Friday, October 26, 2007

Catalyst IOS Commands

snmp-server enable traps

Use the snmp-server enable traps global configuration command to enable the switch to send Simple Network Management Protocol (SNMP) notifications for various traps or inform requests to the network management system (NMS). Use the no form of this command to return to the default setting.

snmp-server enable traps [bridge [newroot] [topologychange] | cluster | config | copy-config | entity | envmon [fan | shutdown | status | supply | temperature] | flash | hsrp | ipmulticast | mac-notification | msdp | ospf [cisco-specific | errors | lsa | rate-limit | retransmit | state-change] | pim [invalid-pim-message | neighbor-change | rp-mapping-change] | port-security [trap-rate value] | rtr | snmp [authentication | coldstart | linkdown | linkup | warmstart] | storm-control trap-rate value | stpx [inconsistency] [root-inconsistency] [loop-inconsistency] | syslog | tty | vlan-membership | vlancreate | vlandelete | vtp]

no snmp-server enable traps [bridge [newroot] [topologychange] | cluster | config | copy-config | entity | envmon [fan | shutdown | status | supply | temperature] | flash | hsrp | ipmulticast | mac-notification | msdp | ospf [cisco-specific | errors | lsa | rate-limit | retransmit | state-change] | pim [invalid-pim-message | neighbor-change | rp-mapping-change] | port-security [trap-rate] | rtr | snmp [authentication | coldstart | linkdown | linkup | warmstart] | storm-control trap-rate | stpx [inconsistency] [root-inconsistency] [loop-inconsistency] | syslog | tty | vlan-membership | vlancreate | vlandelete | vtp]

Syntax Description


bridge [newroot] [topologychange]

(Optional) Generate STP bridge MIB traps. The keywords have these meanings:

newroot—(Optional) Enable SNMP STP Bridge MIB new root traps.

topologychange—(Optional) Enable SNMP STP Bridge MIB topology change traps.

cluster

(Optional) Enable cluster traps.

config

(Optional) Enable SNMP configuration traps.

copy-config

(Optional) Enable SNMP copy-configuration traps.

entity

(Optional) Enable SNMP entity traps.

envmon [fan | shutdown | status | supply | temperature]

Optional) Enable SNMP environmental traps. The keywords have these meanings:

fan—(Optional) Enable fan traps.

shutdown(Optional) Enable environmental monitor shutdown traps.

status—(Optional) Enable SNMP environmental status-change traps.

supply(Optional) Enable environmental monitor power-supply traps.

temperature(Optional) Enable environmental monitor temperature traps.

flash

(Optional) Enable SNMP FLASH notifications.

hsrp

(Optional) Enable Hot Standby Router Protocol (HSRP) traps.

ipmulticast

(Optional) Enable IP multicast routing traps.

mac-notification

(Optional) Enable MAC address notification traps.

msdp

(Optional) Enable Multicast Source Discovery Protocol (MSDP) traps.

ospf [cisco-specific | errors | lsa | rate-limit | retransmit | state-change]

(Optional) Enable Open Shortest Path First (OSPF) traps. The keywords have these meanings:

cisco-specific(Optional) Enable Cisco-specific traps.

errors(Optional) Enable error traps.

lsa(Optional) Enable link-state advertisement (LSA) traps.

rate-limit(Optional) Enable rate-limit traps.

retransmit(Optional) Enable packet-retransmit traps.

state-change(Optional) Enable state-change traps.

pim [invalid-pim-message | neighbor-change | rp-mapping-change]

(Optional) Enable Protocol-Independent Multicast (PIM) traps. The keywords have these meanings:

invalid-pim-message(Optional) Enable invalid PIM message traps.

neighbor-change(Optional) Enable PIM neighbor-change traps.

rp-mapping-change(Optional) Enable rendezvous point (RP)-mapping change traps.

port-security
[trap-rate value]

(Optional) Enable port security traps. Use the trap-rate keyword to set the maximum number of port-security traps sent per second. The range is from 0 to 1000; the default is 0 (no limit imposed; a trap is sent at every occurrence).

rtr

(Optional) Enable SNMP Response Time Reporter traps.

snmp [authentication | coldstart | linkdown | linkup | warmstart]

(Optional) Enable SNMP traps. The keywords have these meanings:

authentication(Optional) Enable authentication trap.

coldstart(Optional) Enable cold start trap.

linkdown(Optional) Enable linkdown trap.

linkup(Optional) Enable linkup trap.

warmstart(Optional) Enable warmstart trap.

storm-control trap-rate value

(Optional) Enable storm-control traps. Use the trap-rate keyword to set the maximum number of storm-control traps sent per second. The range is 0 to 1000; the default is 0 (no limit is imposed; a trap is sent at every occurrence).

stpx

(Optional) Enable SNMP STPX MIB traps. The keywords have these meanings:

inconsistency(Optional) Enable SNMP STPX MIB Inconsistency Update traps.

root-inconsistency(Optional) Enable SNMP STPX MIB Root Inconsistency Update traps.

loop-inconsistency(Optional) Enable SNMP STPX MIB Loop Inconsistency Update traps.

syslog

(Optional) Enable SNMP syslog traps.

tty

(Optional) Send TCP connection traps. This is enabled by default.

vlan-membership

(Optional) Enable SNMP VLAN membership traps.

vlancreate

(Optional) Enable SNMP VLAN-created traps.

vlandelete

(Optional) Enable SNMP VLAN-deleted traps.

vtp

(Optional) Enable VLAN Trunking Protocol (VTP) traps.


