Home » Cisco Manuals » Bridges & Routers » Cisco 3845 » Manual Viewer

Cisco 3845 Software Guide - Page 456

IPv4 Access List Numbers, ACL Logging, Supported

UPC - 746320981420

Add to My Manuals
Save this manual to your list of manuals

Page 456 highlights

Configuring IPv4 ACLs Chapter 26 Configuring Network Security with ACLs IPv4 Access List Numbers The number you use to denote your IPv4 ACL shows the type of access list that you are creating. Table 26-1 lists the access-list number and corresponding access list type and shows whether or not they are supported in the switch. The switch supports IPv4 standard and extended access lists, numbers 1 to 199 and 1300 to 2699. Table 26-1 Access List Numbers Access List Number 1-99 100-199 200-299 300-399 400-499 500-599 600-699 700-799 800-899 900-999 1000-1099 1100-1199 1200-1299 1300-1999 2000-2699 Type IP standard access list IP extended access list Protocol type-code access list DECnet access list XNS standard access list XNS extended access list AppleTalk access list 48-bit MAC address access list IPX standard access list IPX extended access list IPX SAP access list Extended 48-bit MAC address access list IPX summary address access list IP standard access list (expanded range) IP extended access list (expanded range) Supported Yes Yes No No No No No No No No No No No Yes Yes Note In addition to numbered standard and extended IPv4 ACLs, you can also create standard and extended named IPv4 ACLs by using the supported numbers. That is, the name of a standard IP ACL can be 1 to 99; the name of an extended IP ACL can be 100 to 199. The advantage of using named ACLs instead of numbered lists is that you can delete individual entries from a named list. ACL Logging The switch software can provide logging messages about packets permitted or denied by a standard IP access list. That is, any packet that matches the ACL causes an informational logging message about the packet to be sent to the console. The level of messages logged to the console is controlled by the logging console commands controlling the syslog messages. Note Because routing is done in hardware and logging is done in software, if a large number of packets match a permit or deny ACE containing a log keyword, the software might not be able to match the hardware processing rate, and not all packets will be logged. 26-8 Cisco ME 3800X and 3600X Switch Software Configuration Guide OL-23400-01

