Cisco ME 3400E Ethernet Access Switch Command Reference, Cisco IOS Release 12.2(58)EX

Cisco ME 3400E Ethernet Access Switch
Cisco IOS Commands

aaa accounting dot1x

Use the aaa accounting dot1x global configuration command to enable authentication, authorization, and accounting (AAA) accounting and to create method lists defining specific accounting methods on a per-line or per-interface basis for IEEE 802.1x sessions. Use the no form of this command to disable IEEE 802.1x accounting.

aaa accounting dot1x {name | default} start-stop {broadcast group {name | radius | tacacs+} [group {name | radius | tacacs+}... ] | group {name | radius | tacacs+} [group {name | radius | tacacs+} ... ]}

no aaa accounting dot1x {name | default}

Syntax Description

Defaults

AAA accounting is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

This command requires access to a RADIUS server.

Note We recommend that you enter the dot1x reauthentication interface configuration command before configuring IEEE 802.1x RADIUS accounting on an interface.

Examples

This example shows how to configure IEEE 802.1x accounting:

Switch(config)# aaa accounting dot1x

Switch(config)# aaa accounting dot1x default start-stop group radius

Switch(config)#

Note The RADIUS authentication server must be properly configured to accept and log update or watchdog packets from the AAA client.

Related Commands

aaa authentication dot1x

Use the aaa authentication dot1x global configuration command to specify the authentication, authorization, and accounting (AAA) method to use on ports complying with IEEE 802.1x. Use the no form of this command to disable authentication.

aaa authentication dot1x {default} method1

no aaa authentication dot1x {default}

Syntax Description

Note Though other keywords are visible in the command-line help strings, only the default and group radius keywords are supported.

Defaults

No authentication is performed.

Command Modes

Global configuration

Command History

Usage Guidelines

The method argument identifies the method that the authentication algorithm tries in the given sequence to validate the password provided by the client. The only method that is truly IEEE 802.1x-compliant is the group radius method, in which the client data is validated against a RADIUS authentication server.

If you specify group radius, you must configure the RADIUS server by entering the radius-server host global configuration command.

Use the show running-config privileged EXEC command to display the configured lists of authentication methods.

Examples

This example shows how to enable AAA and how to create an IEEE 802.1x-compliant authentication list. This authentication first tries to contact a RADIUS server. If this action returns an error, the user is not allowed access to the network.

Switch(config)# aaa new-model

Switch(config)# aaa authentication dot1x default group radius

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

action

Use the action access-map configuration command to set the action for the VLAN access map entry. Use the no form of this command to set the action to the default value, which is to forward.

action {drop | forward}

no action

Syntax Description

Defaults

The default action is to forward packets.

Command Modes

Access-map configuration

Command History

Usage Guidelines

You enter access-map configuration mode by using the vlan access-map global configuration command.

If the action is drop, you should define the access map, including configuring any access control list (ACL) names in match clauses, before applying the map to a VLAN, or all packets could be dropped.

In access-map configuration mode, use the match access-map configuration command to define the match conditions for a VLAN map. Use the action command to set the action that occurs when a packet matches the conditions.

The drop and forward parameters are not used in the no form of the command.

Examples

This example shows how to identify and apply a VLAN access map vmap4 to VLANs 5 and 6 that causes the VLAN to forward an IP packet if the packet matches the conditions defined in access list al2:

Switch(config)# vlan access-map vmap4

Switch(config-access-map)# match ip address al2

Switch(config-access-map)# action forward

Switch(config-access-map)# exit

Switch(config)# vlan filter vmap4 vlan-list 5-6

You can verify your settings by entering the show vlan access-map privileged EXEC command.

Related Commands

alarm-contact

Use the alarm-contact global configuration command to configure triggers and severity levels for external alarms. Use the no form of this command to remove the configuration.

alarm-contact {contact-number {description string | severity {critical | major | minor} | trigger {closed | open}} | all {severity {critical | major | minor} | trigger {closed | open}}

no alarm-contact {contact-number {description | severity | trigger} | all {severity | trigger}

Defaults

No alarms are configured.

Command Modes

Global configuration

Command History

Usage Guidelines

The no alarm-contact contact-number description sets the description to an empty string.

The no alarm-contact {contact-number | all} severity sets the alarm-contact severity to minor.

The no alarm-contact {contact-number | all} trigger sets the external alarm-contact trigger to closed.

Examples

This example shows how to configure alarm contact number 1 to report a critical alarm when the contact is open.

Switch(config)# alarm-contact 1 description main_lab_door

Switch(config)# alarm-contact 1 severity critical 

Switch(config)# alarm-contact 1 trigger open

Dec  4 10:34:09.049: %PLATFORM_ENV-1-EXTERNAL_ALARM_CONTACT_ASSERT: Alarm asserted: 
main_lab_door

You can verify your settings by entering the show env alarm-contact or the show running-config privileged EXEC command.

Switch# show env alarm-contact

ALARM CONTACT 1

   Status:      asserted

   Description: main_lab_door

   Severity:    critical

   Trigger:     open

This example shows how to configure clear alarm contact number 1 and the show command outputs.

Switch(config)# no alarm-contact 1 description

Dec  4 10:39:33.621: %PLATFORM_ENV-1-EXTERNAL_ALARM_CONTACT_CLEAR: Alarm cleared: 
main_lab_door Dec  4 10:39:33.621: %PLATFORM_ENV-1-EXTERNAL_ALARM_CONTACT_ASSERT: Alarm 
asserted: external alarm contact 1

Switch(config)# no alarm-contact 1 severity

Dec  4 10:39:46.774: %PLATFORM_ENV-1-EXTERNAL_ALARM_CONTACT_CLEAR: Alarm cleared: external 
alarm contact 1 Dec  4 10:39:46.774: %PLATFORM_ENV-1-EXTERNAL_ALARM_CONTACT_ASSERT: Alarm 
asserted: external alarm contact 1

Switch(config)# no alarm-contact 1 trigger open

Dec  4 10:39:56.547: %PLATFORM_ENV-1-EXTERNAL_ALARM_CONTACT_CLEAR: Alarm cleared: external 
alarm contact 1

Switch(config)# end

Switch# show env alarm-contact

ALARM CONTACT 1

   Status:      not asserted

   Description: external alarm contact 1

   Severity:    minor

   Trigger:     closed

Switch# show hard led

SWITCH: 1

SYSTEM: GREEN

MGMT: GREEN

ALARM 1: BLACK

ALARM 2: BLACK

ALARM 3: BLACK

ALARM 4: BLACK

Related Commands

archive download-sw

Use the archive download-sw privileged EXEC command to download a new image from a TFTP server to the switch and to overwrite or keep the existing image.

archive download-sw {/force-reload | /imageonly | /leave-old-sw | /no-set-boot | /no-version-check | /overwrite | /reload | /safe} source-url

Syntax Description

Defaults

The current software image is not overwritten with the downloaded image.

