Professional Documents
Culture Documents
2
Connecting Via Console Cable
Connect the Male DB-9 Serial Console port to the Male DB-9 Serial Port
of a PC using a straight through cable. The serial communications is
9600 Baud, 8 bits, parity none, 1 stop bit, and no flow control.
Using the Command Line Interface
There are three modes: non-privileged, privileged, and configuration. In
order to execute commands to configure, reload, upgrade, etc, you must
be in privilege mode. For help at any time, press <tab> or <?>.
Commands may be abbreviated to the extent that no other command is
recognized by the abbreviated command. To remove a configuration
statement, use no in front of it. There is a start-up configuration and a
running configuration. To commit changes so they are not lost during
power failure or a reload, issue write memory. To view the start-up
configuration, type show configuration. To view the running
configuration, type show run
CLI Navigation Example:
FES4802> enable
Password: *********
FES4802# show run (output not shown)
FES4802# configure terminal
FES4802(config)#hostname MySwitch
MySwitch(config)#no hostname
FES4802(config)#exit
FES4802#wr m
Setting IP Address and default gateway on a switch
Notes: This is for a device running switch code. For devices in Layer-3
mode, refer to Configuring Router Interfaces or Configuring Virtual
Router Interfaces to assign an IP. To assign a default-grateway on a
router, use ip route 0.0.0.0/0 192.168.10.1
Troubleshooting: show ip
Configuration Example:
ip address 192.168.10.2/24
ip default-gateway 192.168.10.1
Password Recovery
Prerequisites: Must have physical access to the switch and console port
Notes: Press b within 3-seconds of power-cycling the switch to enter
the boot prompt. This removes passwords in the running configuration,
so be sure to set passwords. Alternatively, you can reset the
configuration to factory defaults by replacing the command no
password with use default. This only effects the running configuration,
so be sure to write mem or erase start once youre into the CLI.
Example:
Boot>no password
Boot>boot system flash primary
Upgrading software
Prerequisites: Refer to the release notes for specific upgrade
procedures and requirements
Notes: For most devices, there is boot code, monitor code, and a
running image. You can store two versions on the device at a time.
Troubleshooting: show flash
Typical File names: (First two letters is device type, third letter is code
type. Remaining digits is the version number)
FEB = Boot
FEM = Monitor
FES = Switch
Example:
Securing Telnet
Prerequisites: Standard ACL created (optional) and user (if using
enable telnet authentication, see example for creating users in Enabling
SSH)
Notes: Typically for security, telnet is disabled; however in addition to
disabling it (no telnet server), it is advised to secure it as if it was
enabled, just incase someone inadvertently turns it on.
Configuration Example:
telnet access-group 10
telnet timeout 10
enable telnet authentication
Securing Web Access
Prerequisites: Standard ACL created (optional) and user (if using aaa
authentication, see example for creating users in Enabling SSH)
Notes: By default, the web-server responds and can be authenticated
using user get and the read-only SNMP community string as the
password. Alternatively, if a read-write community string is created, it can
be accessed via set and the read-write community string. Changing the
aaa authentication method will change this behavior. Also, it is advised to
change access from http to https or disable it all together with no webmanagement http
Configuration Example:
crypto-ssl cert generate
no web-management http
web-management https
web access-group 10
aaa authentication web-server default local
Dual-Mode Ports
Prerequisites: VLANs created with ports assigned.
Notes: In some situations, like connecting to a Cisco device or VoIP
device, traffic may appear on an interface both tagged and untagged. For
example, Cisco native vlan will not have a VLAN tag on a Cisco 802.1Q
link. A port that is dual-mode, will send/receive untagged packets and
place it into the appropriate VLAN while also accepting normal tagged
traffic.
Configuration Example (Edge Device):
vlan 10 name Voice
tagged e 1
vlan 20 name Data
tagged e 1
int e 1
dual-mode 20 !Untagged traffic goes to VLAN 20
Configuration Example (Core Devices):
vlan 10 name Voice
tagged e 1/1
vlan 20 name Data
untagged e 1/1 !--- Port can only be untagged for one vlan
! By default, ports will remain untagged in the default vlan as
! you tag them into other vlans unless you remove them
! individually:
vlan 1
no untagged e 1/1
! or to stop that behavior globally (v3.7.0 and greater)
no dual-mode-default-vlan
Per VLAN Spanning Tree
Prerequisites: VLAN created with ports assigned
Notes: By default, devices running switch code have Per-VLAN STP
running. Devices running router code do not. Default spanning tree
priority is 32768.
Caveats: None
Troubleshooting: show spanning-tree
Configuration Example:
vlan 10
spanning-tree
spanning-tree priority 256
Configuring OSPF
Prerequisites: Switch is running Full Layer-3 code and IP address are
already assigned to interface or virtual interfaces
Notes: Passive interface do not transmit OSPF hellos. This is for
security on subnets that dont have neighboring routers. Additionally,
consider MD5 authentication of neighbors (example not show).
Configuring a loopback interface is recommended as the router-id for
OSPF.
