide.

Defaults
If port-string is not specified, MAC authentication information will be displayed for all ports.

Mode
Switch command, read-only.

Example
This example shows how to display MAC authentication information for ge.2.1 through 8:
A4(su)->show macauthentication ge.2.1-8
MAC authentication: - enabled
MAC user password: - NOPASSWORD
Port username significant bits - 48

Port Port Reauth Auth Auth Reauthentications

State Period Allowed Allocated
------- -------- ---------- -------- --------- -----------------
ge.2.1 disabled 3600 1 1 disabled
ge.2.2 disabled 3600 1 1 disabled
ge.2.3 disabled 3600 1 1 disabled
ge.2.4 disabled 3600 1 1 disabled
ge.2.5 disabled 3600 1 1 disabled
ge.2.6 disabled 3600 1 1 disabled
ge.2.7 disabled 3600 1 1 disabled
ge.2.8 disabled 3600 1 1 disabled
Table 27-3 provides an explanation of the command output.

Table 27-3 show macauthentication Output Details

Output Field What It Displays...

MAC authentication Whether MAC authentication is globally enabled or disabled. Set using the set
macauthentication command as described in “set macauthentication” on
page 27-24.

MAC user password User password associated with MAC authentication on the device. Set using the set
macauthentication password command as described in “set macauthentication
password” on page 27-24.

27-22 Authentication and Authorization Configuration

 show macauthentication session

Table 27-3 show macauthentication Output Details (Continued)

Output Field What It Displays...

Port username Number of significant bits in the MAC addresses to be used starting with the left-most
significant bits bit of the vendor portion of the MAC address. The significant portion of the MAC
address is sent as a user-name credential when the primary attempt to authenticate
the full MAC address fails. Any other failure to authenticate the full address, (i.e.,
authentication server timeout) causes the next attempt to start once again with a full
MAC authentication. Default value of 48 can be changed with the set
macauthentication significant-bits command.

Port Port designation. For a detailed description of possible port-string values, refer to
Chapter 8, “Port Configuration,” in the Fixed Switching Configuration Guide.
Port State Whether or not MAC authentication is enabled or disabled on this port.

Reauth Period Reauthentication period for this port. Default value of 30 can be changed using the
set macauthentication reauthperiod command (page 27-30).

Auth Allowed Number of concurrent authentications supported on this port.

Auth Allocated Maximum number of MAC authentications permitted on this port.

Reauthentications Whether or not reauthentication is enabled or disabled on this port. Set using the set
macauthentication reauthentication command (page 27-28).

show macauthentication session

Use this command to display the active MAC authenticated sessions.

Syntax
show macauthentication session

Parameters
None.

Defaults
If port-string is not specified, MAC session information will be displayed for all MAC
authentication ports.

Mode
Switch command, read-only.

Usage
Changing the Reauth Period with the set macauthentication reauthperiod command does not
affect current sessions. New sessions display the correct period.

Example
This example shows how to display MAC session information:
A4(su)->show macauthentication session
Port MAC Address Duration Reauth Period Reauthentications
----- ----------------- ---------- ------------- -----------------
ge.1.2 00:60:97:b5:4c:07 0,00:52:31 3600 disabled

Extreme A4 CLI Reference 27-23

set macauthentication

Table 27-4 provides an explanation of the command output.

Table 27-4 show macauthentication session Output Details

Output Field What It Displays...

Port Port designation. For a detailed description of possible port-string values, refer to
Chapter 8, “Port Configuration,” in the Fixed Switching Configuration Guide.
MAC Address MAC address associated with the session.

Duration Time this session has been active.

Reauth Period Reauthentication period for this port, set using the set macauthentication
reauthperiod command described in “set macauthentication reauthperiod” on
page 27-30.

Reauthentications Whether or not reauthentication is enabled or disabled on this port. Set using the set
macauthentication reauthentication command described in “set
macauthentication reauthentication” on page 27-28.

set macauthentication
Use this command to globally enable or disable MAC authentication.

Syntax
set macauthentication {enable | disable}

Parameters
enable | disable Globally enables or disables MAC authentication.

Mode
Switch command, read-write.

Defaults
None.

Example
This example shows how to globally enable MAC authentication:
A4(su)->set macauthentication enable

set macauthentication password

Use this command to set a MAC authentication password.

Syntax
set macauthentication password password

Parameters
password Specifies a text string MAC authentication password.

27-24 Authentication and Authorization Configuration

 clear macauthentication password

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the MAC authentication password to “macauth”:
A4(su)->set macauthentication password macauth

clear macauthentication password

Use this command to clear the MAC authentication password.

Syntax
clear macauthentication password

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the MAC authentication password:
A4(su)->clear macauthentication password

set macauthentication port

Use this command to enable or disable one or more ports for MAC authentication.

Syntax
set macauthentication port {enable | disable} port-string

Parameters
enable | disable Enables or disables MAC authentication.
port-string Specifies port(s) on which to enable or disable MAC authentication. For a
detailed description of possible port-string values, refer to Chapter 8, “Port
Configuration,” in the Fixed Switching Configuration Guide.

Defaults
None.

Extreme A4 CLI Reference 27-25

set macauthentication portinitialize

Mode
Switch command, read-write.

Usage
Enabling port(s) for MAC authentication requires globally enabling MAC authentication on the
switch as described in “set macauthentication” on page 27-24, and then enabling it on a port-by-
port basis. By default, MAC authentication is globally disabled and disabled on all ports.

Example
This example shows how to enable MAC authentication on ge.2.1 though 5:
A4(su)->set macauthentication port enable ge.2.1-5

set macauthentication portinitialize

Use this command to force one or more MAC authentication ports to re-initialize and remove any
currently active sessions on those ports.

Syntax
set macauthentication portinitialize port-string

Parameters
port-string Specifies the MAC authentication port(s) to re-initialize. For a detailed
description of possible port-string values, refer to Chapter 8, “Port
Configuration,” in the Fixed Switching Configuration Guide.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to force ge.2.1 through 5 to initialize:
A4(su)->set macauthentication portinitialize ge.2.1-5

set macauthentication portquietperiod

This sets the number of seconds following a failed authentication before another attempt may be
made on the port.

Syntax
set macauthentication portquietperiod time port-string

27-26 Authentication and Authorization Configuration

 clear macauthentication portquietperiod

Parameters
time Period in seconds to wait after a failed authentication. By default, this is 30
seconds.
port-string Specifies the ports for which the quit period is to be applied. For a detailed
description of possible port-string values, refer to Chapter 8, “Port
Configuration,” in the Fixed Switching Configuration Guide.

Defaults
None.

Mode
Switch command, read-write.

Example
This example sets port 1 to wait 5 seconds after a failed authentication attempt before a new
attempt can be made:
A4(su)->set macauthentication portquietperiod 5 ge.1.1

clear macauthentication portquietperiod

This sets the quiet period back to the default value of 30 seconds.

Syntax
clear macauthentication portquietperiod [port-string]

Parameters
port-string (Optional) Specifies the ports for which the quiet period is to be reset. For a
detailed description of possible port-string values, refer to Chapter 8, “Port
Configuration,” in the Fixed Switching Configuration Guide.

Defaults
If a port-string is not specified then all ports will be set to the default port quiet period.

Mode
Switch command, read-write.

Example
This example resets the default quiet period on port 1:
A4(su)->clear macauthentication portquietperiod ge.1.1

Extreme A4 CLI Reference 27-27

set macauthentication macinitialize

set macauthentication macinitialize

Use this command to force a current MAC authentication session to re-initialize and remove the
session.

Syntax
set macauthentication macinitialize mac-addr

Parameters
mac-addr Specifies the MAC address of the session to re-initialize.

Mode
Switch command, read-write.

Defaults
None.

Example
This example shows how to force the MAC authentication session for address 00-60-97-b5-4c-07
to re-initialize:
A4(su)->set macauthentication macinitialize 00-60-97-b5-4c-07

set macauthentication reauthentication

Use this command to enable or disable reauthentication of all currently authenticated MAC
addresses on one or more ports.

Syntax
set macauthentication reauthentication {enable | disable} port-string

Parameters
enable | disable Enables or disables MAC reauthentication.
port-string Specifies port(s) on which to enable or disable MAC reauthentication. For a
detailed description of possible port-string values, refer to Chapter 8, “Port
Configuration,” in the Fixed Switching Configuration Guide.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to enable MAC reauthentication on ge.4.1 though 5:
A4(su)->set macauthentication reauthentication enable ge.4.1-5

27-28 Authentication and Authorization Configuration

 set macauthentication portreauthenticate

set macauthentication portreauthenticate

Use this command to force an immediate reauthentication of the currently active sessions on one
or more MAC authentication ports.

Syntax
set macauthentication portreauthenticate port-string

Parameters
port-string Specifies MAC authentication port(s) to be reauthenticated. For a detailed
description of possible port-string values, refer to Chapter 8, “Port
Configuration,” in the Fixed Switching Configuration Guide.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to force ge.2.1 though 5 to reauthenticate:
A4(su)->set macauthentication portreauthentication ge.2.1-5

set macauthentication macreauthenticate

Use this command to force an immediate reauthentication of a MAC address.

Syntax
set macauthentication macreauthenticate mac-addr

Parameters
mac-addr Specifies the MAC address of the session to reauthenticate.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to force the MAC authentication session for address 00-60-97-b5-4c-07
to reauthenticate:
A4(su)->set macauthentication macreauthenticate 00-60-97-b5-4c-07

Extreme A4 CLI Reference 27-29

set macauthentication reauthperiod

set macauthentication reauthperiod

Use this command to set the MAC reauthentication period (in seconds). This is the time lapse
between attempts to reauthenticate any current MAC address authenticated to a port.

Syntax
set macauthentication reauthperiod time port-string

Parameters
time Specifies the number of seconds between reauthentication attempts. Valid
values are 1 - 4294967295.
port-string Specifies the port(s) on which to set the MAC reauthentication period. For a
detailed description of possible port-string values, refer to Chapter 8, “Port
Configuration,” in the Fixed Switching Configuration Guide.

Defaults
None.

Mode
Switch command, read-write.

Usage
Changing the Reauth Period with the set macauthentication reauthperiod command does not
affect current sessions. New sessions will use the correct period.

Example
This example shows how to set the MAC reauthentication period to 7200 seconds (2 hours) on
ge.2.1 through 5:
A4(su)->set macauthentication reauthperiod 7200 ge.2.1-5

clear macauthentication reauthperiod

Use this command to clear the MAC reauthentication period on one or more ports.

Syntax
clear macauthentication reauthperiod [port-string]

Parameters
port-string (Optional) Clears the MAC reauthentication period on specific port(s). For a
detailed description of possible port-string values, refer to Chapter 8, “Port
Configuration,” in the Fixed Switching Configuration Guide.

Defaults
If port-string is not specified, the reauthentication period will be cleared on all ports.

Mode
Switch command, read-write.

27-30 Authentication and Authorization Configuration

 set macauthentication significant-bits

Example
This example shows how to globally clear the MAC reauthentication period:
A4(su)->clear macauthentication reauthperiod

set macauthentication significant-bits

Use this command to set the number of significant bits of the MAC address to use for
authentication.

Syntax
set macauthentication significant-bits number

Parameters
number Specifies the number of significant bits to be used for authentication.

Defaults
None.

Mode
Switch command, read-write.

Usage
This command allows you to specify a mask to apply to MAC addresses when authenticating
users through a RADIUS server. The most common use of significant bit masks is for
authentication of all MAC addresses for a specific vendor.
On switches using MAC authentication, the MAC address of a user attempting to log in is sent to
the RADIUS server as the user name. If access is denied, and if a significant bit mask has been
configured (other than 48) with this command, the switch will apply the mask and resend the
masked address to the RADIUS server. For example, if a user with MAC address of 00-16-CF-12-
34-56 is denied access, and a 32 bit mask has been configured, the switch will apply the mask and
resend a MAC address of 00-16-CF-12-00-00 to the RADIUS server.
To use a significant bits mask for authentication of devices by a particular vendor, specify a 24-bit
mask, to mask out everything except the vendor portion of the MAC address.

Example
This example sets the MAC authentication significant bits mask to 24.
A4(su)->set macauthentication significant-bits 24

clear macauthentication significant-bits

Use this command to reset the number of significant bits of the MAC address to use for
authentication to the default of 48.

Syntax
clear macauthentication significant-bits

Extreme A4 CLI Reference 27-31

Configuring Multiple Authentication Methods

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example resets the MAC authentication significant bits to 48.
A4(su)->clear macauthentication significant-bits

Configuring Multiple Authentication Methods

Use the following commands to configure multiple authentication types and multi-user
authentication. Refer to Chapter 10, “Configuring User Authentication,” in the Fixed Switching
Configuration Guide for a detailed discussion of multiple authentication types and multi-user
authentication.

For information about... Refer to page...

show multiauth 27-33

set multiauth mode 27-33

clear multiauth mode 27-34

set multiauth precedence 27-34

clear multiauth precedence 27-35

show multiauth port 27-35

set multiauth port 27-36

clear multiauth port 27-37

show multiauth station 27-38

show multiauth session 27-38

show multiauth idle-timeout 27-39

set multiauth idle-timeout 27-40

clear multiauth idle-timeout 27-40

show multiauth session-timeout 27-41

set multiauth session-timeout 27-42

clear multiauth session-timeout 27-42

show multiauth trap 27-43

set multiauth trap 27-44

clear multiauth trap 27-45

27-32 Authentication and Authorization Configuration

 show multiauth

show multiauth
Use this command to display multiple authentication system configuration.

Syntax
show multiauth

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display multiple authentication system configuration:
A4(rw)->show multiauth

Multiple authentication system configuration

-------------------------------------------------
Supported types : dot1x, pwa, mac, cep
Maximum number of users : 96
Current number of users : 2
System mode : multi
Default precedence : dot1x, pwa, mac, cep
Admin precedence :
Operational precedence : dot1x, pwa, mac, cep

set multiauth mode

Use this command to set the system authentication mode to allow multiple authenticators
simultaneously (802.1x, PWA, MAC, CEP Authentication) on a single port, or to strictly adhere to
802.1x authentication.

