Home » Cisco Manuals » Bridges & Routers » Cisco ME-3400-24TS-D » Manual Viewer

Cisco ME-3400-24TS-D Software Guide - Page 624

Configuring IP Unicast Routing, Cisco IOS IP Command Reference, Volume 2 of 3: Routing Protocols

View all Cisco ME-3400-24TS-D manuals

Add to My Manuals
Save this manual to your list of manuals

Page 624 highlights

32 C H A P T E R Configuring IP Unicast Routing This chapter describes how to configure IP Version 4 (IPv4) unicast routing on the Cisco ME 3400 Ethernet Access switch. Note Routing is supported only on switches that are running the metro IP access image. For more detailed IP unicast configuration information, see the Cisco IOS IP Configuration Guide, Release 12.2 For complete syntax and usage information for the commands used in this chapter, see these command references: • Cisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services, Release 12.2 • Cisco IOS IP Command Reference, Volume 2 of 3: Routing Protocols, Release 12.2 • Cisco IOS IP Command Reference, Volume 3 of 3: Multicast, Release 12.2 This chapter consists of these sections: • Understanding IP Routing, page 32-2 • Steps for Configuring Routing, page 32-3 • Configuring IP Addressing, page 32-4 • Enabling IPv4 Unicast Routing, page 32-17 • Configuring RIP, page 32-18 • Configuring OSPF, page 32-23 • Configuring EIGRP, page 32-32 • Configuring BGP, page 32-38 • Configuring Multi-VRF CE, page 32-59 • Configuring Protocol-Independent Features, page 32-69 • Monitoring and Maintaining the IP Network, page 32-83 Note When configuring routing parameters on the switch to allocate system resources to maximize the number of unicast routes allowed, you should use the sdm prefer default global configuration command to set the Switch Database Management (sdm) feature to balance resource. The Layer-2 template does not support routing and forces any routing to be done through software. This overloads the CPU and severely degrades routing performance. For more information on the SDM templates, see Chapter 6, "Configuring SDM Templates" or see the sdm prefer command in the command reference for this release. 78-17058-01 Cisco ME 3400 Ethernet Access Switch Software Configuration Guide 32-1

Section	Page
Cisco ME 3400 EthernetAccessSwitch SoftwareConfigurationGuide	1
Contents	3
Preface	33
Audience	33
Purpose	33
Conventions	33
Related Publications	34
Obtaining Documentation	35
Cisco.com	35
Product Documentation DVD	35
Ordering Documentation	35
Documentation Feedback	36
Cisco Product Security Overview	36
Reporting Security Problems in Cisco Products	37
Obtaining Technical Assistance	37
Cisco Technical Support & Documentation Website	37
Submitting a Service Request	38
Definitions of Service Request Severity	38
Obtaining Additional Publications and Information	39
Overview	41
Features	41
Performance Features	42
Management Options	43
Manageability Features	43
Availability Features	44
VLAN Features	45
Security Features	45
Subscriber Security	45
Switch Security	45
Network Security	46
Quality of Service and Class of Service Features	46
Layer 2 Virtual Private Network Services	47
Layer3 Features	47
Layer 3 VPN Services	48
Monitoring Features	48
Default Settings After Initial Switch Configuration	48
Network Configuration Examples	51
Multidwelling or Ethernet-to-the-Subscriber Network	51
Layer 2 VPN Application	53
Multi-VRF CE Application	54
Where to Go Next	55
Using the Command-Line Interface	57
Understanding Command Modes	57
Understanding the Help System	59
Understanding Abbreviated Commands	59
Understanding no and default Forms of Commands	60
Understanding CLI Error Messages	60
Using Command History	60
Changing the Command History Buffer Size	61
Recalling Commands	61
Disabling the Command History Feature	61
Using Editing Features	62
Enabling and Disabling Editing Features	62
Editing Commands through Keystrokes	62
Editing Command Lines that Wrap	64
Searching and Filtering Output of show and more Commands	64
Accessing the CLI	65
Accessing the CLI through a Console Connection or through Telnet	65
Assigning the Switch IP Address and Default Gateway	67
Understanding the Boot Process	67
