Home » Cisco Manuals » Bridges & Routers » Cisco 3845 » Manual Viewer

Cisco 3845 Software Guide - Page 469

Troubleshooting ACLs, show ip access-lists, show access-lists hardware, counters, range

UPC - 746320981420

Add to My Manuals
Save this manual to your list of manuals

Page 469 highlights

Chapter 26 Configuring Network Security with ACLs Configuring IPv4 ACLs When you enter the show ip access-lists privileged EXEC command, the match count displayed does not account for packets that are access controlled in hardware. Use the show access-lists hardware counters privileged EXEC command to obtain some basic hardware ACL statistics for switched and routed packets. Router ACLs function as follows: • The hardware controls permit and deny actions of standard and extended ACLs (input and output) for security access control. • If log has not been specified, the flows that match a deny statement in a security ACL are dropped by the hardware if ip unreachables is disabled. The flows matching a permit statement are switched in hardware. • Adding the log keyword to an ACE in a router ACL causes a copy of the packet to be sent to the CPU for logging only. If the ACE is a permit statement, the packet is still switched and routed in hardware. Troubleshooting ACLs If this ACL manager message appears and [chars] is the access-list name, ACLMGR-2-NOVMR: Cannot generate hardware representation of access list [chars] The switch has insufficient resources to create a hardware representation of the ACL. The resources include hardware memory and label space but not CPU memory. A lack of available logical operation units or specialized hardware resources causes this problem. Logical operation units are needed for a TCP flag match or a test other than eq (ne, gt, lt, or range) on TCP, UDP, or SCTP port numbers. Use one of these workarounds: • Modify the ACL configuration to use fewer resources. • Rename the ACL with a name or number that alphanumerically precedes the ACL names or numbers. To determine the specialized hardware resources, enter the show platform layer4 acl map privileged EXEC command. If the switch does not have available resources, the output shows that index 0 to index 15 are not available. For more information about configuring ACLs with insufficient resources, see CSCsq63926 in the Bug Toolkit. For example, if you apply this ACL to an interface: permit tcp source source-wildcard destination destination-wildcard range 5 60 permit tcp source source-wildcard destination destination-wildcard range 15 160 permit tcp source source-wildcard destination destination-wildcard range 115 1660 permit tcp source source-wildcard destination destination-wildcard And if this message appears: ACLMGR-2-NOVMR: Cannot generate hardware representation of access list [chars] The flag-related operators are not available. To avoid this issue, • Move the fourth ACE before the first ACE by using ip access-list resequence global configuration command: permit tcp source source-wildcard destination destination-wildcard permit tcp source source-wildcard destination destination-wildcard range 5 60 permit tcp source source-wildcard destination destination-wildcard range 15 160 permit tcp source source-wildcard destination destination-wildcard range 115 1660 OL-23400-01 Cisco ME 3800X and 3600X Switch Software Configuration Guide 26-21