Both the software image and HTML files are downloaded.

The new image is downloaded to the flash: file system.

The BOOT environment variable is changed to point to the new software image on the flash: file system.

Image names are case sensitive; the image file is provided in tar format.

Compatibility of the version on the image to be downloaded is checked.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

The /imageonly option removes the HTML files for the existing image if the existing image is being removed or replaced. Only the Cisco IOS image (without the HTML files) is downloaded.

Using the /safe or /leave-old-sw option can cause the new image download to fail if there is insufficient flash memory. If leaving the software in place prevents the new image from fitting in flash memory due to space constraints, an error results.

If you used the /leave-old-sw option and did not overwrite the old image when you downloaded the new one, you can remove the old image by using the delete privileged EXEC command. For more information, see the "delete" section.

Note Use the /no-version-check option with care. This option allows an image to be downloaded without first confirming that it is not incompatible with the switch.

Use the /overwrite option to overwrite the image on the flash device with the downloaded one.

If you specify the command without the /overwrite option, the download algorithm verifies that the new image is not the same as the one on the switch flash device. If the images are the same, the download does not occur. If the images are different, the old image is deleted, and the new one is downloaded.

After downloading a new image, enter the reload privileged EXEC command to begin using the new image, or specify the /reload or /force-reload option in the archive download-sw command.

Examples

This example shows how to download a new image from a TFTP server at 172.20.129.10 and overwrite the image on the switch:

Switch# archive download-sw /overwrite tftp://172.20.129.10/test-image.tar 

This example shows how to download only the software image from a TFTP server at 172.20.129.10 to the switch:

Switch# archive download-sw /imageonly tftp://172.20.129.10/test-image.tar 

This example shows how to keep the old software version after a successful download:

Switch# archive download-sw /leave-old-sw tftp://172.20.129.10/test-image.tar 

Related Commands

archive tar

Use the archive tar privileged EXEC command to create a tar file, list files in a tar file, or extract the files from a tar file.

archive tar {/create destination-url flash:/file-url} | {/table source-url} | {/xtract source-url flash:/file-url [dir/file...]}

Syntax Description

Defaults

None

Command Modes

Privileged EXEC

Command History

Usage Guidelines

Filenames and directory names are case sensitive.

Image names are case sensitive.

Examples

This example shows how to create a tar file. The command writes the contents of the new-configs directory on the local flash device to a file named saved.tar on the TFTP server at 172.20.10.30:

Switch# archive tar /create tftp:172.20.10.30/saved.tar flash:/new-configs

This example shows how to display the contents of the file that is in flash memory. The contents of the tar file appear on the screen:

Switch# archive tar /table flash:image_name-mz.122-release.tar 

info (219 bytes)

image_name-mz.122-release/(directory)

image_name-mz.122-release(610856 bytes)

image_name-mz.122-release/info (219 bytes)

info.ver (219 bytes)

This example shows how to display only the html directory and its contents:

Switch# archive tar /table flash:image_name-mz.122-release.tar 
image_name-mz.122-release/html

image_name-mz.122-release/html/ (directory)

image_name-mz.122-release/html/const.htm (556 bytes)

image_name-mz.122-release/html/xhome.htm (9373 bytes)

image_name-mz.122-release/html/menu.css (1654 bytes)

<output truncated>

This example shows how to extract the contents of a tar file on the TFTP server at 172.20.10.30. This command extracts just the new-configs directory into the root directory on the local flash file system. The remaining files in the saved.tar file are ignored.

Switch# archive tar /xtract tftp://172.20.10.30/saved.tar flash:/ new-configs

Related Commands

archive upload-sw

Use the archive upload-sw privileged EXEC command to upload an existing switch image to a server.

archive upload-sw [/version version_string] destination-url

Syntax Description

Defaults

Uploads the currently running image from the flash: file system.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

Use the upload feature only if the HTML files associated with the embedded device manager have been installed with the existing image.

The files are uploaded in this sequence: the Cisco IOS image, the HTML files, and info. After these files are uploaded, the software creates the tar file.

Image names are case sensitive.

Examples

This example shows how to upload the currently running image to a TFTP server at 172.20.140.2:

Switch# archive upload-sw tftp://172.20.140.2/test-image.tar 

Related Commands

arp access-list

Use the arp access-list global configuration command to define an Address Resolution Protocol (ARP) access control list (ACL) or to add clauses to the end of a previously defined list. Use the no form of this command to delete the specified ARP access list.

arp access-list acl-name

no arp access-list acl-name

Syntax Description

Defaults

No ARP access lists are defined.

Command Modes

Global configuration

Command History

Usage Guidelines

After entering the arp access-list command, you enter ARP access-list configuration mode, and these configuration commands are available:

•default: returns a command to its default setting.

•deny: specifies packets to reject. For more information, see the "deny (ARP access-list configuration)" section.

•exit: exits ARP access-list configuration mode.

•no: negates a command or returns to the default settings.

•permit: specifies packets to forward. For more information, see the "permit (ARP access-list configuration)" section.

Use the permit and deny access-list configuration commands to forward and to drop ARP packets based on the specified matching criteria.

When the ARP ACL is defined, you can apply it to a VLAN by using the ip arp inspection filter vlan global configuration command. ARP packets containing only IP-to-MAC address bindings are compared to the ACL. All other types of packets are bridged in the ingress VLAN without validation. If the ACL permits a packet, the switch forwards it. If the ACL denies a packet because of an explicit deny statement, the switch drops the packet. If the ACL denies a packet because of an implicit deny statement, the switch compares the packet to the list of DHCP bindings (unless the ACL is static, which means that packets are not compared to the bindings).

Examples

This example shows how to define an ARP access list and to permit both ARP requests and ARP responses from a host with an IP address of 1.1.1.1 and a MAC address of 0000.0000.abcd:

Switch(config)# arp access-list static-hosts

Switch(config-arp-nacl)# permit ip host 1.1.1.1 mac host 00001.0000.abcd

Switch(config-arp-nacl)# end

You can verify your settings by entering the show arp access-list privileged EXEC command.

Related Commands

bandwidth

Use the bandwidth policy-map class configuration command to configure class-based weighted fair queuing (CBWFQ) by setting the output bandwidth for a policy-map class. Use the no form of this command to remove the bandwidth setting for the class.

bandwidth {rate | percent value | remaining percent value}

no bandwidth [rate | percent value | remaining percent value]

Syntax Description

Defaults

No bandwidth is defined.

