Home » HP Manuals » Storage Devices » HP Cisco Nexus 5000 » Manual Viewer

HP Cisco Nexus 5000 Cisco Nexus 5000 Series Switch CLI Software Configuration - Page 325

Configuring Access Control Lists, Information About ACLs, IP ACL Types and Applications

View all HP Cisco Nexus 5000 manuals

Add to My Manuals
Save this manual to your list of manuals

Page 325 highlights

21 C H A P T E R Configuring Access Control Lists This chapter contains the following sections: • Information About ACLs, page 279 • Configuring IP ACLs, page 283 • Configuring MAC ACLs, page 287 • Example Configuration for MAC ACLs, page 291 • Information About VLAN ACLs, page 291 • Configuring VACLs, page 292 • Example Configuration for VACL, page 295 • Default ACL Settings, page 295 Information About ACLs An access control list (ACL) is an ordered set of rules that you can use to filter traffic. Each rule specifies a set of conditions that a packet must satisfy to match the rule. When the switch determines that an ACL applies to a packet, it tests the packet against the conditions of all rules. The first match determines whether the packet is permitted or denied. If there is no match, the switch applies the applicable default rule. The switch continues processing packets that are permitted and drops packets that are denied. You can use ACLs to protect networks and specific hosts from unnecessary or unwanted traffic. For example, you could use ACLs to disallow HTTP traffic from a high-security network to the Internet. You could also use ACLs to allow HTTP traffic but only to specific sites, using the IP address of the site to identify it in an IP ACL. IP ACL Types and Applications The Cisco Nexus 5000 Series switch supports IPv4, IPv6, and MAC ACLs for security traffic filtering. The switch allows you to use IP ACLs as port ACLs and VLAN ACLs, as shown in the following table. OL-16597-01 Cisco Nexus 5000 Series Switch CLI Software Configuration Guide 279