Assigning Switch Information	68
Default Switch Information	69
Understanding DHCP-Based Autoconfiguration	69
DHCP Client Request Process	69
Configuring DHCP-Based Autoconfiguration	71
DHCP Server Configuration Guidelines	71
Configuring the TFTP Server	71
Configuring the DNS	72
Configuring the Relay Device	72
Obtaining Configuration Files	73
Example Configuration	74
Manually Assigning IP Information	75
Checking and Saving the Running Configuration	76
Modifying the Startup Configuration	78
Default Boot Configuration	79
Automatically Downloading a Configuration File	79
Specifying the Filename to Read and Write the System Configuration	79
Booting Manually	80
Booting a Specific Software Image	80
Controlling Environment Variables	81
Scheduling a Reload of the Software Image	82
Configuring a Scheduled Reload	83
Displaying Scheduled Reload Information	84
Configuring Cisco IOS CNS Agents	85
Understanding Cisco Configuration Engine Software	85
Configuration Service	86
Event Service	87
NameSpace Mapper	87
What You Should Know About the CNS IDs and Device Hostnames	87
ConfigID	87
DeviceID	88
Hostname and DeviceID	88
Using Hostname, DeviceID, and ConfigID	88
Understanding Cisco IOS Agents	89
Initial Configuration	89
Incremental (Partial) Configuration	90
Synchronized Configuration	90
Configuring Cisco IOS Agents	90
Enabling Automated CNS Configuration	90
Enabling the CNS Event Agent	92
Enabling the Cisco IOS CNS Agent	93
Enabling an Initial Configuration	93
Enabling a Partial Configuration	95
Displaying CNS Configuration	96
Administering the Switch	98
Managing the System Time and Date	98
Understanding the System Clock	99
Understanding Network Time Protocol	99
Configuring NTP	101
Default NTP Configuration	101
Configuring NTP Authentication	102
Configuring NTP Associations	103
Configuring NTP Broadcast Service	104
Configuring NTP Access Restrictions	105
Configuring the Source IP Address for NTP Packets	107
Displaying the NTP Configuration	108
Configuring Time and Date Manually	108
Setting the System Clock	108
Displaying the Time and Date Configuration	109
Configuring the Time Zone	109
Configuring Summer Time (Daylight Saving Time)	110
Configuring a System Name and Prompt	111
Default System Name and Prompt Configuration	112
Configuring a System Name	112
Understanding DNS	112
Default DNS Configuration	113
Setting Up DNS	113
Displaying the DNS Configuration	114
Creating a Banner	114
Default Banner Configuration	114
Configuring a Message-of-the-Day Login Banner	115
Configuring a Login Banner	116
Managing the MAC Address Table	116
Building the Address Table	117
MAC Addresses and VLANs	117
Default MAC Address Table Configuration	118
Changing the Address Aging Time	118
Removing Dynamic Address Entries	119
Configuring MAC Address Notification Traps	119
Adding and Removing Static Address Entries	121
Configuring Unicast MAC Address Filtering	122
Disabling MAC Address Learning on a VLAN	123
Displaying Address Table Entries	125
Managing the ARP Table	125
Configuring SDM Templates	126
Understanding the SDM Templates	126
Configuring the Switch SDM Template	127
Default SDM Template	127
SDM Template Configuration Guidelines	127
Setting the SDM Template	128
Displaying the SDM Templates	129
Configuring Switch-Based Authentication	130
Preventing Unauthorized Access to Your Switch	130
Protecting Access to Privileged EXEC Commands	131
Default Password and Privilege Level Configuration	131
Setting or Changing a Static Enable Password	132
Protecting Enable and Enable Secret Passwords with Encryption	133
Disabling Password Recovery	134
Setting a Telnet Password for a Terminal Line	135
Configuring Username and Password Pairs	136
Configuring Multiple Privilege Levels	137
Setting the Privilege Level for a Command	137
Changing the Default Privilege Level for Lines	138
Logging into and Exiting a Privilege Level	139
Controlling Switch Access with TACACS+	139
Understanding TACACS+	139
TACACS+ Operation	141
Configuring TACACS+	142
Default TACACS+ Configuration	142
Identifying the TACACS+ Server Host and Setting the Authentication Key	142
Configuring TACACS+ Login Authentication	143