Command Modes

Policy-map class configuration

Command History

Usage Guidelines

You use the bandwidth policy-map class command to control output traffic. The bandwidth command specifies the bandwidth for traffic in that class. CBWFQ derives the weight for packets belonging to the class from the bandwidth allocated to the class and uses the weight to ensure that the queue for that class is serviced fairly. Bandwidth settings are not supported in input policy maps.

When you configure bandwidth for a class of traffic as an absolute rate (kbps) or a percentage of bandwidth (percent value), it represents the minimum bandwidth guarantee or committed information rate (CIR) for that traffic class. This means that the traffic class gets at least the bandwidth specified in the command, but is not limited to that bandwidth. Any excess bandwidth on the port is allocated to each class in the same ratio as the configured CIR rates.

When you enter the bandwidth remaining percent command, hard bandwidths are not guaranteed, and only relative bandwidths are assured. Class bandwidths are always proportional to the specified bandwidth percentages configured for the port.

When you configure bandwidth in an output policy, you must specify the same units in each bandwidth configuration; that is, all absolute values (rates) or percentages.

The total rate of the minimum bandwidth guarantees for each queue of the policy cannot exceed the total speed for the interface. If the percent keyword is used, the sum of the class bandwidth percentages cannot exceed 100 percent.

Using the queue-limit command to modify the default queue limit is especially important on higher-speed interfaces so that they meet the minimum bandwidth guarantees required by the interface.

You cannot use the bandwidth policy-map class configuration command to configure CBWFQ and the shape average command to configure class-based shaping for the same class in a policy map.

You cannot configure bandwidth in a class that includes priority queuing (configured with the priority policy-map class configuration command).

Examples

This example shows how to set the precedence of output queues by setting bandwidth in kilobits per second. The classes outclass1, outclass2, and outclass3 get a minimum of 50000, 20000, and 10000 kbps. The class class-default at a minimum gets the remaining bandwidth.

Switch(config)# policy-map out-policy

Switch(config-pmap)# class outclass1

Switch(config-pmap-c)# bandwidth 50000

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass2

Switch(config-pmap-c)# bandwidth 20000

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass3

Switch(config-pmap-c)# bandwidth 10000

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet 0/1

Switch(config-if)# service-policy output out-policy

Switch(config-if)# exit

This example shows how to set the precedence of output queues by allocating percentages of the total available bandwidth to each traffic class.The classes outclass1, outclass2, and outclass3 get a minimum of 50, 20, and 10 percent. The class class-default at a minimum gets 20 percent.

Switch(config)# policy-map out-policy

Switch(config-pmap)# class outclass1

Switch(config-pmap-c)# bandwidth percent 50

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass2

Switch(config-pmap-c)# bandwidth percent 20

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass3

Switch(config-pmap-c)# bandwidth percent 10

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet 0/1

Switch(config-if)# service-policy output out-policy

Switch(config-if)# exit

This example shows how to set outclass1 as a priority queue, with outclass2, and outclass3 getting 50 and 20 percent, respectively, of the bandwidth remaining after the priority queue is serviced. The class class-default gets the remaining 30 percent with no guarantees.

Switch(config)# policy-map out-policy

Switch(config-pmap)# class outclass1

Switch(config-pmap-c)# priority

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass2

Switch(config-pmap-c)# bandwidth remaining percent 50

Switch(config-pmap-c)# exit

Switch(config-pmap)# class outclass3

Switch(config-pmap-c)# bandwidth remaining percent 20

Switch(config-pmap-c)# exit

Switch(config-pmap)# exit

Switch(config)# interface fastethernet 0/1

Switch(config-if)# service-policy output out-policy

Switch(config-if)# exit

You can verify your settings by entering the show policy-map privileged EXEC command.

Related Commands

boot buffersize

Use the boot buffersize global configuration command to configure the NVRAM size. Use the no form of this command to return to the default.

boot buffersize size

no boot buffersize

Syntax Description

Defaults

The default NVRAM buffer size is 512 KB.

Command Modes

Global configuration

Command History

Usage Guidelines

The default NVRAM buffer size is 512 KB. In some cases, the configuration file might be too large to save to NVRAM. You can configure the size of the NVRAM buffer to support larger configuration files.

After you configure the NVRAM buffer size, reload the switch.

Examples

This example shows how to configure the NVRAM buffer size:

Switch(config)# boot buffersize 524288

Switch(config)# end

Related Commands

boot config-file

Use the boot config-file global configuration command to specify the filename that Cisco IOS uses to read and write a nonvolatile copy of the system configuration. Use the no form of this command to return to the default setting.

boot config-file flash:/file-url

no boot config-file

Syntax Description

Defaults

The default configuration file is flash:config.text.

Command Modes

Global configuration

Command History

Usage Guidelines

Filenames and directory names are case sensitive.

This command changes the setting of the CONFIG_FILE environment variable. For more information, see "Cisco ME 3400E Ethernet Access Switch Boot Loader Commands."

Related Commands

boot enable-break

Use the boot enable-break global configuration command to enable interrupting the automatic boot process. Use the no form of this command to return to the default setting.

boot enable-break

no boot enable-break

Syntax Description

This command has no arguments or keywords.

Defaults

Disabled. The automatic boot process cannot be interrupted by pressing the Break key on the console.

Command Modes

Global configuration

Command History

Usage Guidelines

When you enter this command, you can interrupt the automatic boot process by pressing the break key on the console after the flash file system is initialized. The break key is different for each operating system:

•On a SUN work station running UNIX, Ctrl-C is the break key.

•On a PC running Windows 2000, Ctrl-Break is the break key.

This command changes the setting of the ENABLE_BREAK environment variable. For more information, see "Cisco ME 3400E Ethernet Access Switch Boot Loader Commands."

Related Commands

boot helper

Use the boot helper global configuration command to dynamically load files during boot loader initialization to extend or patch the functionality of the boot loader. Use the no form of this command to return to the default.

boot helper filesystem:/file-url ...

no boot helper

Syntax Description

Defaults

No helper files are loaded.

Command Modes

Global configuration

Command History

Usage Guidelines

This variable is used only for internal development and testing.

Filenames and directory names are case sensitive.

This command changes the setting of the HELPER environment variable. For more information, see "Cisco ME 3400E Ethernet Access Switch Boot Loader Commands."

