Commands for VLAN and MAC Address Configuration

Content

Content
CHAPTER 1 VLAN CONFIGURATION..........................................1
1.1 Commands for VLAN Configuration.......................................................................1 1.1.1 debug gvrp event...............................................................................................1 1.1.2 debug gvrp packet.............................................................................................1 1.1.3 dot1q-tunnel enable..........................................................................................2 1.1.4 dot1q-tunnel selective enable..........................................................................2 1.1.5 dot1q-tunnel selective s-vlan...........................................................................2 1.1.6 dot1q-tunnel tpid...............................................................................................3 1.1.7 garp timer join....................................................................................................3 1.1.8 garp timer leave.................................................................................................3 1.1.9 garp timer leaveAll............................................................................................4 1.1.10 gvrp (Global)....................................................................................................4 1.1.11 gvrp (Port)........................................................................................................4 1.1.12 no garp timer....................................................................................................5 1.1.13 name.................................................................................................................5 1.1.14 private-vlan......................................................................................................5 1.1.15 private-vlan association.................................................................................6 1.1.16 show dot1q-tunnel...........................................................................................7 1.1.17 show garp timer...............................................................................................7 1.1.18 show gvrp fsm information............................................................................7 1.1.19 show gvrp leaveAll fsm information..............................................................8 1.1.20 show gvrp leavetimer running information..................................................8 1.1.21 show gvrp port-member.................................................................................9 1.1.22 show gvrp port registerd vlan........................................................................9 1.1.23 show gvrp timer running information.........................................................10 1.1.24 show gvrp vlan registerd port......................................................................10 1.1.25 show vlan.......................................................................................................10 1.1.26 show vlan-translation...................................................................................12 1.1.27 switchport access vlan.................................................................................12 1.1.28 switchport dot1q-tunnel...............................................................................12 1.1.29 switchport forbidden vlan............................................................................12 1.1.30 switchport hybrid allowed vlan....................................................................13 1.1.31 switchport hybrid native vlan.......................................................................14 1.1.32 switchport interface......................................................................................14 1.1.33 switchport mode............................................................................................15 1.1.34 switchport mode trunk allow-null................................................................15 1.1.35 switchport trunk allowed vlan......................................................................16 1.1.36 switchport trunk native vlan.........................................................................16 1

Commands for VLAN and MAC Address Configuration

Content

1.1.37 vlan.................................................................................................................17 1.1.38 vlan internal...................................................................................................17 1.1.39 vlan ingress enable.......................................................................................18 1.1.40 vlan-translation..............................................................................................18 1.1.41 vlan-translation enable.................................................................................18 1.1.42 vlan-translation miss drop...........................................................................19 1.2 Commands for Dynamic VLAN Configuration......................................................19 1.2.1 dynamic-vlan mac-vlan prefer........................................................................19 1.2.2 dynamic-vlan subnet-vlan prefer...................................................................20 1.2.3 mac-vlan...........................................................................................................20 1.2.4 mac-vlan vlan...................................................................................................21 1.2.5 protocol-vlan....................................................................................................21 1.2.6 show dynamic-vlan prefer..............................................................................22 1.2.7 show mac-vlan.................................................................................................22 1.2.8 show mac-vlan interface.................................................................................22 1.2.9 show protocol-vlan..........................................................................................23 1.2.10 show subnet-vlan..........................................................................................23 1.2.11 show subnet-vlan interface..........................................................................23 1.2.12 subnet-vlan....................................................................................................24 1.2.13 switchport mac-vlan enable.........................................................................24 1.2.14 switchport subnet-vlan enable.....................................................................25 1.3 Commands for Voice VLAN Configuration...........................................................25 1.3.1 show voice-vlan...............................................................................................25 1.3.2 switchport voice-vlan enable.........................................................................25 1.3.3 voice-vlan.........................................................................................................26 1.3.4 voice-vlan vlan.................................................................................................26

CHAPTER 2 COMMANDS FOR MAC ADDRESS TABLE CONFIGURATION..........................................................................1

2.1 Commands for MAC Address Table Configuration................................................1 2.1.1 clear mac-address-table dynamic....................................................................1 2.1.2 mac-address-table aging-time.........................................................................1 2.1.3 mac-address-table static | static-multicast | blackhole.................................2 2.1.4 show mac-address-table..................................................................................3 2.2 Commands for Mac Address Binding configuration...............................................3 2.2.1 clear port-security dynamic.............................................................................3 2.2.2 mac-address-table periodic-monitor-time......................................................3 2.2.3 mac-address-table trap enable........................................................................4 2.2.4 mac-address-table synchronizing enable.......................................................4 2.2.5 show port-security............................................................................................4 2.2.6 show port-security address.............................................................................5 2.2.7 show port-security interface............................................................................5 2

Commands for VLAN and MAC Address Configuration

Content

2.2.8 switchport port-security...................................................................................6 2.2.9 switchport port-security convert.....................................................................6 2.2.10 switchport port-security lock.........................................................................7 2.2.11 switchport port-security mac-address..........................................................7 2.2.12 switchport port-security maximum...............................................................7 2.2.13 switchport port-security timeout...................................................................8 2.2.14 switchport port-security violation.................................................................8

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

Chapter 1 VLAN Configuration

1.1 Commands for VLAN Configuration 1.1.1 debug gvrp event
Command: debug gvrp event interface (ethernet | port-channel |) IFNAME no debug gvrp event interface (ethernet | port-channel |) IFNAME Function: Enable/disable GVRP event debugging including the transfer of state machine and the expiration of timer. Parameters: ethernet, physical port port-channel, aggregate port IFNAME, port name Command Mode: Admin mode Default: GVRP event debugging is disabled. Usage Guide: Use this command to enable GVRP event debugging. Example: Show GVRP event debugging. Switch(config)#debug gvrp event interface ethernet 1/0/1 %Jan 16 02:25:14 2006 GVRP EVENT: LO -> VO interface ethernet 1/0/1, vlan 100 %Jan 16 02:35:15 2006 GVRP EVENT: join timer expireinterface ethernet 1/0/1

1.1.2 debug gvrp packet

Command: debug gvrp packet (receive | send) interface (ethernet | port-channel |) IFNAME no debug gvrp packet (receive | send) interface (ethernet | port-channel |) IFNAME Function: Enable/disable GVRP packet debugging. Parameters: receive, enabling the debugging of receiving GVRP packet send, enabling the debugging of sending GVRP packet ethernet, physical port port-channel, aggregate port IFNAME, port name Command Mode: Admin mode Default: GVRP packet debugging is disabled. Usage Guide: Use this command to enable the debugging of GVRP packet. Example: Show information of sending and receiving GVRP packet. Switch(config)#debug gvrp packet receive interface ethernet 1/0/1 Receive packet, smac 00-21-27-aa-0f-46, dmac 01-80-C2-00-00-21, length 90, protocol ID:1,attribute type:0x01, 1

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

Attribute Index Length Event Value -------------------- --------- ------------1 10 joinIn 100 2 10 joinEmpty 140 3 10 leaveIn 150 4 10 leaveEmpty 180

1.1.3 dot1q-tunnel enable

Command: dot1q-tunnel enable no dot1q-tunnel enable Function: Set the access port of the switch to dot1q-tunnel mode; the no command restores to default. Parameter: None. Command Mode: Port Mode. Default: Dot1q-tunnel function disabled on the port by default. Usage Guide: After enabling dot1q-tunnel on the port, data packets without VLAN tag (referred to as tag) will be packed with a tag when entering through the port; those with tag will be packed with an external tag. The TPID in the tag is 8100 and the VLAN ID is the VLAN ID that the port belongs to. Data packets with double tags will be forwarded according to MAC address and external tag, till the external tag is removed when transmitted outside from the access port. Since the length of the data packet may be over sized when packed with external tag, it is recommended to use this command associating the Jumbo function. Normally this command is used on access ports. This command and dot1q-tunnel tpid are mutually exclusive, also and vlan-translation enable. Example: Join port1 into VLAN3, enable dot1q-tunnel function. Switch(config)#vlan 3 Switch(Config-Vlan3)#switchport interface ethernet 1/0/1 Switch(Config-Vlan3)#exit Switch(config)#interface ethernet 1/0/1 Switch(Config-If-Ethernet1/0/1)# dot1q-tunnel enable Switch(Config-If-Ethernet1/0/1)# exit Switch(config)#

1.1.4 dot1q-tunnel selective enable

This command is not supported by the switch.

1.1.5 dot1q-tunnel selective s-vlan

This command is not supported by the switch.