Section	Page
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide	1
Contents	3
New and Changed Information for the Cisco Nexus 5000 Series	41
Preface	43
Audience	43
Document Organization	43
Document Conventions	44
Related Documentation	45
Obtaining Documentation and Submitting a Service Request	46
Overview	47
Information About Cisco Nexus 5000 Series Switches	47
New Technologies in the Cisco Nexus 5000 Series	47
Fibre Channel over Ethernet	47
Data Center I/O Consolidation	48
Virtual Interfaces	49
Cisco Nexus 5000 Series Switch Hardware	50
Chassis	50
Expansion Modules	50
Fabric Extender	50
Ethernet Interfaces	50
Fibre Channel Interfaces	51
Management Interfaces	51
Cisco Nexus 5000 Series Switch Software	51
Ethernet Switching	51
FCoE and Fibre Channel Switching	51
QoS	52
Virtual Port Channels	52
Serviceability	52
Switched Port Analyzer	52
Ethanalyzer	52
Call Home	52
Online Diagnostics	53
Switch Management	53
Simple Network Management Protocol	53
Role-Based Access Control	53
Configuration Methods	53
Configuring with CLI, XML Management Interface, or SNMP	53
Configuring with Cisco Data Center Network Manager	53
Configuring with Cisco MDS Fabric Manager	53
Network Security Features	54
Virtual Device Contexts	54
Licensing	54
Typical Deployment Topologies	54
Ethernet TOR Switch Topology	54
Fabric Extender Deployment Topology	56
Data Center I/O Consolidation Topology	57
Supported Standards	57
Configuration Fundamentals	59
Using the Command-Line Interface	61
Accessing the Command Line Interface	61
Telnet Connection	61
SSH Connection	62
Using the CLI	63
Using CLI Command Modes	63
Changing Command Modes	63
Listing the Commands Used with Each Command Mode	64
CLI Command Hierarchy	64
EXEC Mode Commands	64
Configuration Mode Commands	66
Using Commands	68
Listing Commands and Syntax	68
Entering Command Sequences	68
Undoing or Reverting to Default Values or Conditions	68
Using Keyboard Shortcuts	69
Using CLI Variables	70
User-Defined Persistent CLI Variables	71
Using Command Aliases	72
Defining Command Aliases	72
Command Scripts	72
Executing Commands Specified in a Script	72
Using CLI Variables in Scripts	73
Setting the Delay Time	74
Initial Switch Configuration	75
Configuring the Switch	75
Image Files on the Switch	75
Starting the Switch	75
Boot Sequence	76
Console Settings	77
Upgrading the Switch Software	77
Downgrading from a Higher Release	79
Initial Configuration	81
Configuration Prerequisites	81
Initial Setup	81
Preparing to Configure the Switch	81
Default Login	82
Configuring the Switch	82
Changing the Initial Configuration	86
Accessing the Switch	86
Additional Switch Configuration	86
Assigning a Switch Name	86
Configuring Date and Time	87
Configuring Time Zone	87
Adjusting for Daylight Saving Time or Summer Time	88
NTP Configuration	89
About NTP	89
NTP Configuration Guidelines	89
Configuring NTP	90
NTP CFS Distribution	91
Enabling NTP Distribution	91
Committing NTP Configuration Changes	91
Discarding NTP Configuration Changes	92
Releasing Fabric Session Lock	92
Database Merge Guidelines	92
NTP Session Status Verification	92
Management Interface Configuration	93
About the mgmt0 Interface	93
Configuring the Management Interface	93
Displaying Management Interface Configuration	94
Shutting Down the Management Interface	94
Managing the Switch Configuration	94
Displaying the Switch Configuration	94
Saving a Configuration	95
Clearing a Configuration	95
Using Switch File Systems	95
Setting the Current Directory	95
Displaying the Current Directory	95
Listing the Files in a Directory	96
Creating a Directory	96
Deleting an Existing Directory	96
Moving Files	96
Copying Files	97
Deleting Files	97
Displaying File Contents	97
Saving Command Output to a File	97
Compressing and Uncompressing Files	98
Managing Licenses	99
Licensing Terminology	99
Licensing Model	100
Licence Installation	101
Obtaining a Factory-Installed License	101
Performing a Manual Installation	102
Obtaining the License Key File	102
Installing the License Key File	102
Backing Up License Files	103
Identifying License Features in Use	104
Uninstalling Licenses	104
Updating Licenses	105
Grace Period Alerts	106
License Transfers Between Switches	107
Verifying the License Configuration	107
LAN Switching	109
Configuring Ethernet Interfaces	111
Information About Ethernet Interfaces	111
About the Interface Command	111
About the Unidirectional Link Detection Parameter	112
UDLD Overview	112
Default UDLD Configuration	113
UDLD Aggressive and Nonaggressive Modes	113
About Interface Speed	114
About the Cisco Discovery Protocol	114
Default CDP Configuration	114
About the Debounce Timer Parameters	114
About MTU Configuration	115
Configuring Ethernet Interfaces	115
Configuring the UDLD Mode	115
Configuring Interface Speed	116
Configuring the Cisco Discovery Protocol	117
Configuring the CDP Characteristics	117
Enabling or Disabling CDP	118
Configuring the Debounce Timer	118
Configuring the Description Parameter	119
Disabling and Restarting Ethernet Interfaces	119
Displaying Interface Information	120
Default Physical Ethernet Settings	123
Configuring VLANs	125
Configuring VLANs	125
Information About VLANs	125
Understanding VLANs	125
Understanding VLAN Ranges	126
Creating, Deleting, and Modifying VLANs	127
Configuring a VLAN	128
Creating and Deleting a VLAN	128
Entering the VLAN Submode and Configuring the VLAN	129
Adding Ports to a VLAN	130
Verifying VLAN Configuration	130
Configuring Private VLANs	133
Information About Private VLANs	133
Primary and Secondary VLANs in Private VLANs	134
Private VLAN Ports	134
Primary, Isolated, and Community Private VLANs	135
Associating Primary and Secondary VLANs	136
Private VLAN Promiscuous Trunks	137
Private VLAN Isolated Trunks	137
Broadcast Traffic in Private VLANs	138