Section	Page
Cisco ME 3800X and 3600X Switch Software Configuration Guide	1
Contents	3
Preface	35
Audience	35
Purpose	35
Conventions	35
Related Publications	36
Obtaining Documentation and Submitting a Service Request	37
Overview	39
Software Licenses and Features	39
Features	40
Performance Features	40
Management Options	41
Manageability Features	41
Availability Features	43
VLAN Features	43
Security Features	44
Switch Security	44
Network Security	44
Quality of Service and Class of Service Features	45
Layer 2 Virtual Private Network Services	45
Layer 3 Features	46
Layer 3 VPN Services	46
Monitoring Features	47
Feature Support per License	47
Where to Go Next	49
Using the Command-Line Interface	51
Understanding Command Modes	51
Understanding the Help System	53
Understanding Abbreviated Commands	53
Understanding no and default Forms of Commands	54
Understanding CLI Error Messages	54
Using Command History	54
Changing the Command History Buffer Size	55
Recalling Commands	55
Disabling the Command History Feature	55
Using Editing Features	56
Enabling and Disabling Editing Features	56
Editing Commands through Keystrokes	56
Editing Command Lines that Wrap	58
Searching and Filtering Output of show and more Commands	58
Accessing the CLI	59
Accessing the CLI through a Console Connection or through Telnet	59
Assigning the Switch IP Address and Default Gateway	61
Understanding the Boot Process	61
Initial Configuration	62
Assigning Switch Information	63
Default Switch Information	63
Understanding DHCP-Based Autoconfiguration	64
DHCP Client Request Process	64
Understanding DHCP-based Autoconfiguration and Image Update	65
DHCP Autoconfiguration	65
DHCP Auto-Image Update	65
Limitations and Restrictions	66
Configuring DHCP-Based Autoconfiguration	66
DHCP Server Configuration Guidelines	67
Configuring the TFTP Server	67
Configuring the DNS	68
Configuring the Relay Device	68
Obtaining Configuration Files	69
Example Configuration	70
Configuring the DHCP Auto Configuration and Image Update Features	71
Configuring DHCP Autoconfiguration (Only Configuration File)	72
Configuring DHCP Auto-Image Update (Configuration File and Image)	73
Configuring the Client	74
Manually Assigning IP Information	75
Checking and Saving the Running Configuration	76
Modifying the Startup Configuration	77
Default Boot Configuration	78
Automatically Downloading a Configuration File	78
Specifying the Filename to Read and Write the System Configuration	78
Booting Manually	79
Booting a Specific Software Image	79
Controlling Environment Variables	80
Scheduling a Reload of the Software Image	81
Configuring a Scheduled Reload	82
Displaying Scheduled Reload Information	83
Configuring Cisco IOS Configuration Engine	85
Understanding Cisco Configuration Engine Software	85
Configuration Service	86
Event Service	87
NameSpace Mapper	87
What You Should Know About the CNS IDs and Device Hostnames	87
ConfigID	87
DeviceID	88
Hostname and DeviceID	88
Using Hostname, DeviceID, and ConfigID	88
Understanding Cisco IOS Agents	89
Initial Configuration	89
Incremental (Partial) Configuration	90
Synchronized Configuration	90
Configuring Cisco IOS Agents	90
Enabling Automated CNS Configuration	90
Enabling the CNS Event Agent	91
Enabling the Cisco IOS CNS Agent	92
Enabling an Initial Configuration	93
Enabling a Partial Configuration	96
Upgrading Devices with Cisco IOS Image Agent	97
Prerequisites for the CNS Image Agent	97
Restrictions for the CNS Image Agent	97
Displaying CNS Configuration	98
Administering the Switch	99
Managing the System Time and Date	99
Understanding the System Clock	99
Understanding Network Time Protocol	100
Configuring NTP	101
Default NTP Configuration	102
Configuring NTP Authentication	102
Configuring NTP Associations	103
Configuring NTP Broadcast Service	104
Configuring NTP Access Restrictions	106
Configuring the Source IP Address for NTP Packets	108
Displaying the NTP Configuration	109
Configuring Time and Date Manually	109
Setting the System Clock	109
Displaying the Time and Date Configuration	110
Configuring the Time Zone	110
Configuring Summer Time (Daylight Saving Time)	111
Configuring a System Name and Prompt	112
Default System Name and Prompt Configuration	113
Configuring a System Name	113
Understanding DNS	113
Default DNS Configuration	114
Setting Up DNS	114
Displaying the DNS Configuration	115
Creating a Banner	115
Default Banner Configuration	115
Configuring a Message-of-the-Day Login Banner	116
Configuring a Login Banner	117
Managing the MAC Address Table	117