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

1.1.6 dot1q-tunnel tpid

Command: dot1q-tunnel tpid {0x8100|0x9100|0x9200| <1-65535> } Function: Configure the type (TPID) of the protocol of switch trunk port. Parameter: None. Command Mode: Port Mode. Default: TPID on the port is defaulted at 0x8100. Usage Guide: This function is to facilitate internetworking with equipments of other manufacturers. If the equipment connected with the switch trunk port sends data packet with a TPID of 0x9100, the port TPID will be set to 0x9100, this way switch will receive and process data packets normally. This command and dot1q-tunnel enable are mutually exclusive. Example: Set port10 of the switch to trunk port and sends data packet with a TPID of 0x9100. Switch(config)#interface ethernet 1/0/10 Switch(Config-If-Ethernet1/0/10)#switchport mode trunk Switch(Config-If-Ethernet1/0/10)#dot1q-tunnel tpid 0x9100 Switch(Config-If-Ethernet1/0/10)#exit Switch(config)#

1.1.7 garp timer join

Command: garp timer join <200-500> Function: Set the value of garp join timer, note that the value of join timer must be less than half leave timer. Parameters: <200-500>, the value of timer in millisecond Command Mode: Global mode Default: 200 ms. Usage Guide: Check whether the value satisfy the range. If so, modify the value of garp timer to the specified value, otherwise return a configuration error. Example: Set the value of garp join timer as 200ms. Switch(config)#garp timer join 200

1.1.8 garp timer leave

Command: garp timer leave <500-1200> Function: Set the value of garp leave timer, note that the value of leave timer must be double of join timer and less than leaveAll timer. Parameters: <500-1200>, the value of timer in millisecond Command Mode: Global mode Default: 600 ms. Usage Guide: Check whether the value satisfy the range. If so, modify the value of garp timer to the specified value, otherwise return a configuration error. 3

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

Example: Set the value of garp leave timer as 600ms. Switch(config)#garp timer leave 600

1.1.9 garp timer leaveAll

Command: garp timer leaveall <5000-60000> Function: Set the value of garp leaveAll timer, note that the value of leaveAll timer must be larger than leave timer. Parameters: <5000-60000>, the value of timer in millisecond Command Mode: Global mode Default: 10000 ms. Usage Guide: Check whether the value satisfy the range. If so, modify the value of garp leaveAll timer to the specified value, otherwise return a configuration error. Example: Set the value of garp leaveAll as 20000ms. Switch(config)#garp timer leaveall 20000

1.1.10 gvrp (Global)

Command: gvrp no gvrp Function: Enable/disable GVRP funciton globally. Parameters: None. Command Mode: Global mode Default: Disabled. Usage Guide: Enable GVRP function globally and only in this way GVRP module can work normally. Example: Enable GVRP function globally. Switch(config)#gvrp

1.1.11 gvrp (Port)

Command: gvrp no gvrp Function: Enable/disable GVRP function on port. Notice: although GVRP can be enabled on port when GVRP is not enabled globally, it will not take effect until global GVRP is enabled. Parameters: None Command Mode: Port mode Default: Disabled Usage Guide: GVRP function can only be enabled on trunk and hybrid ports, and enabling GVRP will return an error on access port. After GVRP enabled on port, this port will be added to GVRP (i.e. adding corresponding state machine to GVRP of the port). Example: Enable GVRP of port.

Commands for VLAN and MAC Address Configuration Switch(config-if-ethernet1/0/1)#gvrp

Chapter 1 VLAN Configuration

1.1.12 no garp timer

Command: no garp timer (join | leave | leaveall) Function: Restore garp join | leave | leaveAll timer to the default value. Parameters: join, join timer leave, leave timer leaveAll, leaveAll timer Command Mode: Global mode Default: 200 | 600 | 10000 milliseconds for join | leave | leaveall timer respectively. Usage Guide: Check whether the default value satisfy the range. If so, modify the value of garp join | leave | leaveAll timer to the default value, otherwise return a configuration error. Example: Restore garp timer to the default value. Switch(config)#no garp timer leaveall

1.1.13 name
Command: name <vlan-name> no name Function: Specify a name, a descriptive string, for the VLAN; the no operation of the command will delete the name of the VLAN. Parameters: <vlan-name> is the specified name string. Command Mode: VLAN Configuration Mode. Default: The default VLAN name is vlanXXX, where xxx is VID. Usage Guide: The switch can specify names for different VLANs, making it easier for users to identify and manage VLANs. Examples: Specify the name of VLAN100 as TestVlan. Switch(Config-Vlan100)#name TestVlan

1.1.14 private-vlan
Command: private-vlan {primary | isolated | community} no private-vlan Function: Configure current VLAN to Private VLAN. The no command cancels the Private VLAN configuration. Parameter: primary set current VLAN to Primary VLAN, isolated set current VLAN to Isolated VLAN, community set current VLAN to Community VLAN. Command Mode: VLAN mode Default: Private VLAN is not configured by default. Usage Guide: There are three Private VLANs: Primary VLAN, Isolated VLAN and Community VLAN. Ports in Primary there are three Private VLANs: Primary VLAN,

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

Isolated VLAN and Community VLAN can communicate with ports of Isolated VLAN and Community VLAN related to this Primary VLAN; Ports in Isolated VLAN are isolated between each other and only communicate with ports in Primary VLAN they related to; ports in Community VLAN can communicate both with each other and with Primary VLAN ports they related to; there is no communication between ports in Community VLAN and port in Isolated VLAN. Only VLANs containing empty Ethernet ports can be set to Private VLAN, and only the Private VLANs configured with associated private relationships can set the Access Ethernet ports their member ports. Normal VLAN will clear its Ethernet ports when set to Private VLAN. It is to be noted Private VLAN messages will not be transmitted by GVRP. Example: Set VLAN100, 200, 300 to private vlans, with respectively primary, Isolated, Community types. Switch(config)#vlan 100 Switch(Config-Vlan100)#private-vlan primary Note:This will remove all the ports from vlan 100 Switch(Config-Vlan100)#exit Switch(config)#vlan 200 Switch(Config-Vlan200)#private-vlan isolated Note:This will remove all the ports from vlan 200 Switch(Config-Vlan200)#exit Switch(config)#vlan 300 Switch(Config-Vlan300)#private-vlan community Note:This will remove all the ports from vlan 300 Switch(Config-Vlan300)#exit

1.1.15 private-vlan association

Command: private-vlan association <secondary-vlan-list> no private-vlan association Function: Set Private VLAN association; the no command cancels Private VLAN association. Parameter: <secondary-vlan-list> Sets Secondary VLAN list which is associated to Primary VLAN. There are two types of Secondary VLAN: Isolated VLAN and Community VLAN. Users can set multiple Secondary VLANs by ';'. Command mode: VLAN Mode. Default: There is no Private VLAN association by default. Usage Guide: This command can only used for Private VLAN. The ports in Secondary VLANs which are associated to Primary VLAN can communicate to the ports in Primary VLAN. Before setting Private VLAN association, three types of Private VLANs should have no member ports; the Private VLAN with Private VLAN association cant be deleted. When users delete Private VLAN association, all the member ports in the Private VLANs

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

whose association is deleted are removed from the Private VLANs. Example: Associate Isolated VLAN200 and Community VLAN300 to Primary VLAN100. Switch(Config-Vlan100)#private-vlan association 200;300

1.1.16 show dot1q-tunnel

Command: show dot1q-tunnel Function: Display the information of all the ports at dot1q-tunnel state. Parameter: None. Command Mode: Admin and Configuration Mode. Usage Guide: This command is used for displaying the information of the ports at dot1qtunnel state. Example: Display current dot1q-tunnel state. Switch#show dot1q-tunnel Interface Ethernet1/0/1: dot1q-tunnel is enable Interface Ethernet1/0/3: dot1q-tunnel is enable

1.1.17 show garp timer

Command: show garp timer (join | leave | leaveall |) Function: Show the value of each timer. Note that the value is not the remaining time to run the timer but the initial value when enabling the timer. Parameters: join, join timer leave, leave timer leaveAll, leaveAll timer Command Mode: Admin mode Default: 200|600|10000 milliseconds for join | leave | leaveAll timer respectively. Usage Guide: Show the corresponding value of the timer specified in the command. Example: Show the value of all garp timers currently. Switch#show garp timer join Garp join timers value is 200(ms)

1.1.18 show gvrp fsm information

Command: show gvrp fsm information interface (ethernet | port-channel) IFNAME Function: Show the current state of all registered machines and request state machines on specified or all ports. Parameters: ethernet, physical port port-channel, aggregate port IFNAME, port name Command Mode: Admin mode