Related Commands

boot helper-config-file

Use the boot helper-config-file global configuration command to specify the name of the configuration file to be used by the Cisco IOS helper image. If this is not set, the file specified by the CONFIG_FILE environment variable is used by all versions of Cisco IOS that are loaded. Use the no form of this command to return to the default setting.

boot helper-config-file filesystem:/file-url

no boot helper-config file

Syntax Description

Defaults

No helper configuration file is specified.

Command Modes

Global configuration

Command History

Usage Guidelines

This variable is used only for internal development and testing.

Filenames and directory names are case sensitive.

This command changes the setting of the HELPER_CONFIG_FILE environment variable. For more information, see "Cisco ME 3400E Ethernet Access Switch Boot Loader Commands."

Related Commands

boot manual

Use the boot manual global configuration command to enable manually booting the switch during the next boot cycle. Use the no form of this command to return to the default setting.

boot manual

no boot manual

Syntax Description

This command has no arguments or keywords.

Defaults

Manual booting is disabled.

Command Modes

Global configuration

Command History

Usage Guidelines

The next time you reboot the system, the switch is in boot loader mode, which is shown by the switch: prompt. To boot the system, use the boot boot loader command, and specify the name of the bootable image.

This command changes the setting of the MANUAL_BOOT environment variable. For more information, see "Cisco ME 3400E Ethernet Access Switch Boot Loader Commands."

Related Commands

boot private-config-file

Use the boot private-config-file global configuration command to specify the filename that Cisco IOS uses to read and write a nonvolatile copy of the private configuration. Use the no form of this command to return to the default setting.

boot private-config-file filename

no boot private-config-file

Syntax Description

Defaults

The default configuration file is private-config.

Command Modes

Global configuration

Command History

Usage Guidelines

Filenames are case sensitive.

Examples

This example shows how to specify the name of the private configuration file to be pconfig:

Switch(config)# boot private-config-file pconfig

Related Commands

boot system

Use the boot system global configuration command to specify the Cisco IOS image to load during the next boot cycle. Use the no form of this command to return to the default setting.

boot system filesystem:/file-url ...

no boot system

Syntax Description

Defaults

The switch attempts to automatically boot the system by using information in the BOOT environment variable. If this variable is not set, the switch attempts to load and execute the first executable image it can by performing a recursive, depth-first search throughout the flash file system. In a depth-first search of a directory, each encountered subdirectory is completely searched before continuing the search in the original directory.

Command Modes

Global configuration

Command History

Usage Guidelines

Filenames and directory names are case sensitive.

If you are using the archive download-sw privileged EXEC command to maintain system images, you never need to use the boot system command. The boot system command is automatically manipulated to load the downloaded image.

This command changes the setting of the BOOT environment variable. For more information, see "Cisco ME 3400E Ethernet Access Switch Boot Loader Commands."

Related Commands

channel-group

Use the channel-group interface configuration command to assign an Ethernet port to an EtherChannel group. Use the no form of this command to remove an Ethernet port from an EtherChannel group.

channel-group channel-group-number mode {active | {auto [non-silent] | desirable [non-silent] | on} | passive}

no channel-group

PAgP modes:
channel-group channel-group-number mode {auto [non-silent] | {desirable [non-silent]}

LACP modes:
channel-group channel-group-number mode {active | passive}

On mode:
channel-group channel-group-number mode on

Note Link Aggregation Control Protocol (LACP.) and Port Aggregation Protocol (PAgP) are available only on network node interfaces (NNIs) or enhanced network interfaces (ENIs). The active, auto, desirable, and passive keywords are not visible on user network interfaces (UNIs).

Syntax Description

Defaults

No channel groups are assigned.

No mode is configured.

Command Modes

Interface configuration

Command History

Usage Guidelines

For Layer 2 EtherChannels, you do not have to create a port-channel interface first by using the interface port-channel global configuration command before assigning a physical port to a channel group. Instead, you can use the channel-group interface configuration command. It automatically creates the port-channel interface when the channel group gets its first physical port if the logical interface is not already created. If you create the port-channel interface first, the channel-group-number can be the same as the port-channel-number, or you can use a new number. If you use a new number, the channel-group command dynamically creates a new port channel.

If the port is a UNI or an ENI, you must use the no shutdown interface configuration command to enable it before using the channel-group command. UNIs and ENIs are disabled by default. NNIs are enabled by default.

You do not have to disable the IP address that is assigned to a physical port that is part of a channel group, but we strongly recommend that you do so.

You create Layer 3 port channels by using the interface port-channel command followed by the no switchport interface configuration command. You should manually configure the port-channel logical interface before putting the interface into the channel group.

After you configure an EtherChannel, configuration changes that you make on the port-channel interface apply to all the physical ports assigned to the port-channel interface. Configuration changes applied to the physical port affect only the port where you apply the configuration. To change the parameters of all ports in an EtherChannel, apply configuration commands to the port-channel interface, for example, spanning-tree commands or commands to configure a Layer 2 EtherChannel as a trunk.

If you do not specify non-silent with the auto or desirable mode, silent is assumed. The silent mode is used when the switch is connected to a device that is not PAgP-capable and seldom, if ever, sends packets. A example of a silent partner is a file server or a packet analyzer that is not generating traffic. In this case, running PAgP on a physical port prevents that port from ever becoming operational. However, it allows PAgP to operate, to attach the port to a channel group, and to use the port for transmission. Both ends of the link cannot be set to silent.

In the on mode, an EtherChannel exists only when a port group in the on mode is connected to another port group in the on mode.

Caution You should exercise care when setting the mode to on (manual configuration). All ports configured in the on mode are bundled in the same group and are forced to have similar characteristics. If the group is misconfigured, packet loss or spanning-tree loops might occur.

Do not configure an EtherChannel in both the PAgP and LACP modes. EtherChannel groups running PAgP and LACP can coexist on the same switch. Individual EtherChannel groups can run either PAgP or LACP, but they cannot interoperate.

Note PAgP and LACP are available only on NNIs and ENIs.

If you set the protocol by using the channel-protocol interface configuration command, the setting is not overridden by the channel-group interface configuration command.

Do not configure a port that is an active or a not-yet-active member of an EtherChannel as an IEEE 802.1x port. If you try to enable IEEE 802.1x on an EtherChannel port, an error message appears, and IEEE 802.1x is not enabled.

Do not configure a secure port as part of an EtherChannel or an EtherChannel port as a secure port.

For a complete list of configuration guidelines, see the "Configuring EtherChannels" chapter in the software configuration guide for this release.

Caution Do not enable Layer 3 addresses on the physical EtherChannel ports. Do not assign bridge groups on the physical EtherChannel ports because it creates loops.