Configuring TACACS+ Authorization for Privileged EXEC Access and Network Services	145
Starting TACACS+ Accounting	146
Displaying the TACACS+ Configuration	146
Controlling Switch Access with RADIUS	147
Understanding RADIUS	147
RADIUS Operation	148
Configuring RADIUS	149
Default RADIUS Configuration	149
Identifying the RADIUS Server Host	149
Configuring RADIUS Login Authentication	152
Defining AAA Server Groups	154
Configuring RADIUS Authorization for User Privileged Access and Network Services	156
Starting RADIUS Accounting	157
Configuring Settings for All RADIUS Servers	158
Configuring the Switch to Use Vendor-Specific RADIUS Attributes	158
Configuring the Switch for Vendor-Proprietary RADIUS Server Communication	160
Displaying the RADIUS Configuration	160
Controlling Switch Access with Kerberos	161
Understanding Kerberos	161
Kerberos Operation	163
Authenticating to a Boundary Switch	164
Obtaining a TGT from a KDC	164
Authenticating to Network Services	164
Configuring Kerberos	165
Configuring the Switch for Local Authentication and Authorization	165
Configuring the Switch for Secure Shell	166
Understanding SSH	167
SSH Servers, Integrated Clients, and Supported Versions	167
Limitations	167
Configuring SSH	168
Configuration Guidelines	168
Setting Up the Switch to Run SSH	168
Configuring the SSH Server	169
Displaying the SSH Configuration and Status	170
Configuring IEEE 802.1x Port-Based Authentication	172
Understanding IEEE 802.1x Port-Based Authentication	172
Device Roles	173
Authentication Initiation and Message Exchange	174
Ports in Authorized and Unauthorized States	175
IEEE 802.1x Accounting	176
IEEE 802.1x Accounting Attribute-Value Pairs	176
IEEE 802.1x Host Mode	177
Using IEEE 802.1x with Port Security	178
Using IEEE 802.1x with VLAN Assignment	179
Configuring IEEE 802.1x Authentication	180
Default IEEE 802.1x Configuration	180
IEEE 802.1x Configuration Guidelines	181
Configuring IEEE 802.1x Authentication	182
Configuring the Switch-to-RADIUS-Server Communication	183
Configuring Periodic Re-Authentication	184
Manually Re-Authenticating a Client Connected to a Port	185
Changing the Quiet Period	185
Changing the Switch-to-Client Retransmission Time	186
Setting the Switch-to-Client Frame-Retransmission Number	186
Setting the Re-Authentication Number	187
Configuring the Host Mode	188
Resetting the IEEE 802.1x Configuration to the Default Values	188
Configuring IEEE 802.1x Accounting	189
Displaying IEEE 802.1x Statistics and Status	190
Configuring Interface Characteristics	192
Understanding Interface Types	192
Port-Based VLANs	193
Switch Ports	193
UNI and NNI Ports	194
Access Ports	194
Trunk Ports	195
Tunnel Ports	195
Routed Ports	195
Switch Virtual Interfaces	196
EtherChannel Port Groups	197
Connecting Interfaces	197
Using Interface Configuration Mode	198
Procedures for Configuring Interfaces	198
Configuring a Range of Interfaces	199
Configuring and Using Interface Range Macros	201
Configuring Ethernet Interfaces	202
Default Ethernet Interface Configuration	203
Configuring User Network and Network Node Interfaces	204
Configuring Interface Speed and Duplex Mode	205
Speed and Duplex Configuration Guidelines	206
Setting the Interface Speed and Duplex Parameters	206
Configuring IEEE 802.3x Flow Control	208
Configuring Auto-MDIX on an Interface	209
Adding a Description for an Interface	210
Configuring Layer 3 Interfaces	211
Configuring the System MTU	212
Monitoring and Maintaining the Interfaces	213
Monitoring Interface Status	214
Clearing and Resetting Interfaces and Counters	215
Shutting Down and Restarting the Interface	215
Configuring Command Macros	216
Understanding Command Macros	216
Configuring Command Macros	217
Default Command Macro Configuration	217
Command Macro Configuration Guidelines	217
Creating Command Macros	218
Applying Command Macros	219
Displaying Command Macros	220
Configuring VLANs	222
Understanding VLANs	222
Supported VLANs	224
Normal-Range VLANs	224
Extended-Range VLANs	225
VLAN Port Membership Modes	225
UNI VLANs	226
Creating and Modifying VLANs	227
Default Ethernet VLAN Configuration	228
VLAN Configuration Guidelines	229
Creating or Modifying an Ethernet VLAN	230