Section	Page
Cisco ME 3800X and 3600X Switch Software Configuration Guide	1
Contents	3
Preface	35
Audience	35
Purpose	35
Conventions	35
Related Publications	36
Obtaining Documentation and Submitting a Service Request	37
Overview	39
Software Licenses and Features	39
Features	40
Performance Features	40
Management Options	41
Manageability Features	41
Availability Features	43
VLAN Features	43
Security Features	44
Switch Security	44
Network Security	44
Quality of Service and Class of Service Features	45
Layer 2 Virtual Private Network Services	45
Layer 3 Features	46
Layer 3 VPN Services	46
Monitoring Features	47
Feature Support per License	47
Where to Go Next	49
Using the Command-Line Interface	51
Understanding Command Modes	51
Understanding the Help System	53
Understanding Abbreviated Commands	53
Understanding no and default Forms of Commands	54
Understanding CLI Error Messages	54
Using Command History	54
Changing the Command History Buffer Size	55
Recalling Commands	55
Disabling the Command History Feature	55
Using Editing Features	56
Enabling and Disabling Editing Features	56
Editing Commands through Keystrokes	56
Editing Command Lines that Wrap	58
Searching and Filtering Output of show and more Commands	58
Accessing the CLI	59
Accessing the CLI through a Console Connection or through Telnet	59
Assigning the Switch IP Address and Default Gateway	61
Understanding the Boot Process	61
Initial Configuration	62
Assigning Switch Information	63
Default Switch Information	63
Understanding DHCP-Based Autoconfiguration	64
DHCP Client Request Process	64
Understanding DHCP-based Autoconfiguration and Image Update	65
DHCP Autoconfiguration	65
DHCP Auto-Image Update	65
Limitations and Restrictions	66
Configuring DHCP-Based Autoconfiguration	66
DHCP Server Configuration Guidelines	67
Configuring the TFTP Server	67
Configuring the DNS	68
Configuring the Relay Device	68
Obtaining Configuration Files	69
Example Configuration	70
Configuring the DHCP Auto Configuration and Image Update Features	71
Configuring DHCP Autoconfiguration (Only Configuration File)	72
Configuring DHCP Auto-Image Update (Configuration File and Image)	73
Configuring the Client	74
Manually Assigning IP Information	75
Checking and Saving the Running Configuration	76
Modifying the Startup Configuration	77
Default Boot Configuration	78
Automatically Downloading a Configuration File	78
Specifying the Filename to Read and Write the System Configuration	78
Booting Manually	79
Booting a Specific Software Image	79
Controlling Environment Variables	80
Scheduling a Reload of the Software Image	81
Configuring a Scheduled Reload	82
Displaying Scheduled Reload Information	83
Configuring Cisco IOS Configuration Engine	85
Understanding Cisco Configuration Engine Software	85
Configuration Service	86
Event Service	87
NameSpace Mapper	87
What You Should Know About the CNS IDs and Device Hostnames	87
ConfigID	87
DeviceID	88
Hostname and DeviceID	88
Using Hostname, DeviceID, and ConfigID	88
Understanding Cisco IOS Agents	89
Initial Configuration	89
Incremental (Partial) Configuration	90
Synchronized Configuration	90
Configuring Cisco IOS Agents	90
Enabling Automated CNS Configuration	90
Enabling the CNS Event Agent	91
Enabling the Cisco IOS CNS Agent	92
Enabling an Initial Configuration	93
Enabling a Partial Configuration	96
Upgrading Devices with Cisco IOS Image Agent	97
Prerequisites for the CNS Image Agent	97
Restrictions for the CNS Image Agent	97
Displaying CNS Configuration	98
Administering the Switch	99
Managing the System Time and Date	99
Understanding the System Clock	99
Understanding Network Time Protocol	100
Configuring NTP	101
Default NTP Configuration	102
Configuring NTP Authentication	102
Configuring NTP Associations	103
Configuring NTP Broadcast Service	104
Configuring NTP Access Restrictions	106
Configuring the Source IP Address for NTP Packets	108
Displaying the NTP Configuration	109
Configuring Time and Date Manually	109
Setting the System Clock	109
Displaying the Time and Date Configuration	110
Configuring the Time Zone	110
Configuring Summer Time (Daylight Saving Time)	111
Configuring a System Name and Prompt	112
Default System Name and Prompt Configuration	113
Configuring a System Name	113
Understanding DNS	113
Default DNS Configuration	114
Setting Up DNS	114
Displaying the DNS Configuration	115
Creating a Banner	115
Default Banner Configuration	115
Configuring a Message-of-the-Day Login Banner	116
Configuring a Login Banner	117
Managing the MAC Address Table	117