Examples

This example shows how to configure an EtherChannel. It assigns two static-access ports in VLAN 10 to channel 5 with the PAgP mode desirable:

Switch# configure terminal 

Switch(config)# interface range gigabitethernet0/1 -2 

Switch(config-if-range)# switchport mode access

Switch(config-if-range)# switchport access vlan 10

Switch(config-if-range)# channel-group 5 mode desirable 

Switch(config-if-range)# end 

This example shows how to configure an EtherChannel. It assigns two static-access ports in VLAN 10 to channel 5 with the LACP mode active:

Switch# configure terminal 

Switch(config)# interface range gigabitethernet0/1 -2 

Switch(config-if-range)# switchport mode access

Switch(config-if-range)# switchport access vlan 10

Switch(config-if-range)# channel-group 5 mode active 

Switch(config-if-range)# end 

You can verify your settings by entering the show running-config privileged EXEC command.

Related Commands

channel-protocol

Use the channel-protocol interface configuration command to restrict the protocol used on a port to manage channeling. Use the no form of this command to return to the default setting.

channel-protocol {lacp | pagp}

no channel-protocol

Syntax Description

Defaults

No protocol is assigned to the EtherChannel.

Command Modes

Interface configuration

Command History

Usage Guidelines

Use the channel-protocol command only to restrict a channel to LACP or PAgP. If you set the protocol by using the channel-protocol command, the setting is not overridden by the channel-group interface configuration command.

Note PAgP and LACP are available only on network node interfaces (NNIs) and enhanced network interfaces (ENIs).

If the port is a user network interface (UNI) or an ENI, you must use the no shutdown interface configuration command to enable it before using the channel-protocol command. UNIs and ENIs are disabled by default. NNIs are enabled by default.

You must use the channel-group interface configuration command to configure the EtherChannel parameters. The channel-group command also can set the mode for the EtherChannel.

You cannot enable both the PAgP and LACP modes on an EtherChannel group.

PAgP and LACP are not compatible; both ends of a channel must use the same protocol.

Examples

This example shows how to specify LACP as the protocol that manages the EtherChannel:

Switch(config-if)# channel-protocol lacp

You can verify your settings by entering the show etherchannel [channel-group-number] protocol privileged EXEC command.

Related Commands

class

Use the class policy-map configuration command to specify the name of the class whose policy you want to create or to change or to specify the system default class before you configure a policy and to enter policy-map class configuration mode. Use the no form of this command to remove the class from a policy map.

class {class-map-name| class-default}

no class {class-map-name| class-default}

Syntax Description

Defaults

No policy map classes are defined.

Command Modes

Policy-map configuration

Command History

Usage Guidelines

Before using the class class-map-name command in policy-map configuration mode, you must create the class by using the class-map class-map-name global configuration command. The class class-default is the class to which traffic is directed if that traffic does not match any of the match criteria in the configured class maps.

Use the policy-map global configuration command to identify the policy map and to enter policy-map configuration mode. After specifying a policy map, you can configure a policy for new classes or modify a policy for any existing classes in that policy map.

An input policy map can have a maximum of 64 classes, plus class-default.

You attach the policy map to a port by using the service-policy interface configuration command.

After entering the class command, you enter policy-map class configuration mode, and these configuration commands are available:

•bandwidth: specifies the bandwidth allocated for a class belonging to a policy map. For more information, see the bandwidth command.

•exit: exits policy-map class configuration mode and returns to policy-map configuration mode.

•no: returns a command to its default setting.

•police: defines an individual policer or aggregate policer for the classified traffic. The policer specifies the bandwidth limitations and the action to take when the limits are exceeded. For more information, see the police and police aggregate (policy-map class configuration) policy-map class commands.

•priority: sets the strict scheduling priority for this class or, when used with the police keyword, sets priority with police. For more information, see the priority policy-map class command.

•queue-limit: sets the queue maximum threshold for Weighted Tail Drop (WTD). For more information, see the queue-limit command.

•service-policy: configures a QoS service policy to attach to a parent policy map for an input or output policy. For more information, see the service-policy (policy-map class configuration) command.

•set: specifies a value to be assigned to the classified traffic. For more information, see the set commands.

•shape average: specifies the average traffic shaping rate. For more information, see the shape average command.

To return to policy-map configuration mode, use the exit command. To return to privileged EXEC mode, use the end command.

Examples

This example shows how to create a policy map called policy1, define a class class1, and enter policy-map class configuration mode to set a criterion for the class.

Switch(config)# policy-map policy1

Switch(config-pmap)# class class1

Switch(config-pmap-c)# set dscp 10

Switch(config-pmap-c)# exit

You can verify your settings by entering the show policy-map privileged EXEC command.

Related Commands

class-map

Use the class-map global configuration command to create a class map to be used for matching packets to a specified criteria and to enter class-map configuration mode. Use the no form of this command to delete an existing class map.

class-map [match-all | match-any] class-map-name

no class-map [match-all | match-any] class-map-name

Syntax Description

Defaults

No class maps are defined.

If neither the match-all or the match-any keyword is specified, the default is match-all.

Command Modes

Global configuration

Command History

Usage Guidelines

Use this command to specify the name of the class for which you want to create or to modify class-map match criteria and to enter class-map configuration mode.

The switch supports a maximum of 1024 unique class maps.

You use the class-map command and class-map configuration mode to define packet classification as part of a globally named service policy applied on a per-port basis. When you configure a class map, you can use one or more match commands to specify match criteria. Packets arriving at either the input or output interface (determined by how you configure the service-policy interface configuration command) are checked against the class-map match criteria to determine if the packet belongs to that class.

A match-all class map means that the packet must match all entries and can have no other match statements.

After you are in class-map configuration mode, these configuration commands are available:

•description: describes the class map (up to 200 characters). The show class-map privileged EXEC command displays the description and the name of the class map.

•exit: exits QoS class-map configuration mode.

•match: configures classification criteria. For more information, see the match class-map configuration commands.

•no: removes a match statement from a class map.

Examples

This example shows how to configure the class map called class1. By default, the class map is match-all and therefore can contain no other match criteria.

Switch(config)# class-map class1

Switch(config-cmap)# exit

This example shows how to configure a match-any class map with one match criterion, which is an access list called 103. This class map (matching an ACL) is supported only in an input policy map.

Switch(config)# class-map class2

Switch(config-cmap)# match access-group 103

Switch(config-cmap)# exit

This example shows how to delete the class map class1:

Switch(config)# no class-map class1

You can verify your settings by entering the show class-map privileged EXEC command.

Related Commands

clear ip arp inspection log

Use the clear ip arp inspection log privileged EXEC command to clear the dynamic Address Resolution Protocol (ARP) inspection log buffer.

clear ip arp inspection log

Syntax Description

This command has no arguments or keywords.