Syntax
set multiauth mode {multi | strict}

Parameters
multi Allows the system to use multiple authenticators simultaneously (802.1x,
PWA, MAC, CEP Authentication) on a port. This is the default mode.
strict User must authenticate using 802.1x authentication before normal traffic
(anything other than authentication traffic) can be forwarded.

Defaults
None.

Extreme A4 CLI Reference 27-33

clear multiauth mode

Mode
Switch command, read-write.

Usage
Multiauth multi mode requires that CEP, MAC, PWA, and 802.1X authentication be enabled
globally, and configured appropriately on the desired ports according to their corresponding
command sets described in this chapter. Refer to “Configuring 802.1X Authentication” on
page 27-12 and “Configuring MAC Authentication” on page 27-21 and “Configuring Port Web
Authentication (PWA)” on page 27-65 and “Configuring Convergence End Points Phone
Detection” on page 27-75.

Example
This example shows how to enable simultaneous multiple authentications:
A4(rw)->set multiauth mode multi

clear multiauth mode

Use this command to clear the system authentication mode.

Syntax
clear multiauth mode

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the system authentication mode:
A4(rw)->clear multiauth mode

set multiauth precedence

Use this command to set the system’s multiple authentication administrative precedence.

Syntax
set multiauth precedence {[dot1x] [mac] [pwa][cep]}

Parameters
dot1x Sets precedence for 802.1X authentication.
mac Sets precedence for MAC authentication.
pwa Sets precedence for port web authentication.

27-34 Authentication and Authorization Configuration

 clear multiauth precedence

cep Sets precedence for convergence endpoint detection.

Defaults
Default precedence order is dot1x, pwa, mac.

Mode
Switch command, read-write.

Usage
When a user is successfully authenticated by more than one method at the same time, the
precedence of the authentication methods will determine which RADIUS-returned filter ID will be
processed and result in an applied traffic policy profile.

Example
This example shows how to set precedence for MAC authentication:
A4(rw)->set multiauth precedence mac dot1x

clear multiauth precedence

Use this command to clear the system’s multiple authentication administrative precedence to the
default precedence order.

Syntax
clear multiauth precedence

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the multiple authentication precedence:
A4(rw)->clear multiauth precedence

show multiauth port

Use this command to display multiple authentication properties for one or more ports.

Syntax
show multiauth port [port-string]

Extreme A4 CLI Reference 27-35

set multiauth port

Parameters
port-string (Optional) Displays multiple authentication information for specific port(s).

Defaults
If port-string is not specified, multiple authentication information will be displayed for all ports.

Mode
Switch command, read-only.

Example
This example shows how to display multiple authentication information for ports ge.3.1-4. The
number of “Max users” shown by this command varies depending on the platform.
A4(rw)->show multiauth port ge.3.1-4

Port Mode Max Allowed Current

users users users
------------ ------------ ---------- ---------- ----------
ge.3.1 auth-opt n 1 0
ge.3.2 auth-opt n 1 0
ge.3.3 auth-opt n 1 0
ge.3.4 auth-opt n 1 0

set multiauth port

Use this command to set multiple authentication properties for one or more ports.

Syntax
set multiauth port mode {auth-opt | auth-reqd | force-auth | force-unauth} |
numusers numusers port-string

Parameters
mode Specifies the port(s)’ multiple authentication mode as:
auth-opt |
• auth-opt — Authentication optional (“non-strict” behavior). If a user
auth-reqd |
does not attempt to authenticate using 802.1x, or if 802.1x
force-auth |
authentication fails, the port will allow traffic to be forwarded
force-unauth
according to the defined default VLAN. This mode is typically used
with a default policy that restricts the unauthenticated user while
allowing the authenticated user to gain a higher level of network access.
• auth-reqd — Authentication is required. All user traffic is dropped
until the user authenticates.
• force-auth — Authentication disable, all traffic is allowed to pass (this
mode is often set on underlying lag ports)
force-unauth — Authentication disabled. The authentication ID is disabled,
no authentication is possible, and all traffic is dropped.

27-36 Authentication and Authorization Configuration

 clear multiauth port

numusers Specifies the number of users allowed authentication on port(s). Valid

numusers values depend on your specific platform. Refer to the Release Notes for your
platform for information about multi-user capacities.
port-string Specifies the port(s) on which to set multiple authentication properties.

Defaults
Default value for the number of users allowed to authenticate on a port is 1.

Mode
Switch command, read-write.

Examples
This example shows how to set the port multiple authentication mode to required on ge.3.14:
A4(rw)->set multiauth port mode auth-reqd ge.3.14
This example shows how to set the number of users allowed to authenticate on port ge.3.14 to 2:
A4(rw)->set multiauth port numusers 2 ge.3.14

clear multiauth port

Use this command to clear multiple authentication properties for one or more ports.

Syntax
clear multiauth port {mode | numusers} port-string

Parameters
mode Clears the specified port’s multiple authentication mode.
numusers Clears the value set for the number of users allowed authentication on the
specified port.
port-string Specifies the port or ports on which to clear multiple authentication
properties.

Defaults
None.

Mode
Switch command, read-write.

Examples
This example shows how to clear the port multiple authentication mode on port ge.3.14:
A4(rw)->clear multiauth port mode ge.3.14
This example shows how to clear the number of users on port ge.3.14:
A4(rw)->clear multiauth port numusers ge.3.14

Extreme A4 CLI Reference 27-37

show multiauth station

show multiauth station

Use this command to display multiple authentication station (end user) entries.

Syntax
show multiauth station [mac address] [port port-string]

Parameters
mac address (Optional) Displays multiple authentication station entries for a specific
MAC address.
port port-string (Optional) Displays multiple authentication station entries for one or more
ports.

Mode
Switch command, read-only.

Defaults
If no options are specified, multiple authentication station entries will be displayed for all MAC
addresses and ports.

Example
This example shows how to display multiple authentication station entries. In this case, two end
user MAC addresses are shown:
A4(rw)->show multiauth station
Port Address type Address
------------ ------------ ------------------------
fe.1.20 mac 00-10-a4-9e-24-87
fe.2.16 mac 00-b0-d0-e5-0c-d0

show multiauth session

Use this command to display multiple authentication session entries.

Syntax
show multiauth session [all] [agent {dot1x | mac | pwa | cep}] [mac address]
[port port-string]

Parameters
all (Optional) Displays information about all sessions, including those with
terminated status.
agent dot1x | mac | (Optional) Displays 802.1X, or MAC, or port web authentication or CEP
pwa | cep session information.
mac address (Optional) Displays multiple authentication session entries for specific
MAC address(es).
port port-string (Optional) Displays multiple authentication session entries for the
specified port or ports.

27-38 Authentication and Authorization Configuration

 show multiauth idle-timeout

Defaults
If no options are specified, multiple authentication session entries will be displayed for all
sessions, authentication types, MAC addresses, and ports.

Mode
Switch command, read-only.

Example
This example shows how to display multiple authentication session information for port fe.1.9.
A4(su)->show multiauth session port ge.1.9
Multiple authentication session entries
__________________________________________
Port | ge.1.9 Station address | 00-A0-C9-39-5C-B4
Auth status | success Last attempt | MON APR 22 12:37:26 2013
Agent type | dot1x Session applied | true
Server type | radius VLAN-Tunnel-Attr | none
Policy index | 1 Policy name | Sales
Session timeout | 900 Session duration | 0,00:00:07
Idle timeout | 0 Idle time | 0,00:00:00
Termination time | Not Terminated Terminate Action | Terminate

show multiauth idle-timeout

Use this command to display the timeout value, in seconds, for an idle session for all
authentication methods.

Syntax
show multiauth idle-timeout

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display timeout values for an idle session for all authentication types.
A4(su)->show multiauth idle-timeout
Authentication type Timeout (sec)
------------------- -------------
cep 0
dot1x 0
pwa 0
mac 0

Extreme A4 CLI Reference 27-39

set multiauth idle-timeout

set multiauth idle-timeout

Use this command to set the maximum number of consecutive seconds an authenticated session
may be idle before termination of the session.

Syntax
set multiauth idle-timeout [dot1x | mac | pwa | cep] timeout

Parameters
dot1x (Optional) Specifies the IEEE 802.1X port-based network access control
authentication method for which to set the timeout value.
mac (Optional) Specifies the Extreme MAC authentication method for which
to set the timeout value.
pwa (Optional) Specifies the Extreme Port Web Authentication method for
which to set the timeout value.
cep (Optional) Specifies the convergence end point detection authentication
method for which to set the timeout value.
timeout Specifies the timeout value in seconds. The value can range from 0 to
65535. A value of 0 means that no idle timeout will be applied unless an
idle timeout value is provided by the authenticating server.

Defaults
If no authentication method is specified, the idle timeout value is set for all authentication
methods.

Mode
Switch mode, read-write.

Usage
If you set an idle timeout value, a MAC user whose MAC address has aged out of the forwarding
database will be unauthenticated if no traffic has been seen from that address for the specified idle
timeout period.
A value of zero indicates that no idle timeout will be applied unless an idle timeout value is
provided by the authenticating server. For example, if a session is authenticated by a RADIUS
server, that server may encode a Idle-Timeout Attribute in its authentication response.

Example
This example sets the idle timeout value for all authentication methods to 300 seconds.
A4(su)->set multiauth idle-timeout 300

clear multiauth idle-timeout

Use this command to reset the maximum number of consecutive seconds an authenticated session
may be idle before termination of the session to its default value of 0.

Syntax
clear multiauth idle-timeout [dot1x | mac | pwa | cep]

27-40 Authentication and Authorization Configuration

 show multiauth session-timeout

Parameters
dot1x (Optional) Specifies the IEEE 802.1X port-based network access control
authentication method for which to reset the timeout value to its
default.
mac (Optional) Specifies the MAC authentication method for which to reset
the timeout value to its default.
pwa (Optional) Specifies the Port Web Authentication method for which to
reset the timeout value to its default.
cep (Optional) Specifies the convergence end point detection authentication
method for which to reset the timeout value to its default.

Defaults
If no authentication method is specified, the idle timeout value is reset to its default value of 0 for
all authentication methods.

Mode
Switch mode, read-write.

Example
This example resets the idle timeout value for all authentication methods to 0 seconds.
A4(su)->clear multiauth idle-timeout

show multiauth session-timeout

Use this command to display the session timeout value, in seconds, for all authentication methods.

Syntax
show multiauth session-timeout

Parameters
None.

Defaults
None.

Mode
Switch mode, read-only.

Example
This example displays the session timeout values for all authentication methods.
A4(su)->show multiauth session-timeout
Authentication type Timeout (sec)
------------------- -------------
cep 0
dot1x 0
pwa 0
mac 0

Extreme A4 CLI Reference 27-41

set multiauth session-timeout

set multiauth session-timeout

Use this command to set the maximum number of seconds an authenticated session may last
before termination of the session.

Syntax
set multiauth session-timeout [dot1x | mac | pwa | cep] timeout

Parameters
dot1x (Optional) Specifies the IEEE 802.1X port-based network access control
authentication method for which to set the session timeout value.
mac (Optional) Specifies the Extreme MAC authentication method for which
to set the session timeout value.
pwa (Optional) Specifies the Port Web Authentication method for which to
set the session timeout value.
cep (Optional) Specifies the convergence end point detection authentication
method for which to set the session timeout value.
timeout Specifies the timeout value in seconds. The value can range from 0 to
65535 (CEP lowest supported value is 300). A value of 0 means that no
session timeout will be applied unless a session timeout value is
provided by the authenticating server.

Defaults
If no authentication method is specified, the session timeout value is set for all authentication
methods.

Mode
Switch mode, read-write.

Usage
A value of zero may be superseded by a session timeout value provided by the authenticating
server. For example, if a session is authenticated by a RADIUS server, that server may encode a
Session-Timeout Attribute in its authentication response.

Example
This example sets the session timeout value for the IEEE 802.1X authentication method to 300
seconds.
A4(su)->set multiauth session-timeout dot1x 300

clear multiauth session-timeout

Use this command to reset the maximum number of consecutive seconds an authenticated session
may last before termination of the session to its default value of 0.

Syntax
clear multiauth session-timeout [dot1x | mac | pwa | cep]

27-42 Authentication and Authorization Configuration

 show multiauth trap

Parameters
dot1x (Optional) Specifies the IEEE 802.1X port-based network access control
authentication method for which to reset the timeout value to its
default.
mac (Optional) Specifies the MAC authentication method for which to reset
the timeout value to its default.
pwa (Optional) Specifies the Port Web Authentication method for which to
reset the timeout value to its default.
cep (Optional) Specifies the convergence end point detection authentication
method for which to reset the timeout value to its default.

Defaults
If no authentication method is specified, the session timeout value is reset to its default value of 0
for all authentication methods.

Mode
Switch mode, read-write.

Example
This example resets the session timeout value for the IEEE 802.1X authentication method to 0
seconds.
A4(su)->clear multiauth session-timeout dot1x

show multiauth trap

Use this command to display multiple authentication trap settings for the specified context.

Syntax
show multiauth trap [port port-string] [system]

Parameters
port port-string (Optional) Displays multiple authentication information for specific port(s).
system (Optional) Displays multiple authentication system state.

Defaults
If no option is specified, statistics for all traps are displayed.

Mode
Switch command, read-only.

Extreme A4 CLI Reference 27-43

set multiauth trap

Examples
This example shows how to display multiple authentication trap settings for ports ge.1.1-4.
A4(rw)->show multiauth trap port ge.1.1-4
Location Trap configuration
Success Failed Terminated Max-Reached
------------- ---------- ---------- ---------- ----------
ge.1.1 Disabled Disabled Disabled Disabled
ge.1.2 Disabled Disabled Disabled Disabled
ge.1.3 Disabled Disabled Disabled Disabled
ge.1.4 Disabled Disabled Disabled Disabled
This example shows how to display multiple authentication trap system setting.
A4(rw)->show multiauth trap system
System : Disabled

set multiauth trap

Use this command to set the multiple authentication trap settings.

Syntax
set multiauth trap port port-string {all | success | failed | terminated |
maxreached}

Parameters
port port-string Configures multiple authentication port trap settings for the port
specified by port-string.
all Enables sending all traps for the specified port(s).
success Enables sending success traps for the specified port(s).
failed Enables sending failed traps for the specified port(s).
terminated Enables sending terminated traps for the specified port(s).
maxreached Enables sending the max number users reached traps for the sepcified
port(s).