Building the Address Table	118
MAC Addresses and VLANs	118
Default MAC Address Table Configuration	119
Changing the Address Aging Time	119
Removing Dynamic Address Entries	119
Configuring MAC Address Change Notification Traps	120
Configuring MAC Address Move Notification Traps	122
Configuring MAC Threshold Notification Traps	123
Adding and Removing Static Address Entries	124
Configuring Unicast MAC Address Filtering	125
Disabling MAC Address Learning on a VLAN	126
Displaying Address Table Entries	127
Managing the ARP Table	128
Configuring Synchronous Ethernet	129
Understanding SyncE	129
Reference Clocks	129
SyncE Timing Using REP for Loop Prevention and Resiliency	130
BITS Interface	133
Configuring SyncE	133
Default SyncE Configuration	134
Configuring the Network Clock Selection	134
Configuring the BITS Interface	135
Selecting the Network Clock	137
Configuring REP for the SyncE Network	138
Monitoring SyncE	139
Configuring the Switch External Alarms	141
Understanding Switch Alarms	141
Configuring Switch Alarms	142
Configuring Switch-Based Authentication	145
Preventing Unauthorized Access to Your Switch	145
Protecting Access to Privileged EXEC Commands	146
Default Password and Privilege Level Configuration	146
Setting or Changing a Static Enable Password	147
Protecting Enable and Enable Secret Passwords with Encryption	147
Disabling Password Recovery	149
Setting a Telnet Password for a Terminal Line	150
Configuring Username and Password Pairs	150
Configuring Multiple Privilege Levels	151
Setting the Privilege Level for a Command	152
Changing the Default Privilege Level for Lines	153
Logging into and Exiting a Privilege Level	153
Controlling Switch Access with TACACS+	154
Understanding TACACS+	154
TACACS+ Operation	156
Configuring TACACS+	156
Default TACACS+ Configuration	157
Identifying the TACACS+ Server Host and Setting the Authentication Key	157
Configuring TACACS+ Login Authentication	158
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services	160
Starting TACACS+ Accounting	160
Displaying the TACACS+ Configuration	161
Controlling Switch Access with RADIUS	161
Understanding RADIUS	161
RADIUS Operation	163
Configuring RADIUS	163
Default RADIUS Configuration	164
Identifying the RADIUS Server Host	164
Configuring RADIUS Login Authentication	166
Defining AAA Server Groups	168
Configuring RADIUS Authorization for User Privileged Access and Network Services	170
Starting RADIUS Accounting	171
Configuring Settings for All RADIUS Servers	172
Configuring the Switch to Use Vendor-Specific RADIUS Attributes	172
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication	173
Configuring RADIUS Server Load Balancing	174
Displaying the RADIUS Configuration	174
Controlling Switch Access with Kerberos	175
Understanding Kerberos	175
Kerberos Operation	177
Authenticating to a Boundary Switch	177
Obtaining a TGT from a KDC	178
Authenticating to Network Services	178
Configuring Kerberos	178
Configuring the Switch for Local Authentication and Authorization	179
Configuring the Switch for Secure Shell	180
Understanding SSH	180
SSH Servers, Integrated Clients, and Supported Versions	180
Limitations	181
Configuring SSH	181
Configuration Guidelines	181
Setting Up the Switch to Run SSH	181
Configuring the SSH Server	182
Displaying the SSH Configuration and Status	183
Configuring the Switch for Secure Copy Protocol	183
Information About Secure Copy	184
Configuring Interfaces	185
Understanding Interface Types	185
NNI Port Type	186
Port-Based VLANs	186
Switch Ports	186
Access Ports	187
Trunk Ports	187
Routed Ports	187
Ethernet Management Port	188
Switch Virtual Interfaces	188
EtherChannel Port Groups	188
Ethernet Flow Points	189
Connecting Interfaces	189
Using Interface Configuration Mode	190
Procedures for Configuring Interfaces	190
Configuring a Range of Interfaces	191
Configuring and Using Interface Range Macros	192
Using the Ethernet Management Port	194
Understanding the Ethernet Management Port	194
Supported Features on the Ethernet Management Port	196
Configuring the Ethernet Management Port	196
TFTP and the Ethernet Management Port	196
Configuring Ethernet Interfaces	197
Default Ethernet Interface Configuration	197
Configuring Interface Speed and Duplex Mode	198
Speed and Duplex Configuration Guidelines	198
Setting the Interface Speed and Duplex Parameters	199
Configuring IEEE 802.3x Flow Control	201
Configuring Auto-MDIX on an Interface	202
Adding a Description for an Interface	203
Configuring Layer 3 Interfaces	203