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Examples

This example shows how to clear the contents of the log buffer:

Switch# clear ip arp inspection log

You can verify that the log was cleared by entering the show ip arp inspection log privileged command.

Related Commands

clear ip arp inspection statistics

Use the clear ip arp inspection statistics privileged EXEC command to clear the dynamic Address Resolution Protocol (ARP) inspection statistics.

clear ip arp inspection statistics [vlan vlan-range]

Syntax Description

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Examples

This example shows how to clear the statistics for VLAN 1:

Switch# clear ip arp inspection statistics vlan 1

You can verify that the statistics were deleted by entering the show ip arp inspection statistics vlan 1 privileged EXEC command.

Related Commands

clear ip dhcp snooping

Use the clear ip dhcp snooping privileged EXEC command to clear the DHCP binding database agent statistics or the DHCP snooping statistics counters.

clear ip dhcp snooping {binding {* | ip-address | interface interface-id | vlan vlan-id} | database statistics | statistics}

Syntax Description

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

When you enter the clear ip dhcp snooping database statistics command, the switch does not update the entries in the binding database and in the binding file before clearing the statistics.

Examples

This example shows how to clear the DHCP snooping binding database agent statistics:

Switch# clear ip dhcp snooping database statistics 

You can verify that the statistics were cleared by entering the show ip dhcp snooping database privileged EXEC command.

This example shows how to clear the DHCP snooping statistics counters:

Switch# clear ip dhcp snooping statistics 

You can verify that the statistics were cleared by entering the show ip dhcp snooping statistics user EXEC command.

Related Commands

clear ipc

Use the clear ipc privileged EXEC command to clear Interprocess Communications Protocol (IPC) statistics.

clear ipc {queue-statistics | statistics}

Syntax Description

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

You can clear all statistics by using the clear ipc statistics command, or you can clear only the queue statistics by using the clear ipc queue-statistics command.

Examples

This example shows how to clear all statistics:

Switch# clear ipc statistics

This example shows how to clear only the queue statistics:

Switch# clear ipc queue-statistics

You can verify that the statistics were deleted by entering the show ipc rpc or the show ipc session privileged EXEC command.

Related Commands

clear ipv6 dhcp conflict

Use the clear ipv6 dhcp conflict privileged EXEC command to clear an address conflict from the Dynamic Host Configuration Protocol for IPv6 (DHCPv6) server database.

clear ipv6 dhcp conflict {* | IPv6-address}

Note This command is available only if the switch is running the metro IP access image and you have configured a dual IPv4 and IPv6 Switch Database Management (SDM) template on the switch.

Syntax Description

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

To configure the dual IPv4 and IPv6 template, enter the sdm prefer dual-ipv4-and-ipv6 {default | routing | vlan} global configuration command, and reload the switch.

When you configure the DHCPv6 server to detect conflicts, it uses ping. The client uses neighbor discovery to detect clients and reports to the server through a DECLINE message. If an address conflict is detected, the address is removed from the pool and is not assigned until the administrator removes the address from the conflict list.

If you use the asterisk (*) character as the address parameter, DHCP clears all conflicts.

Examples

This example shows how to clear all address conflicts from the DHCPv6 server database:

Switch# clear ipv6 dhcp conflict *

Related Commands

clear l2protocol-tunnel counters

Use the clear l2protocol-tunnel counters privileged EXEC command to clear the protocol counters in protocol tunnel ports.

clear l2protocol-tunnel counters [interface-id]

This command is supported only when the switch is running the metro IP access or metro access image.

Syntax Description

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

Use this command to clear protocol tunnel counters on the switch or on the specified interface.

Examples

This example shows how to clear Layer 2 protocol tunnel counters on an interface:

Switch# clear l2protocol-tunnel counters gigabitethernet0/2

Related Commands

clear lacp

Use the clear lacp privileged EXEC command to clear Link Aggregation Control Protocol (LACP) channel-group counters.

clear lacp {channel-group-number counters | counters}

Note LACP is available only on network node interfaces (NNIs) and enhanced network interfaces (ENIs).

Syntax Description

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

You can clear all counters by using the clear lacp counters command, or you can clear only the counters for the specified channel group by using the clear lacp channel-group-number counters command.

Examples

This example shows how to clear all channel-group information:

Switch# clear lacp counters

This example shows how to clear LACP traffic counters for group 4:

Switch# clear lacp 4 counters

You can verify that the information was deleted by entering the show lacp counters or the show lacp 4 counters privileged EXEC command.

Related Commands

clear logging onboard

Use the clear logging onboard privileged EXEC command to clear all the on-board failure logging (OBFL) data except for the uptime and CLI-command information stored in the flash memory.

clear logging onboard [module {slot-number | all}]

Syntax Description

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

We recommend that you keep OBFL enabled and do not clear the data stored in the flash memory.

Examples

These examples show how to clear all the OBFL information except for the uptime and CLI-command information:

Switch# clear logging onboard

Clear logging onboard buffer [confirm]

PID: ME-3400E-24TS-M   , VID: 03 , SN: FOC1225U4CY

Switch# clear logging onboard module all

Clear logging onboard buffer [confirm]

PID: ME-3400E-24TS-M   , VID: 03 , SN: FOC1225U4CY

You can verify that the information was cleared by entering the show logging onboard onboard privileged EXEC command.

Related Commands

clear mac address-table

Use the clear mac address-table privileged EXEC command to delete from the MAC address table a specific dynamic address, all dynamic addresses on a particular interface, or all dynamic addresses on a particular VLAN. This command also clears the MAC address notification global counters.

clear mac address-table {dynamic [address mac-addr | interface interface-id | vlan vlan-id] | notification}

Syntax Description

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Examples

This example shows how to remove a specific MAC address from the dynamic address table:

Switch# clear mac address-table dynamic address 0008.0070.0007

You can verify that the information was deleted by entering the show mac address-table privileged EXEC command.

Related Commands

clear mac address-table move update

Use the clear mac address-table move update privileged EXEC command to clear the mac address-table-move update-related counters.

clear mac address-table move update

This command is supported only when the switch is running the metro IP access or metro access image.

Syntax Description

This command has no arguments or keywords.

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Examples

This example shows how to clear the mac address-table move update related counters.

Switch# clear mac address-table move update

You can verify that the information was cleared by entering the show mac address-table move update privileged EXEC command.

Related Commands

clear pagp

Use the clear pagp privileged EXEC command to clear Port Aggregation Protocol (PAgP) channel-group information.

clear pagp {channel-group-number counters | counters}

Note PAgP is available only on network node interfaces (NNIs) enhanced network interfaces (ENIs).