Building the Address Table	118
MAC Addresses and VLANs	118
Default MAC Address Table Configuration	119
Changing the Address Aging Time	119
Removing Dynamic Address Entries	119
Configuring MAC Address Change Notification Traps	120
Configuring MAC Address Move Notification Traps	122
Configuring MAC Threshold Notification Traps	123
Adding and Removing Static Address Entries	124
Configuring Unicast MAC Address Filtering	125
Disabling MAC Address Learning on a VLAN	126
Displaying Address Table Entries	127
Managing the ARP Table	128
Configuring Synchronous Ethernet	129
Understanding SyncE	129
Reference Clocks	129
SyncE Timing Using REP for Loop Prevention and Resiliency	130
BITS Interface	133
Configuring SyncE	133
Default SyncE Configuration	134
Configuring the Network Clock Selection	134
Configuring the BITS Interface	135
Selecting the Network Clock	137
Configuring REP for the SyncE Network	138
Monitoring SyncE	139
Configuring the Switch External Alarms	141
Understanding Switch Alarms	141
Configuring Switch Alarms	142
Configuring Switch-Based Authentication	145
Preventing Unauthorized Access to Your Switch	145
Protecting Access to Privileged EXEC Commands	146
Default Password and Privilege Level Configuration	146
Setting or Changing a Static Enable Password	147
Protecting Enable and Enable Secret Passwords with Encryption	147
Disabling Password Recovery	149
Setting a Telnet Password for a Terminal Line	150
Configuring Username and Password Pairs	150
Configuring Multiple Privilege Levels	151
Setting the Privilege Level for a Command	152
Changing the Default Privilege Level for Lines	153
Logging into and Exiting a Privilege Level	153
Controlling Switch Access with TACACS+	154
Understanding TACACS+	154
TACACS+ Operation	156
Configuring TACACS+	156
Default TACACS+ Configuration	157
Identifying the TACACS+ Server Host and Setting the Authentication Key	157
Configuring TACACS+ Login Authentication	158
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services	160
Starting TACACS+ Accounting	160
Displaying the TACACS+ Configuration	161
Controlling Switch Access with RADIUS	161
Understanding RADIUS	161
RADIUS Operation	163
Configuring RADIUS	163
Default RADIUS Configuration	164
Identifying the RADIUS Server Host	164
Configuring RADIUS Login Authentication	166
Defining AAA Server Groups	168
Configuring RADIUS Authorization for User Privileged Access and Network Services	170
Starting RADIUS Accounting	171
Configuring Settings for All RADIUS Servers	172
Configuring the Switch to Use Vendor-Specific RADIUS Attributes	172
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication	173
Configuring RADIUS Server Load Balancing	174
Displaying the RADIUS Configuration	174
Controlling Switch Access with Kerberos	175
Understanding Kerberos	175
Kerberos Operation	177
Authenticating to a Boundary Switch	177
Obtaining a TGT from a KDC	178
Authenticating to Network Services	178
Configuring Kerberos	178
Configuring the Switch for Local Authentication and Authorization	179
Configuring the Switch for Secure Shell	180
Understanding SSH	180
SSH Servers, Integrated Clients, and Supported Versions	180
Limitations	181
Configuring SSH	181
Configuration Guidelines	181
Setting Up the Switch to Run SSH	181
Configuring the SSH Server	182
Displaying the SSH Configuration and Status	183
Configuring the Switch for Secure Copy Protocol	183
Information About Secure Copy	184
Configuring Interfaces	185
Understanding Interface Types	185
NNI Port Type	186
Port-Based VLANs	186
Switch Ports	186
Access Ports	187
Trunk Ports	187
Routed Ports	187
Ethernet Management Port	188
Switch Virtual Interfaces	188
EtherChannel Port Groups	188
Ethernet Flow Points	189
Connecting Interfaces	189
Using Interface Configuration Mode	190
Procedures for Configuring Interfaces	190
Configuring a Range of Interfaces	191
Configuring and Using Interface Range Macros	192
Using the Ethernet Management Port	194
Understanding the Ethernet Management Port	194
Supported Features on the Ethernet Management Port	196
Configuring the Ethernet Management Port	196
TFTP and the Ethernet Management Port	196
Configuring Ethernet Interfaces	197
Default Ethernet Interface Configuration	197
Configuring Interface Speed and Duplex Mode	198
Speed and Duplex Configuration Guidelines	198
Setting the Interface Speed and Duplex Parameters	199
Configuring IEEE 802.3x Flow Control	201
Configuring Auto-MDIX on an Interface	202
Adding a Description for an Interface	203
Configuring Layer 3 Interfaces	203