Configuring the Interface MTU	205
Monitoring and Maintaining the Interfaces	205
Monitoring Interface Status	205
Clearing and Resetting Interfaces and Counters	207
Shutting Down and Restarting the Interface	207
Configuring VLANs	209
Understanding VLANs	209
Supported VLANs	211
Normal-Range VLANs	211
Extended-Range VLANs	212
VLAN Port Membership Modes	212
UNI VLANs	212
Creating and Modifying VLANs	213
Default Ethernet VLAN Configuration	213
VLAN Configuration Guidelines	214
Creating or Modifying an Ethernet VLAN	215
Assigning Static-Access Ports to a VLAN	216
Displaying VLANs	217
Configuring VLAN Trunks	217
Trunking Overview	217
IEEE 802.1Q Configuration Considerations	218
Default Layer 2 Ethernet Interface VLAN Configuration	218
Configuring an Ethernet Interface as a Trunk Port	219
Interaction with EtherChannels	219
Configuring a Trunk Port	219
Defining the Allowed VLANs on a Trunk	220
Configuring the Native VLAN for Untagged Traffic	221
Configuring Trunk Ports for Load Sharing	222
Load Sharing Using STP Port Priorities	222
Load Sharing Using STP Path Cost	223
Configuring Ethernet Virtual Connections (EVCs)	227
Supported EVC Features	228
Understanding EVC Features	229
Ethernet Virtual Connections	229
Service Instances and EFPs	229
Encapsulation	230
Bridge Domains	232
Split-Horizon	232
Rewrite Operations	233
Configuring EFPs	234
Default EVC Configuration	234
Configuration Guidelines	234
Creating Service Instances	235
Configuration Examples	236
Configuring a Service Instance	236
Encapsulation Using a VLAN Range	236
Two Service Instances Joining the Same Bridge Domain	236
Bridge Domains and VLAN Encapsulation	237
Rewrite	237
Split Horizon	237
Hairpinning	238
Egress Filtering	238
Examples of Unsupported Configurations	239
Overlapping Encapsulation	239
Global Rewrite Operation Limitation on a Switch	240
Configuring Other Features on EFPs	241
EFPs and EtherChannels	241
EFPs and Layer 2 Protocols	242
MAC Address Forwarding, Learning and Aging on EFPs	242
Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling using EFPs	243
802.1Q Tunneling (QinQ)	243
Layer 2 Protocol Tunneling	247
EFPs and Ethernet over Multiprotocol Layer Switching (EoMPLS)	250
Bridge Domain Routing	250
EFPs and Switchport MAC Addresses	251
EVC and Switchports	251
EFPs and MSTP	255
Monitoring EVC	255
Configuring Command Macros	259
Understanding Command Macros	259
Configuring Command Macros	259
Default Command Macro Configuration	260
Command Macro Configuration Guidelines	260
Creating Command Macros	261
Applying Command Macros	262
Displaying Command Macros	263
Configuring STP	265
Understanding Spanning-Tree Features	265
STP Overview	266
Spanning-Tree Topology and BPDUs	266
Bridge ID, Switch Priority, and Extended System ID	267
Spanning-Tree Interface States	268
Blocking State	269
Listening State	270
Learning State	270
Forwarding State	270
Disabled State	270
How a Switch or Port Becomes the Root Switch or Root Port	271
Spanning Tree and Redundant Connectivity	271
Spanning-Tree Address Management	272
Accelerated Aging to Retain Connectivity	272
Spanning-Tree Modes and Protocols	273
Supported Spanning-Tree Instances	273
Spanning-Tree Interoperability and Backward Compatibility	274
STP and IEEE 802.1Q Trunks	274
Configuring Spanning-Tree Features	274
Default Spanning-Tree Configuration	275
Spanning-Tree Configuration Guidelines	275
Changing the Spanning-Tree Mode.	276
Disabling Spanning Tree	277
Configuring the Root Switch	278
Configuring a Secondary Root Switch	279
Configuring Port Priority	280
Configuring Path Cost	282
Configuring the Switch Priority of a VLAN	283
Configuring Spanning-Tree Timers	284
Configuring the Hello Time	284
Configuring the Forwarding-Delay Time for a VLAN	285
Configuring the Maximum-Aging Time for a VLAN	285
Displaying the Spanning-Tree Status	286
Configuring MSTP	287
Understanding MSTP	288
Multiple Spanning-Tree Regions	288
IST, CIST, and CST	288
Operations Within an MST Region	289
Operations Between MST Regions	289
IEEE 802.1s Terminology	291
Hop Count	291
Boundary Ports	292
IEEE 802.1s Implementation	292
Port Role Naming Change	292
Interoperation Between Legacy and Standard Switches	293
Detecting Unidirectional Link Failure	293
Interoperability with IEEE 802.1D STP	294
Understanding RSTP	294
Port Roles and the Active Topology	295
Rapid Convergence	295
Synchronization of Port Roles	297
Bridge Protocol Data Unit Format and Processing	298
Processing Superior BPDU Information	299
Processing Inferior BPDU Information	299