Defaults
The sending of all multiple authentication traps disabled.

Mode
Switch mode, read-write.

Example
This example enables the sending of all traps to port ge.1.1.
A4(su)->set multiauth trap port ge.1.1 all

27-44 Authentication and Authorization Configuration

 clear multiauth trap

clear multiauth trap

Use this command to disable the multiple authentication trap settings.

Syntax
clear multiauth trap port port-string {all | success | failed | terminated |
maxreached}

Parameters
port port-string Disables multiple authentication port trap settings for the port(s)
specified by port-string.
all Disables sending all traps for the specified port(s).
success Disables sending success traps for the specified port(s).
failed Disables sending failed traps for the specified port(s).
terminated Disables sending terminated traps for the specified port(s).
maxreached Disables sending the max number users reached traps for the sepcified
port(s).

Defaults
None.

Mode
Switch mode, read-write.

Example
This example disables the sending of all traps to port ge.1.1.
A4(su)->clear multiauth trap port ge.1.1 all

Configuring VLAN Authorization (RFC 3580)

Use the following commands to configure VLAN authorization.

For information about... Refer to page...

set vlanauthorization 27-45

set vlanauthorization egress 27-46

clear vlanauthorization 27-47

show vlanauthorization 27-47

set vlanauthorization
Enable or disable the use of the RADIUS VLAN tunnel attribute to put a port into a particular
VLAN based on the result of authentication.

Syntax
set vlanauthorization {enable | disable} [port-string]

Extreme A4 CLI Reference 27-45

set vlanauthorization egress

Parameters
enable | disable Enables or disables vlan authorization/tunnel attributes.
port-string (Optional) Specifies which ports to enable or disable the use of VLAN
tunnel attributes/authorization. For a detailed description of possible port-
string values, refer to Chapter 8, “Port Configuration,” in the Fixed
Switching Configuration Guide.

Defaults
VLAN authentication is disabled by default.

Mode
Switch command, read-write.

Examples
This example shows how to enable VLAN authentication for all Gigabit Ethernet ports:
A4(rw)-> set vlanauthorization enable ge.*.*
This example shows how to disable VLAN authentication for all Gigabit Ethernet ports on switch
unit/module 3:
A4(rw)-> set vlanauthorization disable ge.3.*

set vlanauthorization egress

Controls the modification of the current VLAN egress list of 802.1x authenticated ports for the
VLANs returned in the RADIUS authorization filter id string.

Syntax
set vlanauthorization egress {none | tagged | untagged} port-string

Parameters
none Specifies that no egress manipulation will be made.
tagged Specifies that the authenticating port will be added to the current tagged
egress for the VLAN-ID returned.
untagged Specifies that the authenticating port will be added to the current
untagged egress for the VLAN-ID returned (default).
port-string Specifies that the port or list of ports. to which this command will apply.
For a detailed description of possible port-string values, refer to Chapter 8,
“Port Configuration,” in the Fixed Switching Configuration Guide.

Defaults
By default, administrative egress is set to untagged.

Mode
Switch command, read-write.

27-46 Authentication and Authorization Configuration

 clear vlanauthorization

Example
This example shows how to enable the insertion of the RADIUS assigned VLAN to an 802.1q tag
for all outbound frames for ports 10 through 15 on unit/module number 3.
A4(rw)->set vlanauthorization egress tagged ge.3.10-15

clear vlanauthorization
Use this command to return port(s) to the default configuration of VLAN authorization disabled,
egress untagged.

Syntax
clear vlanauthorization [port-string]

Parameters
port-string (Optional) Specifies which ports are to be restored to default
configuration. If no port string is entered, the action will be a global
setting.

Defaults
If no port string is entered, all ports a will be reset to default configuration with VLAN
authorization disabled and egress frames untagged.

Mode
Switch command, read-write.

Example
This example show how to clear VLAN authorization for all ports on slots 3, 4, and 5:
A4(rw)->clear vlanauthorization ge.3-5.*

show vlanauthorization
Displays the VLAN authentication status and configuration information for the specified ports.

Syntax
show vlanauthorization [port-string]

Parameters
port-string (Optional) Displays VLAN authentication status for the specified ports. If
no port string is entered, then the global status of the setting is displayed.

Defaults
If no port string is entered, the status for all ports will be displayed.

Mode
Switch command, read-only.

Extreme A4 CLI Reference 27-47

Configuring Policy Maptable Response

Example
This command shows how to display VLAN authorization status for ge.1.1:
A4(su)->show vlanauthorization ge.1.1
Vlan Authorization: - enabled
port status administrative operational authenticated vlan id
egress egress mac address
------- -------- -------------- ----------- ----------------- -------
ge.1.1 enabled untagged
Table 27-5 provides an explanation of command output. For details on enabling and assigning
protocol and egress attributes, refer to “set vlanauthorization” on page 27-45 and “set
vlanauthorization egress” on page 27-46.

Table 27-5 show vlanauthorization Output Details

Output Field What It Displays...

port Port identification

status Port status as assigned by set vlanauthorization command

administrative Port status as assigned by the set vlanauthorization egress command

egress

operational egress Port operational status of vlanauthorization egress.

authenticated mac If authentication has succeeded, displays the MAC address assigned for egress.
address

vlan id If authentication has succeeded, displays the assigned VLAN id for ingress.

Configuring Policy Maptable Response

Use the following commands to configure the policy maptable response. Refer to Chapter 10,
“Configuring User Authentication,” in the Fixed Switching Configuration Guide for a detailed
description of this feature and how to use it.

For information about... Refer to page...

show policy maptable 27-48

set policy maptable 27-49

clear policy maptable 27-50

show policy maptable

Use this command to display information about the current VLAN-to-policy mapping table and
the switch’s policy maptable response setting.

Syntax
show policy maptable [vlan-list]

Parameters
vlan-list (Optional) Specifies the VLAN or list of VLANs for which to display the
VLAN-to-policy settings.

27-48 Authentication and Authorization Configuration

 set policy maptable

Defaults
If no VLAN list is specified, all entries in the VLAN-to-policy mapping table are displayed.

Mode
Switch command, read-only.

Usage
This command displays both the policy maptable response setting, and the entries in the VLAN-
to-policy mapping table for one or multiple VLANs.

Example
This example shows how to display the policy maptable response and all the entries in the VLAN-
to-policy mapping table. In this example, hybrid authentication mode is enabled (because the
policy maptable response is both).
A4(rw)->show policy maptable
Policy map response : both
Policy map last change : 1 days 00:23:57

VLAN ID Policy Profile

144 4 (Students)
160 7 (Faculty)

set policy maptable

Use this command to configure the VLAN-to-policy mapping table and also the switch’s maptable
response setting— that is, whether the switch is in tunnel mode, policy mode, or hybrid
authentication mode.

Syntax
set policy maptable {vlan-list policy-index | response {both | policy | tunnel}}

Parameters
vlan-list policy-index Specifies an entry in the VLAN-to-policy mapping table, which relates a
policy profile with a VLAN ID or range of IDs. vlan-list can range from 1
to 4093. policy-index can range from 1 to 1023.
response Indicates that this command is configuring the policy maptable
response.
both Sets the maptable response to look at both the Filter-ID and tunnel
attributes in a RADIUS Access-Accept reply to determine how to
handle an authenticating user. This is equivalent to enabling hybrid
authentication mode.
policy Sets the maptable response to policy mode. The system will look at only
the Filter-ID attributes in a RADIUS Access-Accept reply to determine
how to handle an authenticating user.
tunnel Sets the maptable response to tunnel mode. The system will look at
only the tunnel attributes in a RADIUS Access-Accept reply to
determine how to handle an authenticating user.

Extreme A4 CLI Reference 27-49

clear policy maptable

Defaults
No mapping table entries are configured.
The default policy maptable response setting is policy mode.

Mode
Switch command, read-write.

Usage
This command can be used to create entries in the VLAN-to-policy mapping table and also to set
the switch’s maptable response.
When you are using VLAN authorization for dynamic VLAN assignment, you should set the
policy maptable response to tunnel. See “Configuring VLAN Authorization (RFC 3580)” on
page 27-45.

Examples
This example shows how to set the policy maptable response to both, or hybrid authentication
mode:
A4(rw)->set policy maptable response both
This example shows how to configure a policy mapping entry that will map VLAN 144 to policy
profile 4.
A4(rw)->set policy maptable 144 4

clear policy maptable

Use this command to clear a VLAN-to-policy mapping table entry or to reset the maptable
response to the default value of policy mode.

Syntax
clear policy maptable {vlan-list | response}

Parameters
vlan-list Clears the policy profile mapping for the specified VLAN ID or range of
VLANs.
response Resets the maptable response to policy.

Switch command, read-write.

Usage
This command can be used to remove an entry in the VLAN-to-policy mapping table or to change
the maptable response back to the default value of policy mode.

Example
This example removes the entry in the mapping table for VLAN 144.
A4(rw)->show policy maptable
Policy map response : both
Policy map last change : 1 days 17:23:57

27-50 Authentication and Authorization Configuration

 Configuring MAC Locking

VLAN ID Policy Profile

144 4 (Students)
160 7 (Faculty)

A4(rw)->clear policy maptable 144

A4(rw)->show policy maptable

Policy map response : both
Policy map last change : 1 days 17:24:01

VLAN ID Policy Profile

160 7 (Faculty)

Configuring MAC Locking

Use the following commands to review, disable, enable, and configure MAC locking. Refer to
Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration Guide for a
detailed discussion of using MAC locking.

For information about... Refer to page...

show maclock 27-52

show maclock stations 27-53

set maclock enable 27-54

set maclock disable 27-55

set maclock 27-55

clear maclock 27-56

set maclock static 27-57

clear maclock static 27-57

set maclock firstarrival 27-58

clear maclock firstarrival 27-58

set maclock agefirstarrival 27-59

clear maclock agefirstarrival 27-59

set maclock clearonlinkchange 27-60

clear maclock clearonlinkchange 27-60

set maclock move 27-61

set maclock trap 27-62

set maclock syslog 27-62

set maclock disable-port 27-63

clear maclock disable-port 27-64

clear maclock violation disabled-port 27-64

Extreme A4 CLI Reference 27-51

show maclock

show maclock
Use this command to display the status of MAC locking on one or more ports.

Syntax
show maclock [port-string]

Parameters
port-string (Optional) Displays MAC locking status for specified port(s).

Defaults
If port-string is not specified, MAC locking status will be displayed for all ports.

Mode
Switch command, read-only.

Example
This example shows how to display MAC locking information for ge.1.1.
A4(su)->show maclock ge.1.1-9

MAC locking is globally disabled

Port Port Trap Syslog Aging Port Clr Max Max Last Violating
Number Stat Thr|Viol Thr|Viol Stat Dis|Viol OLC Stc FA MAC Address
-------- ---- -------- -------- ---- -------- --- --- ---- -----------------
ge.1.1 dis dis|dis dis|dis dis dis|dis ena 20 600 00:00:00:00:00:00
ge.1.2 dis dis|dis dis|dis dis dis|dis ena 20 600 00:00:00:00:00:00
ge.1.3 dis dis|dis dis|dis dis dis|dis ena 20 600 00:00:00:00:00:00
ge.1.4 dis dis|dis dis|dis dis dis|dis ena 20 600 00:00:00:00:00:00
ge.1.5 dis dis|dis dis|dis dis dis|dis ena 20 600 00:00:00:00:00:00
ge.1.6 dis dis|dis dis|dis dis dis|dis ena 20 600 00:00:00:00:00:00
ge.1.7 dis dis|dis dis|dis dis dis|dis ena 20 600 00:00:00:00:00:00
ge.1.8 dis dis|dis dis|dis dis dis|dis ena 20 600 00:00:00:00:00:00
ge.1.9 dis dis|dis dis|dis dis dis|dis ena 20 600 00:00:00:00:00:00

Table 27-6 provides an explanation of the command output.

Table 27-6 show maclock Output Details

Output Field What It Displays...

Port Number Port designation.

Port Stat(us) Whether MAC locking is enabled (ena) or disabled (dis) on the port. MAC locking is
globally disabled by default. For details on enabling MAC locking on the switch and
on one or more ports, refer to “set maclock enable” on page 27-54 and “set maclock”
on page 27-55.

Trap Thr | Vio Whether MAC lock threshold (Thr) and violation (Vio) trap messaging is enabled
(ena) or disabled (dis) on the port. For details on setting this status, refer to “set
maclock trap” on page 27-62.

Syslog Thr | Vio Whether MAC lock threshold (Thr) and violation (Vio) syslog messaging is enabled
(ena) or disabled (dis) on the port. For details on setting this status, refer to “set
maclock syslog” on page 27-62.

27-52 Authentication and Authorization Configuration

 show maclock stations

Table 27-6 show maclock Output Details (Continued)

Output Field What It Displays...

Aging Stat(us) Whether aging of FirstArrival MAC addresses is enabled (ena) or disabled (dis) on
the port. Refer to “set maclock agefirstarrival” on page 27-59.

Port Dis | Viol Port Dis shows the port’s threshold shutdown state, enabled (ena) or disabled (dis).
(etsMACLockingThresholdShutdown) Refer to “set maclock disable-port” on
page 27-63.
Port Viol shows the MAC locking shutown state, enabled (ena) or disabled (dis).
(etsMACLockingShutdownState) Refer to “clear maclock violation disabled-port” on
page 27-64.

Clr OLC Shows the state of First Arrival MAC address locking clear on link change, enabled
(ena) or disabled (dis). Refer to “set maclock clearonlinkchange” on page 27-60.

Max Stc The maximum static MAC addresses allowed locked to the port. For details on
setting this value, refer to “set maclock static” on page 27-57.

Max FA The maximum end station MAC addresses allowed locked to the port. For details on
setting this value, refer to “set maclock firstarrival” on page 27-58.

Last Violating MAC Most recent MAC address(es) violating the maximum static and first arrival value(s)
Address set for the port.

show maclock stations

Use this command to display MAC locking information about end stations connected to the
switch.

Syntax
show maclock stations [firstarrival | static] [port-string]

Parameters
firstarrival (Optional) Displays MAC locking information about end stations first
connected to MAC locked ports.
static (Optional) Displays MAC locking information about static (management
defined) end stations connected to MAC locked ports.
port-string (Optional) Displays end station information for specified port(s).