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

Default: MT for registered machine and VO for request state machine. Usage Guide: Show the corresponding state of all registered machines and request state machines. Example: Show the state of all state machines. Switch#show gvrp fsm information interface ethernet 1/0/1 VAVery anxious Active memberAAAnxious Active memberQAQuiet Active member VP Very anxious Passive member AP Anxious Passive member QP Quiet Passive member VOVery anxious ObserverAOAnxious ObserverQOQuiet Observer LALeaving Acitve memberLOleaving Observer Interface ethernet 1/0/1 gvrp fsm information: Index VLANID Applicant Registrar ---- ----------------------------1 100 VO LV 2 300 VP IN

1.1.19 show gvrp leaveAll fsm information

Command: show gvrp leaveall fsm information interface (ethernet | port-channel) IFNAME Function: Show the state of leaveAll state machine on specified or all ports. Parameters: ethernet, physical port port-channel, aggregate port IFNAME, port name Command Mode: Admin mode Default: Passive. Usage Guide: Check the state of leaveAll state machine. Example: Show the state of leaveAll state machine on port. Switch#show gvrp leaveall fsm information interface ethernet 1/0/1 Interface leaveAll fsm ---------- -----------Ethernet1/0/1 passive

1.1.20 show gvrp leavetimer running information

Command: show gvrp leavetimer running information (vlan <1-4094> |) interface (Ethernet | port-channel |) IFNAME Function: Show running of all leavetimer on current port. Parameters: <1-4094>, VLAN tag Ethernet, physical port port-channel, aggregate port IFNAME, port name Command Mode: Admin mode

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

Default: leavetimer is disabled. Usage Guide: Show running state and expiration time of each leave timer. Example: Show running state and expiration time of each leave timer on current port. Switch#show gvrp leavetimer running information interface ethernet 1/0/1 VLANID running state expired time ------------ -----------------100 UP 0.2 s 300 DOWN non

1.1.21 show gvrp port-member

Command: show gvrp (active|) port-member Function: Shows all ports with GVRP enabled. active means the port is in active state with GVRP enabled. Parameters: active means the port is in active state Command Mode: Admin mode Default: GVRP is disabled on port. Usage Guide: Show all ports (enable GVRP) saved in GVRP. Example: Show all ports with GVRP enabled. Switch#show gvrp port member Ports which were enabled gvrp included Ethernet1/0/3T Ethernet1/0/4T Ethernet1/0/5T Ethernet1/0/6T Ethernet1/0/7T Ethernet1/0/8T Ethernet1/0/9T Ethernet1/0/10T

1.1.22 show gvrp port registerd vlan

Commmand: show gvrp port (dynamic | static |) registerd vlan interface (Ethernet | port-channel |) IFNAME Function: Show the dynamic or static registration VLANs on current port. Parameters: dynamic, dynamic registration static, static registration Ethernet, physical port port-channel, aggregate port IFNAME, port name Command Mode: Admin mode Default: No dynamic or static registration VLANs on port. Usage Guide: Show the corresponding VLANs of the registered machines by dynamic or static registration. Example: Show all dynamic or static registration VLANs on current port. Switch#show gvrp port registerd vlan interface ethernet 1/0/1 Current port dynamic registerd vlan included

Commands for VLAN and MAC Address Configuration Vlan10 vlan20 Vlan40 vlan60 Current port static registerd vlan included Vlan10 vlan30 Vlan40 vlan200

Chapter 1 VLAN Configuration

1.1.23 show gvrp timer running information

Command: show gvrp timer (join | leaveall) running information interface (ethernet | port-channel |) IFNAME Function: Show running of all join|leaveAll timer on current port. Parameters: join, join timer leaveall, leaveAll timer ethernet, physical port port-channel, aggregate port IFNAME, port name Command Mode: Admin mode Default: Join timer is disabled and leaveAll timer is enabled. Usage Guide: Check running state of join|leaveAll timer on port. Example: Show running state and expiration time of each timer. Switch(config)#show gvrp timer join running information interface ethernet 1/0/1 Current ports jointimer running state is: UP Current ports jointimer expired time is: 0.2 s

1.1.24 show gvrp vlan registerd port

Command: show gvrp vlan <1-4094> registerd port Function: Show the ports with specified VLAN registered. Parameters: <1-4094>: VLAN tag Command Mode: Admin mode Default: No ports with specified VLAN registered. Usage Guide: None. Example: Show all ports with current VLAN registered. Switch#show gvrp vlan 100 registerd port Ethernet1/0/3T Ethernet1/0/4T Ethernet1/0/5T Ethernet1/0/6T Ethernet1/0/7T Ethernet1/0/8T Ethernet1/0/9T Ethernet1/0/10T

1.1.25 show vlan

Command: show vlan [brief | summary] [id <vlan-id>] [name <vlan-name>] [internal

10

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

usage [id <vlan-id> | name <vlan-name>]] [private-vlan [id <vlan-id> | name <vlan-name> ]] Function: Display detailed information for all VLANs or specified VLAN. Parameter: brief stands for brief information; summary for VLAN statistics; <vlan-id> for VLAN ID of the VLAN to display status information, the valid range is 1 to 4094; <vlan-name> is the VLAN name for the VLAN to display status information, valid length is 1 to 11 characters. private-vlan displays the ID, name, relating VLAN and port of the private-vlan relative information. Command mode: Admin Mode and Configuration Mode. Usage Guide: If no <vlan-id> or <vlan-name> is specified, then information for all VLANs in the switch will be displayed. Example: Display the status for the current VLAN; display statistics for the current VLAN. Switch#show vlan VLAN Name Type Media Ports ---- ------------ ---------- --------- ---------------------------------------1 default Static ENET Ethernet1/0/1Ethernet1/0/2 Ethernet1/0/3 Ethernet1/0/4 Ethernet1/0/9 Ethernet1/0/10 Ethernet1/0/11 Ethernet1/0/12 2 VLAN0002 Static ENET Ethernet1/0/5 Ethernet1/0/6 Ethernet1/0/7 Ethernet1/0/8 Switch#show vlan summary The max. vlan entrys: 4094 Existing Vlans: Universal Vlan: 1 12 13 15 16 22 Total Existing Vlans is:6 Displayed information VLAN Name Type Media Ports Explanation VLAN number VLAN name VLAN type, statically dynamically learned. Access port within a VLAN configured or

VLAN interface type: Ethernet

Switch(config)#show vlan private-vlan VLAN Name Type Asso VLAN Ports ---- ------------ ---------- --------- ---------------------------------------100 VLAN0100 Primary 101 102 Ethernet1/0/9 Ethernet1/0/10 Ethernet1/0/11 Ethernet1/0/12 Ethernet1/0/13 101 VLAN0101 Community 100 Ethernet1/0/9 Ethernet1/0/10

11

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

Ethernet1/0/11 Ethernet1/0/12 Ethernet1/0/13 102 VLAN0102 Isolate 100 Ethernet1/0/9

1.1.26 show vlan-translation

Command: show vlan-translation Function: Show the related configuration of vlan-translation. Parameter: None. Command mode: Admin mode. Usage Guide: Show the related configuration of vlan-translation. Example: Show the related configuration of vlan-translation. Switch#show vlan-translation Interface Ethernet1/0/1: vlan-translation is enable, miss drop is not set vlan-translation 5 to 10 in

1.1.27 switchport access vlan

Command: switchport access vlan <vlan-id> no switchport access vlan Function: Add the current Access port to the specified VLAN. The no switchport access vlan command deletes the current port from the specified VLAN, and the port will be partitioned to VLAN1. Parameter: <vlan-id> is the VID for the VLAN to be added the current port, valid range is 1 to 4094. Command mode: Port Mode. Default: All ports belong to VLAN1 by default. Usage Guide: Only ports in Access mode can join specified VLANs, and an Access port can only join one VLAN at a time. Example: Add some Access port to VLAN100. Switch(config)#interface ethernet 1/0/8 Switch(Config-If-Ethernet1/0/8)#switchport mode access Switch(Config-If-Ethernet1/0/8)#switchport access vlan 100 Switch(Config-If-Ethernet1/0/8)#exit

1.1.28 switchport dot1q-tunnel

This command is not supported by this switch.

