Cisco 300 Series Managed Switches Administration Guide ...

1 Cisco 300 Series Managed Switches Administra-tion GuideADMINISTRATION Guide Cisco 300 Series Managed Switches Administration Guide 22 Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the and other countries. To view a list of Cisco trademarks, go to this URL: Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R) Cisco 300 Series Managed Switches Administration Guide 1 ContentsChapter 2: Getting Started10 Starting the Web-based Configuration Utility10 Quick Start Device Configuration14 Interface Naming Conventions 14 Window Navigation16 Chapter 3: Status and Statistics20 System Summary 20 Ethernet Interfaces20 Etherlike Statistics22 GVRP EAP Statistics 24 ACL Statistics25 TCAM Utilization25 Health26 RMON26 View Log33 Chapter 4: Administration : System Log34 Setting System Log Settings34 Setting Remote Logging Settings36 Viewing Memory Logs37 Chapter 5: Administration : File Management39 System Files39 Upgrade/Backup Firmware/Language42 Active Image 45 Download/Backup Configuration/Log46 Configuration Files Properties50 Copy/Save Configuration51 Cisco 300 Series Managed Switches Administration Guide 2 ContentsAuto Configuration/Image Update via DHCP5261 Chapter 6.

2 Administration62 Device Models63 System Settings65 Console Settings (Autobaud Rate Support)68 Management Interface68 User Accounts68 Defining Idle Session Timeout 69 Time Settings69 System Log69 File Management69 Rebooting the Device 70 Routing Resources71 Health73 Diagnostics74 Discovery - Bonjour74 Discovery - LLDP74 Discovery - CDP75 Ping75 Traceroute76 Chapter 7: Administration : Time Settings78 System Time Options78 SNTP Modes80 configuring System Time80 Chapter 8: Administration : Diagnostics 89 Copper Ports Tests89 Cisco 300 Series Managed Switches Administration Guide 3 ContentsDisplaying Optical Module Status91 configuring Port and VLAN Mirroring92 Viewing CPU Utilization and Secure Core Technology94 Chapter 9: Administration : Discovery95 Bonjour95 LLDP and CDP97 configuring LLDP98 configuring CDP117 CDP Statistics124 Chapter 10: Port Management125 configuring Ports125 Loopback Detection130 Link Aggregation132 UDLD139 PoE139 configuring Green Ethernet139 Chapter 11: Port Management: Unidirectional Link Detection146 UDLD Overview146 UDLD Operation147 Usage Guidelines149 Dependencies On Other Features149 Default Settings and Configuration150 Before You Start150 Common UDLD Tasks150 configuring UDLD151 Chapter 12: Smartport155 Cisco 300 Series Managed Switches Administration Guide 4 ContentsOverview156 What is a Smartport156 Smartport Types157 Smartport Macros159 Macro Failure and the Reset Operation160 How the Smartport Feature Works161 Auto Smartport161 Error Handling165 Default Configuration165 Relationships with Other Features and Backwards Compatibility166 Common Smartport Tasks166 configuring Smartport Using The Web-based Interface168 Built-in Smartport Macros173 Chapter 13: Port Management: PoE 184 PoE on the Device184 PoE Properties187 PoE Settings188 Chapter 14.