Defaults
If no parameters are specified, MAC locking information will be displayed for all end stations.

Mode
Switch command, read-only.

Example
This example shows how to display MAC locking information for the end stations connected to all
Gigabit Ethernet ports in unit/module 2:
A4(su)->show maclock stations fe.2.*
Port Number MAC Address Status State Aging
------------ ----------------- -------------- -------------- -----
fe.2.1 00:a0:c9:39:5c:b4 active first arrival true

Extreme A4 CLI Reference 27-53

set maclock enable

fe.2.7 00:a0:c9:39:1f:11 active static false

Table 27-7 provides an explanation of the command output.

Table 27-7 show maclock stations Output Details

Output Field What It Displays...

Port Number Port designation.

MAC address MAC address of the end station(s) locked to the port.

Status Whether the end stations are active or inactive.

State Whether the end station locked to the port is a first arrival or static connection.

Aging When true, FirstArrival MACs that have aged out of the forwarding database will be
removed for the associated port lock.

set maclock enable

Use this command to enable MAC locking globally or on one or more ports.

Note: MAC locking needs to be enabled globally and on appropriate ports for it to function.

Syntax
set maclock enable [port-string]

Parameters
port-string (Optional) Enables MAC locking on specific port(s).

Defaults
If port-string is not specified, MAC locking will be enabled globally.

Mode
Switch command, read-write.

Usage
When enabled and configured, MAC locking defines which MAC addresses, as well as how many
MAC addresses are permitted to use specific port(s).
MAC locking is disabled by default at device startup. Configuring one or more ports for MAC
locking requires globally enabling it on the device and then enabling it on the desired ports.

Example
This example shows how to enable MAC locking on fe.2.3:
A4(su)->set maclock enable fe.2.3

27-54 Authentication and Authorization Configuration

 set maclock disable

set maclock disable

Use this command to disable MAC locking globally or on one or more ports.

Syntax
set maclock disable [port-string]

Parameters
port-string (Optional) Disables MAC locking on specific port(s).

Defaults
If port-string is not specified, MAC locking will be disabled globally on the switch.

Mode
Switch command, read-write.

Example
This example shows how to disable MAC locking on fe.2.3:
A4(su)->set maclock disable fe.2.3

set maclock
Use this command to create a static MAC address-to-port locking, and to enable or disable MAC
locking for the specified MAC address and port.

Syntax
set maclock mac-address port-string {create | enable | disable}

Parameters
mac-address Specifies the MAC address for which MAC locking will be created,
enabled or disabled.
port-string Specifies the port on which to create, enable or disable MAC locking for
the specified MAC.
create Establishes a MAC locking association between the specified MAC
address and port. Create automatically enables MAC locking between the
specified MAC address and port.
enable | disable Enables or disables MAC locking between the specified MAC address and
port.

Defaults
None.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 27-55

clear maclock

Usage
Configuring a port for MAC locking requires globally enabling it on the switch first using the set
maclock enable command as described in “set maclock enable” on page 27-54.
Static MAC locking a user on multiple ports is not supported.
Statically MAC locked addresses will display in the show mac output (as described on page 17-9)
as address type “other” and will not remove them on link down.

Example
This example shows how to create a MAC locking association between MAC address 0e-03-ef-d8-
44-55 and port ge.3.2:
A4(rw)->set maclock 0e-03-ef-d8-44-55 ge.3.2 create

clear maclock
Use this command to remove a static MAC address to port locking entry.

Syntax
clear maclock {all | mac-address} port-string

Parameters
all Clears all static entries on the specified port or ports.
mac-address Specifies the MAC address that will be removed from the list of static
MACs allowed to communicate on the port.
port-string Specifies the port on which to clear the MAC address.

Defaults
None.

Mode
Switch command, read-write.

Usage
The MAC address that is cleared will no longer be able to communicate on the port unless the first
arrival limit has been set to a value greater than 0 and this limit has not yet been met.
For example, if user B’s MAC is removed from the static MAC address list and the first arrival
limit has been set to 0, then user B will not be able to communicate on the port. If user A’s MAC is
removed from the static MAC address list and the first arrival limit has been set to 10, but only has
7 entries, user A will become the 8th entry and allowed to communicate on the port.

Example
This example shows how to remove a MAC from the list of static MACs allowed to communicate
on port ge.3.2:
A4(rw)->clear maclock 0e-03-ef-d8-44-55 ge.3.2

27-56 Authentication and Authorization Configuration

 set maclock static

set maclock static

Use this command to set the maximum number of static MAC addresses allowed per port. Static
MACs are administratively defined.

Syntax
set maclock static port-string value

Parameters
port-string Specifies the port on which to set the maximum number of static MACs
allowed.
value Specifies the maximum number of static MAC addresses allowed per
port. Valid values are 0 to 20.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the maximum number of allowable static MACs to 2 on ge.3.1:
A4(rw)->set maclock static ge.3.1 2

clear maclock static

Use this command to reset the number of static MAC addresses allowed per port to the default
value of 20.

Syntax
clear maclock static port-string

Parameters
port-string Specifies the port on which to reset number of static MAC addresses
allowed.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset the number of allowable static MACs on fe.2.3:
A4(rw)->clear maclock static fe.2.3

Extreme A4 CLI Reference 27-57

set maclock firstarrival

set maclock firstarrival

Use this command to restrict MAC locking on a port to a maximum number of end station
addresses first connected to that port.

Syntax
set maclock firstarrival port-string value

Parameters
port-string Specifies the port on which to limit MAC locking.
value Specifies the number of first arrival end station MAC addresses to be
allowed connections to the port. Valid values are 0 to 600.

Defaults
None.

Mode
Switch command, read-write.

Usage
By default, the maclock first arrival count resets when the link goes down. This feature is
beneficial if you have roaming users—the first arrival count will be reset every time a user moves
to another port, but will still protect against connecting multiple devices on a single port and will
protect against MAC address spoofing.
See “set maclock clearonlinkchange” on page 27-60 for information about causing the MAC
locked addresses to be maintained at lilnk state change.

Note: Setting a port’s first arrival limit to 0 does not deny the first MAC address learned on the port
from passing traffic.

Example
This example shows how to restrict MAC locking to 6 MAC addresses on fe.2.3:
A4(su)->set maclock firstarrival fe.2.3 6

clear maclock firstarrival

Use this command to reset the number of first arrival MAC addresses allowed per port to the
default value of 600.

Syntax
clear maclock firstarrival port-string

Parameters
port-string Specifies the port on which to reset the first arrival value.

27-58 Authentication and Authorization Configuration

 set maclock agefirstarrival

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset MAC first arrivals on fe.2.3:
A4(su)->clear maclock firstarrival fe.2.3

set maclock agefirstarrival

Use this command to enable or disable the aging of first arrival MAC addresses. When enabled,
first arrival MAC addresses that are aged out of the forwarding database will be removed from the
associated port MAC lock.

Syntax
set maclock agefirstarrival port-string {enable | disable}

Parameters
port-string Specifies the port(s) on which to enable or disable first arrival aging.
enable | disable Enable or disable first arrival aging. By default, first arrival aging is
disabled.

Defaults
None.

Mode
Switch mode, read-write.

Example
This example enables first arrival aging on port ge.1.1.
A4(su)-> set maclock agefirstarrival ge.1.1 enable

clear maclock agefirstarrival

Use this command to reset first arrival aging on one or more ports to its default state of disabled.

Syntax
clear maclock agefirstarrival port-string

Parameters
port-string Specifies the port(s) on which to disable first arrival aging.

Extreme A4 CLI Reference 27-59

set maclock clearonlinkchange

Defaults
None.

Mode
Switch mode, read-write.

Example
This example disables first arrival aging on port ge.1.1.
A4(su)-> clear maclock agefirstarrival ge.1.1 enable

set maclock clearonlinkchange

Use this command to manage the behavior of First Arrival MAC locking with link state change.

Syntax
set maclock clearonlinkchange port-string {enable | disable}

Parameters
port-string Specifies the port or ports on which to apply the command.
enable | disable Enable or disable clearing of First Arrival MAC locks with a change in
link state.

Defaults
Clear on link change is enabled by default.

Mode
Switch command, read-write.

Usage
If you disable clearing of First Arrival MAC locking, First Arrival MAC addresses will be
maintained on a loss of link.

Example
This example shows how to configure a port to maintain First Arrival MAC address locks on a
port through a link state change.
A4(su)->set maclock clearonlinkchange ge.1.1 disable

clear maclock clearonlinkchange

Use this command to return the behavior of First Arrival MAC locking with link state change to its
default value of enabled.

Syntax
clear maclock clearonlinkchange port-string

27-60 Authentication and Authorization Configuration

 set maclock move

Parameters
port-string Specifies the port or ports on which to apply the command.

Defaults
Clear on link change is enabled by default.

Mode
Switch command, read-write.

Example
This example returns clear on link change to its default value on ge.1.1.
A4(su)->clear maclock clearonlinkchange ge.1.1

set maclock move

Use this command to move all current first arrival MACs to static entries.

Syntax
set maclock move port-string

Parameters
port-string Specifies the port on which MAC will be moved from first arrival MACs
to static entries.

Defaults
None.

Mode
Switch command, read-write.

Usage
If there are more first arrival MACs than the allowed maximum static MACs, then only the latest
first arrival MACs will be moved to static entries. For example, if you set the maximum number of
static MACs to 2 with the set maclock static command, and then executed the set maclock move
command, even though there were five MACs in the first arrival table, only the two most recent
MAC entries would be moved to static entries.

Example
This example shows how to move all current first arrival MACs to static entries on ports ge.3.1-40:
A4(rw)->set maclock move ge.3.1-40

Extreme A4 CLI Reference 27-61

set maclock trap

set maclock trap

Use this command to enable or disable MAC lock trap messaging.

Syntax
set maclock trap port-string {enable | disable} [threshold | violation]

Parameters
port-string Specifies the port on which MAC lock trap messaging will be enabled or
disabled.
enable | disable Enables or disables MAC lock trap messaging.
threshold (Optional) Send a trap if the MAC address table threshold is reached.
violation (Optional) Send a trap if a connected end station exceeds the maximum
values configured with the set maclock firstarrival and set maclock static
commands.

Defaults
Traps are disabled by default. When a set macklock trap enable command is executed without a
violation or threshold parameter, violation is assumed.

Mode
Switch command, read-write.

Usage
When violation is enabled, this feature authorizes the switch to send an SNMP trap message if an
end station is connected that exceeds the maximum values configured using the set maclock
firstarrival and set maclock static commands. Violating MAC addresses are dropped from the
device’s (or stack’s) filtering database.
When threshold is enabled, the agent issues a trap when the MAC address table threshold, as
defined in the etsysMACLockingFirstArrivalStationsAllocated object, is reached.

Example
This example shows how to enable the MAC lock trap threshold trap on fe.2.3:
A4(su)->set maclock trap fe.2.3 enable threshold

set maclock syslog

Use this command to set the status of MAC locking syslog messages.

Syntax
set maclock syslog port-string {disable | enable} [threshold | violation]

Parameters
port-string Specifies the port or ports on which MAC lock syslog messaging will be
enabled or disabled.
enable | disable Enables or disables MAC lock syslog messaging.

27-62 Authentication and Authorization Configuration

 set maclock disable-port

threshold (Optional) Send a syslog message when the MAC address table
threshold is reached.
violation (Optional) Send a syslog message if a connected end station exceeds the
maximum values configured with the set maclock firstarrival and set
maclock static commands.

Defaults
Syslog messages are disabled by default. When a set maclock syslock enable command is
executed without the threshold or violation parameter, violation is assumed.

Mode
Switch mode, read-write.

Usage
When violation is enabled, this feature authorizes the switch to send a syslog message if an end
station is connected that exceeds the maximum values configured using the set maclock
firstarrival and set maclock static commands. Violating MAC addresses are dropped from the
device’s (or stack’s) filtering database.
When threshold is enabled, the agent issues a syslog message when the MAC address table
threshold, as defined in the etsysMACLockingFirstArrivalStationsAllocated object, is reached.

Example
This example enables the MAC lock syslog threshold message on ge.2.3.
A4(su)->set maclock syslog fe.2.3 enable threshold

set maclock disable-port

Use this command to set MAC locking threshold shutdown (corresponds to
etsMACLockingThresholdShutdown).

Syntax
set maclock disable-port port-string

Parameters
port-string Specifies the port or ports on which MAC lock threshold shutdown will
be enabled.

Defaults
MAC lock threshold shutdown is disabled on all ports by default.

Mode
Switch command, read-write.

Usage
When threshold shutdown is enabled, the agent attempts to disable a port (operstatus down)
when the MAC address table threshold, as defined in etsysMACLockingFirstArrivalStations-
Allocated object, is exceeded.

Extreme A4 CLI Reference 27-63

clear maclock disable-port

Example
This example enables MAC lock disable-port on ge.2.3.
A4(su)->set maclock disable-port fe.2.3

clear maclock disable-port

Use this command to clear MAC locking threshold shutdown to the default condition of disabled.

Syntax
clear maclock disable-port port-string

Parameters
port-string Specifies the port or ports on which MAC lock threshold shutdown will
be disabled.

Defaults
None.

Mode
Switch command, read-write.

Usage
This command returns MAC lock threshold shutdown to its default, which is disabled on all ports.

Example
This example clears MAC lock threshold shutdown on ge.2.3.
A4(su)->clear maclock disable-port fe.2.3

clear maclock violation disabled-port

Use this command to clear ports disabled due to a MAC lock violation (corresponds to
etsMACLockingShutdownState).

Syntax
clear maclock violation disabled-port port-string

Parameters
port-string Specifies the port or ports to clear.

Defaults
None.

Mode
Switch command, read-write.

27-64 Authentication and Authorization Configuration

 Configuring Port Web Authentication (PWA)

Usage
This command will clear the operstatus down caused by a MAC lock disable-port threshold and
clear the port’s etsMacLockingShutdownState.

Example
This example how to clear a port disabled due to a MAC lock violation.
A4(su)->clear maclock violation disabled-port fe.2.3

Configuring Port Web Authentication (PWA)

Use the following commands to review, enable, disable, and configure Port Web Authentication
(PWA). Refer to Chapter 10, “Configuring User Authentication,” in the Fixed Switching
Configuration Guide for a details discussion of Port Web Authentication.