1.1.29 switchport forbidden vlan

Command: switchport forbidden vlan {WORD | all | add WORD | except WORD | 12

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

remove WORD} no switchport forbidden vlan Function: Configure the forbidden vlan for a port. Note that this command can only be used to configure on trunk or hybrid ports and the port with GVRP not enabled. No command cancels the forbidden vlanlist for a port. Parameters: WORD, add the vlanList as forbidden vlan and cover the previous configuration all, set all VLANs as forbidden vlan add WORD, add vlanList to the current forbidden vlanList except WORD, set all VLANs as forbidden vlan except vlanList remove WORD, remove vlan specified by vlanList from current forbidden vlanList Command Mode: Port mode Default: Forbidden vlanList is empty Usage Guide: Tag the corresponding position for forbidden vlanList and clear allow vlanList flags in ports. A port leaves these VLANs if it joins them statically, and it sends message to GVRP module to enable corresponding registered machine of the port to enter forbidden mode. Example: Port quits the corresponding VLAN and the corresponding registered machine of GVRP to enter forbidden mode. Switch(config-if-ethernet1/0/1)#switchport forbidden vlan all

1.1.30 switchport hybrid allowed vlan

Command: switchport hybrid allowed vlan {WORD | all | add WORD | except WORD | remove WORD} {tag | untag} no switchport hybrid allowed vlan Function: Set hybrid port which allow the VLAN to pass with tag or untag method; the no switchport hybrid allowed vlan command restores the default setting. Parameter: WORD: Set vlan List to allowed vlan, and the late configuration will cover the previous configuration; all: Set all VLANs to allowed vlan; add WORD: Add vlanList to the existent allowed vlanList; except WORD: Set all VLANs to allowed vlan except the configured vlanList; remove WORD: Delete the specific VLAN of vlanList from the existent allow vlanList; tag: Join the specific VLAN with tag mode; untag: Join the specific VLAN with untag mode. Command mode: Port Mode. Default: Deny all VLAN traffic to pass. Usage Guide: The user can use this command to set the VLANs whose traffic allowed to pass through the Hybrid port, traffic of VLANs not included are prohibited. The difference

13

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

between tag and untag mode by setting allowed vlan: set VLAN to untag mode, the frame sent via hybrid port without VLAN tag; set VLAN to tag mode, the frame sent via hybrid port with corresponding VLAN tag. The same VLAN can not be allowed with tag and untag mode by a Hybrid port at the same time. If configure the tag (or untag) allowed VLAN to untag (or tag) allowed VLAN, the last configuration will cover the previous. Example: Set hybrid port allowed vlan 1, 3, 5-20 with untag mode and allow vlan 100; 300; 500-2000 with tag mode. Switch(config)#interface ethernet 1/0/5 Switch(Config-If-Ethernet1/0/5)#switchport mode hybrid Switch(Config-If-Ethernet1/0/5)#switchport hybrid allowed vlan 1;3;5-20 untag Switch(Config-If-Ethernet1/0/5)#switchport hybrid allowed vlan 100; 300; 500-2000 tag Switch(Config-If-Ethernet1/0/5)#exit

1.1.31 switchport hybrid native vlan

Command: switchport hybrid native vlan <vlan-id> no switchport hybrid native vlan Function: Set the PVID for Hybrid port; the no switchport hybrid native vlan command restores the default setting. Parameter: <vlan-id> is the PVID of Hybrid port. Command mode: Port Mode. Default: The default PVID of Hybrid port is 1. Usage Guide: When an untagged frame enters a Hybrid port, it will be added a tag of the native PVID which is set by this command, and is forwarded to the native VLAN. Example: Set the native vlan to 100 for a Hybrid port. Switch(config)#interface ethernet 1/0/5 Switch(Config-If-Ethernet1/0/5)#switchport mode hybrid Switch(Config-If-Ethernet1/0/5)#switchport hybrid native vlan 100 Switch(Config-If-Ethernet1/0/5)#exit

1.1.32 switchport interface

Command: switchport interface [ethernet | portchannel] [<interface-name | interface-list>] no switchport interface [ethernet | portchannel] [<interface-name | interface-list>] Function: Specify Ethernet port to VLAN; the no command deletes one or one set of ports from the specified VLAN. Parameter: ethernet is the Ethernet port to be added. portchannel means that the port to be added is a link-aggregation port. interface-name port name, such as e1/0/1. If this option is selected, ethernet or portchannel should not be. interface-list is the port list to be added or deleted, ; and - are supported, for example: ethernet1/0/1;3;4-7;8. Command mode: VLAN Mode.

14

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

Default: A newly created VLAN contains no port by default. Usage Guide: Access ports are normal ports and can join a VLAN, but a port can only join one VLAN for a time. Example: Assign Ethernet port 1, 3, 4-7, 8 of VLAN100. Switch(Config-Vlan100)#switchport interface ethernet 1/0/1;3;4-7;8

1.1.33 switchport mode

Command: switchport mode {trunk | access | hybrid} Function: Set the port in access mode, trunk mode or hybrid mode. Parameter: trunk means the port allows traffic of multiple VLAN; access indicates the port belongs to one VLAN only; hybrid means the port allows the traffic of multi-VLANs to pass with tag or untag mode. Command mode: Port Mode. Default: The port is in Access mode by default. Usage Guide: Ports in trunk mode is called Trunk ports. Trunk ports can allow traffic of multiple VLANs to pass through. VLAN in different switches can be interconnected with the Trunk ports. Ports under access mode are called Access ports. An access port can be assigned to one and only one VLAN at a time. Hybrid ports can allow traffic of multiple VLANs to pass through, receive and send the packets of multiple VLANs, used to connect switch, or users computer. When Hybrid ports and Trunk ports receive the data, the deal way is same, but the deal way is different in sending the data. Because Hybrid ports can allow the packets of multiple VLANs to send with no tag, however, Trunk ports can only allow the packets of the default VLAN to send with no tag. The attribute of ports can not directly convert between Hybrid and Trunk, it must configure to be access at first, then configure to be Hybrid or Trunk. When the Trunk or Hybrid attribute is cancelled, the port attribute restores the default (access) attribute and belongs to vlan1. Example: Set port 5 to trunk mode and port 8 to access mode, port 10 to hybrid mode. Switch(config)#interface ethernet 1/0/5 Switch(Config-If-Ethernet1/0/5)#switchport mode trunk Switch(Config-If-Ethernet1/0/5)#exit Switch(config)#interface ethernet 1/0/8 Switch(Config-If-Ethernet1/0/8)#switchport mode access Switch(Config-If-Ethernet1/0/8)#exit Switch(config)#interface ethernet 1/0/10 Switch(Config-If-Ethernet1/0/10)#switchport mode hybrid Switch(Config-If-Ethernet1/0/10)#exit

1.1.34 switchport mode trunk allow-null

Command: switchport mode trunk allow-null Function: Add a port as trunk mode. When enabling GVRP, the mode that adds the ports with trunk mode to all VLANs is not appropriate. Therefore, add a port as trunk port

15

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

and does not join any VLANs by default for enabling GVRP on trunk port is appropriate. It is recommended to configure a port as trunk with this command before enabling GVRP. This command can also be used when a port has been configured as trunk already, which equals to clearing allow-list and quits all VLANs. Parameters: None Command Mode: Port mode Default: access mode. Usage Guide: Configure the port as trunk, enable it to leave all VLANs and clear allowlist. Example: Switch(config-if-ethernet1/0/1)#switchport mode trunk allow-null

1.1.35 switchport trunk allowed vlan

Command: switchport trunk allowed vlan {WORD | all | add WORD | except WORD | remove WORD} no switchport trunk allowed vlan Function: Set trunk port to allow VLAN traffic; the no switchport trunk allowed vlan command restores the default setting. Parameter: WORD: specified VIDs; keyword; all: all VIDs, the range from 1 to 4094; add: add assigned VIDs behind allow vlan; except: all VID add to allow vlan except assigned VIDs; remove: delete assigned allow vlan from allow vlan list. Command mode: Port Mode. Default: Trunk port allows all VLAN traffic by default. Usage Guide: The user can use this command to set the VLAN traffic allowed to passthrough the Trunk port; traffic of VLANs not included are prohibited. Example: Set Trunk port to allow traffic of VLAN1, 3, 5-20. Switch(config)#interface ethernet 1/0/5 Switch(Config-If-Ethernet1/0/5)#switchport mode trunk Switch(Config-If-Ethernet1/0/5)#switchport trunk allowed vlan 1;3;5-20 Switch(Config-If-Ethernet1/0/5)#exit

1.1.36 switchport trunk native vlan

Command: switchport trunk native vlan <vlan-id> no switchport trunk native vlan Function: Set the PVID for Trunk port; the no switchport trunk native vlan command restores the default setting. Parameter: <vlan-id> is the PVID for Trunk port. Command mode: Port Mode. Default: The default PVID of Trunk port is 1. Usage Guide: PVID concept is defined in 802.1Q. PVID in Trunk port is used to tag

16

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

untagged frames. When an untagged frame enters a Trunk port, the port will tag the untagged frame with the native PVID set with this commands for VLAN forwarding. Example: Set the native VLAN for a Trunk port to 100. Switch(config)#interface ethernet 1/0/5 Switch(Config-If-Ethernet1/0/5)#switchport mode trunk Switch(Config-If-Ethernet1/0/5)#switchport trunk native vlan 100 Switch(Config-If-Ethernet1/0/5)#exit