Configuring the Interface MTU	205
Monitoring and Maintaining the Interfaces	205
Monitoring Interface Status	205
Clearing and Resetting Interfaces and Counters	207
Shutting Down and Restarting the Interface	207
Configuring VLANs	209
Understanding VLANs	209
Supported VLANs	211
Normal-Range VLANs	211
Extended-Range VLANs	212
VLAN Port Membership Modes	212
UNI VLANs	212
Creating and Modifying VLANs	213
Default Ethernet VLAN Configuration	213
VLAN Configuration Guidelines	214
Creating or Modifying an Ethernet VLAN	215
Assigning Static-Access Ports to a VLAN	216
Displaying VLANs	217
Configuring VLAN Trunks	217
Trunking Overview	217
IEEE 802.1Q Configuration Considerations	218
Default Layer 2 Ethernet Interface VLAN Configuration	218
Configuring an Ethernet Interface as a Trunk Port	219
Interaction with EtherChannels	219
Configuring a Trunk Port	219
Defining the Allowed VLANs on a Trunk	220
Configuring the Native VLAN for Untagged Traffic	221
Configuring Trunk Ports for Load Sharing	222
Load Sharing Using STP Port Priorities	222
Load Sharing Using STP Path Cost	223
Configuring Ethernet Virtual Connections (EVCs)	227
Supported EVC Features	228
Understanding EVC Features	229
Ethernet Virtual Connections	229
Service Instances and EFPs	229
Encapsulation	230
Bridge Domains	232
Split-Horizon	232
Rewrite Operations	233
Configuring EFPs	234
Default EVC Configuration	234
Configuration Guidelines	234
Creating Service Instances	235
Configuration Examples	236
Configuring a Service Instance	236
Encapsulation Using a VLAN Range	236
Two Service Instances Joining the Same Bridge Domain	236
Bridge Domains and VLAN Encapsulation	237
Rewrite	237
Split Horizon	237
Hairpinning	238
Egress Filtering	238
Examples of Unsupported Configurations	239
Overlapping Encapsulation	239
Global Rewrite Operation Limitation on a Switch	240
Configuring Other Features on EFPs	241
EFPs and EtherChannels	241
EFPs and Layer 2 Protocols	242
MAC Address Forwarding, Learning and Aging on EFPs	242
Configuring IEEE 802.1Q Tunneling and Layer 2 Protocol Tunneling using EFPs	243
802.1Q Tunneling (QinQ)	243
Layer 2 Protocol Tunneling	247
EFPs and Ethernet over Multiprotocol Layer Switching (EoMPLS)	250
Bridge Domain Routing	250
EFPs and Switchport MAC Addresses	251
EVC and Switchports	251
EFPs and MSTP	255
Monitoring EVC	255
Configuring Command Macros	259
Understanding Command Macros	259
Configuring Command Macros	259
Default Command Macro Configuration	260
Command Macro Configuration Guidelines	260
Creating Command Macros	261
Applying Command Macros	262
Displaying Command Macros	263
Configuring STP	265
Understanding Spanning-Tree Features	265
STP Overview	266
Spanning-Tree Topology and BPDUs	266
Bridge ID, Switch Priority, and Extended System ID	267
Spanning-Tree Interface States	268
Blocking State	269
Listening State	270
Learning State	270
Forwarding State	270
Disabled State	270
How a Switch or Port Becomes the Root Switch or Root Port	271
Spanning Tree and Redundant Connectivity	271
Spanning-Tree Address Management	272
Accelerated Aging to Retain Connectivity	272
Spanning-Tree Modes and Protocols	273
Supported Spanning-Tree Instances	273
Spanning-Tree Interoperability and Backward Compatibility	274
STP and IEEE 802.1Q Trunks	274
Configuring Spanning-Tree Features	274
Default Spanning-Tree Configuration	275
Spanning-Tree Configuration Guidelines	275
Changing the Spanning-Tree Mode.	276
Disabling Spanning Tree	277
Configuring the Root Switch	278
Configuring a Secondary Root Switch	279
Configuring Port Priority	280
Configuring Path Cost	282
Configuring the Switch Priority of a VLAN	283
Configuring Spanning-Tree Timers	284
Configuring the Hello Time	284
Configuring the Forwarding-Delay Time for a VLAN	285
Configuring the Maximum-Aging Time for a VLAN	285
Displaying the Spanning-Tree Status	286
Configuring MSTP	287
Understanding MSTP	288
Multiple Spanning-Tree Regions	288
IST, CIST, and CST	288
Operations Within an MST Region	289
Operations Between MST Regions	289
IEEE 802.1s Terminology	291
Hop Count	291
Boundary Ports	292
IEEE 802.1s Implementation	292
Port Role Naming Change	292
Interoperation Between Legacy and Standard Switches	293
Detecting Unidirectional Link Failure	293
Interoperability with IEEE 802.1D STP	294
Understanding RSTP	294
Port Roles and the Active Topology	295
Rapid Convergence	295
Synchronization of Port Roles	297
Bridge Protocol Data Unit Format and Processing	298
Processing Superior BPDU Information	299
Processing Inferior BPDU Information	299