Private VLAN Port Isolation	138
Guidelines and Limitations for Private VLANs	138
Configuring a Private VLAN	138
Enabling Private VLANs	138
Configuring a VLAN as a Private VLAN	139
Associating Secondary VLANs with a Primary Private VLAN	140
Configuring an Interface as a Private VLAN Host Port	141
Configuring an Interface as a Private VLAN Promiscuous Port	142
Configuring a Promiscuous Trunk Port	143
Configuring an Isolated Trunk Port	143
Configuring the Allowed VLANs for PVLAN Trunking Ports	144
Configuring Native 802.1Q VLANs on Private VLANs	145
Verifying Private VLAN Configuration	146
Configuring Access and Trunk Interfaces	147
Information About Access and Trunk Interfaces	147
Understanding Access and Trunk Interfaces	147
Understanding IEEE 802.1Q Encapsulation	148
Understanding Access VLANs	149
Understanding the Native VLAN ID for Trunk Ports	150
Understanding Allowed VLANs	150
Understanding Native 802.1Q VLANs	150
Configuring Access and Trunk Interfaces	151
Configuring a LAN Interface as an Ethernet Access Port	151
Configuring Access Host Ports	151
Configuring Trunk Ports	152
Configuring the Native VLAN for 802.1Q Trunking Ports	153
Configuring the Allowed VLANs for Trunking Ports	153
Configuring Native 802.1Q VLANs	154
Verifying Interface Configuration	155
Configuring EtherChannels	157
Information About EtherChannels	157
Understanding EtherChannels	157
Compatibility Requirements	158
Load Balancing Using EtherChannels	159
Understanding LACP	160
LACP Overview	160
LACP ID Parameters	161
Channel Modes	162
LACP Marker Responders	163
LACP-Enabled and Static EtherChannels Differences	163
Configuring EtherChannels	163
Creating an EtherChannel	163
Adding a Port to an EtherChannel	164
Configuring Load Balancing Using EtherChannels	165
Enabling LACP	166
Configuring Channel Mode for a Port	166
Configuring the LACP System Priority and System ID	167
Configuring the LACP Port Priority	167
Verifying EtherChannel Configuration	168
Configuring Virtual Port Channels	169
Information About vPCs	169
vPC Overview	169
Terminology	171
vPC Terminology	171
Fabric Extender Terminology	171
Supported vPC Topologies	172
Cisco Nexus 5000 Series Switch vPC Topology	172
Single Homed Fabric Extender vPC Topology	172
Dual Homed Fabric Extender vPC Topology	173
vPC Domain	174
Peer-Keepalive Link and Messages	174
Compatibility Parameters for vPC Peer Links	175
Configuration Parameters That Must Be Identical	175
Configuration Parameters That Should Be Identical	176
vPC Peer Links	177
vPC Peer Link Overview	177
Manually Configured vPC Features	178
vPC Number	179
vPC Interactions with Other Features	179
vPC and LACP	179
vPC Peer Links and STP	179
CFSoE	180
vPC Guidelines and Limitations	180
Configuring vPCs	181
Enabling vPCs	181
Disabling vPCs	181
Creating a vPC Domain	182
Configuring a vPC Keepalive Link	183
Creating a vPC Peer Link	184
Checking the Configuration Compatibility	184
Creating an EtherChannel Host Interface	185
Moving Other EtherChannels into a vPC	186
Manually Configuring a vPC Domain MAC Address	187
Manually Configuring the System Priority	188
Manually Configuring a vPC Peer Switch Role	189
Verifying the vPC Configuration	190
vPC Example Configurations	191
Dual Homed Fabric Extender vPC Configuration Example	191
Single Homed Fabric Extender vPC Configuration Example	192
vPC Default Settings	194
Configuring Rapid PVST+	195
Information About Rapid PVST+	195
Understanding STP	196
STP Overview	196
Understanding How a Topology is Created	196
Understanding the Bridge ID	196
Bridge Priority Value	197
Extended System ID	197
STP MAC Address Allocation	197
Understanding BPDUs	198
Election of the Root Bridge	199
Creating the Spanning Tree Topology	199
Understanding Rapid PVST+	200
Rapid PVST+ Overview	200
Rapid PVST+ BPDUs	202
Proposal and Agreement Handshake	203
Protocol Timers	204
Port Roles	204
Port States	205
Rapid PVST+ Port State Overview	205
Blocking State	206
Learning State	206
Forwarding State	206
Disabled State	207
Summary of Port States	207
Synchronization of Port Roles	207
Processing Superior BPDU Information	208
Processing Inferior BPDU Information	208
Detecting Unidirectional Link Failure	209
Port Cost	209
Port Priority	210
Rapid PVST+ and IEEE 802.1Q Trunks	210
Rapid PVST+ Interoperation with Legacy 802.1D STP	210
Rapid PVST+ Interoperation with 802.1s MST	211
Configuring Rapid PVST+	211
Enabling Rapid PVST+	211
Enabling Rapid PVST+ per VLAN	212
Configuring the Root Bridge ID	213
Configuring a Secondary Root Bridge	214
Configuring the Rapid PVST+ Port Priority	214
Configuring the Rapid PVST+ Pathcost Method and Port Cost	215
Configuring the Rapid PVST+ Bridge Priority of a VLAN	216
Configuring the Rapid PVST+ Hello Time for a VLAN	216
Configuring the Rapid PVST+ Forward Delay Time for a VLAN	217
Configuring the Rapid PVST+ Maximum Age Time for a VLAN	217
Specifying the Link Type	218
Restarting the Protocol	218
Verifying Rapid PVST+ Configurations	218
Configuring Multiple Spanning Tree	221
Information About MST	221
MST Overview	221
MST Regions	222
MST BPDUs	222
MST Configuration Information	223
IST, CIST, and CST	223
IST, CIST, and CST Overview	223
Spanning Tree Operation Within an MST Region	224
Spanning Tree Operations Between MST Regions	224
MST Terminology	225
Hop Count	226
Boundary Ports	226
Detecting Unidirectional Link Failure	227
Port Cost and Port Priority	228
Interoperability with IEEE 802.1D	228
Interoperability with Rapid PVST+: Understanding PVST Simulation	229
Configuring MST	229
MST Configuration Guidelines	229
Enabling MST	229
Entering MST Configuration Mode	230
Specifying the MST Name	231
Specifying the MST Configuration Revision Number	231
Specifying the Configuration on an MST Region	232
Mapping and Unmapping VLANs to MST Instances	233