For information about... Refer to page...

show pwa 27-65

set pwa 27-67

show pwa banner 27-67

set pwa banner 27-68

clear pwa banner 27-68

set pwa displaylogo 27-69

set pwa ipaddress 27-69

set pwa protocol 27-70

set pwa guestname 27-70

clear pwa guestname 27-71

set pwa guestpassword 27-71

set pwa gueststatus 27-72

set pwa initialize 27-72

set pwa quietperiod 27-73

set pwa maxrequest 27-73

set pwa portcontrol 27-74

show pwa session 27-74

set pwa enhancedmode 27-75

show pwa
Use this command to display port web authentication information for one or more ports.

Syntax
show pwa [port-string]

Extreme A4 CLI Reference 27-65

show pwa

Parameters
port-string (Optional) Displays PWA information for specific port(s).

Defaults
If port-string is not specified, PWA information will be displayed for all ports.

Mode
Switch command, read-only.

Example
This example shows how to display PWA information for ge.2.1:
A4(su)->show pwa ge.2.1
PWA Status - enabled
PWA IP Address - 192.168.62.99
PWA Protocol - PAP
PWA Enhanced Mode - N/A
PWA Logo - enabled
PWA Guest Networking Status - disabled
PWA Guest Name - guest
PWA Redirect Time - N/A

Port Mode AuthStatus QuietPeriod MaxReq

-------- ---------------- -------------- ----------- ---------
ge.2.1 disabled disconnected 60 16
Table 27-8 provides an explanation of the command output.

Table 27-8 show pwa Output Details

Output Field What It Displays...

PWA Status Whether or not port web authentication is enabled or disabled. Default state of
disabled can be changed using the set pwa command as described in “set pwa” on
page 27-67.

PWA IP Address IP address of the end station from which PWA will prevent network access until the
user is authenticated. Set using the set pwa ipaddress command as described in
“set pwa ipaddress” on page 27-69.

PWA Protocol Whether PWA protocol is CHAP or PAP. Default setting of PAP can be changed
using the set pwa protocol command as described in “set pwa protocol” on
page 27-70.

PWA Enhanced Whether PWA enhanced mode is enabled or disabled. Default state of disabled can
Mode be changed using the set pwa enhancedmode command as described in “set pwa
enhancedmode” on page 27-75.

PWA Logo Whether the Extreme logo will be displayed or hidden at user login. Default state of
enabled (displayed) can be changed using the set pwa displaylogo command as
described in “set pwa displaylogo” on page 27-69.

PWA Guest Whether PWA guest user status is disabled or enabled with RADIUS or no
Networking Status authentication. Default state of disabled can be changed using the set pwa
gueststatus command as described in “set pwa gueststatus” on page 27-72.

PWA Guest Name Guest user name for PWA enhanced mode networking. Default value of “guest” can
be changed using the set pwa guestname command as described in “set pwa
guestname” on page 27-70.

27-66 Authentication and Authorization Configuration

 set pwa

Table 27-8 show pwa Output Details (Continued)

Output Field What It Displays...

PWA Guest Guest user’s password. Default value of an empty string can be changed using the
Password set pwa guestpassword command as described in “set pwa guestpassword” on
page 27-71.

PWA Redirect Time Time in seconds after login success before the user is redirected to the PWA home
page.

Port PWA port designation.

Mode Whether PWA is enabled or disabled on his port.

Auth Status Whether or not the port state is disconnected, authenticating, authenticated, or held
(authentication has failed).

Quiet Period Amount of time a port will be in the held state after a user unsuccessfully attempts to
log on to the network. Default value of 60 can be changed using the set pwa
quietperiod command as described in “set pwa quietperiod” on page 27-73.

MaxReq Maximum number of log on attempts allowed before transitioning the port to a held
state. Default value of 2 can be changed using the set pwa maxrequests command
as described in “set pwa maxrequest” on page 27-73.

set pwa
Use this command to enable or disable port web authentication.

Syntax
set pwa {enable | disable}

Parameters
enable | disable Enables or disables port web authentication.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to enable port web authentication:
A4(su)->set pwa enable

show pwa banner

Use this command to display the port web authentication login banner string.

Syntax
show pwa banner

Extreme A4 CLI Reference 27-67

set pwa banner

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the PWA login banner:
A4(su)->show pwa banner
Welcome to Extreme Networks

set pwa banner

Use this command to configure a string to be displayed as the PWA login banner.

Syntax
set pwa banner string

Parameters
string Specifies the PWA login banner.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set the PWA login banner to “Welcome to Extreme Networks”:
A4(su)->set pwa banner “Welcome to Extreme Networks”

clear pwa banner

Use this command to reset the PWA login banner to a blank string.

Syntax
clear pwa banner

Parameters
None.

27-68 Authentication and Authorization Configuration

 set pwa displaylogo

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to reset the PWA login banner to a blank string
A4(su)->clear pwa banner

set pwa displaylogo

Use this command to set the display options for the Extreme Networks logo.

Syntax
set pwa displaylogo {display | hide}

Parameters
display | hide Displays or hides the Extreme Networks logo when the PWA website
displays.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to hide the Extreme Networks logo:
A4(su)->set pwa displaylogo hide

set pwa ipaddress

Use this command to set the PWA IP address. This is the IP address of the end station from which
PWA will prevent network access until the user is authenticated.

Syntax
set pwa ipaddress ip-address

Parameters
ip-address Specifies a globally unique IP address. This same value must be
configured into every authenticating switch in the domain.

Defaults
None.

Extreme A4 CLI Reference 27-69

set pwa protocol

Mode
Switch command, read-write.

Example
This example shows how to set a PWA IP address of 1.2.3.4:
A4(su)->set pwa ipaddress 1.2.3.4

set pwa protocol

Use this command to set the port web authentication protocol.

Syntax
set pwa protocol {chap | pap}

Parameters
chap | pap Sets the PWA protocol to:
• CHAP (PPP Challenge Handshake Protocol) - encrypts the username
and password between the end-station and the switch port.
• PAP (Password Authentication Protocol- does not provide any
encryption between the end-station and the switch port. This is the
default.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to set a the PWA protocol to CHAP:
A4(su)->set pwa protocol chap

set pwa guestname

Use this command to set a guest user name for PWA networking. PWA will use this name to grant
network access to guests without established login names and passwords.

Syntax
set pwa guestname name

Parameters
name Specifies a guest user name.

Defaults
None.

27-70 Authentication and Authorization Configuration

 clear pwa guestname

Mode
Switch command, read-write.

Example
This example shows how to set the PWA guest user name to “guestuser”:
A4(su)->set pwa guestname guestuser

clear pwa guestname

Use this command to clear the PWA guest user name.

Syntax
clear pwa guestname

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to clear the PWA guest user name
A4(su)->clear pwa guestname

set pwa guestpassword

Use this command to set the guest user password for PWA networking.

Syntax
set pwa guestpassword

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Usage
PWA will use this password and the guest user name to grant network access to guests without
established login names and passwords.

Extreme A4 CLI Reference 27-71

set pwa gueststatus

Example
This example shows how to set the PWA guest user password name:
A4(su)->set pwa guestpassword
Guest Password: *********
Retype Guest Password: *********

set pwa gueststatus

Use this command to enable or disable guest networking for port web authentication.

Syntax
set pwa gueststatus {authnone | authradius | disable}

Parameters
authnone Enables guest networking with no authentication method.
authradius Enables guest networking with RADIUS authentication. Upon successful
authentication from RADIUS, PWA will apply the policy returned from
RADIUS to the PWA port.
disable Disables guest networking.

Defaults
None.

Mode
Switch command, read-write.

Usage
PWA will use a guest password and guest user name to grant network access with default policy
privileges to users without established login names and passwords.

Example
This example shows how to enable PWA guest networking with RADIUS authentication:
A4(su)->set pwa guestnetworking authradius

set pwa initialize

Use this command to initialize a PWA port to its default unauthenticated state.

Syntax
set pwa initialize [port-string]

Parameters
port-string (Optional) Initializes specific port(s).

27-72 Authentication and Authorization Configuration

 set pwa quietperiod

Defaults
If port-string is not specified, all ports will be initialized.

Mode
Switch command, read-write.

Example
This example shows how to initialize ports ge.1.5-7:
A4(su)->set pwa initialize ge.1.5-7

set pwa quietperiod

Use this command to set the amount of time a port will remain in the held state after a user
unsuccessfully attempts to log on to the network.

Syntax
set pwa quietperiod time [port-string]

Parameters
time Specifies quiet time in seconds.
port-string (Optional) Sets the quiet period for specific port(s).

Defaults
If port-string is not specified, quiet period will be set for all ports.

Mode
Switch command, read-write.

Example
This example shows how to set the PWA quiet period to 30 seconds for ports ge.1.5-7:
A4(su)->set pwa quietperiod 30 ge.1.5-7

set pwa maxrequest

Use this command to set the maximum number of log on attempts allowed before transitioning
the PWA port to a held state.

Syntax
set pwa maxrequests requests [port-string]

Parameters
maxrequests Specifies the maximum number of log on attempts.
port-string (Optional) Sets the maximum requests for specific port(s).

Extreme A4 CLI Reference 27-73

set pwa portcontrol

Defaults
If port-string is not specified, maximum requests will be set for all ports.

Mode
Switch command, read-write.

Example
This example shows how to set the PWA maximum requests to 3 for all ports:
A4(su)->set pwa maxrequests 3

set pwa portcontrol

This command enables or disables PWA authentication on select ports.

Syntax
set pwa portcontrol {enable | disable} [port-string]

Parameters
enable | disable Enables or disables PWA on specified ports.
port-string (Optional) Sets the control mode on specific port(s).

Defaults
If port-string is not specified, PWA will enabled on all ports.

Mode
Switch command, read-write.

Example
This example shows how to enable PWA on ports 1-22:
A4(su)->set pwa portcontrol enable ge.1.1-22

show pwa session

Use this command to display information about current PWA sessions.

Syntax
show pwa session [port-string]

Parameters
port-string (Optional) Displays PWA session information for specific port(s).

Defaults
If port-string is not specified, session information for all ports will be displayed.

27-74 Authentication and Authorization Configuration

 set pwa enhancedmode

Mode
Switch command, read-only.

Example
This example shows how to display PWA session information:
A4(su)->show pwa session
Port MAC IP User Duration Status
-------- ----------------- --------------- ------------- ------------ ---------
ge.2.19 00-c0-4f-20-05-4b 172.50.15.121 pwachap10 0,14:46:55 active
ge.2.19 00-c0-4f-24-51-70 172.50.15.120 pwachap1 0,15:43:30 active
ge.2.19 00-00-f8-78-9c-a7 172.50.15.61 pwachap11 0,14:47:58 active

set pwa enhancedmode

This command enables PWA URL redirection. The switch intercepts all HTTP packets on port 80
from the end user, and sends the end user a refresh page destined for the PWA IP Address
configured.

Syntax
set pwa enhancedmode {enable | disable}

Parameters
enable | disable Enables or disables PWA enhancedmode.

Defaults
None.

Mode
Switch command, read-write.

Example
This example shows how to enable PWA enhancedmode:
A4(su)->set pwa enhancedmode enable

Configuring Convergence End Points Phone Detection

Convergence Endpoint (CEP) detection is an Extreme Networks mechanism for identifying IP
phones that are connected to a given switch. When an endpoint is discovered, a policy is then
assigned to the endpoint.

Note: CEP is not supported on the A4 when in User + IP Phone authentication mode. See the
Configuring User + IP Phone Authentication section of the Extreme Fixed Switching Configuration
Guide for User + IP Phone authentication mode details.

Use the following commands to configure CEP.

For information about... Refer to page...

set cep 27-76

Extreme A4 CLI Reference 27-75

set cep

For information about... Refer to page...

set cep port 27-76

set cep policy 27-77

set cep initialize 27-78

show cep port 27-78

show cep policy 27-79

show cep connections 27-80

clear cep all 27-80

clear cep policy 27-81

clear cep port 27-81

clear cep users 27-82

set cep
Use this command to enable or disable convergence end point detection globally on the switch.

Syntax
set cep {enable | disable}

Parameters
enable | disable Enable or disable CEP detection.

Defaults
CEP detection is disabled globally by default.

Mode
Switch command, read-write.

Example
This example enables CEP detection on the switch.
A4(su)->set cep enable

set cep port

Use this command to enable or disable a CEP detection type on one or more ports.

Syntax
set cep port port-string {cisco | lldp-med} {enable | disable}

Parameters
port-string Specifies the port or ports to configured.
cisco Selects Cisco phone detection as the method to enable or disable.

27-76 Authentication and Authorization Configuration

 set cep policy

lldp-med Selects LLDP-MED phone detection as the method to enable or disable.

enable | disable Enables or disables the specified phone detection method on the
specified port or ports.

Defaults
All phone detection methods are disabled on all ports.

Mode
Switch command, read-write.

Usage
CEP must be enabled globally on the switch, and at least one detection method must be enabled
on a port for CEP detection to operate. Also, if the IP phone could multi-authenticate, CEP must
have a higher multiauth precedence (see “set multiauth precedence” on page 27-34) than the
current authentication method for a session to start.
There is no precedence between the detection mechanisms (cisco or lldp-med). The detection
protocols are processed on a first come first serve basis. If a detection method is disabled, the next
mechanism will be used. Only the policy index mapped to the correct detection mechanism will be
used.

Example
This example enables Cisco phone detection on port fe.1.1.
A4(su)->set cep port fe.1.1 cisco enable

set cep policy

Use this command to set a global default policy for a CEP detection type.

Syntax
set cep policy {cisco | lldp-med} profile-index

Parameters
cisco Specify that the Cisco detection type global policy is being set.
lldp-med Specify that the LLDP-MED detection type global policy is being set.
profile-index Specifies the policy profile index.
Valid values range from 1 to 255.
Specifying 0 removes the policy profile configuration.

Defaults
None.

Mode
Switch command, read-write.

Extreme A4 CLI Reference 27-77

set cep initialize

Usage
See Chapter 13, Policy Classification Configuration for information about creating policy
profiles.

Example
This example sets the policy profile with index 100 as the default global policy for Cisco phones
detected by CEP.
A4(su)->set cep policy cisco 100

set cep initialize

Use this command to initialize or reinitialize all existing CEP connections for one or more CEP-
enabled ports.