3 VLAN Management191 Overview191 Regular VLANs199 Private VLAN Settings206 GVRP Settings207 VLAN Groups208 voice VLAN210 Access Port Multicast TV VLAN222 Customer Port Multicast TV VLAN225 Chapter 15: Spanning Tree228 Cisco 300 Series Managed Switches Administration Guide 5 ContentsSTP Flavors228 STP Status and Global Settings229 Spanning Tree Interface Settings231 Rapid Spanning Tree Settings233 Multiple Spanning Tree235 MSTP Properties235 vlans to a MSTP Instance 236 MSTP Instance Settings237 MSTP Interface Settings238 Chapter 16: Managing MAC Address Tables241 Static MAC Addresses242 Dynamic MAC Addresses243 Reserved MAC Addresses244 Chapter 17: Multicast245 Multicast Forwarding245 Multicast Properties250 MAC Group Address250IP Multicast Group Addresses252 IPv4 Multicast Configuration253 IPv6 Multicast Configuration256 IGMP/MLD Snooping IP Multicast Group259 Multicast Router Ports260 Forward All260 Unregistered Multicast261 Chapter 18: IP Configuration263 Overview263 IPv4 Management and Interfaces266 Cisco 300 Series Managed Switches Administration Guide 6 ContentsDHCP Server283 IPv6 Management and Interfaces291 Domain Name304 Chapter 19: Security309 Defining Users310 configuring TACACS+313 configuring RADIUS317 Management Access Method321 Management Access Authentication326 Secure Sensitive Data Management327 SSL Server327 SSH Server329 SSH Client330 configuring TCP/UDP Services330 Defining Storm Control331 configuring Port Security of Service Prevention 334 DHCP Snooping343IP Source Guard343 ARP Inspection347 First Hop Security352 Chapter 20: Security: Authentication353 Overview of Overview356 Common Configuration Through the GUI366 Defining Time Ranges375 Cisco 300 Series Managed Switches Administration Guide 7 ContentsAuthentication Method and Port Mode Support376 Chapter 21: Security.

4 IPv6 First Hop Security379 IPv6 First Hop Security Overview380 Router Advertisement Guard384 Neighbor Discovery Inspection384 DHCPv6 Guard385 Neighbor Binding Integrity385 IPv6 Source Guard388 Attack Protection389 Policies, Global Parameters and System Defaults390 Common Tasks392 Default Settings and Configuration394 Before You Start394 configuring IPv6 First Hop Security through Web GUI395 Chapter 22: Security: Secure Sensitive Data Management411 Introduction 411 SSD Rules412 SSD Properties417 Configuration Files419 SSD Management Channels423 Menu CLI and Password Recovery 424 configuring SSD424 Chapter 23: Security: SSH Client428 Secure Copy (SCP) and SSH428 Protection Methods429 SSH Server Authentication430 SSH Client Authentication431 Cisco 300 Series Managed Switches Administration Guide 8 ContentsBefore You Begin432 Common Tasks432 SSH Client Configuration Through the GUI434 Chapter 24: Security: SSH Server438 Overview438 Common Tasks438 SSH Server Configuration Pages439 Chapter 25: Access Control443 Access Control Lists443 MAC-based ACLs446 IPv4-based ACLs448 IPv6-Based ACLs453 ACL Binding456 Chapter 26: Quality of Service 459 QoS Features and Components460 configuring QoS - General462 QoS Basic Mode471 QoS Advanced Mode473 Managing QoS Statistics483 Chapter 27.

5 SNMP487 SNMP Versions and Workflow487 Model OIDs490 SNMP Engine ID491 configuring SNMP Views493 Creating SNMP Groups 494 Managing SNMP Users496 Cisco 300 Series Managed Switches Administration Guide 9 ContentsDefining SNMP Communities497 Defining Trap Settings499 Notification Recipients499 SNMP Notification Filters5031 Cisco 300 Series Managed Switches Administration Guide10 Getting StartedThis section provides an introduction to the web-based configuration utility, and covers the following topics: Starting the Web-based Configuration Utility Quick Start Device Configuration Interface Naming Conventions Window NavigationStarting the Web-based Configuration UtilityThis section describes how to navigate the web-based switch configuration utility. If you are using a pop-up blocker, make sure it is RestrictionsIf you are using IPv6 interfaces on your management station, use the IPv6 global address and not the IPv6 link local address to access the device from your the Configuration UtilityTo open the web-based configuration utility:STEP 1 Open a Web 2 Enter the IP address of the device you are configuring in the address bar on the browser, and then press StartedStarting the Web-based Configuration Utility11 Cisco 300 Series Managed Switches Administration Guide1 NOTEWhen the device is using the factory default IP address of , its power LED flashes continuously.