1.1.37 vlan
Command: vlan WORD no vlan WORD Function: Create VLANs and enter VLAN configuration mode. If using ';' and '-' connect with multi-VLANs, then only create these VLANs. If only existing VLAN, then enter VLAN configuration mode; if the VLAN is not exist, then create VLAN and enter VLAN configuration mode. In VLAN Mode, the user can set VLAN name and assign the switch ports to the VLAN. The no command deletes specified VLANs. Parameter: WORD is the VLAN ID to be created/deleted, valid range is 1 to 4094, connect with ';' and '-'. Command mode: Global Mode. Default: Only VLAN1 is set by default. Usage Guide: VLAN1 is the default VLAN and cannot be configured or deleted by the user. The maximal VLAN number is 4094. It should be noted that dynamic VLANs learnt by GVRP cannot be deleted by this command. Example: Create VLAN100 and enter the configuration mode for VLAN 100. Switch(config)#vlan 100 Switch(Config-Vlan100)#

1.1.38 vlan internal

Command: vlan <2-4094> internal Function: Specify the internal VLAN ID. After an ID is specified as the internal VLAN ID, it is not allowed to be used by other VLAN. Internal VLAN is only used to LOOPBACK interface and can not add physical port. New internal VLAN ID takes effect after save the configuration and reboot the switch. Parameter: <vlan-id>: The ID is specified as internal VLAN ID, the range is 2 to 4094. Command mode: Global Mode. Default: 1006. Usage Guide: Set 1006 as the default internal VLAN ID, the internal VLAN ID needs to be modified when the network set 1006 as VLAN ID. Internal VLAN ID must select an unused ID or else affect other VLAN. This command takes effect after save the configuration and reboot the switch. Example: Set 100 as the internal VLAN ID.

17

Commands for VLAN and MAC Address Configuration Switch(config)#vlan 100 internal

Chapter 1 VLAN Configuration

1.1.39 vlan ingress enable

Command: vlan ingress enable no vlan ingress enable Function: Enable the VLAN ingress filtering for a port; the no vlan ingress enable command disables the ingress filtering. Command mode: Port Mode Default: Enable VLAN ingress filtering function. Usage Guide: After VLAN ingress filtering is enabled on the port, when the system receives data it will check source port first, and forwards the data to the destination port if it is the VLAN member port, or else drop the data. Example: Disable VLAN ingress rules on the port. Switch(Config-If-Ethernet1/0/1)# no vlan ingress enable

1.1.40 vlan-translation
Command: vlan-translation <old-vlan-id> to <new-vlan-id> in no vlan-translation <old-vlan-id> in Function: Add VLAN translation by creating a mapping between original VLAN ID and current VLAN ID; the no form of this command deletes corresponding mapping. Parameter: old-vlan-id is the original VLAN ID; new-vlan-id is the translated VLAN ID; in indicates ingress translation. Command Mode: Port Mode. Default: There is no VLAN translation relation. Usage Guide: The command is for configuring the in and out translation relation of the VLAN translation function. The data packets will be matched according to the configured translation relations, and its VLAN ID will be changed to the one in the configured item once matched, while the vlan-translation miss drop command will determine the next forwarding if not match. Example: Move the VLAN100 data entered from the port1 to VLAN2 after ingress translation. Switch#config Switch(config)#interface ethernet 1/0/1 Switch(Config-If-Ethernet1/0/1)#vlan-translation enable Switch(Config-If-Ethernet1/0/1)#vlan-translation 100 to 2 in Switch(Config-If-Ethernet1/0/1)#exit Switch(config)#

1.1.41 vlan-translation enable

Command: vlan-translation enable

18

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

no vlan-translation enable Function: Enable VLAN translation on the port; the no command restores to the default value. Parameter: None. Command Mode: Port Mode. Default: VLAN translation has not been enabled on the port by default. Usage Guide: This command and dot1q-tunnel are mutually exclusive. Example: Enable VLAN translation function on port1. Switch#config Switch(config)#interface ethernet 1/0/1 Switch(Config-If-Ethernet1/0/1)#vlan-translation enable

1.1.42 vlan-translation miss drop

Command: vlan-translation miss drop in no vlan-translation miss drop in Function: Set packet dropping when checking vlan-translation is failing; the no command restores to the default value. Parameter: In refers to ingress. Command Mode: Port Mode. Default: Do not drop the packets when checking vlan-translation is failing. Usage Guide: When performing the mapping translation between the original and the current VID, if no corresponding translation is configured, the packet will not be dropped by default, but checking failure will drop the tag message after use this command, this command is of no effect for untag message. Example: Set ingress packet dropped on port1 when translation failure. Switch(Config-If-Ethernet1/0/1)#vlan-translation miss drop in

1.2 Commands for Dynamic VLAN Configuration 1.2.1 dynamic-vlan mac-vlan prefer
Command: dynamic-vlan mac-vlan prefer Function: Set the MAC-based VLAN preferred. Parameter: None. Command Mode: Global Mode. Default: MAC-based VLAN is preferred by default. Usage Guide: Configure the preference of dynamic-vlan on switch. The default priority sequence is MAC-based VLAN IP-subnet-based VLAN Protocol-based VLAN, namely the preferred order when several dynamic VLAN is available. After the IP-subnet-based VLAN is set to be preferred and the user wish to restore to preferring the MAC-based

19

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

VLAN, please use this command. Example: Set the MAC-based VLAN preferred. Switch#config Switch(config)#dynamic-vlan mac-vlan prefer

1.2.2 dynamic-vlan subnet-vlan prefer

Command: dynamic-vlan subnet-vlan prefer Function: Set the IP-subnet-based VLAN preferred. Parameter: None. Command Mode: Global Mode. Default: MAC-based VLAN is preferred by default. Usage Guide: Configure the preference of dynamic-vlan on switch. The default priority sequence is MAC-based VLAN IP-subnet-based VLAN Protocol-based VLAN, namely the preferred order when several dynamic VLAN is available. This command is used to set to preferring the IP-subnet-based VLAN. Example: Set the IP-subnet-based VLAN preferred. Switch#config Switch(config)#dynamic-vlan subnet-vlan prefer

1.2.3 mac-vlan
Command: mac-vlan mac <mac-addrss> vlan <vlan-id> priority <priority-id> no mac-vlan {mac <mac-addrss>|all} Function: Add the correspondence between MAC address and VLAN, namely specify certain MAC address to join specified VLAN. The no form of this command deletes all/the correspondence. Parameter: mac-address is the MAC address which is shown in the form of XX-XX-XXXX-XX-XX, vlan-id is the ID of the VLAN with a valid range of 1~4094; priority-id is the level of priority and is used in the VLAN tag with a valid range of 0~7 ; all refers to all the MAC addresses. Command Mode: Global Mode. Default: No MAC address joins the VLAN by default. Usage Guide: With this command user can add specified MAC address to specified VLAN. If there is a non VLAN label data packet enters from the switch port from the specified MAC address, it will be assigned with specified VLAN ID so sent enter specified VLAN. Their belonging VLAN are the same no matter which port did they enter through. The command does not have any interfere on the VLAN label data packet. Example: Add network device of MAC address as 00-03-0f-11-22-33 to VLAN 100. Switch#config Switch(config)#mac-vlan mac 00-03-0f-11-22-33 vlan 100 priority 0

20

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

1.2.4 mac-vlan vlan

Command: mac-vlan vlan <vlan-id> no mac-vlan vlan <vlan-id> Function: Configure the specified VLAN to MAC VLAN; the no mac-vlan vlan <vlanid> command cancels the MAC VLAN configuration of this VLAN. Parameter: <vlan-id> is the number of the specified VLAN. Command Mode: Global Mode. Default: No MAC VLAN is configured by default. Usage Guide: Set specified VLAN for MAC VLAN. Example: Set VLAN100 to MAC VLAN. Switch#config Switch(config)#mac-vlan vlan 100