Syntax
set cep initialize [port-string]

Parameters
port-string (Optional) Specifies the port or ports on which to clear all existing CEP
connections.

Defaults
If no port string is entered, CEP connections are cleared on all ports.

Mode
Switch command, read-write.

Usage
This command is similar to the clear cep users command.

Example
This example clears CEP connections on port fe.1.10.
A4(su)->set cep initialize fe.1.10

show cep port

Use this command to display enabled/disabled status of all supported CEP types per port.

Syntax
show cep port [port-string]

Parameters
port-string (Optional) Specifies the port or ports for which to display the enabled/
disabled status of all supported CEP types.

27-78 Authentication and Authorization Configuration

 show cep policy

Defaults
If no port string is specified, information for all ports is displayed.

Mode
Switch command, read-only.

Example
This example displays the status of ports fe.1.1 through fe.1.5.
A4(su)->show cep port fe.1.1-5

Global CEP state disabled

Port Cisco LLDP-MED
---------- -------- --------
fe.1.1 disabled disabled
fe.1.2 disabled disabled
fe.1.3 disabled disabled
fe.1.4 disabled disabled
fe.1.5 disabled disabled

show cep policy

Use this command to display the global policies of all supported CEP types.

Syntax
show cep policy

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows how to display the default global CEP policies.
A4(su)->show cep policy
CEP default policies
CEP Type Policy Index Policy Name
------------ -------------- ------------
cisco 13 Cisco IP Phone
lldp-med 2 LLDP IP Phone

Extreme A4 CLI Reference 27-79

show cep connections

show cep connections

Use this command to display all learned CEPs.

Syntax
show cep connections [port-string]

Parameters
port-string (Optional) Specifies the port or ports for which to display learned CEPs.

Defaults
If no port string is specified, learned connections for all ports are shown.

Mode
Switch command, read-only.

Example
This example shows how to display CEP connections for port fe.1.21:
A4(su)->show cep connections fe.1.21
Connection Info for fe.1.21
Endpoint Type lldp-med
Policy Index 3
Discovery Time MON FEB 06 02:31:42 2012
Firmware Version
Address Type unknown
Endpoint IP unavailable
Endpoint MAC 00:04:0d:01:f8:35

clear cep all

Use this command to restore factory defaults to all CEP configuration information,

Syntax
clear cep all

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This command returns all CEP configuration to factory defaults.
A4(su)->clear cep all

27-80 Authentication and Authorization Configuration

 clear cep policy

clear cep policy

Use this command to restore factory defaults to CEP policy configuration.

Syntax
clear cep policy

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Example
This command returns CEP policy configuration to factory defaults (no policy configured for any
supported CEP discovery type).
A4(su)->clear cep policy

clear cep port

Use this command to disable CEP detection on one or more ports.

Syntax
clear cep port [port-string {all | cisco | lldp-med}]

Parameters
port-string (Optional) Specifies a port or ports on which to disable CEP detection.
all This parameter will disable all CEP detection on the specified port or
ports.
cisco This parameter will disable the Cisco CEP detection on the specified
port or ports.
lldp-med This parameter will disable the LLDP-MED CEP detection on the
specified port or ports.

Defaults
If no port string is specified, all CEP detection on all ports will be returned to factory default
settings (disabled).

Mode
Switch command, read-write.

Example
This example disables the CISCO CEP detection on ports fe1.1 through fe1.10.

Extreme A4 CLI Reference 27-81

clear cep users

A4(su)->clear cep port fe.1.1-10 cisco

clear cep users

Use this command to clear discovered Convergence Endpoints on one or more ports.

Syntax
clear cep users [port-string]

Parameters
port-string (Optional) Specifies the port or ports on which to clear discovered
convergence endpoints.

Defaults
If no port string is specified, all discovered convergence endpoints on all ports will be cleared.

Mode
Switch command, read-write.

Usage
This command is similar in operation to the set cep initialize command.

Example
This example clears discovered convergence endpoints on fe.1.10.
A4(su)->clear cep users fe.1.10

27-82 Authentication and Authorization Configuration

 28
Configuring IPsec

This chapter describes the commands used to configure IPsec (IP Security) as specified in RFC
4301. Refer to Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration
Guide for configuration procedures, examples, and conceptual information about IPsec.

For information about... Refer to page...

show ipsec 28-1

set ipsec authentication 28-2

set ipsec encryption 28-2

set ipsec ike dh-group 28-3

set ipsec ike lifetime 28-3

set ipsec ike phase1 28-4

set ipsec ike version 28-5

show ipsec
Use this command to display the current IPsec values.

Syntax
show ipsec

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example shows the output of this command.
A4(su)->show ipsec
authentication: sha1
encryption: aes128
ike version: ikev1

Extreme A4 CLI Reference 28-1

Configuring IPsec set ipsec authentication

ike dh-group: group-14

ike lifetime main: 60
ike lifetime quick: 5
ike lifetime bandwidth: 100000
ike phase1: main

set ipsec authentication

Use this command to set the authentication protocol to be used for IPsec.

Note: This command is not accessible if the security profile is set to C2.

Syntax
set ipsec authentication {md5 | sha1}

Parameters
md5 Select HMAC-MD5 as the authentication protocol.
sha1 Select HMAC-SHA1 as the authentication protocol. This is the default
value.

Defaults
HMAC-SHA1 is the default authentication protocol.

Mode
Switch command, read-write, if the security profile = normal.

Example
This example sets the authentication protocol to HMAC-MD5.
A4(su)->set ipsec authentication md5

set ipsec encryption

Use this command to set the encryption type to be used for IPsec.

Syntax
set ipsec encryption {3des | aes128 | aes192 | aes256}

Parameters
3des Select Triple DES as the encryption type.
aes128 Select AES-128 as the encryption type. This is the default.
aes192 Select AES-192 as the encryption type.
aes256 Select AES-256 as the encryption type.

Defaults
AES-128 is the default encryption type.

28-2
set ipsec ike dh-group Configuring IPsec

Mode
Switch command, read-write, if the security profile = normal.
Switch command, super-user, if the security profile = C2.

Example
This example selects AES-192 as the IPsec encryption type.
A4(su)->set ipsec encryption aes192

set ipsec ike dh-group

Use this command to configure the IKE Diffie-Hellman key exchange group.

Syntax
set ipsec ike dh-group {group-1 | group-2 | group-5 | group-14}

Parameters
group-1 Configure IKE to use the Diffie-Hellman key exchange group 1 — 768-
bit Diffie-Hellman prime modulus group.
This is the default.
group-2 Configure IKE to use the Diffie-Hellman key exchange group 2 — 1024-
bit Diffie-Hellman prime modulus group.
group-5 Configure IKE to use the Diffie-Hellman key exchange group 5 — 1536-
bit Diffie-Hellman prime modulus group.
group-14 Configure IKE to use the Diffie-Hellman key exchange group 14 —
2048-bit Diffie-Hellman prime modulus group.

Defaults
Diffie-Hellman group 1 is the default.

Mode
Switch command, read-write, if the security profile = normal.
Switch command, super-user, if the security profile = C2.

Example
This example configures IKE to use Diffie-Hellman group 5.
A4(su)->set ipsec ike dh-group group-5

set ipsec ike lifetime

Use this command to define the IKE timeout interval.

Syntax
set ipsec ike lifetime {[bandwidth bytes] | [main minutes] | [quick minutes]}

Extreme A4 CLI Reference 28-3

Configuring IPsec set ipsec ike phase1

Parameters
bandwidth bytes Specifies the lifetime bandwidth limit in bytes. Valid range is from 1 to
2147483647 bytes. Default is 100000 bytes.
main minutes Specifies the lifetime timeout interval for main mode in minutes. Value
range is from 1 to 1440 minutes. Default is 60 minutes.
quick minutes Specifies the lifetime timeout interval for quick mode in minutes. Value
range is from 1 to 1440 minutes. Default is 5 minutes.

Defaults
The default IKE lifetime timeout interval for main mode is 60 minutes.
The default IKE lifetime timeout interval for quick mode is 5 minutes.
The default IKE lifetime bandwith limit is 100000 bytes

Mode
Switch command, read-write, if the security profile = normal.
Switch command, super-user, if the security profile = C2.

Example
This example sets the IKE quick mode lifetime interval to 20 minutes.
A4(su)->set ipsec ike lifetime quick 20

set ipsec ike phase1

Use this command to configure the mode for Phase 1 of establishing an IPsec connection (ISAKMP
Security Association).

Note: Currently, only main mode is supported.

Syntax
set ipsec ike phase1 {main | aggressive}

Parameters
main The more secure mode that uses three separate message exchanges for a
total of six messages. The first two messages negotiate policy, the next
two exchange Diffie-Hellman data, and the last two authenticate the
Diffie-Hellman exchange.
aggressive A faster, less secure, mode that uses only three messages, which
exchange Diffie-Hellman data and identify the two VPN endpoints.

Defaults
The default Phase 1 mode is main.

Mode
Switch command, read-write, if the security profile = normal.

28-4
set ipsec ike version Configuring IPsec

Switch command, super-user, if the security profile = C2.

Example
This example sets the Phase 1 mode to main.
A4(su)->set ipsec ike phase1 main

set ipsec ike version

Use this command to set the version of the IKE protocol.

Note: Currently, only IKE version 1 is supported.

Syntax
set ipsec ike version {ikev1 | ikev2}

Parameters
ikev1 Select IKE version 1 to be used for IPsec. This is the default.
ikev2 Select IKE version 2 to be used for IPsec.

Defaults
IKE version 1 is the default.

Mode
Switch command, read-write, if the security profile = normal.
Switch command, super-user, if the security profile = C2.

Example
This example sets the IKE version to version 1.
A4(su)->set ipsec ike version ikev1

Extreme A4 CLI Reference 28-5

Configuring IPsec set ipsec ike version

28-6
 29
Configuring Access Control Lists

This chapter describes how to configure and apply router mode Access Control Lists (ACLs). For
information about switch mode Service ACLs, refer to Chapter 30, Configuring Service Access
Control Lists.

Router: These commands can be executed when the device is in router mode only.

About Access Control Lists

Access Control Lists are configured in router mode. An ACL can be configured as a MAC ACL or
an extended IP ACL, and each type of list can contain only one type of rule:
• MAC ACL rules can contain source and destination MAC addresses. MAC ACLs are uniquely
identified by name.
• Extended IP ACL rules can contain source and destination IP addresses. Extended IP ACLs
are uniquely identified by number, from 100 to 199.
ACLs can be applied to ports with the access-list interface command. ACLs are supported on Link
Agregation ports as well as physical ports. You can apply MAC, IP, or both types of ACLs to a
port. Rule precedence is based on the priority levels shown in Table 29-1, where highest priority
has precedence.

Table 29-1 ACL Rule Precedence

ACL Type and Rule Priority Example

MAC SA DA exact 23 permit 00-01-01-00-00-01 00-01-02-00-00-23

MAC SA exact DA any 22 deny 00:01:01:00:00:05 any

MAC SA any DA exact 21 deny any 00:01:01:00:00:01

IP SIP DIP exact 20 deny 10.0.1.15 10.0.1.5

IP SIP exact DIP any 19 deny 10.0.1.8 any

IP SIP any DIP exact 18 permit any 10.0.1.22

IP SIP any DIP any 17 deny any any

MAC SA any DA any 16 deny any any

Rule Actions
Rule actions include:
• Deny — drop the packet.

Extreme A4 CLI Reference 29-1

Configuring Access Control Lists Commands

• Permit — allow the frame to be switched.

• Assign to queue — assign the packet to a queue
All ACLs are terminated with an implicit “deny all” rule.

Commands
For information about... Refer to page...

show access-lists 29-2

access-list 29-3

access-list mac 29-4

access-list interface 29-6

show access-lists
Use this command to display configured access control lists when operating in router mode.

Syntax
show access-lists [name] | [number] | [interface port-string]

Parameters
name (Optional) Displays information for the access control list specified by name.
number (Optional) Displays information for the access control list specified by
number. Valid values are between 100 and 199.
interface port- (Optional) Displays the access control lists associated with the specified port
string or ports.

Defaults
If no optional parameter is specified, the entire table of access lists will be displayed.

Mode
Any router mode.

Examples
This example shows how to display all configured access lists.
A4(su)->router#show access-lists

Extended IP access list 101

1: deny ip host 192.168.1.1 any
joe MAC access-list
1: permit 00:00:11:22:33:44 any
This example shows how to display what access lists are assigned to a port.
A4(su)->router#show access-lists interface fe.1.1
Port-string Access-list
----------- -----------
fe.1.1 101

29-2
access-list Configuring Access Control Lists

access-list
Use this command to create and configure an extended IP access list by number when operating in
router mode. The no form of this command removes the defined access list or one or more entries.

Syntax
To create or delete an IP ACL entry:
access-list number {deny | permit} ip (any | host src-ipaddr} {any | host dest-
ipaddr} [assign-queue queue-id]
no access-list number [entryno [entryno]]

To insert or replace an IP ACL entry:

access-list number {insert | replace} entryno {deny | permit} ip (any | host src-
ipaddr} {any | host dest-ipaddr} [assign-queue queue-id]

To move an IP ACL entry:

access-list number move destination source1 [source2]

Parameters
number Specifies the access control list by number. Valid values range from 100
to 199.
[entryno [entryno]] Specifies the number of a rule within the access control list.
When using the no access-list command, you can delete a whole access-
list, or only specific entries in the list with the optional entryno
parameter. Specify a range of entries by entering the start and end entry
numbers.
deny | permit Denies or permits access if specified conditions are met.
any Specifies that any source host or destination host will match the rule.
host src-ipaddr Specifies the IP address of the source host that will match the rule.
host dest-ipaddr Specifies the IP address of the destination host that will match the rule.
assign-queue queue-id (Optional) Specifies the queue to which a packet matching the permit
rule will be assigned. Valid values for queue-id are from 0 to 5.
insert | replace (Optional) Inserts this new entry before a specified entry in an existing
entryno ACL, or replaces a specified entry with this new entry.
move destination (Optional) Moves a sequence of access list entries before another entry.
source1 source2 Destination is the number of the existing entry before which this new
entry will be moved. Source1 is a single entry number or the first entry
number in the range to be moved. Source2 (optional) is the last entry
number in the range to be moved. If source2 is not specified, only the
source1 entry will be moved.