Topology Changes	299
Configuring MSTP Features	300
Default MSTP Configuration	300
MSTP Configuration Guidelines	301
Specifying the MST Region Configuration and Enabling MSTP	302
Configuring the Root Switch	303
Configuring a Secondary Root Switch	304
Configuring Port Priority	305
Configuring Path Cost	307
Configuring the Switch Priority	308
MSTP and Ethernet Flow Points (EFPs)	309
Configuring the Hello Time	309
Configuring the Forwarding-Delay Time	309
Configuring the Maximum-Aging Time	310
Configuring the Maximum-Hop Count	310
Specifying the Link Type to Ensure Rapid Transitions	311
Designating the Neighbor Type	312
Restarting the Protocol Migration Process	312
Displaying the MST Configuration and Status	313
Configuring Optional Spanning-Tree Features	315
Understanding Optional Spanning-Tree Features	315
Understanding Port Fast	316
Understanding BPDU Guard	316
Understanding BPDU Filtering	317
Understanding EtherChannel Guard	317
Understanding Root Guard	317
Understanding Loop Guard	318
Configuring Optional Spanning-Tree Features	319
Default Optional Spanning-Tree Configuration	319
Optional Spanning-Tree Configuration Guidelines	319
Enabling Port Fast	319
Enabling BPDU Guard	320
Enabling BPDU Filtering	321
Enabling EtherChannel Guard	322
Enabling Root Guard	323
Enabling Loop Guard	323
Displaying the Spanning-Tree Status	324
Configuring Resilient Ethernet Protocol	325
Understanding REP	325
Link Integrity	327
Fast Convergence	328
VLAN Load Balancing	328
Spanning Tree Interaction	330
REP Ports	330
Configuring REP	330
Default REP Configuration	331
REP Configuration Guidelines	331
Configuring the REP Administrative VLAN	332
Configuring REP Interfaces	333
Setting Manual Preemption for VLAN Load Balancing	337
Configuring SNMP Traps for REP	337
Monitoring REP	338
Configuring Flex Links and the MAC Address-Table Move Update Feature	339
Understanding Flex Links and the MAC Address-Table Move Update	339
Flex Links	339
VLAN Flex Link Load Balancing and Support	340
Flex Link Multicast Fast Convergence	341
Learning the Other Flex Link Port as the mrouter Port	341
Generating IGMP Reports	341
Leaking IGMP Reports	342
MAC Address-Table Move Update	344
Configuring Flex Links and MAC Address-Table Move Update	345
Default Configuration	345
Configuration Guidelines	346
Configuring Flex Links	346
Configuring VLAN Load Balancing on Flex Links	348
Configuring the MAC Address-Table Move Update Feature	349
Monitoring Flex Links and the MAC Address-Table Move Update	351
Configuring IGMP Snooping	353
Understanding IGMP Snooping	353
IGMP Versions	354
Joining a Multicast Group	355
Leaving a Multicast Group	356
Immediate Leave	357
IGMP Configurable-Leave Timer	357
IGMP Report Suppression	357
Configuring IGMP Snooping	358
Default IGMP Snooping Configuration	358
Enabling or Disabling IGMP Snooping	358
Configuring a Multicast Router Port	359
Configuring a Host Statically to Join a Group	360
Enabling IGMP Immediate Leave	360
Configuring the IGMP Leave Timer	361
Configuring TCN-Related Commands	362
Controlling the Multicast Flooding Time After a TCN Event	362
Recovering from Flood Mode	362
Disabling Multicast Flooding During a TCN Event	363
Disabling IGMP Report Suppression	364
Displaying IGMP Snooping Information	364
Configuring IGMP Filtering and Throttling	365
Default IGMP Filtering and Throttling Configuration	366
Configuring IGMP Profiles	366
Applying IGMP Profiles	367
Setting the Maximum Number of IGMP Groups	368
Configuring the IGMP Throttling Action	369
Displaying IGMP Filtering and Throttling Configuration	370
Configuring Traffic Control	371
Configuring Storm Control	371
Understanding Storm Control	371
Default Storm Control Configuration	373
Configuring Storm Control and Threshold Levels	373
Configuring Port Blocking	375
Default Port Blocking Configuration	375
Blocking Flooded Traffic on an Interface	375
Configuring EVC MAC Security	376
Understanding MAC Security	377
Secure MAC Addresses	377
Security Violations	377
Default EVC MAC Security Configuration	378
MAC Address Security Guidelines	379
Enabling and Configuring EVC MAC Security	379
Displaying Traffic Control Settings	382
Configuring CDP	383
Understanding CDP	383
Configuring CDP	384
Default CDP Configuration	384
Configuring the CDP Characteristics	384
Disabling and Enabling CDP	385
Disabling and Enabling CDP on an Interface	386
CDP and Ethernet Flow Points (EFPs)	386
Monitoring and Maintaining CDP	387
Configuring LLDP and LLDP-MED	389
Understanding LLDP and LLDP-MED	389