Topology Changes	299
Configuring MSTP Features	300
Default MSTP Configuration	300
MSTP Configuration Guidelines	301
Specifying the MST Region Configuration and Enabling MSTP	302
Configuring the Root Switch	303
Configuring a Secondary Root Switch	304
Configuring Port Priority	305
Configuring Path Cost	307
Configuring the Switch Priority	308
MSTP and Ethernet Flow Points (EFPs)	309
Configuring the Hello Time	309
Configuring the Forwarding-Delay Time	309
Configuring the Maximum-Aging Time	310
Configuring the Maximum-Hop Count	310
Specifying the Link Type to Ensure Rapid Transitions	311
Designating the Neighbor Type	312
Restarting the Protocol Migration Process	312
Displaying the MST Configuration and Status	313
Configuring Optional Spanning-Tree Features	315
Understanding Optional Spanning-Tree Features	315
Understanding Port Fast	316
Understanding BPDU Guard	316
Understanding BPDU Filtering	317
Understanding EtherChannel Guard	317
Understanding Root Guard	317
Understanding Loop Guard	318
Configuring Optional Spanning-Tree Features	319
Default Optional Spanning-Tree Configuration	319
Optional Spanning-Tree Configuration Guidelines	319
Enabling Port Fast	319
Enabling BPDU Guard	320
Enabling BPDU Filtering	321
Enabling EtherChannel Guard	322
Enabling Root Guard	323
Enabling Loop Guard	323
Displaying the Spanning-Tree Status	324
Configuring Resilient Ethernet Protocol	325
Understanding REP	325
Link Integrity	327
Fast Convergence	328
VLAN Load Balancing	328
Spanning Tree Interaction	330
REP Ports	330
Configuring REP	330
Default REP Configuration	331
REP Configuration Guidelines	331
Configuring the REP Administrative VLAN	332
Configuring REP Interfaces	333
Setting Manual Preemption for VLAN Load Balancing	337
Configuring SNMP Traps for REP	337
Monitoring REP	338
Configuring Flex Links and the MAC Address-Table Move Update Feature	339
Understanding Flex Links and the MAC Address-Table Move Update	339
Flex Links	339
VLAN Flex Link Load Balancing and Support	340
Flex Link Multicast Fast Convergence	341
Learning the Other Flex Link Port as the mrouter Port	341
Generating IGMP Reports	341
Leaking IGMP Reports	342
MAC Address-Table Move Update	344
Configuring Flex Links and MAC Address-Table Move Update	345
Default Configuration	345
Configuration Guidelines	346
Configuring Flex Links	346
Configuring VLAN Load Balancing on Flex Links	348
Configuring the MAC Address-Table Move Update Feature	349
Monitoring Flex Links and the MAC Address-Table Move Update	351
Configuring IGMP Snooping	353
Understanding IGMP Snooping	353
IGMP Versions	354
Joining a Multicast Group	355
Leaving a Multicast Group	356
Immediate Leave	357
IGMP Configurable-Leave Timer	357
IGMP Report Suppression	357
Configuring IGMP Snooping	358
Default IGMP Snooping Configuration	358
Enabling or Disabling IGMP Snooping	358
Configuring a Multicast Router Port	359
Configuring a Host Statically to Join a Group	360
Enabling IGMP Immediate Leave	360
Configuring the IGMP Leave Timer	361
Configuring TCN-Related Commands	362
Controlling the Multicast Flooding Time After a TCN Event	362
Recovering from Flood Mode	362
Disabling Multicast Flooding During a TCN Event	363
Disabling IGMP Report Suppression	364
Displaying IGMP Snooping Information	364
Configuring IGMP Filtering and Throttling	365
Default IGMP Filtering and Throttling Configuration	366
Configuring IGMP Profiles	366
Applying IGMP Profiles	367
Setting the Maximum Number of IGMP Groups	368
Configuring the IGMP Throttling Action	369
Displaying IGMP Filtering and Throttling Configuration	370
Configuring Traffic Control	371
Configuring Storm Control	371
Understanding Storm Control	371
Default Storm Control Configuration	373
Configuring Storm Control and Threshold Levels	373
Configuring Port Blocking	375
Default Port Blocking Configuration	375
Blocking Flooded Traffic on an Interface	375
Configuring EVC MAC Security	376
Understanding MAC Security	377
Secure MAC Addresses	377
Security Violations	377
Default EVC MAC Security Configuration	378
MAC Address Security Guidelines	379
Enabling and Configuring EVC MAC Security	379
Displaying Traffic Control Settings	382
Configuring CDP	383
Understanding CDP	383
Configuring CDP	384
Default CDP Configuration	384
Configuring the CDP Characteristics	384
Disabling and Enabling CDP	385
Disabling and Enabling CDP on an Interface	386
CDP and Ethernet Flow Points (EFPs)	386
Monitoring and Maintaining CDP	387
Configuring LLDP and LLDP-MED	389
Understanding LLDP and LLDP-MED	389