Mapping Secondary VLANs to Same MSTI as Primary VLANs for Private VLANs	234
Configuring the Root Bridge	235
Configuring a Secondary Root Bridge	236
Configuring the Port Priority	236
Configuring the Port Cost	237
Configuring the Switch Priority	238
Configuring the Hello Time	239
Configuring the Forwarding-Delay Time	239
Configuring the Maximum-Aging Time	240
Configuring the Maximum-Hop Count	240
Configuring PVST Simulation Globally	240
Configuring PVST Simulation Per Port	241
Specifying the Link Type	242
Restarting the Protocol	242
Verifying MST Configurations	243
Configuring STP Extensions	245
About STP Extensions	245
Information About STP Extensions	245
Understanding STP Port Types	245
Spanning Tree Edge Ports	245
Spanning Tree Network Ports	246
Spanning Tree Normal Ports	246
Understanding Bridge Assurance	246
Understanding BPDU Guard	246
Understanding BPDU Filtering	247
Understanding Loop Guard	248
Understanding Root Guard	248
Configuring STP Extensions	249
STP Extensions Configuration Guidelines	249
Configuring Spanning Tree Port Types Globally	249
Configuring Spanning Tree Edge Ports on Specified Interfaces	250
Configuring Spanning Tree Network Ports on Specified Interfaces	251
Enabling BPDU Guard Globally	252
Enabling BPDU Guard on Specified Interfaces	252
Enabling BPDU Filtering Globally	253
Enabling BPDU Filtering on Specified Interfaces	254
Enabling Loop Guard Globally	255
Enabling Loop Guard or Root Guard on Specified Interfaces	256
Verifying STP Extension Configuration	256
Configuring the MAC Address Table	257
Information About MAC Addresses	257
Configuring MAC Addresses	257
Configuring a Static MAC Address	257
Configuring the Aging Time for the MAC Table	258
Clearing Dynamic Addresses from the MAC Table	259
Verifying the MAC Address Configuration	259
Configuring IGMP Snooping	261
Information About IGMP Snooping	261
IGMPv1 and IGMPv2	262
IGMPv3	263
IGMP Snooping Querier	263
IGMP Forwarding	263
Configuring IGMP Snooping Parameters	264
Verifying IGMP Snooping Configuration	266
Configuring Traffic Storm Control	267
Information About Traffic Storm Control	267
Traffic Storm Guidelines and Limitations	268
Configuring Traffic Storm Control	269
Verifying Traffic Storm Control Configuration	269
Traffic Storm Control Example Configuration	270
Default Traffic Storm Settings	270
Switch Security Features	271
Configuring Authentication, Authorization, and Accounting	273
Information About AAA	273
AAA Security Services	273
Benefits of Using AAA	274
Remote AAA Services	274
AAA Server Groups	275
AAA Service Configuration Options	275
Authentication and Authorization Process for User Login	276
Prerequisites for Remote AAA	277
Information about AAA Guidelines and Limitations	278
Configuring AAA	278
Configuring Console Login Authentication Methods	278
Configuring Default Login Authentication Methods	279
Enabling Login Authentication Failure Messages	280
Enabling MSCHAP Authentication	281
Configuring AAA Accounting Default Methods	282
Using AAA Server VSAs	283
About VSAs	283
VSA Format	283
Specifying Switch User Roles and SMNPv3 Parameters on AAA Servers	284
Displaying and Clearing the Local AAA Accounting Log	284
Verifying AAA Configuration	284
Example AAA Configuration	285
Default AAA Settings	285
Configuring RADIUS	287
Configuring RADIUS	287
Information About RADIUS	287
RADIUS Network Environments	287
RADIUS Operation	288
RADIUS Server Monitoring	288
Vendor-Specific Attributes	289
Prerequisites for RADIUS	290
Guidelines and Limitations for RADIUS	290
Configuring RADIUS Servers	290
Configuring RADIUS Server Hosts	291
Configuring RADIUS Global Preshared Keys	291
Configuring RADIUS Server Preshared Keys	292
Configuring RADIUS Server Groups	293
Allowing Users to Specify a RADIUS Server at Login	294
Configuring the Global RADIUS Transmission Retry Count and Timeout Interval	294
Configuring the RADIUS Transmission Retry Count and Timeout Interval for a Server	295
Configuring Accounting and Authentication Attributes for RADIUS Servers	296
Configuring Periodic RADIUS Server Monitoring	297
Configuring the Dead-Time Interval	298
Manually Monitoring RADIUS Servers or Groups	298
Verifying RADIUS Configuration	299
Displaying RADIUS Server Statistics	299
Example RADIUS Configuration	300
Default RADIUS Settings	300
Configuring TACACS+	301
About Configuring TACACS+	301
Information About TACACS+	301
TACACS+ Advantages	301
User Login with TACACS+	302
Default TACACS+ Server Encryption Type and Preshared Key	302
TACACS+ Server Monitoring	303
Prerequisites for TACACS+	303
Guidelines and Limitations for TACACS+	303
Configuring TACACS+	304
TACACS+ Server Configuration Process	304
Enabling TACACS+	304
Configuring TACACS+ Server Hosts	305
Configuring TACACS+ Global Preshared Keys	305
Configuring TACACS+ Server Preshared Keys	306
Configuring TACACS+ Server Groups	307
Specifying a TACACS+ Server at Login	308
Configuring the Global TACACS+ Timeout Interval	308
Configuring the Timeout Interval for a Server	309
Configuring TCP Ports	309
Configuring Periodic TACACS+ Server Monitoring	310
Configuring the Dead-Time Interval	311
Manually Monitoring TACACS+ Servers or Groups	312
Disabling TACACS+	312
Displaying TACACS+ Statistics	313
Verifying TACACS+ Configuration	313
Example TACACS+ Configuration	313
Default TACACS+ Settings	313
Configuring SSH and Telnet	315
Configuring SSH and Telnet	315
Information About SSH and Telnet	315
SSH Server	315
SSH Client	315
SSH Server Keys	315
Telnet Server	316
Guidelines and Limitations for SSH	316
Configuring SSH	316
Generating SSH Server Keys	316
Specifying the SSH Public Keys for User Accounts	317
Specifying the SSH Public Keys in Open SSH Format	317
Specifying the SSH Public Keys in IETF SECSH Format	318
Specifying the SSH Public Keys in PEM-Formatted Public Key Certificate Form	318