1.2.5 protocol-vlan
Command: protocol-vlan mode {ethernetii etype <etype-id> | llc {dsap <dsap-id> ssap <ssap-id>} | snap etype <etype-id>} vlan <vlan-id> priority <priority-id> no protocol-vlan {mode {ethernetii etype <etype-id> | llc {dsap <dsapid> ssap <ssap-id>} | snap etype <etype-id>} | all} Function: Add the correspondence between the protocol and the VLAN namely specify the protocol to join specified VLAN. The no form of this command deletes all/the correspondence. Parameter: mode is the encapsulate type of the configuration which is ethernetii, llc, snap; the encapsulate type of the ethernetii is EthernetII; etype-id is the type of the packet protocol, with a valid range of 1536~65535; llc is LLC encapsulate format; dsapid is the access point of the destination service, the valid range is 0~255; ssap-id is the access point of the source service with a valid range of 0~255; snap is SNAP encapsulate format; etype-id is the type of the packet protocol, the valid range is 1536~65535; vlan-id is the ID of VLAN, the valid range is 1~4094; priority is the priority, the range is 0~7; all indicates all the encapsulate protocols. Command Mode: Global Mode. Default: No protocol joined the VLAN by default. Usage Guide: The command adds specified protocol into specified VLAN. If there is any non VLAN label packet from specified protocol enters through the switch port, it will be assigned with specified VLAN ID and enter the specified VLAN. No matter which port the packets go through, their belonging VLAN is the same. The command will not interfere with VLAN labeled data packets. It is recommended to configure ARP protocol together with the IP protocol or else some application may be affected. Example: Assign the IP protocol data packet encapsulated by the EthernetII to VLAN200. Switch#config Switch(config)#protocol-vlan mode ethernetii etype 2048 vlan 200 21

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

1.2.6 show dynamic-vlan prefer

Command: show dynamic-vlan prefer Function: Display the preference of the dynamic VLAN. Parameter: None. Command Mode: Admin Mode and Configuration Mode. Usage Guide: Display the dynamic VLAN preference. Example: Display current dynamic VLAN preference. Switch#show dynamic-vlan prefer Mac Vlan/Voice Vlan IP Subnet Vlan Protocol Vlan

1.2.7 show mac-vlan

Command: show mac-vlan Function: Display the configuration of MAC-based VLAN on the switch. Parameter: None. Command Mode: Admin Mode and other configuration Mode. Usage Guide: Display the configuration of MAC-based VLAN on the switch. Example: Display the configuration of the current MAC-based VLAN. Switch#show mac-vlan MAC-Address VLAN_ID Priority ---------------------------- -------00-e0-4c-77-ab-9d 2 2 00-0a-eb-26-8d-f3 2 2 00-03-0f-11-22-33 5 5

1.2.8 show mac-vlan interface

Command: show mac-vlan interface Function: Display the ports at MAC-based VLAN. Parameter: None. Command Mode: Admin Mode and other configuration Mode. Usage Guide: Display the ports of enabling MAC-based VLAN, the character in the bracket indicate the ports mode, A means Access port, T means Trunk port, H means Hybrid port. Example: Display the ports of enabling MAC-based VLAN currently. Switch#show mac-vlan interface Ethernet1/0/1(A) Ethernet1/0/2(A) Ethernet1/0/3(A) Ethernet1/0/4(A) Ethernet1/0/5(H) Ethernet1/0/6(T)

22

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

1.2.9 show protocol-vlan

Command: show portocol-vlan Function: Display the configuration of Protocol-based VLAN on the switch. Parameter: None. Command Mode: Admin Mode and Configuration Mode Usage Guide: Display the configuration of Protocol-based VLAN on the switch. Example: Display the configuration of the current Protocol-based VLAN. Switch#show protocol-vlan Protocol_Type VLAN_ID Priority --------------------------------------mode ethernetii etype 0x800 200 4 mode ethernetii etype 0x860 200 4 mode snap etype 0xabc 100 5 mode llc dsap 0xac ssap 0xbd 100 5

1.2.10 show subnet-vlan

Command: show subnet-vlan Function: Display the configuration of the IP-subnet-based VLAN on the switch. Parameter: None. Command Mode: Admin Mode and other Configuration Mode. Usage Guide: Display the configuration of the IP-subnet-based VLAN on the switch. Example: Display the configuration of the current IP-subnet-based VLAN. Switch#show subnet-vlan IP-Address Mask VLAN_ID -----------------------------192.168.1.165 255.255.255.0 2 202.200.121.21 255.255.0.0 2 10.0.0.1 255.248.0.0 5

1.2.11 show subnet-vlan interface

Command: show subnet-vlan interface Function: Display the port at IP-subnet-based VLAN. Parameter: None. Command Mode: Admin Mode and other Configuration Mode. Usage Guide: Display the port of enabling IP-subnet-based VLAN, the character in the bracket indicate the ports mode, A means Access port, T means Trunk port, H means Hybrid port. Example: Display the port of enabling IP-subnet-based VLAN currently. Switch#show subnet-vlan interface Ethernet1/0/1(A) Ethernet1/0/2(A) 23

Commands for VLAN and MAC Address Configuration Ethernet1/0/3(A) Ethernet1/0/5(H) Ethernet1/0/4(A) Ethernet1/0/6(T)

Chapter 1 VLAN Configuration

1.2.12 subnet-vlan
Command: subnet-vlan ip-address <ipv4-addrss> mask <subnet-mask > vlan <vlanid> priority <priority-id> no subnet-vlan {ip-address <ipv4-addrss> mask <subnet-mask> | all} Function: Add a correspondence between the IP subnet and the VLAN, namely add specified IP subnet into specified VLAN; the no form of this command deletes all/the correspondence. Parameter: ipv4-address is the IPv4 address shown in dotted decimal notation; the valid range of each section is 0~255; subnet-mask is the subnet mask code shown in dotted decimal notation; the valid range of each section is 0~255; priority-id is the priority applied in the VLAN tag with a valid range of 0~7; vlan-id is the VLAN ID with a valid range of 1~4094;all indicates all the subnets. Command Mode: Global Mode. Default: No IP subnet joined the VLAN by default. Usage Guide: This command is used for adding specified IP subnet to specified VLAN. When packet without VLAN label and from the specified IP subnet enters through the switch port, it will be matched with specified VLAN id and enters specified VLAN. These packets will always come to the same VLAN no matter through which port did they enter. This command will not interfere with VLAN labeled data packets. Example: Add the network equipment with IP subnet of 192.168.1.0/24 to VLAN 300. Switch#config Switch(config)#subnet-vlan ip-address 192.168.1.1 mask 255.255.255.0 vlan 300 priority 0

1.2.13 switchport mac-vlan enable

Command: switchport mac-vlan enable no switchport mac-vlan enable Function: Enable the MAC-based VLAN function on the port; the no form of this command will disable the MAC-based VLAN function on the port. Parameter: None. Command Mode: Port Mode. Default: The MAC-base VLAN function is enabled on the port by default. Usage Guide: After adding a MAC address to specified VLAN, the MAC-based VLAN function will be globally enabled. This command can disable the MAC-based VLAN function on specified port to meet special user applications. Example: Disable the MAC-based VLAN function on port1. Switch#config Switch(config)#interface ethernet 1/0/1

24

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

Switch(Config-If-Ethernet1/0/1)#no switchport mac-vlan enable

1.2.14 switchport subnet-vlan enable

Command: switchport subnet-vlan enable no switchport subnet-vlan enable Function: Enable the IP-subnet-based VLAN on the port; the no form of this command disables the IP-subnet-based VLAN function on the port. Parameter: None. Command Mode: Port Mode. Default: The IP-subnet-based VLAN is enabled on the port by default. Usage Guide: After adding the IP subnet to specified VLAN, the IP-subnet-based VLAN function will be globally enabled. This command can disable the IP-subnet-based VLAN function on specified port to meet special user applications. Example: Disable the IP-subnet-based VLAN function on port1. Switch#config Switch(config)#interface ethernet 1/0/1 Switch(Config-If-Ethernet1/0/1)#no switchport subnet-vlan enable

1.3 Commands for Voice VLAN Configuration 1.3.1 show voice-vlan

Command: show voice-vlan Function: Display the configuration status of the Voice VLAN on the switch. Parameter: None. Command Mode: Admin Mode and other Configuration Mode. Usage Guide: Display Voice VLAN Configuration. Example: Display the Current Voice VLAN Configuration. Switch#show voice-vlan Voice VLAN ID:2 Ports:ethernet1/0/1;ethernet1/0/3 Voice name MAC-Address Mask Priority ---------------- --------------------------------financePhone 00-e0-4c-77-ab-9d 0xff 5 manager 00-0a-eb-26-8d-f3 0xfe 6 Mr_Lee 00-03-0f-11-22-33 0x80 5 NULL 00-03-0f-11-22-33 0x0 5

1.3.2 switchport voice-vlan enable

25

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

Command: switchport voice-vlan enable no switchport voice-vlan enable Function: Enable the Voice VLAN function on the port; the no form of this command disables Voice VLAN function on the port. Parameter: None. Command Mode: Port Mode. Default: Voice VLAN is enabled by default. Usage Guide: When voice equipment is added to the Voice VLAN, the Voice VLAN is enabled globally by default. This command disables Voice VLAN on specified port to meet specified application of the user. Example: Disable the Voice VLAN function on port3. Switch#config Switch(config)#interface ethernet 1/0/3 Switch(Config-If-Ethernet1/0/3)#no switchport voice-vlan enable