Defaults
If insert, replace or move are not specified, the new entry will be appended to the access list.
If source2 is not specified with move, only one entry will be moved.
If no entryno is specified with the no access-list command, the ACL itself is deleted.

Extreme A4 CLI Reference 29-3

Configuring Access Control Lists access-list mac

Mode
Global configuration: A4(su)->router(Config)#

Usage
Valid access list numbers for extended IP ACLs are 100 to 199.
IP access lists are applied to ports with the access-list interface command (page 29-6).
All access lists have an implicit “deny any any” statment as their last entry.

Example
This example creates IP ACL number 101 and creates a deny rule, then displays the ACL.
A4(su)->router
A4(su)->router>enable
A4(su)->router#config
A4(su)->router(Config)#access-list 101 deny ip host 192.168.1.1 any
A4(su)->router(Config)#show access-lists 101
Extended IP access list 101
1: deny ip host 192.168.1.1 any

access-list mac
Use this command to define a MAC-based access list when operating in router mode.
The no form of this command removes the defined access list or one or more entries.

Syntax
To create or delete a MAC-based ACL:
access-list mac name {deny | permit} (any | src-macaddr} {any | dest-macaddr}
[assign-queue queue-id]
no access-list mac name [entryno [entryno]]

To insert or replace a MAC-based ACL entry:

access-list mac name {insert | replace} entryno {deny | permit} (any | src-macaddr}
{any | dest-macaddr} [assign-queue queue-id]

To move entries within a MAC-based ACL:

access-list mac name move destination source1 [source2]

Parameters
name Specifies the name of the MAC-based ACL. The name may be up to 31
characters in length.
[entryno [entryno]] When using the no access-list command, you can delete a whole access-
list, or only specific entries in the list with the optional entryno
parameter. Specify a range of entries by entering the start and end entry
numbers.
deny | permit Denies or permits access if specified conditions are met.
any Specifies that any source host or destination host will match the rule.

29-4
access-list mac Configuring Access Control Lists

src-macaddr Specifies the MAC address of the source host that will match the rule.
The format of the MAC address can be xx-xx-xx-xx-xx-xx or
xx:xx:xx:xx:xx:xx.
dest-macaddr Specifies the MAC address of the destination host that will match the
rule.
The format of the MAC address can be xx-xx-xx-xx-xx-xx or
xx:xx:xx:xx:xx:xx.
assign-queue queue-id (Optional) Specifies the queue to which a packet matching the permit
rule will be assigned. Valid values for queue-id are from 0 to 5.
insert | replace (Optional) Inserts this new entry before a specified entry in an existing
entryno ACL, or replaces a specified entry with this new entry.
move destination (Optional) Moves a sequence of access list entries before another entry.
source1 source2 Destination is the number of the existing entry before which this new
entry will be moved. Source1 is a single entry number or the first entry
number in the range to be moved. Source2 (optional) is the last entry
number in the range to be moved. If source2 is not specified, only the
source1 entry will be moved.

Defaults
If insert, replace, or move are not specified, the new entry will be appended to the access list.
If source2 is not specified with move, only one entry will be moved.
If no entryno is specified with the no access-list command, the ACL itself is deleted.

Mode
Global configuration: A4(su)->router(Config)#

Usage
MAC-based access control lists are applied to ports with the access-list interface command (page
29-6).
All access lists have an implicit “deny any any” statment as their last entry.

Example
This example creates a MAC-based ACL, creates a permit rule, then displays the ACL.
A4(su)->router
A4(su)->router>enable
A4(su)->router#config
A4(su)->router(Config)#access-list mac mymac permit 00:01:00:02:00:01 any assign-
queue 2
A4(su)->router(Config)#show access-lists mymac
mymac MAC access-list
1: permit 00:01:00:02:00:01 any assign-queue 2

Extreme A4 CLI Reference 29-5

Configuring Access Control Lists access-list interface

access-list interface
Use this command to apply access control lists to ports.

Syntax
access-list interface {number | name} port-string [in] [sequence seq]
no access-list interface {number | name} port-string [in]

Parameters
number | name Specifies the name or number of the access list to be applied to the port.
MAC-based access control lists are identified by name. Extended IP access
control lists are identifed by a decimal number from 100 to 199.
port-string Specifies the port or ports to which the access control list will be applied.
in (Optional) Specifies the direction of the packets (inbound only) to which
the access control list will be applied.
sequence seq (Optional) Sepcifies the order in which this access control list is applied
relative to other ACLs that may already be associated with the port.

Defaults
If direction is not specified, the direction will be inbound.
If a sequence is not specified, the access control list will be applied in the order in which it was
associated with the port.

Mode
Global configuration: A4(su)->router(Config)#

Example
This example applies an access control list to a port list.
A4(su)->router
A4(su)->router>enable
A4(su)->router#config
A4(su)->router(Config)#access-list interface 101 fe.1.1-24

29-6
 30
Configuring Service Access Control Lists

This chapter describes the commands used to configure and apply Service Access Control Lists
(SACLs). For information about router mode ACLs, refer to Chapter 29, Configuring Access
Control Lists.
Refer to Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration Guide for
configuration procedures, examples, and conceptual information about SACLs.

Note: These commands can be executed in switch mode.

For information about... Refer to page...

set system service-acl 30-1

show system service-acl 30-3

clear system service-acl 30-3

set system service-class 30-4

show system service-class 30-5

clear system service-class 30-5

set system service-acl

Use this command to create and add rules to a service access control list. Only a single list is
allowed in the system with a maximum of 64 rules.

Syntax
set system service-acl name {permit | deny} [ip-source ip-address [wildcard
wildcard-bits] | ipv6-source ipv6-address [wildcard /prefix-length]] [port port-
string | vlan vlan-id] [service service] [priority priority-value]

Parameters
name Specifies the name of the service ACL. If the ACL does not exist, it will
be created. The name can be up to 32 characters in length.
permit | deny Specifies the rule action.
ip-source ip-address (Optional) Specifies the IPv4 source address for the rule.
wildcard wildcard-bits (Optional)Specifies the bits to match in the IPv4 source address, in
dotted octet notation. A 0 indicates the address bits that must be
matched, while a 1 indicates the bits that must be ignored.

Extreme A4 CLI Reference 30-1

Configuring Service Access Control Lists set system service-acl

ipv6-source (Optional) Specifies the IPv6 source address for the rule.
ipv6-address
wildcard /prefix-length (Optional) Specifies the number of bits (0-128) that comprise the source
IPv6 address prefix. The prefix length must be preceded by a forward
slash (/). If no prefix length value is specified, a prefix length of 128 bits
is assumed.
port port-string (Optional) Specifies a port for the rule.
vlan vlan-id (Optional) Specifies a VLAN for the rule.
service service (Optional) Specifies the host service for the rule. Valid values for service
are:
• HTTP
• HTTPS
• SNMP
• SSH
• Telnet
• TFTP
priority priority-value (Optional) Specifies the priority for the rule. Value can range from 1
(highest priority) to 64 (lowest priority). If no priority is specified, the
rule will be added to the end of the access control list.

Defaults
If no service is specified, the given ACL will be applied to all host services.
If no port or VLAN is specified, the rule applies to all interfaces.
If no priority is specified, the rule will be assigned a priority value with the lowest precedence.
If no priority is specified and this is the first rule being created a priority value of 1 will be
assigned (highest precedence).

Mode
Switch command, read-write.

Usage
Use this command to configure a service access control list. Each rule should have a unique
priority. New rules without a priority will be entered at the end of the service ACL. Use the set
system access-class command to choose the active service-acl. The active management list can't be
updated or removed.
A service ACL has an implicit deny all rule at the end. If you want to allow access by a network
server that is not covered by the specific services listed with the service parameter, such as an NTP/
SNTP server, you can add a permit rule for the IP address of that server.

Examples
The following example shows how to allow remote management for all host services through
ports fe.1.1 and fe.1.2. Since no priority is specified, the rules will be added in the order in which
they are entered.
A4(su)->set system service-acl my-sacl permit port fe.1.1
A4(su)->set system service-acl my-sacl permit port fe.1.2
A4(su)->set system service-class my-sacl

30-2
show system service-acl Configuring Service Access Control Lists

This command adds a permit rule to only allow Telnet traffic with an IP address of 10.10.22.2 on
ports 1-10.
A4(su)->set system service-acl my-sacl permit service telnet ip-source 10.10.22.2
wildcard 0.0.0.0 port fe.1.1-10
These commands allow only SSH with IP source address of 192.168.1.100 on all ports except port
15.
A4(su)->set system service-acl my-sacl deny service ssh ip-source 192.168.1.100
port fe.1.15 priority 1
A4(su)->set system service-acl my-sacl permit service ssh ip-source 192.168.1.100
priority 2
A4(su)->set system service-class my-sacl

show system service-acl

Use this command to display the contents of the service ACL configured on the switch.

Syntax
show system service-acl [name]

Parameters
name (Optional) Specifies the service ACL to display.

Defaults
If no name is specified, all service ACLs are displayed. Note that currently, only one service ACL
can be configured.

Mode
Switch command, read-only.

Example
This example displays the contents of the my-sacl service ACL.
A4(su)->show system service-acl
my-sacl
-------
set system service-acl my-sacl deny ip-source 192.168.10.10 wildcard 0.0.0.0
service ssh priority 1
set system service-acl my-sacl permit port fe.1.1 priority 2
set system service-acl my-sacl permit port fe.1.2 priority 3
! (Note: all other access implicitly denied)

clear system service-acl

Use this command to delete a service ACL.

Syntax
clear system service-acl name

Extreme A4 CLI Reference 30-3

Configuring Service Access Control Lists set system service-class

Parameters
name Specifies the service ACL to delete.

Defaults
None.

Mode
Switch command, read-write.

Example
This example deletes service ACL my-sacl.
A4(su)->clear system service-acl my-sacl

set system service-class

Use this command to activate a service ACL on the switch, or to restrict management access to the
console port.

Syntax
set system service-class {name | console-only}

Parameters
name Specifies the service ACL to activate, or enable, on the switch.
console-only Specifies that the switch can be managed only from the console port.

Defaults
None.

Mode
Switch command, read-write.

Usage
A service ACL is not actively used by the switch until the ACL has been activated with this
command.
The switch can be managed remotely by default. If you want to restrict management to the serial
console port, use the console-only option. This option cannot be specified if a service ACL is
currently activated. If you specify console-only, new remote sessions will be refused, but your
current remote session will not be terminated.

Examples
This example activates service ACL my-sacl.
A4(su)->set system service-class my-sacl
This example restricts management to the console port only.
A4(su)->set system service-class console-only

30-4
show system service-class Configuring Service Access Control Lists

show system service-class

Use this command to display the current system service ACL status, or class.

Syntax
show system service-class

Parameters
None.

Defaults
None.

Mode
Switch command, read-only.

Example
This example activates the service ACL named my-sacl, then displays the service class status.
A4(su)->set system service-class my-sacl
A4(su)->show system service-class

system service-class is enabled, using access list my-sacl.

clear system service-class

Use this command to de-activate a service ACL or remove the restriction of management to the
console port.

Syntax
clear system service-class

Parameters
None.

Defaults
None.

Mode
Switch command, read-write.

Usage
If a service ACL has been activated, this command will de-activate the ACL.
If console-only management has been set, this command will remove console-only management.

Example
This example de-activates the active service ACL my-sacl.
A4(su)->set system service-class my-sacl

Extreme A4 CLI Reference 30-5

Configuring Service Access Control Lists clear system service-class

A4(su)->show system service-class

system service-class is enabled, using access list my-sacl.

A4(su)->clear system service-class

A4(su)->show system service-class
system service-class is disabled.

30-6
 31
TACACS+ Configuration

This chapter provides information about the commands used to configure and monitor TACACS+
(Terminal Access Controller Access-Control System Plus).
TACACS+ is a security protcol that provides services for secure authentication, CLI command
authorization, and CLI auditing for administrative access. It can be used as an alternative to the
standard RADIUS security protocol (RFC 2865). TACACS+ runs over TCP and encrypts the body
of each management packet.
Based on the now obsolete TACACS protocol (defined in RFC 1492), TACACS+ is defined in an
un-published and expired Internet Draft draft-grant-tacacs-02.txt, “The TACACS+ Protocol
Version 1.78,” January, 1997.
Refer to Chapter 26, “Configuring Security Features,” in the Fixed Switching Configuration Guide for
configuration procedures, examples, and conceptual information about TACACS+.

For information about... Refer to page...

show tacacs 31-2

set tacacs 31-3

show tacacs server 31-3

set tacacs server 31-4

clear tacacs server 31-5

show tacacs session 31-6

set tacacs session 31-7

clear tacacs session 31-8

show tacacs command 31-9

set tacacs command 31-9

show tacacs singleconnect 31-10

set tacacs singleconnect 31-10

show tacacs interface 31-11

set tacacs interface 31-11

clear tacacs interface 31-12

Extreme A4 CLI Reference 31-1

show tacacs

show tacacs
Use this command to display the current TACACS+ configuration information and status.

Syntax
show tacacs [state]

Parameters
state (Optional) Displays only the TACACS+ client status.

Defaults
If state is not specified, all TACACS+ configuration information will be displayed.

Mode
Switch command, Read-Only.

Example
This example shows how to display all TACACS configuration information.
A4(ro)->show tacacs
TACACS+ status:Disabled
TACACS+ session accounting state:Disabled
TACACS+ command authorization state:Disabled
TACACS+ command auccounting state:Disabled
TACACS+ single connect state:Disabled
TACACS+ service: exec
TACACS+ session authorization A-V pairs:
access-level attribute value
read-only priv-lvl 0
read-write priv-lvl 1
super-user priv-lvl 15
TACACS+ Server IP address Port Timeout
-------------- ---------- ------ -------
1 192.168.10.1 49 10

Table 31-1 provides an explanation of the command output.

Table 31-1 show tacacs Output Details

Output... What it displays...

TACACS+ status Whether the TACACS+ client is enabled or disabled.

TACACS+ session accounting Whether TACACS+ session accounting is enabled or disabled.

state

TACACS+ command Whether TACACS+ command authorization is enabled or disabled.

authorization state

TACACS+ command accounting Whether TACACS+ command accounting is enabled or disabled.

state

TACACS+ singleconnect state Whether TACACS+ singleconnect is enabled or disabled.