Defaults

The sending of SNMP traps is disabled.

Command Modes

Global configuration

snmp-server host

Use the snmp-server host global configuration command to specify the recipient (host) of a Simple Network Management Protocol (SNMP) notification operation. Use the no form of this command to remove the specified host.

snmp-server host host-addr [informs | traps] [version {1 | 2c | 3 {auth | noauth| priv}] [vrf vrf-instance] {community-string [notification-type]}

no snmp-server host host-addr [informs | traps] [version {1 | 2c | 3 {auth | noauth | priv}] [vrf vrf-instance] community-string

Syntax Description


host-addr

Name or Internet address of the host (the targeted recipient).

udp-port port

(Optional) Configure the User Datagram Protocol (UDP) port number of the host to receive the traps. The range is 0 to 65535.

informs | traps

(Optional) Send SNMP traps or informs to this host.

version 1 | 2c | 3

(Optional) Version of the SNMP used to send the traps.

These keywords are supported:

1—SNMPv1. This option is not available with informs.

2c—SNMPv2C.

3—SNMPv3. These optional keywords can follow the Version 3 keyword:

auth (Optional). Enables Message Digest 5 (MD5) and Secure Hash Algorithm (SHA) packet authentication.

noauth (Default). The noAuthNoPriv security level. This is the default if the [auth | noauth | priv] keyword choice is not specified.

priv (Optional). Enables Data Encryption Standard (DES) packet encryption (also called privacy).

Note The priv keyword is available only when the cryptographic (encrypted) software image is installed.

vrf vrf-instance

(Optional) Virtual private network (VPN) routing instance and name for this host.

community-string

Password-like community string sent with the notification operation. Though you can set this string by using the snmp-server host command, we recommend that you define this string by using the snmp-server community global configuration command before using the snmp-server host command.

notification-type

(Optional) Type of notification to be sent to the host. If no type is specified, all notifications are sent. The notification type can be one or more of the these keywords:

bridgeSend SNMP Spanning Tree Protocol (STP) bridge MIB traps.

clusterSend cluster member status traps.

config—Send SNMP configuration traps.

copy-configSend SNMP copy configuration traps.

entity Send SNMP entity traps.

envmonSend environmental monitor traps.

flashSend SNMP FLASH notifications.

hsrp—Send SNMP Hot Standby Router Protocol (HSRP) traps.

ipmulticast—Send SNMP IP multicast routing traps.

mac-notification—Send SNMP MAC notification traps.

msdp—Send SNMP Multicast Source Discovery Protocol (MSDP) traps.

ospf—Send Open Shortest Path First (OSPF) traps.

pim—Send SNMP Protocol-Independent Multicast (PIM) traps.

port-security—Send SNMP port-security traps.

rtr—Send SNMP Response Time Reporter traps.

snmp—Send SNMP-type traps.

storm-control—Send SNMP storm-control traps.

stpx—Send SNMP STP extended MIB traps.

syslog—Send SNMP syslog traps.

tty—Send TCP connection traps.

udp-port port—Configure the User Datagram Protocol (UDP) port number of the host to receive the traps. The range is from 0 to 65535.

vlan-membership— Send SNMP VLAN membership traps.

vlancreate—Send SNMP VLAN-created traps.

vlandelete—Send SNMP VLAN-deleted traps.

vtp—Send SNMP VLAN Trunking Protocol (VTP) traps.


Usage Guidelines

SNMP notifications can be sent as traps or inform requests. Traps are unreliable because the receiver does not send acknowledgments when it receives traps. The sender cannot determine if the traps were received. However, an SNMP entity that receives an inform request acknowledges the message with an SNMP response PDU. If the sender never receives the response, the inform request can be sent again. Thus, informs are more likely to reach their intended destinations.

However, informs consume more resources in the agent and in the network. Unlike a trap, which is discarded as soon as it is sent, an inform request must be held in memory until a response is received or the request times out. Traps are also sent only once, but an inform might be retried several times. The retries increase traffic and contribute to a higher overhead on the network.

If you do not enter an snmp-server host command, no notifications are sent. To configure the switch to send SNMP notifications, you must enter at least one snmp-server host command. If you enter the command with no keywords, all trap types are enabled for the host. To enable multiple hosts, you must enter a separate snmp-server host command for each host. You can specify multiple notification types in the command for each host.

If a local user is not associated with a remote host, the switch does not send informs for the auth (authNoPriv) and the priv (authPriv) authentication levels.

When multiple snmp-server host commands are given for the same host and kind of notification (trap or inform), each succeeding command overwrites the previous command. Only the last snmp-server host command is in effect. For example, if you enter an snmp-server host inform command for a host and then enter another snmp-server host inform command for the same host, the second command replaces the first.