1.3.3 voice-vlan
Command: voice-vlan mac <mac-address> mask <mac-mask> priority <priority-id> [name <voice-name>] no voice-vlan {mac <mac-address> mask <mac-mask> | name <voice-name> | all} Function: Specify certain voice equipment to join in Voice VLAN; the no form of this command will let the equipment leave the Voice VLAN. Parameter: Mac-address is the voice equipment MAC address, shown in xx-xx-xx-xxxx-xx format; mac-mask is the last eight digit of the mask code of the MAC address, the valid values are: 0xff, 0xfe, 0xfc, 0xf8, 0xf0, 0xe0, 0xc0,0x80, 0x0; priority-id is the priority of the voice traffic, the valid range is 07; the voice-name is the name of the voice equipment, which is to facilitate the equipment management; all indicates all the MAC addresses of the voice equipments. Command Mode: Global Mode. Default: This command will add a specified voice equipment into the Voice VLAN, if a non VLAN labeled data packet from the specified voice equipment enters through the switch port, then no matter through which port the packet enters, it will belongs to Voice VLAN. The command will not interfere with the packets of VLAN labels. Example: Add the 256 sets of voice equipments of the R&D department with MAC address ranging from 00-03-0f-11-22-00 to 00-03-0f-11-22-ff to the Voice VLAN. Switch#config Switch(config)#voice-vlan vlan 100 Switch(config)#voice-vlan mac 00-03-0f-11-22-00 mask 0 priority 5 name test

1.3.4 voice-vlan vlan

Command: voice-vlan vlan <vlan-id>

26

Commands for VLAN and MAC Address Configuration

Chapter 1 VLAN Configuration

no voice-vlan Function: Configure the specified VLAN to Voice VLAN; the no voice-vlan command cancels the Voice VLAN configuration of this VLAN. Parameter: Vlan id is the number of the specified VLAN. Command Mode: Global Mode. Default: No Voice VLAN is configured by default. Usage Guide: Set specified VLAN for Voice VLAN, There can be only one Voice VLAN at the same time. The voice VLAN can not be applied concurrently with MAC-based VLAN. Example: Set VLAN100 to Voice VLAN. Switch#config Switch(config)#voice-vlan vlan 100

27

Commands for VLAN and MAC Address Configuration

Chapter 2 Commands for MAC Address Table Configuration

Chapter 2 Commands for MAC Address Table Configuration

2.1 Commands for MAC Address Table Configuration 2.1.1 clear mac-address-table dynamic
Command: clear mac-address-table dynamic [address <mac-addr>] [vlan <vlanid>] [interface [ethernet | portchannel] <interface-name>] Function: Clear the dynamic address table. Parameter: <mac-addr>: MAC address will be deleted; <interface-name> the port name for forwarding the MAC packets; <vlan-id> VLAN ID. Command mode: Admin mode. Usage Guide: Delete all dynamic address entries which exist in MAC address table, except application, system entries. MAC address entries can be classified according to different sources, the types are as follows: DYNAMIC, STATIC, APPLICATION, SYSTEM. DYNAMIC is the dynamic MAC address entries learned by switch, it can be aged by switch automatically. Example: Delete all dynamic MAC. Switch#clear mac-address-table dynamic

2.1.2 mac-address-table aging-time

Command: mac-address-table aging-time <0 | aging-time> no mac-address-table aging-time Function: Sets the aging-time for the dynamic entries of MAC address table. Parameter: <aging-time> is the aging-time seconds, range from 10 to 1000000; 0 to disable aging. Command Mode: Global Mode. Default: Default aging-time is 300 seconds. Usage Guide: If no destination address of the packets is same with the address entry in aging-time, the address entry will get aged. The user had better set the aging-time according to the network condition, it usually use the default value. Example: Set the aging-time to 600 seconds. Switch(config)#mac-address-table aging-time 600

Commands for VLAN and MAC Address Configuration

Chapter 2 Commands for MAC Address Table Configuration

2.1.3 mac-address-table static | static-multicast | blackhole

Command: mac-address-table {static | static-multicast | blackhole} address <macaddr> vlan <vlan-id> [interface [ethernet | portchannel] <interface-name>] | [source | destination | both] no mac-address-table {static | static-multicast | blackhole | dynamic} [address <mac-addr>] [vlan <vlan-id>] [interface [ethernet | portchannel] <interface-name>] Function: Add or modify static address entries, static multicast entries and filter address entries. The no command deletes the three entries. Parameter: static is the static entries; static-multicast is the static multicast entries; blackhole is filter entries, which is for discarding frames from specific MAC address, it can filter source address, destination address or the both. When choose the filter entries, blackhole address cant based on port, and not configure to interface; dynamic is dynamic address entries; <mac-addr> MAC address to be added or deleted; <interfacename> name of the port transmitting the MAC data packet; <vlan-id> is the vlan number. source is based on source address filter; destination is based on destination address filter; both is based on source address and destination address filter, the default is both. Command Mode: Global Mode Default: When VLAN interface is configured and is up, the system will generate a static address mapping entry of which the inherent MAC address corresponds to the VLAN number. Usage Guide: In certain special applications or when the switch is unable to dynamically learn the MAC address, users can use this command to manually establish mapping relation between the MAC address and port and VLAN. no mac-address-table command is for deleting all dynamic, static, filter MAC address entries existing in the switch MAC address list, except application, system entries. MAC address entries can be classified according to the different source, the types are as follows: DYNAMIC, STATIC, APPLICATION, SYSTEM. DYNAMIC is the dynamic MAC address entries learned by switch, it can be aged by switch automatically. STATIC is the static MAC address entries (including blackhole entries) added by user. APPLICATION is the static MAC address entries added by application protocol (such as dot1x, security port). SYSTEM is the additive static MAC address entries according to VLAN interface. When adding STATIC entries, it can cover the conflictive DYNAMIC, except APPLICATION, SYSTEM entries. After configure the static multicast MAC by this command, the multicast MAC traffic will be forwarded to the specified port of the specified VLAN. Example: Port 1/0/1 belongs to VLAN200, and establishes address mapping with MAC address 00-03-0f-f0-00-18. Switch(config)#mac-address-table static address 00-03-0f-f0-00-18 vlan 200 interface ethernet 1/0/1

Commands for VLAN and MAC Address Configuration

Chapter 2 Commands for MAC Address Table Configuration

Configure a static multicast MAC 01-00-5e-00-00-01, the egress is ehernet 1/0/1. Switch(config)#mac-address-table static-multicast address 01-00-5e-00-00-01 vlan 1 interface ethernet1/0/1

2.1.4 show mac-address-table

Command: show mac-address-table [static | blackhole | multicast | aging-time <aging-time> | count] [address <mac-addr>] [vlan <vlan-id>] [count] [interface <interface-name>] Function: Show the current MAC table. Parameter: static static entries; blackhole filter entries; aging-time <aging-time> address aging time; count entrys number, multicast multicast entries; <mac-addr> entrys MAC address; <vlan-id> entrys VLAN number; <interface-name> entrys interface name. Command mode: Admin and Configuration Mode. Default: MAC address table is not displayed by default. Usage guide: This command can display various classes of MAC address entries. Users can also use show mac-address-table to display all the MAC address entries. Example: Display all the filter MAC address entries. Switch#show mac-address-table blackhole

2.2 Commands for Mac Address Binding configuration 2.2.1 clear port-security dynamic
Command: clear port-security dynamic [address <mac-addr> | interface <interfaceid>] Function: Clear the Dynamic MAC addresses of the specified port. Command mode: Admin Mode. Parameter: <mac-addr> stands MAC address; <interface-id> for specified port number. Usage Guide: The secure port must be locked before dynamic MAC clearing operation can be perform in specified port. If no ports and MAC are specified, then all dynamic MAC in all locked secure ports will be cleared; if only port but no MAC address is specified, then all MAC addresses in the specified port will be cleared. Example: Delete all dynamic MAC in port1. Switch#clear port-security dynamic interface Ethernet 1/0/1

2.2.2 mac-address-table periodic-monitor-time

Command: mac-address-table periodic-monitor-time <5-86400> Function: Set the MAC monitor interval to count the added and deleted MAC in time, and send out them with trap message. 3

Commands for VLAN and MAC Address Configuration

Chapter 2 Commands for MAC Address Table Configuration

Parameter: <5-86400>: the interval is 5 to 86400 seconds. Command mode: Global Mode. Default: 60 seconds. Usage Guide: Example: Set the MAC monitor interval as 120 seconds. Switch(Config)#mac-address-table periodic-monitor-time 120

2.2.3 mac-address-table trap enable

This command is not supported by the switch.