6 When the device is using a DHCP-assigned IP address or an administrator-configured static IP address, the power LED is on In The default username is Cisco and the default password is Cisco . The first time that you log in with the default username and password, you are required to enter a new you have not previously selected a language for the GUI, the language of the Login page is determined by the language(s) requested by your browser and the languages configured on your device. If your browser requests Chinese, for example, and Chinese has been loaded into your device, the Login page is automatically displayed in Chinese. If Chinese has not been loaded into your device, the Login page appears in languages loaded into the device have a language and country code (en-US, en-GB and so on). For the Login page to be automatically displayed in a particular language, based on the browser request, both the language and country code of the browser request must match those of the language loaded on the device.

7 If the browser request contains only the language code without a country code (for example: fr). The first embedded language with a matching language code is taken (without matching the country code, for example: fr_CA).To log in to the device configuration utility:STEP 1 Enter the username/password. The password can contain up to 64 ASCII characters. Password-complexity rules are described in Setting Password Complexity Rules. STEP 2If you are not using English, select the desired language from the Language drop-down menu. To add a new language to the device or update a current one, see Upgrade/Backup 3If this is the first time that you logged on with the default user ID ( Cisco ) and the default password ( Cisco ) or your password has expired, the Change Password Page appears. See Password Expiration for additional 4 Choose whether to select Disable Password Complexity Enforcement or not. For more information on password complexity, see the Setting Password Complexity Rules 5 Enter the new password and click StartedStarting the Web-based Configuration UtilityCisco 300 Series Managed Switches Administration Guide121 When the login attempt is successful, the Getting Started page you entered an incorrect username or password, an error message appears and the Login page remains displayed on the window.

8 If you are having problems logging in, please see the Launching the Configuration Utility section in the Administration Guide for additional Don't show this page on startup to prevent the Getting Started page from being displayed each time that you log on to the system. If you select this option, the System Summary page is opened instead of the Getting Started can either open an HTTP session (not secured) by clicking Log In, or you can open an HTTPS (secured) session, by clicking Secure Browsing (HTTPS). You are asked to approve the logon with a default RSA key, and an HTTPS session is is no need to input the username/password prior to clicking the Secure Browsing (HTTPS) information on how to configure HTTPS, see SSL ExpirationThe New Password page is displayed in the following cases: The first time that you access the device with the default username Cisco and password Cisco . This page forces you to replace the factory default password. When the password expires, this page forces you to select a new Out By default, the application logs out after ten minutes of inactivity.

9 You can change this default value as described in the Defining Idle Session Timeout section. !CAUTIONU nless the Running Configuration is copied to the Startup Configuration, rebooting the device removes all changes made since the last time the file was saved. Save the Running Configuration to the Startup Configuration before logging off to preserve any changes you made during this session. A flashing red X icon to the left of the Save application link indicates that Running Getting StartedStarting the Web-based Configuration Utility13 Cisco 300 Series Managed Switches Administration Guide1 Configuration changes have not yet been saved to the Startup Configuration file. The flashing can be disabled by clicking on the Disable Save Icon Blinking button on the Copy/Save Configuration pageWhen the device auto-discovers a device, such as an IP phone (see What is a Smartport), and it configures the port appropriately for the device. These configuration commands are written to the Running Configuration file.

10 This causes the Save icon to begin blinking when the you log on, even though you did not make any configuration you click Save, the Copy/Save Configuration page appears. Save the Running Configuration file by copying it to the Startup Configuration file. After this save, the red X icon and the Save application link are no longer l o g o u t , c l i c k Logout in the top right corner of any page. The system logs out of the a timeout occurs or you intentionally log out of the system, a message is displayed and the Login page appears, with a message indicating the logged-out state. After you log in, the application returns to the initial page. The initial page displayed depends on the Do not show this page on startup option in the Getting Started page. If you did not select this option, the initial page is the Getting Started page. If you did select this option, the initial page is the System Summary StartedQuick Start Device ConfigurationCisco 300 Series Managed Switches Administration Guide141 Quick Start Device ConfigurationTo simplify device configuration through quick navigation, the Getting Started page provides links to the most commonly used are two hot links on the Getting Started page that take you to Cisco web pages for more information.