Match case Limit results 1 per page

26-21

Cisco ME 3800X and 3600X Switch Software Configuration Guide

OL-23400-01

Chapter 26

Configuring Network Security with ACLs

Configuring IPv4 ACLs

When you enter the

show ip access-lists

privileged EXEC command, the match count displayed does

not account for packets that are access controlled in hardware. Use the

show access-lists hardware

counters

privileged EXEC command to obtain some basic hardware ACL statistics for switched and

routed packets.

Router ACLs function as follows:

•

The hardware controls permit and deny actions of standard and extended ACLs (input and output)

for security access control.

•

log

has not been specified, the flows that match a

deny

statement in a security ACL are dropped

by the hardware if

ip unreachables

is disabled. The flows matching a

permit

statement are switched

in hardware.

•

Adding the

log

keyword to an ACE in a router ACL causes a copy of the packet to be sent to the

CPU for logging only. If the ACE is a

permit

statement, the packet is still switched and routed

in hardware.

Troubleshooting ACLs

If this ACL manager message appears and [chars] is the access-list name,

ACLMGR-2-NOVMR: Cannot generate hardware representation of access list [chars]

The switch has insufficient resources to create a hardware representation of the ACL. The resources

include hardware memory and label space but not CPU memory. A lack of available logical operation

units or specialized hardware resources causes this problem. Logical operation units are needed for a

TCP flag match or a test other than

(

, or

range

) on TCP, UDP, or SCTP port numbers.

Use one of these workarounds:

•

Modify the ACL configuration to use fewer resources.

•

Rename the ACL with a name or number that alphanumerically precedes the ACL names or

numbers.

To determine the specialized hardware resources, enter the

show platform layer4 acl map

privileged

EXEC command. If the switch does not have available resources, the output shows that index 0 to

index 15 are not available.

For more information about configuring ACLs with insufficient resources, see CSCsq63926 in the Bug

Toolkit.

For example, if you apply this ACL to an interface:

permit tcp

source source-wildcard

destination destination-wildcard

range 5 60

permit tcp

source source-wildcard

destination destination-wildcard

range 15 160

permit tcp

source source-wildcard

destination destination-wildcard

range 115 1660

permit tcp

source source-wildcard

destination destination-wildcard

And if this message appears:

ACLMGR-2-NOVMR: Cannot generate hardware representation of access list [chars]

The flag-related operators are not available. To avoid this issue,

•

Move the fourth ACE before the first ACE by using

ip access-list resequence

global configuration

command:

permit tcp

source source-wildcard

destination destination-wildcard

permit tcp

source source-wildcard

destination destination-wildcard

range 5 60

permit tcp

source source-wildcard

destination destination-wildcard

range 15 160

permit tcp

source source-wildcard

destination destination-wildcard

range 115 1660