The snmp-server host command is used with the snmp-server enable traps global configuration command. Use the snmp-server enable traps command to specify which SNMP notifications are sent globally. For a host to receive most notifications, at least one snmp-server enable traps command and the snmp-server host command for that host must be enabled. Some notification types cannot be controlled with the snmp-server enable traps command. For example, some notification types are always enabled. Other notification types are enabled by a different command.

The no snmp-server host command with no keywords disables traps, but not informs, to the host. To disable informs, use the no snmp-server host informs command.

Examples

This example shows how to configure a unique SNMP community string named comaccess for traps and prevent SNMP polling access with this string through access-list 10:

Switch(config)# snmp-server community comaccess ro 10
Switch(config)# snmp-server host 172.20.2.160 comaccess
Switch(config)# access-list 10 deny any

This example shows how to send the SNMP traps to the host specified by the name myhost.cisco.com. The community string is defined as comaccess:

Switch(config)# snmp-server enable traps
Switch(config)# snmp-server host myhost.cisco.com comaccess snmp

This example shows how to enable the switch to send all traps to the host myhost.cisco.com by using the community string public:

Switch(config)# snmp-server enable traps
Switch(config)# snmp-server host myhost.cisco.com public
DefaultsThe default is to disable port security.


switchport port-security


Use the switchport port-security interface
configuration command without keywords to enable port security on the
interface. Use the keywords to configure secure MAC addresses, sticky
MAC address learning, a maximum number of secure MAC addresses, or the
violation mode. Use the no form of this command to disable port security or to set the parameters to their default states.


switchport port-security [mac-address mac-address [vlan {vlan-id | {access | voice}}] |
mac-address sticky [mac-address | vlan {vlan-id | {access | voice}}]] [maximum value [vlan
{
vlan-list | {access | voice}}]]

no switchport port-security [mac-address mac-address [vlan {vlan-id | {access | voice}}] |
mac-address sticky [mac-address | vlan {vlan-id | {access | voice}}]] [maximum value [vlan


{vlan-list | {access | voice}}]]

switchport port-security [aging] [violation {protect | restrict | shutdown}]

no switchport port-security [aging] [violation {protect | restrict | shutdown}]


Syntax Description


aging

(Optional) See the switchport port-security aging command.

mac-address mac-address

(Optional) Specify a secure MAC address for the interface by entering a 48-bit MAC address. You can add additional secure MAC addresses up to the maximum value configured.

vlan vlan-id

(Optional) On a trunk port only, specify the VLAN ID and the MAC address. If no VLAN ID is specified, the native VLAN is used.

vlan access

(Optional) On an access port only, specify the VLAN as an access VLAN.

vlan voice

(Optional) On an access port only, specify the VLAN as a voice VLAN.

Note The voice keyword is available only if voice VLAN is configured on a port and if that port is not the access VLAN.

mac-address sticky [mac-address]

(Optional) Enable the interface for sticky learning by entering only the mac-address sticky keywords. When sticky learning is enabled, the interface adds all secure MAC addresses that are dynamically learned to the running configuration and converts these addresses to sticky secure MAC addresses.

(Optional) Enter a mac-address to specify a sticky secure MAC address.

maximum value

(Optional) Set the maximum number of secure MAC addresses for the interface.The maximum number of secure MAC addresses that you can configure on a switch is set by the maximum number of available MAC addresses allowed in the system. For more information, see the sdm prefer global configuration command. This number represents the total of available MAC addresses, including those used for other Layer 2 functions and any other secure MAC addresses configured on interfaces.

The default setting is 1.

vlan [vlan-list]

(Optional) For trunk ports, you can set the maximum number of secure MAC addresses on a VLAN. If the vlan keyword is not entered, the default value is used.

vlan—set a per-VLAN maximum value.

vlan vlan-list—set a per-VLAN maximum value on a range of VLANs separated by a hyphen or a series of VLANs separated by commas. For nonspecified VLANs, the per-VLAN maximum value is used.

violation

(Optional) Set the security violation mode or the action to be taken if port security is violated. The default is shutdown.

protect

Set the security violation protect mode. In this mode, when the number of port secure MAC addresses reaches the maximum limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses to drop below the maximum value or increase the number of maximum allowable addresses. You are not notified that a security violation has occurred.

Note We do not recommend configuring the protect mode on a trunk port. The protect mode disables learning when any VLAN reaches its maximum limit, even if the port has not reached its maximum limit.

restrict

Set the security violation restrict mode. In this mode, when the number of secure MAC addresses reaches the limit allowed on the port, packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses or increase the number of maximum allowable addresses. An SNMP trap is sent, a syslog message is logged, and the violation counter increments.

shutdown

Set the security violation shutdown mode. In this mode, the interface is error-disabled when a violation occurs and the port LED turns off. An SNMP trap is sent, a syslog message is logged, and the violation counter increments. When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisable recovery cause psecure-violation global configuration command, or you can manually re-enable it by entering the shutdown and no shut down interface configuration commands.