Match case Limit results 1 per page

26-8

Cisco ME 3800X and 3600X Switch Software Configuration Guide

OL-23400-01

Chapter 26

Configuring Network Security with ACLs

Configuring IPv4 ACLs

IPv4 Access List Numbers

The number you use to denote your IPv4 ACL shows the type of access list that you are creating.

Table 26-1

lists the access-list number and corresponding access list type and shows whether or not they

are supported in the switch. The switch supports IPv4 standard and extended access lists, numbers 1

to 199 and 1300 to 2699.

Note

In addition to numbered standard and extended IPv4 ACLs, you can also create standard and extended

named IPv4 ACLs by using the supported numbers. That is, the name of a standard IP ACL can be 1 to

99; the name of an extended IP ACL can be 100 to 199. The advantage of using named ACLs instead of

numbered lists is that you can delete individual entries from a named list.

ACL Logging

The switch software can provide logging messages about packets permitted or denied by a standard IP

access list. That is, any packet that matches the ACL causes an informational logging message about the

packet to be sent to the console. The level of messages logged to the console is controlled by the logging

console commands controlling the syslog messages.

Note

Because routing is done in hardware and logging is done in software, if a large number of packets match

permit

deny

ACE containing a

log

keyword, the software might not be able to match the hardware

processing rate, and not all packets will be logged.

Table 26-1

Access List Numbers

Access List Number

Type

Supported

1–99

IP standard access list

Yes

100–199

IP extended access list

Yes

200–299

Protocol type-code access list

300–399

DECnet access list

400–499

XNS standard access list

500–599

XNS extended access list

600–699

AppleTalk access list

700–799

48-bit MAC address access list

800–899

IPX standard access list

900–999

IPX extended access list

1000–1099

IPX SAP access list

1100–1199

Extended 48-bit MAC address access list

1200–1299

IPX summary address access list

1300–1999

IP standard access list (expanded range)

Yes

2000–2699

IP extended access list (expanded range)

Yes