Troubleshooting: show ip ospf
Configuration Example:
interface loopback 1
ip address 192.168.100.1/32
router ospf
area 0
int e 1
ip ospf area 0
int ve 10
ip opsf area 0
ip ospf passive
Configuring VRRP-Extended
Prerequisites: Switch is running Full Layer-3 code and IP address are
already assigned to interface or virtual interfaces.
Notes: VRRP provides redundancy for routers. Two (or more) routers
backup a single IP.
Troubleshooting: show ip vrrp-e brief
Configuration Example:
ROUTER A:
router vrrp-extended
int ve 10
ip address 192.168.10.2/24
ip vrrp-extended vrid 10
backup priority 200
ip-address 192.168.10.1
advertise backup
activate
ROUTER B:
router vrrp-extended
int ve 10
ip address 192.168.10.3/24
ip vrrp-extended vrid 10
backup priority 150
ip-address 192.168.10.1
advertise backup
activate
Securing Management to Specific Router IPs
Prerequisites: Appropriate telnet/snmp/syslog/ssh/web configurations
Notes: Using a loopback interface is best as its not tied to an interface
that potential can go down. Some options may not be available on some
devices.
Configuration Example:
interface loopback 1
ip address 192.168.100.1/32
!
ip telnet source-interface loopback 1
ip ssh source-interface loopback 1
ip web source-interface loopback 1
ip snmp source-interface loopback 1
ip syslog source-interface loopback 1
Backing up the Configuration
Prerequisites: A TFTP server or Secure Copy program and SSH
enabled on the the device
Notes: TFTP commands are issued on the device. SCP commands are
issued on the server.
Example Commands for TFTP:
Backing up the device:
copy run tftp 192.168.10.2 myswitch.cfg
Restoring the device:
copy tftp start 192.168.10.2 myswitch.cfg
reload
Example Commands for SCP:
Backing up the device:
scp username@192.168.10.1:runConfig myswtich.cfg
Restoring the device:
scp myswitch.cfg username@192.168.10.1:startConfig
Reload the switch for the restored configuration to take effect.
Enabling sFlow (RFC 3164)
Prerequisites: sFlow collector to receive the sFlow information
Notes: sFlow samples packets flowing through the switch and reports
them back to a collector for analysis. The devices process the packets in
hardware; however, care should be taken in selecting a sample rate as
not to overwhelm processing and storage space of the collector. Most
devices only sample on the inbound direction, so all ports must be enable
to report all traffic on the device.
Configuration Example:
sflow destination 192.168.100.2
sflow sample 512
sflow enable
int e 1 to 24
sflow-forwarding
Enabling MAC-Based Port Security
Notes: Interface can be set up to accept a certain number of MAC
address per port and automatically shutdown/restrict the port if mac
changes or more than number of mac addresses are discovered on the
port.
Troubleshooting: show port security, clear port security
Configuration Example:
port-security
violation shutdown 10 !shutdown the port for 10 min
autosave 60 !save learned macs to flash every 60 min
int e 1 to 24
port security
enable
maximum 1 !Note: 1 is the defaul
Configuring VLL with LDP
Prerequisites: MPLS capable device with OSPF running and a loopback
configured.
Notes: Route-only should not be configured on MPLS-Interfaces. FDP
and CDP can not be configured on untagged VLL endpoints (ie.
Customer interface).
Troubleshooting: show mpls ldp, show mpls vll
Configuration Example:
router mpls
mpls-interface e 2/1
ldp-enable
vll Test_VLL 100
vll-peer 192.168.100.100 !-- Loopback IP of end-point
vlan 100
untagged e 4/1 !Customer Interface (can be tagged)
Configuring VPLS with LDP
Prerequisites: MPLS capable device with OSPF running and a loopback
configured.
Notes: Route-only should not be configured on MPLS-Interfaces. Bridge
PDUs (BPDUs) do not go across VPLS unless you configure no vplsbpdu-block on the physical interface. FDP and CDP can not be
configured on untagged VPLS endpoints (ie. Customer interface).
Troubleshooting: show mpls ldp, show mpls vlps, show mac vpls
Configuration Example:
router mpls
mpls-interface e 2/1
ldp-enable
vplsl Test_VPLS 200
vpls-peer 192.168.100.10 192.168.100.20
!-- Loopback IP(s) of all end-points
vlan 100
untagged e 4/1 !Customer Interface(s) (can be tagged)
Configuring static LSP
Prerequisites: MPLS capable device with OSPF running and a loopback
configured.
Notes: Specifying a path is optional. If no path is specified, then the
standard IP routing or CSPF (if enabled) will be used to build a path.
Troubleshooting: show mpls path, show mpls lsp, show mpls route
Configuration Example:
router mpls
path R1_to_R3 !Paths are optional (see above)
strict 192.168.100.10 !- Must go to this device
loose 192.168.100.50 !- Take any way to this device
lsp tunnel from R1_to_R3
to 192.168.100.100
primary-path R1_to_R3 !Optional (see above if obmitted)
secondary-path R1-to_R3_Alt !Configure alt path
frr !-enable fast reroute from primary to sec path if desired
2010 by Brocade Communications
Produced by: Tim Braly, BCNP, BCFP Systems Engineer III.
tbraly@brocade.com