2.2.4 mac-address-table synchronizing enable

This command is not supported by the switch.

2.2.5 show port-security

Command: show port-security Function: Display the secure MAC addresses of the port. Command mode: Admin and Configuration Mode. Default: The switch is not display port-security configuration. Usage Guide: This command displays the secure port MAC address information. Example: Switch#show port-security Security Port MaxSecurity Addr CurrentAddr Security Action (count) (count) ----------------------------------------------------------------------------------------------------Ethernet1/0/1 1 1 Protect Ethernet1/0/3 10 1 Protect Ethernet1/0/5 1 0 Protect ----------------------------------------------------------------------------------------------------Max Addresses limit in System:128 Total Addresses in System:2 Displayed information Security Port MaxSecurityAddr CurrentAddr Security Action Total Addresses in System Explanation Is port enabled as a secure port. The maximum secure MAC address number set for the security port. The current secure MAC address number of the security port. The violation mode of the port configuration. The current secure MAC address number of the system. 4

Commands for VLAN and MAC Address Configuration Max Addresses System limit in

Chapter 2 Commands for MAC Address Table Configuration The maximum secure MAC address number of the system.

2.2.6 show port-security address

Command: show port-security address [interface <interface-id>] Function: Display the secure MAC addresses of the port. Command mode: Admin and Configuration Mode. Parameter: <interface-id> stands for the port to be displayed. Usage Guide: This command displays the secure port MAC address information, if no port is specified, secure MAC addresses of all ports are displayed. The following is an example: Switch#show port-security address interface ethernet 1/0/3 Security Mac Address Table -------------------------------------------------------------------------------------------------Vlan Mac Address Type Ports 1 0000.0000.1111 SecureConfigured Ethernet1/0/1 -------------------------------------------------------------------------------------------------Total Addresses: 1 Displayed information Vlan Mac Address Type Ports Total Addresses Explanation The VLAN ID for the secure MAC Address. Secure MAC address. Secure MAC address type. The port that the secure MAC address belongs to. Current secure MAC address number in the system.

2.2.7 show port-security interface

Command: show port-security interface <interface-id> Function: Display the configuration of secure port. Command mode: Admin and Configuration Mode. Parameter: <interface-id> stands for the port to be displayed. Default: Configuration of secure ports is not displayed by default. Usage Guide: This command displays the detailed configuration information for the secure port. Example: Switch#show port-security interface ethernet 1/0/1 Port Security: Enabled Port status: Security Up 5

Commands for VLAN and MAC Address Configuration Violation mode: Protect Maximum MAC Addresses: 1 Total MAC Addresses: 1 Configured MAC Addresses: 1 Lock Timer is ShutDown Mac-Learning function is: Opened Displayed information Port Security Port status Violation mode Maximum MAC Addresses Total MAC Addresses Configured MAC Addresses Lock Timer Mac-Learning function

Chapter 2 Commands for MAC Address Table Configuration

Explanation Is port enabled as a secure port. Port secure status. Violation mode set for the port. The maximum secure number set for the port. MAC address

Current secure MAC address number for the port. Current secure static MAC address number for the port. Whether locking timer (timer timeout) is enabled for the port. Whether the MAC function is enabled. address learning

2.2.8 switchport port-security

Command: switchport port security no switchport port security Function: Enable MAC address binding function for the port; the no command disables the MAC address binding function for the port. Command mode: Port Mode. Default: MAC address binding is not enabled by default. Usage Guide: The MAC address binding function and Port Aggregation functions are mutually exclusive. Therefore, if MAC binding function for a port is to be enabled, the Port Aggregation functions must be disabled, and the port enabling MAC address binding must not be a Trunk port. Example: Enable MAC address binding function for port 1. Switch(config)#interface Ethernet 1/0/1 Switch(Config-If-Ethernet1/0/1)#switchport port security

2.2.9 switchport port-security convert

Command: switchport port-security convert Function: Converts dynamic secure MAC addresses learned by the port to static secure MAC addresses, and disables the MAC address learning function for the port. 6

Commands for VLAN and MAC Address Configuration

Chapter 2 Commands for MAC Address Table Configuration

Command mode: Port Mode. Usage Guide: The port dynamic MAC convert command can only be executed after the secure port is locked. After this command has been executed, dynamic secure MAC addresses learned by the port will be converted to static secure MAC addresses. The command does not reserve the configuration. Example: Converting MAC addresses in port 1 to static secure MAC addresses. Switch(config)#interface Ethernet 1/0/1 Switch(Config-If-Ethernet1/0/1)#switchport port-security convert

2.2.10 switchport port-security lock

Command: switchport port-security lock no switchport port-security lock Function: Lock the port. After the port is locked, the MAC-address learning function will be shut down; the no operation of this command will reset the MAC-address learning function. Command Mode: Port Configuration Mode. Default: Ports are unlocked. Usage Guide: Ports can only be locked after the MAC-address binding function is enabled. When a port becomes locked, its MAC learning function will be disabled. Examples: Lock port 1. Switch(config)#interface Ethernet 1/0/1 Switch(Config-If-Ethernet1/0/1)#switchport port-security lock

2.2.11 switchport port-security mac-address

Command: switchport port-security mac-address <mac-address> no switchport port-security mac-address <mac-address> Function: Add a static secure MAC address; the no command deletes a static secure MAC address. Command mode: Port Mode. Parameters: <mac-address> stands for the MAC address to be added or deleted. Usage Guide: The MAC address binding function must be enabled before static secure MAC address can be added. Example: Adding MAC 00-03-0F-FE-2E-D3 to port1. Switch(config)#interface Ethernet 1/0/1 Switch(Config-If-Ethernet1/0/1)#switchport port-security mac-address 00-03-0F-FE-2ED3

2.2.12 switchport port-security maximum

Command: switchport port-security maximum <value> no switchport port-security maximum

Commands for VLAN and MAC Address Configuration

Chapter 2 Commands for MAC Address Table Configuration

Function: Sets the maximum number of secure MAC addresses for a port; the no command restores the maximum secure address number of 1. Command mode: Port Mode. Parameter: < value> is the up limit for static secure MAC address, the valid range is 1 to 128. Default: The default maximum port secure MAC address number is 1. Usage Guide: The MAC address binding function must be enabled before maximum secure MAC address number can be set. If secure static MAC address number of the port is larger than the maximum secure MAC address number set, the setting fails; extra secure static MAC addresses must be deleted, so that the secure static MAC address number is no larger than the maximum secure MAC address number for the setting to be successful. Example: Set the maximum secure MAC address number as 4 for port1. Switch(config)#interface Ethernet 1/0/1 Switch(Config-If-Ethernet1/0/1)#switchport port-security maximum 4

2.2.13 switchport port-security timeout

Command: switchport port-security timeout <value> no switchport port-security timeout Function: Set the timer for port locking; the no command restores the default setting. Parameter: <value> is the timeout value, the valid range is 0 to 300s. Command mode: Port Mode. Default: Port locking timer is not enabled by default. Usage Guide: The port locking timer function is a dynamic MAC address locking function. MAC address locking and conversion of dynamic MAC entries to secure address entries will be performed on locking timer timeout. The MAC address binding function must be enabled prior to running this command. Example: Set port1 locking timer to 30 seconds. Switch(config)#interface Ethernet 1/0/1 Switch(Config-If-Ethernet1/0/1)#switchport port-security timeout 30

2.2.14 switchport port-security violation

Command: switchport port-security violation {protect | shutdown} [recovery <303600>] no switchport port-security violation Function: Configure the port violation mode. The no restores the violation mode to protect. Command Mode: Port mode. Parameter: protect refers to protect mode shutdown refers to shutdown mode recovery: configure the border port can be recovered automatically after

Commands for VLAN and MAC Address Configuration

Chapter 2 Commands for MAC Address Table Configuration

implement shutdown violation operation <30-3600>: the recovery time, do not recover it by default Default: The port violation mode is protect by default. Usage Guide: The port violation mode configuration is only available after the MAC address binding function is enabled. when the port secure MAC address exceeds the security MAC limit, if the violation mode is protect, the port only disable the dynamic MAC address learning function; while the port will be shut if at shutdown mode. Users can manually open the port with no shutdown command. Example: Set the violation mode of port 1 to shutdown. Switch(config)#interface Ethernet 1/0/1 Switch(Config-If-Ethernet1/0/1)#switchport port-security violation shutdown recovery 60