Assigning Static-Access Ports to a VLAN	231
Creating an Extended-Range VLAN with an Internal VLAN ID	232
Configuring UNI VLANs	233
Configuration Guidelines	233
Configuring UNI VLANs	234
Displaying VLANs	235
Configuring VLAN Trunks	235
Trunking Overview	235
IEEE 802.1Q Configuration Considerations	236
Default Layer 2 Ethernet Interface VLAN Configuration	237
Configuring an Ethernet Interface as a Trunk Port	237
Interaction with Other Features	237
Configuring a Trunk Port	238
Defining the Allowed VLANs on a Trunk	238
Configuring the Native VLAN for Untagged Traffic	240
Configuring Trunk Ports for Load Sharing	240
Load Sharing Using STP Port Priorities	241
Load Sharing Using STP Path Cost	242
Configuring VMPS	244
Understanding VMPS	244
Dynamic-Access Port VLAN Membership	245
Default VMPS Client Configuration	245
VMPS Configuration Guidelines	246
Configuring the VMPS Client	246
Entering the IP Address of the VMPS	246
Configuring Dynamic-Access Ports on VMPS Clients	247
Reconfirming VLAN Memberships	247
Changing the Reconfirmation Interval	248
Changing the Retry Count	248
Monitoring the VMPS	248
Troubleshooting Dynamic-Access Port VLAN Membership	249
VMPS Configuration Example	249
Configuring Private VLANs	252
Understanding Private VLANs	252
Types of Private VLANs and Private-VLAN Ports	253
IP Addressing Scheme with Private VLANs	255
Private VLANs across Multiple Switches	255
Private VLANs and Unicast, Broadcast, and Multicast Traffic	256
Private VLANs and SVIs	256
Configuring Private VLANs	256
Tasks for Configuring Private VLANs	257
Default Private-VLAN Configuration	257
Private-VLAN Configuration Guidelines	257
Secondary and Primary VLAN Configuration	258
Private-VLAN Port Configuration	259
Limitations with Other Features	260
Configuring and Associating VLANs in a Private VLAN	261
Configuring a Layer 2 Interface as a Private-VLAN Host Port	263
Configuring a Layer 2 Interface as a Private-VLAN Promiscuous Port	264
Mapping Secondary VLANs to a Primary VLAN Layer 3 VLAN Interface	265
Monitoring Private VLANs	266
Configuring IEEE 802.1Q and Layer 2 Protocol Tunneling	268
Understanding IEEE 802.1Q Tunneling	268
Configuring IEEE 802.1Q Tunneling	271
Default IEEE 802.1Q Tunneling Configuration	271
IEEE 802.1Q Tunneling Configuration Guidelines	271
Native VLANs	271
System MTU	272
IEEE 802.1Q Tunneling and Other Features	273
Configuring an IEEE 802.1Q Tunneling Port	273
Understanding Layer 2 Protocol Tunneling	275
Configuring Layer 2 Protocol Tunneling	277
Default Layer 2 Protocol Tunneling Configuration	278
Layer 2 Protocol Tunneling Configuration Guidelines	278
Configuring Layer 2 Protocol Tunneling	279
Configuring Layer 2 Tunneling for EtherChannels	281
Configuring the SP Edge Switch	281
Configuring the Customer Switch	282
Monitoring and Maintaining Tunneling Status	285
Configuring STP	286
Understanding Spanning-Tree Features	286
STP Overview	287
Spanning-Tree Topology and BPDUs	288
Bridge ID, Switch Priority, and Extended System ID	289
Spanning-Tree Interface States	289
Blocking State	291
Listening State	291
Learning State	291
Forwarding State	292
Disabled State	292
How a Switch or Port Becomes the Root Switch or Root Port	292
Spanning Tree and Redundant Connectivity	293
Spanning-Tree Address Management	293
Accelerated Aging to Retain Connectivity	294
Spanning-Tree Modes and Protocols	294
Supported Spanning-Tree Instances	295
Spanning-Tree Interoperability and Backward Compatibility	295
STP and IEEE 802.1Q Trunks	295
Configuring Spanning-Tree Features	296
Default Spanning-Tree Configuration	296
Spanning-Tree Configuration Guidelines	297
Changing the Spanning-Tree Mode.	298
Disabling Spanning Tree	299
Configuring the Root Switch	299
Configuring a Secondary Root Switch	301
Configuring Port Priority	301
Configuring Path Cost	303
Configuring the Switch Priority of a VLAN	304
Configuring Spanning-Tree Timers	305
Configuring the Hello Time	305
Configuring the Forwarding-Delay Time for a VLAN	306
Configuring the Maximum-Aging Time for a VLAN	306
Displaying the Spanning-Tree Status	307
Configuring MSTP	308
Understanding MSTP	309
Multiple Spanning-Tree Regions	309
IST, CIST, and CST	309