Syntax Description

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

You can clear all counters by using the clear pagp counters command, or you can clear only the counters for the specified channel group by using the clear pagp channel-group-number counters command.

Examples

This example shows how to clear all channel-group information:

Switch# clear pagp counters

This example shows how to clear PAgP traffic counters for group 10:

Switch# clear pagp 10 counters

You can verify that information was deleted by entering the show pagp privileged EXEC command.

Related Commands

clear policer cpu uni-eni counters

Use the clear policer cpu uni-eni counters privileged EXEC command to clear control-plane policer statistics. The control-plane policer drops or rate-limits control packets from user network interfaces (UNIs) and enhanced network interfaces (ENIs) to protect the CPU from overload.

clear policer cpu uni-eni counters {classification | drop}

Syntax Description

Command Default

No default is defined.

Command Modes

User EXEC

Command History

Usage Guidelines

You can use this command to clear statistics maintained per feature or statistics about dropped frames.

You can enter the show platform policer cpu classification or show policer cpu uni drop command to view feature statistics or dropped frames before and after you use the clear command.

Related Commands

clear port-security

Use the clear port-security privileged EXEC command to delete from the MAC address table all secure addresses or all secure addresses of a specific type (configured, dynamic, or sticky) on the switch or on an interface.

clear port-security {all | configured | dynamic | sticky} [[address mac-addr | interface interface-id] [vlan {vlan-id | {access | voice}}]]

Syntax Description

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Examples

This example shows how to clear all secure addresses from the MAC address table:

Switch# clear port-security all

This example shows how to remove a specific configured secure address from the MAC address table:

Switch# clear port-security configured address 0008.0070.0007

This example shows how to remove all the dynamic secure addresses learned on a specific interface:

Switch# clear port-security dynamic interface gigabitethernet0/1

This example shows how to remove all the dynamic secure addresses from the address table:

Switch# clear port-security dynamic

You can verify that the information was deleted by entering the show port-security privileged EXEC command.

Related Commands

clear rep counters

Use the clear rep counters privileged EXEC command to clear Resilient Ethernet Protocol (REP) counters for the specified interface or all interfaces.

clear rep counters [interface interface-id]

Syntax Description

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

You can clear all REP counters by using the clear rep counters command, or you can clear only the counters for the interface by using the clear rep counters interface interface-id command.

When you enter the clear rep counters command, only the counters visible in the output of the show interface rep detail command are cleared. SNMP visible counters are not cleared as they are read-only.

Examples

This example shows how to clear all REP counters for all REP interfaces:

Switch# clear rep counters

You can verify that REP information was deleted by entering the show interfaces rep detail privileged EXEC command.

Related Commands

clear spanning-tree counters

Use the clear spanning-tree counters privileged EXEC command to clear the spanning-tree counters.

clear spanning-tree counters [interface interface-id]

Syntax Description

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

If the interface-id is not specified, spanning-tree counters are cleared for all STP ports.

Examples

This example shows how to clear spanning-tree counters for all STP ports:

Switch# clear spanning-tree counters

Related Commands

clear spanning-tree detected-protocols

Use the clear spanning-tree detected-protocols privileged EXEC command to restart the protocol migration process (force the renegotiation with neighboring switches) on all spanning-tree interfaces or on the specified interface.

clear spanning-tree detected-protocols [interface interface-id]

Syntax Description

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

A switch running the rapid per-VLAN spanning-tree plus (rapid-PVST+) protocol or the Multiple Spanning Tree Protocol (MSTP) supports a built-in protocol migration mechanism that enables it to interoperate with legacy IEEE 802.1D switches. If a rapid-PVST+ switch or an MSTP switch receives a legacy IEEE 802.1D configuration bridge protocol data unit (BPDU) with the protocol version set to 0, it sends only IEEE 802.1D BPDUs on that port. A multiple spanning-tree (MST) switch can also detect that a port is at the boundary of a region when it receives a legacy BPDU, an MST BPDU (Version 3) associated with a different region, or a rapid spanning-tree (RST) BPDU (Version 2).

However, the switch does not automatically revert to the rapid-PVST+ or the MSTP mode if it no longer receives IEEE 802.1D BPDUs. It cannot learn whether the legacy switch has been removed from the link unless the legacy switch is the designated switch. Use the clear spanning-tree detected-protocols command in this situation.

Examples

This example shows how to restart the protocol migration process on a port:

Switch# clear spanning-tree detected-protocols interface gigabitethernet0/1

Related Commands

clear vmps statistics

Use the clear vmps statistics privileged EXEC command to clear the statistics maintained by the VLAN Query Protocol (VQP) client.

clear vmps statistics

Syntax Description

This command has no arguments or keywords.

Defaults

No default is defined.

Command Modes

Privileged EXEC

Command History

Examples

This example shows how to clear VLAN Membership Policy Server (VMPS) statistics:

Switch# clear vmps statistics

You can verify that information was deleted by entering the show vmps statistics privileged EXEC command.

Related Commands

conform-action

Use the conform-action policy-map class police configuration command to set multiple actions for a policy-map class for packets that conform to the committed information rate (CIR) or peak information rate (PIR) by having a rate less than the conform burst. Use the no form of this command to cancel the action or to return to the default action.

conform-action {drop | set-cos-transmit {new-cos-value | [cos | dscp | precedence] [table table-map name]} | set-dscp-transmit {new-dscp-value | [cos | dscp | precedence] [table table-map name]} | set-prec-transmit {new-precedence-value | [cos | dscp | precedence] [table table-map name]} | set-qos-transmit qos-group-value | transmit]}

no conform-action {drop | set-cos-transmit {new-cos-value | [cos | dscp | precedence] [table table-map name]} | set-dscp-transmit {new-dscp-value | [cos | dscp | precedence] [table table-map name]} | set-prec-transmit {new-precedence-value | [cos | dscp | precedence] [table table-map name]} | set-qos-transmit qos-group-value | transmit]}

Syntax Description

Defaults

The default conform action is to send the packet.

Command Modes

Policy-map class police configuration

Command History

Usage Guidelines

You configure conform actions for packets when the packet rate is less than the configured conform burst.

If the conform action is set to drop, the exceed and violate actions are automatically set to drop.

You can configure conform-action marking by using enhanced packet marking to modify a QoS marking based on any incoming QoS marking and table maps. The switch also supports simultaneously marking multiple QoS parameters for the same class and configuring conform-action, exceed-action, and violate-action marking.

Access policy-map class police configuration mode by entering the police policy-map class command. See the police policy-map class configuration command for more information.