When enabled, the TACACS+ client sends multiple requests over a
single TCP connection.

31-2 TACACS+ Configuration

 set tacacs

Table 31-1 show tacacs Output Details (Continued)

Output... What it displays...

TACACS+ service The name of the service that is requested by the TACACS+ client for
session authorization. “exec” is the default service name.

TACACS+ session authorization Displays the attribute – value pairs that are mapped to the read-only,
A-V pairs read-write, and super-user access privilege levels for the service
requested for session authorization.
The attribute names and values shown in the example above are the
default values.

TACACS+ Server Displays the TACACS+ server information used by the TACACS+
client.

set tacacs
Use this command to enable or disable the TACACS+ client.

Syntax
set tacacs {enable | disable}

Parameters
enable | disable Enables or disables the TACACS client.

Defaults
None.

Mode
Switch command, Read-Write.

Usage
The TACACS+ client can be enabled on the switch anytime, with or without a TACACS+ server
online. If the TACACS+ server is offline and TACACS+ is enabled, the login authentication is
switched to RADIUS or local, if enabled.

Examples
This example shows how to enable the TACACS+ client.
A4(rw)->set tacacs enable

show tacacs server

Use this command to display the current TACACS+ server configuration.

Syntax
show tacacs server {index | all}

Extreme A4 CLI Reference 31-3

set tacacs server

Parameters
index Display the configuration of the TACACS+ server identified by index.
The value of index can range from 1 to 2,147,483,647.
all Display the configuration for all configured TACACS+ servers.

Defaults
None.

Mode
Switch command, Read-Only.

Example
This example displays configuration information for TACACS+ server 1.
A4(ro)->show tacacs server 1
TACACS+ Server IP address Port Timeout
-------------- ---------- ------ -------
1 192.168.10.1 49 10

set tacacs server

Use this command to configure the TACACS+ server(s) to be used by the TACACS+ client. You can
configure the timeout value for all configured servers or a single server, or you can configure the
IP address, TCP port, and secret for a single server. For simplicity, two syntax statements are
shown.

Syntax
set tacacs server {all | index} timeout seconds
set tacacs server index address port secret

Parameters
all Specify the timeout value for all configured TACACS+ servers.
index Configure the TACACS+ server identified by index. The value of index
can range from 1 to 2,147,483,647.
timeout seconds Set the timeout value for the specified server(s) in seconds. The value of
seconds can range from 1 to 180 seconds.
The default timeout value is 10 seconds.
address Specify the IP address of the TACACS+ server.
port Specify the TCP port for the TACACS+ server. The value of port can
range from 0 to 65535, but typically, port 49 is specified.
secret Specify the secret (shared password) for the TACACS+ server.

Defaults
No TACACS+ servers are configured by default.
When you do configure a TACACS+ server, the default timeout value is 10 seconds.

31-4 TACACS+ Configuration

 clear tacacs server

Mode
Switch command, Read-Write.

Usage
Up to 5 TACACS+ servers can be configured, with the index value of 1 having the highest priority.
If you want to change the default timeout value for a specific server or all servers, you must enter
the command using the timeout parameter.
When at least one backup server has been configured and the switch loses contact with the
primary server, the switch will contact the next server in priority. If the switch was trying to
authenticate a user when the connection was lost, or if the default login access (read-only
permissions) had been received, the switch will try to authenticate again.
If a user had already been authenticated and authorized, then the backup server is contacted
without requiring any authentication. The backup server will just authorize or account for the
packets coming in for that user. Since a task ID is associated with each accounting session, if there
is a failover to a backup server, the accounting information will still be associated with the correct
session using the task ID.
When a failover to a backup server occurs, syslog messages are generated containing the reason
for the failure.

Example
This example configures TACACS+ server 1. Then, the default timeout value of 10 seconds is
changed to 20 seconds.
A4(rw)->set tacacs server 1 192.168.10.10 49 mysecret
A4(rw)->set tacacs server 1 timeout 20

clear tacacs server

Use this command to remove one or all configured TACACS+ servers, or to return the timeout
value to its default value for one or all configured TACACS+ servers.

Syntax
clear tacacs server {all | index} [timeout]

Parameters
all Specifies that all configured TACACS+ servers should be affected.
index Specifies one TACACS+ server to be affected.
timeout (Optional) Return the timeout value to its default value of 10 seconds.

Defaults
If timeout is not specified, the affected TACACS+ servers will be removed.

Mode
Switch command, Read-Write.

Extreme A4 CLI Reference 31-5

show tacacs session

Examples
This example removes TACACS+ server 1.
A4(rw)->clear tacacs server 1
This example resets the timeout value to its default value of 10 seconds for all configured
TACACS+ servers.
A4(rw)->clear tacacs server all timeout

show tacacs session

Use this command to display the current TACACS+ client session settings.

Syntax
show tacacs session {authorization | accounting}

Parameters
authorization Display client session authorization settings.
accounting Display client session accounting settings.

Defaults
None.

Mode
Switch command, Read-Only.

Examples
This example shows how to display client session authorization information:
A4(ro)->show tacacs session authorization
TACACS+ service: exec
TACACS+ session authorization A-V pairs:
access-level attribute value
read-only priv-lvl 0
read-write priv-lvl 1
super-user priv-lvl 15

This example shows how to display client session accounting state.

A4(ro)->show tacacs session accounting
TACACS+ session accounting state: enabled

31-6 TACACS+ Configuration

 set tacacs session

set tacacs session

Use this command to enable or disable TACACS+ session accounting, or to configure TACACS+
session authorization parameters. For simplicity, separate syntax formats are shown for
configuring session accounting and session authorization.

Syntax
set tacacs session accounting {enable | disable}
set tacacs session authorization {service name | read-only attribute value |
read-write attribute value | super-user attribute value}

Parameters
accounting Specifies that TACACS+ session accounting is being configured.
enable | disable Enables or disables TACACS+ session accounting.
authorization Specifies that TACACS+ session authorization is being configured.
service name Specifies the name of the service that the TACACS+ client will request
from the TACACS+ server. The name specified here must match the
name of a service configured on the server. The default service name is
exec.
read-only attribute Specifies that the read-only access privilege level should be matched to
value a privilege level configured on the TACACS+ server by means of an
attribute-value pair specified by attribute and value.
By default, attribute is “priv-lvl” and value is 0.
read-write attribute Specifies that the read-write access privilege level should be matched to
value a privilege level configured on the TACACS+ server by means of an
attribute-value pair specified by attribute and value.
By default, attribute is “priv-lvl” and value is 1.
super-user attribute Specifies that the super-user access privilege level should be matched to
value a privilege level configured on the TACACS+ server by means of an
attribute-value pair specified by attribute and value.
By default, attribute is “priv-lvl” and value is 15.

Defaults
None.

Mode
Switch command, Read-Write.

Usage
When session accounting is enabled, the TACACS+ server will log accounting information, such as
start and stop times, IP address of the client, and so forth, for each authorized client session.
When the TACACS+ client is enabled on the switch (with the set tacacs enable command), the
session authorization parameters configured with this command are sent by the client to the
TACACS+ server when a session is initiated on the switch. The parameter values must match a
service and access level attribute-value pairs configured on the server for the session to be
authorized. If the parameter values do not match, the session will not be allowed.

Extreme A4 CLI Reference 31-7

clear tacacs session

The service name and attribute-value pairs can be any character string, and are determined by
your TACACS+ server configuration.
Since a task ID is associated with each accounting session, if there is a failover to a backup server,
the accounting information will still be associated with the correct session using the task ID.

Examples
This example configures the service requested by the TACACS+ client as the service name “basic.”
A4(rw)->set tacacs session authorization service basic
This example maps the read-write access privilege level to an attribute named “priv-lvl” with the
value of 5 configured on the TACACS+ server.
A4(rw)->set tacacs session authorization read-write priv-lvl 5
This example enables TACACS+ session accounting.
A4(rw)->set tacacs session accounting enable

clear tacacs session

Use this command to return the TACACS+ session authorization settings to their default values.

Syntax
clear tacacs session authorization {[service]|[read-only]|[read-write] |
[super-user]}

Parameters
authorization Clears the TACACS+ session authorization parameters.
service Clears the TACACS+ session authorization service name to the default
value of “exec.”
read-only Clears the TACACS+ session authorization read-only attribute-value
pair to their default values of “priv-lvl” and 0.
read-write Clears the TACACS+ session authorization read-write attribute-value
pair to their default values of “priv-lvl” and 1.
super-user Clears the TACACS+ session authorization super-user attribute-value
pair to their default values of “priv-lvl” and 15.

Defaults
At least one of the session authorization parameters must be specified.

Mode
Switch command, Read-Write.

Examples
This example shows how to return the service name to the default of “exec.”
A4(rw)->clear tacacs session authorization service
This example shows how to return all the session authorization parameters to their default values.
A4(rw)->clear tacacs session authorization service read-only read-write super-
user

31-8 TACACS+ Configuration

 show tacacs command

show tacacs command

Use this command to display the status (enabled or disabled) of TACACS+ accounting or
authorization on a per-command basis.

Syntax
show tacacs command {accounting | authorization}

Parameters
accounting Display the status of TACACS+ accounting on a per-command basis.
authorization Display the status of TACACS+ authorization on a per-command basis.

Defaults
None.

Mode
Switch command, Read-Write.

Example
This example shows how to display the state of the TACACS+ client’s command authorization.
A4(rw)->show tacacs command authorization
TACACS+ command authorization state: enabled

set tacacs command

Use this command to enable or disable TACACS+ accounting or authorization on a per-command
basis.

Syntax
set tacacs command {accounting | authorization} {enable | disable}

Parameters
accounting | Specifies either TACACS+ accounting or authorization to be enabled or
authorization disabled.
enable | disable Enable or disable accounting or authorization on a per-command basis.

Defaults
None.

Mode
Switch command, Read-Write.

Usage
In order for per-command accounting or authorization by a TACACS+ server to take place, the
command must be executed within an authorized session.

Extreme A4 CLI Reference 31-9

show tacacs singleconnect

When per-command accounting is enabled, the TACACS+ server will log accounting information,
such as start and stop times, IP address of the client, and so forth, for each command executed
during the session.
When per-command authorization is enabled, the TACACS+ server will check whether each
command is permitted for that authorized session and return a success or fail. If the authorization
fails, the command is not executed.

Example
This example shows how to enable TACACS+ authorization on a command basis.
A4(rw)->set tacacs command authorization enable

show tacacs singleconnect

Use this command to display the current status of the TACACS+ client’s ability to send multiple
requests over a single TCP connection.

Syntax
show tacacs singleconnect

Parameters
None.

Defaults
None.

Mode
Switch command, Read-Write.

Example
This example shows how to display the state of the TACACS+ client’s ability to send multiple
requests over a single connection.

A4(rw)->show tacacs singleconnect

TACACS+ single-connect state: enabled

set tacacs singleconnect

Use this command to enable or disable the ability of the TACACS+ client to send multiple requests
over a single TCP connection. When enabled, the TACACS+ client will use a single TCP
connection for all requests to a given TACACS+ server.

Syntax
set tacacs singleconnect {enable | disable}

Parameters
enable | disable Enable or disable the ability to send multiple requests over a single TCP
connection.

31-10 TACACS+ Configuration

 show tacacs interface

Defaults
None.

Mode
Switch command, Read-Write.

Examples
This example shows how to disable sending multiple requests over a single connection.

A4(rw)->set tacacs singleconnect disable

show tacacs interface

Use this command to display the interface used for the source IP address of the TACACS+ packets
generated by the switch.

Syntax
show tacacs interface

Parameters
None.

Defaults
None.

Mode
Switch mode, read-only.

Example
This example displays the output of this command. In this case, the IP address assigned to
loopback interface 1 will be used as the source IP address of the TACACS+ packets generated by
the switch.
A4(rw)->show tacacs interface
loopback 1 192.168.10.1

set tacacs interface

Use this command to specify the interface used for the source IP address of the TACACS+ packets
generated by the switch.

Syntax
set tacacs interface {loopback loop-ID | vlan vlan-ID}

Parameters
loopback loop-ID Specifies the loopback interface to be used. The value of loop-ID can
range from 0 to 7.

Extreme A4 CLI Reference 31-11

clear tacacs interface

vlan vlan-ID Specifies the VLAN interface to be used. The value of vlan-ID can range
from 1 to 4093.

Defaults
None.

Mode
Switch command, read-write.

Usage
This command allows you to configure the source IP address used by the TACACS+ application
on the switch when generating packets for management purposes. Any of the management
interfaces, including VLAN routing interfaces, can be configured as the source IP address used in
packets generated by the TACACS+ client.
An interface must have an IP address assigned to it before it can be set by this command.
If no interface is specified, then the IP address of the Host interface will be used.
If a non-loopback interface is configured with this command, application packet egress is
restricted to that interface if the server can be reached from that interface. Otherwise, the packets
are transmitted over the first available route. Packets from the application server are received on
the configured interface.
If a loopback interface is configured, and there are multiple paths to the application server, the
outgoing interface (gateway) is determined based on the best route lookup. Packets from the
application server are then received on the sending interface. If route redundancy is required,
therefore, a loopback interface should be configured.

Example
This example configures an IP address on VLAN interface 100 and then sets that interface as the
TACACS+ client source IP address.
A4(rw)->router(Config-if(Vlan 100))#ip address 192.168.10.1 255.255.255.0
A4(rw)->router(Config-if(Vlan 100))#exit
A4(rw)->router(Config)#exit
A4(rw)->router#exit
A4(rw)->router>exit
A4(rw)->set tacacs interface vlan 100

A4(rw)->show tacacs interface

vlan 100 192.168.10.1

clear tacacs interface

Use this command to clear the interface used for the source IP address of the TACACS+ client back
to the default of the Host interface.

Syntax
clear tacacs interface

Parameters
None.

31-12 TACACS+ Configuration

 clear tacacs interface

Defaults
None.

Mode
Switch command, read-write.

Example
This command returns the interface used for the source IP address of the TACACS+ client back to
the default of the Host interface.
A4(rw)->show tacacs interface
vlan 100 192.168.10.1
A4(rw)->clear tacacs interface
A4(rw)->

Extreme A4 CLI Reference 31-13