Match case Limit results 1 per page

CHAPTER

Configuring Access Control Lists

This chapter contains the following sections:

•

Information About ACLs, page 279

•

Configuring IP ACLs, page 283

•

Configuring MAC ACLs, page 287

•

Example Configuration for MAC ACLs, page 291

•

Information About VLAN ACLs, page 291

•

Configuring VACLs, page 292

•

Example Configuration for VACL, page 295

•

Default ACL Settings, page 295

Information About ACLs

An access control list (ACL) is an ordered set of rules that you can use to filter traffic. Each rule specifies a

set of conditions that a packet must satisfy to match the rule. When the switch determines that an ACL applies

to a packet, it tests the packet against the conditions of all rules. The first match determines whether the packet

is permitted or denied. If there is no match, the switch applies the applicable default rule. The switch continues

processing packets that are permitted and drops packets that are denied.

You can use ACLs to protect networks and specific hosts from unnecessary or unwanted traffic. For example,

you could use ACLs to disallow HTTP traffic from a high-security network to the Internet. You could also

use ACLs to allow HTTP traffic but only to specific sites, using the IP address of the site to identify it in an

IP ACL.

IP ACL Types and Applications

The Cisco Nexus 5000 Series switch supports IPv4, IPv6, and MAC ACLs for security traffic filtering. The

switch allows you to use IP ACLs as port ACLs and VLAN ACLs, as shown in the following table.

Cisco Nexus 5000 Series Switch CLI Software Configuration Guide

OL-16597-01

279