Operations Within an MST Region	310
Operations Between MST Regions	310
Hop Count	311
Boundary Ports	312
Interoperability with IEEE 802.1D STP	312
Understanding RSTP	313
Port Roles and the Active Topology	313
Rapid Convergence	314
Synchronization of Port Roles	315
Bridge Protocol Data Unit Format and Processing	316
Processing Superior BPDU Information	317
Processing Inferior BPDU Information	317
Topology Changes	317
Configuring MSTP Features	318
Default MSTP Configuration	319
MSTP Configuration Guidelines	319
Specifying the MST Region Configuration and Enabling MSTP	320
Configuring the Root Switch	321
Configuring a Secondary Root Switch	323
Configuring Port Priority	324
Configuring Path Cost	325
Configuring the Switch Priority	326
Configuring the Hello Time	326
Configuring the Forwarding-Delay Time	327
Configuring the Maximum-Aging Time	328
Configuring the Maximum-Hop Count	328
Specifying the Link Type to Ensure Rapid Transitions	329
Restarting the Protocol Migration Process	329
Displaying the MST Configuration and Status	330
Configuring Optional Spanning-Tree Features	332
Understanding Optional Spanning-Tree Features	332
Understanding Port Fast	333
Understanding BPDU Guard	333
Understanding BPDU Filtering	334
Understanding EtherChannel Guard	334
Understanding Root Guard	334
Understanding Loop Guard	335
Configuring Optional Spanning-Tree Features	336
Default Optional Spanning-Tree Configuration	336
Optional Spanning-Tree Configuration Guidelines	336
Enabling Port Fast	336
Enabling BPDU Guard	337
Enabling BPDU Filtering	338
Enabling EtherChannel Guard	339
Enabling Root Guard	340
Enabling Loop Guard	340
Displaying the Spanning-Tree Status	341
Configuring Flex Links	342
Understanding Flex Links	342
Configuring Flex Links	343
Default Flex Link Configuration	343
Flex Link Configuration Guidelines	343
Configuring Flex Links	344
Monitoring Flex Links	345
Configuring DHCP Features and IP Source Guard	346
Understanding DHCP Features	346
DHCP Server	347
DHCP Relay Agent	347
DHCP Snooping	347
Option-82 Data Insertion	348
DHCP Snooping Binding Database	350
Configuring DHCP Features	351
Default DHCP Configuration	352
DHCP Snooping Configuration Guidelines	352
Configuring the DHCP Relay Agent	353
Specifying the Packet Forwarding Address	354
Enabling DHCP Snooping and Option 82	355
Enabling DHCP Snooping on Private VLANs	356
Enabling the DHCP Snooping Binding Database Agent	357
Displaying DHCP Snooping Information	358
Understanding IP Source Guard	358
Source IP Address Filtering	359
Source IP and MAC Address Filtering	359
Configuring IP Source Guard	359
Default IP Source Guard Configuration	359
IP Source Guard Configuration Guidelines	360
Enabling IP Source Guard	360
Displaying IP Source Guard Information	361
Configuring Dynamic ARP Inspection	362
Understanding Dynamic ARP Inspection	362
Interface Trust States and Network Security	364
Rate Limiting of ARP Packets	365
Relative Priority of ARP ACLs and DHCP Snooping Entries	365
Logging of Dropped Packets	365
Configuring Dynamic ARP Inspection	366
Default Dynamic ARP Inspection Configuration	366
Dynamic ARP Inspection Configuration Guidelines	367
Configuring Dynamic ARP Inspection in DHCP Environments	368
Configuring ARP ACLs for Non-DHCP Environments	369
Limiting the Rate of Incoming ARP Packets	371
Performing Validation Checks	373
Configuring the Log Buffer	374
Displaying Dynamic ARP Inspection Information	375
Configuring IGMP Snooping and MVR	378
Understanding IGMP Snooping	378
IGMP Versions	379
Joining a Multicast Group	380
Leaving a Multicast Group	382
Immediate Leave	382
IGMP Configurable-Leave Timer	382
IGMP Report Suppression	383
Configuring IGMP Snooping	383
Default IGMP Snooping Configuration	383
Enabling or Disabling IGMP Snooping	384
Configuring a Multicast Router Port	385
Configuring a Host Statically to Join a Group	385
Enabling IGMP Immediate Leave	386
Configuring the IGMP Leave Timer	387
Configuring TCN-Related Commands	388
Controlling the Multicast Flooding Time After a TCN Event	388
Recovering from Flood Mode	388
Disabling Multicast Flooding During a TCN Event	389
Configuring the IGMP Snooping Querier	390