Use this command to set one or more conform actions for a traffic class.

Examples

This example shows how configure multiple conform actions in a policy map that sets a committed information rate of 23000 bits per second (bps) and a conform burst rate of 10000 bps. The policy map includes multiple conform actions (for DSCP and for Layer 2 CoS) and an exceed action.

Switch(config)# policy-map map1

Switch(config-pmap)# class cos-set-1

Switch(config-pmap-c)# police cir 23000 bc 10000

Switch(config-pmap-c-police)# conform-action set-dscp-transmit 48

Switch(config-pmap-c-police)# conform-action set-cos-transmit 5

Switch(config-pmap-c-police)# exceed-action drop

Switch(config-pmap-c-police)# exit

You can verify your settings by entering the show policy-map privileged EXEC command.

Related Commands

copy logging onboard module

Use the copy logging onboard module privileged EXEC command to copy on-board failure logging (OBFL) data to the local network or a specific file system.

copy logging onboard module [slot-number] destination

Syntax Description

Defaults

This command has no default setting.

Command Modes

Privileged EXEC

Command History

Usage Guidelines

For information about OBFL, see the hw-module module logging onboard global configuration command.

Examples

This example shows how to copy the OBFL data messages to the obfl_file file on the flash file system:

Switch# copy logging onboard module flash:obfl_file

OBFL copy successful

Related Commands

cpu traffic qos cos

Use the cpu traffic qos cos command in global configuration mode to configure quality of service (QoS) marking based on class of service (CoS) for control plane traffic. To return to the default value, use the no form of this command.

cpu traffic qos cos {cos_value | cos [table-map table-map-name] | dscp [table-map table-map-name] | precedence [table-map table-map-name]}

no cpu traffic qos cos {cos_value | cos [table-map table-map-name] | dscp [table-map table-map-name] | precedence [table-map table-map-name]}

Syntax Description

Command Default

Control plane (CPU) traffic is not marked for QoS.

Command Modes

Global configuration

Command History

Usage Guidelines

Configure any desired table-maps before configuring marking or queuing of CPU traffic.

This feature must be configured globally for a switch; it cannot be configured per-port or per-protocol.

Enter each cpu traffic qos marking action on a separate line.

The cpu traffic qos cos global configuration command configures CoS marking for CPU-generated traffic by using either a specific CoS value or a table map, but not both. A new configuration overwrites the existing configuration.

When the cpu traffic qos cos global configuration command is configured with table maps, you can configure two map from values at a time—CoS and either DSCP or precedence.

If the cpu traffic qos cos global configuration command is configured with only a map from value of IP-DSCP or IP-precedence:

•The CoS value of IP packets is mapped by using the IP-DSCP (or IP-precedence) value in the packet and the configured table map. Packets can be classified and queued by an output policy map based on the marked CoS value.

•The CoS value of non-IP packets remains unchanged.

If the cpu traffic qos cos global configuration command is configured with a map from value of CoS:

•The CoS value of IP packets is mapped by using the CoS value in the packet and the configured table map. Packets can be classified and queued by an output policy map based on the marked CoS value.

•The CoS value of non-IP packets is mapped by using the CoS value in the packet and the configured table map. Packets can be classified and queued by an output policy map based on the marked CoS value.

If the cpu traffic qos cos global configuration command is configured with a map from value of DSCP or precedence and CoS:

•The CoS value of IP packets is mapped by using the DSCP or precedence value in the packet and the configured table map. Packets can be classified and queued by an output policy map based on the marked CoS value.

•The CoS value of non-IP packets is mapped by using the CoS value in the packet and the configured table map. Packets can be classified and queued by an output policy map based on the marked CoS value.

Examples

This example shows how to mark the CoS of CPU-generated IP traffic (including IP-SLA and TWAMP) based on the DSCP value in the packet and to configure egress queuing based on the CoS value.

The sample configuration has these results:

•All CPU-generated IP traffic is queued on the egress port based on the DSCP value and the configured output policy map called output-policy.

•All IP SLA or TWAMP probes with the DSCP value ef to simulate voice traffic are assigned to the voice class.

•All IP SLA or TWAMP probes with the DSCP values af41, af42 and af43 to simulate video traffic are assigned to the video class.

•All IP control protocol traffic with the DSCP values 48 and 56 are assigned to the network-internetwork-control class.

•The rest of the IP traffic is assigned to the default class.

•All CPU-generated non-IP traffic with CoS 5 is assigned to the voice class.

•All CPU-generated non-IP traffic with CoS 3 is assigned to the video class.

•All CPU-generated non-IP traffic with CoS 6 and 7 is assigned to the network-internetwork-control class.

•All CFM traffic with CoS 5 is assigned to the voice class.

•All CFM traffic with CoS 3 is assigned to the video class.

•All CFM traffic with CoS 6 and 7 is assigned to the network-internetwork-control class.

Table Map:

Switch(config)# table-map dscp-to-cos

Switch(config-tablemap)# map from 46 to 5

Switch(config-tablemap)# map from 48 to 6

Switch(config-tablemap)# map from 56 to 7

Switch(config-tablemap)# map from af41 to 3

Switch(config-tablemap)# map from af42 to 3

Switch(config-tablemap)# map from af43 to 3

Switch(config-tablemap)# default 0

Switch(config-tablemap)# end

CPU QoS:

Switch(config)# cpu traffic qos cos dscp table-map dscp-to-cos

Switch(config)# cpu traffic qos cos cos 

Class:

Switch(config)# class-map match-any video

Switch(config-cmap)# match cos 3

Switch(config-cmap)# exit

Switch(config)# class-map match-any voice

Switch(config-cmap)# match cos 5

Switch(config-cmap)# exit

Switch(config)# class-map match-any network-internetwork-control

Switch(config-cmap)# match cos 6 7

Switch(config-cmap)# exit

Policy:

Switch(config)# policy-map output-policy

Switch(config-pmap)# class voice

Switch(config-pmap-c)# priority

Switch(config-pmap-c)# police cir 10000000

Switch(config-pmap-c)# exit

Switch(config-pmap)# class video

Switch(config-pmap-c)# bandwidth percent 40

Switch(config-pmap-c)# exit

Switch(config-pmap)# class network-internetwork-control

Switch(config-pmap-c)# bandwidth percent 10

Switch(config-pmap-c)# exit

Switch(config-pmap)# class class-default

Switch(config-pmap-c)# bandwidth percent 30

Switch(config-pmap-c)# exit

Interface

Switch(config)# interface fastethernet0/1

Switch(config-if)# service-policy output output-policy

Switch(config-pmap-c)# exit

Related Commands