<view_name 32> | notify_view <view_name 32>} <groupname 32>
<ipaddr> {v1 |v2c | v3 [noauth_nopriv | auth_nopriv | auth_priv]} <auth_string 32> <ipaddr> <auth_string 32> <ipaddr> <ipaddr> <ipaddr> <ipaddr>
<sw_contact> <sw_location> <sw_name>
Purpose Syntax Used to create a new SNMP user and adds the user to an SNMP group that is also created by this command. create snmp user <SNMP_name 32> <groupname 32> {encrypted [by_password auth [md5 <auth_password 8-16> | sha <auth_password 8-20>] priv [none | des <priv_password 816>] | by_key auth [md5 <auth_key 32-32> | sha <auth_key 4040>] priv [none | des <priv_key 32-32>]]} The create snmp user command creates a new SNMP user and adds the user to an SNMP group that is also created by this command. SNMP ensures: Message integrity Ensures that packets have not been tampered with during transit. Authentication Determines if an SNMP message is from a valid source. 32
Encryption Scrambles the contents of messages to prevent it from being viewed by an unauthorized source. Parameters <username 32> An alphanumeric name of up to 32 characters that will identify the new SNMP user. <groupname 32> An alphanumeric name of up to 32 characters that will identify the SNMP group with which the new SNMP user will be associated. encrypted Allows the user to choose a type of authorization for authentication using SNMP. The user may choose: by_password Requires the SNMP user to enter a password for authentication and privacy. The password is defined by specifying the auth_password below. This method is recommended. by_key Requires the SNMP user to enter a encryption key for authentication and privacy. The key is defined by specifying the key in hex form below. This method is not recommended.
auth - The user may also choose the type of authentication algorithms used to authenticate the snmp user. The choices are: md5 Specifies that the HMAC-MD5-96 authentication level will be used. md5 may be utilized by entering one of the following: <auth password 8-16> - An alphanumeric sting of between 8 and 16 characters that will be used to authorize the agent to receive packets for the host. <auth_key 32-32> - Enter an alphanumeric sting of exactly 32 characters, in hex form, to define the key that will be used to authorize the agent to receive packets for the host. sha Specifies that the HMAC-SHA-96 authentication level will be used. <auth password 8-20> - An alphanumeric sting of between 8 and 20 characters that will be used to authorize the agent to receive packets for the host. <auth_key 40-40> - Enter an alphanumeric sting of exactly 40 characters, in hex form, to define the key that will be used to authorize the agent to receive packets for the host. priv Adding the priv (privacy) parameter will allow for encryption in addition to the authentication algorithm for higher security. The user may choose: des Adding this parameter will allow for a 56-bit encryption to be added using the DES-56 standard using: <priv_password 8-16> - An alphanumeric string of between 8 and 16 characters that will be used to encrypt the contents of messages the host sends to 33

XStack DES-6500 Modular Layer 3 Chassis Ethernet Switch CLI Manual **********

disable autoconfig

Purpose Syntax Description Use this to deactivate autoconfiguration from DHCP. disable autoconfig This instructs the Switch not to accept autoconfiguration instruction from the DHCP server. This does not change the IP settings of the Switch. The ipif settings will continue as DHCP client until changed with the config ipif command. None. None.
To stop the autoconfiguration function: DES-6500:4#disable autoconfig Command: disable autoconfig Success. DES-6500:4#
NOTE: With autoconfig enabled, the Switch ipif settings now define the Switch as a DHCP client. Use the show switch command to display the new IP settings status.

show autoconfig

Purpose Syntax Description Parameters Restrictions Example usage: To show the autoconfig configuration set on the Switch: DES-6500:4#show autoconfig Command: show autoconfig Autoconfig disabled. Success. DES-6500:4# Used to display the current autoconfig status of the Switch. show autoconfig This will list the current status of the autoconfiguration function. None. None.
N ETWORK M ONITORING C OMMANDS
The network monitoring commands in the Command Line Interface (CLI) are listed (along with the appropriate parameters) in the following table.
show packet ports show error ports show utilization show stack information clear counters clear log show log enable syslog disable syslog show syslog create syslog host
<portlist> <portlist> [ports | cpu]

ports <portlist>

index <value_list>
[<index 1-4> | all] {severity [informational | warning | all] | facility [local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7] | udp_port <udp_port_number> | ipaddress <ipaddr> | state [enabled | disabled]} <index 1-4> {severity [informational | warning | all] | facility [local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7] | udp_port <udp_port_number> | ipaddress <ipaddr> | state [enabled | disabled]} {severity [informational | warning | all] | facility [local0 | local1 | local2 | local3 | local4 | local5 | local6 | local7] | udp_port <udp_port_number> | state [enabled | disabled]} [<index 1-4> | all] [<index 1-4>] [trap | log | all] [critical | warning | information]

config syslog host

config syslog host all
delete syslog host show syslog host config system_severity show system_severity

Choose one of the following to identify where severity messages are to be sent.
trap Entering this parameter will define which events occurring on the Switch will be sent to a SNMP agent for analysis. log Entering this parameter will define which events occurring on the Switch will be sent to the Switchs log for analysis. all Entering this parameter will define which events occurring on the Switch will be sent to a SNMP agent and the Switchs log for analysis.
Choose one of the following to identify what type of severity warnings are to be sent to the destination entered above.
critical Entering this parameter along with the proper destination, stated above, will instruct the Switch to send only critical events to the Switchs log or SNMP agent. warning Entering this parameter along with the proper destination, stated above, will instruct the Switch to send critical and warning events to the Switchs log or SNMP agent. information Entering this parameter along with the proper destination, stated above, will instruct the switch to send informational, warning and critical events to the Switchs log or SNMP agent.
To configure the system severity:
XStack DES-6500 Modular Layer 3 Chassis Ethernet Switch CLI Manual DES-6500:4#config system_severity trap critical Command: config system_severity trap critical Success. DES-6500:4#

show system_severity

Purpose Syntax Description To display the current severity settings set on the Switch. show system_severity This command is used to view the severity settings that have been implemented on the Switch using the config system_severity command. None. None.
To view the system severity settings currently implemented on the Switch: DES-6500:4#show system_severity Command: show system_severity system_severity log system_severity trap DES-6500:4# : information : critical
M ULTIPLE S PANNING T REE P ROTOCOL (MSTP) C OMMANDS
This switch supports three versions of the Spanning Tree Protocol; 802.1d STP, 802.1w Rapid STP and 802.1s MSTP. Multiple Spanning Tree Protocol, or MSTP, is a standard defined by the IEEE community that allows multiple VLANs to be mapped to a single spanning tree instance, which will provide multiple pathways across the network. Therefore, these MSTP configurations will balance the traffic load, preventing wide scale disruptions when a single spanning tree instance fails. This will allow for faster convergences of new topologies for the failed instance. Frames designated for these VLANs will be processed quickly and completely throughout interconnected bridges utilizing either of the three spanning tree protocols (STP, RSTP or MSTP). This protocol will also tag BPDU packets so receiving devices can distinguish spanning tree instances, spanning tree regions and the VLANs associated with them. These instances will be classified by an instance_id. MSTP will connect multiple spanning trees with a Common and Internal Spanning Tree (CIST). The CIST will automatically determine each MSTP region, its maximum possible extent and will appear as one virtual bridge that runs a single spanning tree. Consequentially, frames assigned to different VLANs will follow different data routes within administratively established regions on the network, continuing to allow simple and full processing of frames, regardless of administrative errors in defining VLANs and their respective spanning trees. Each switch utilizing the MSTP on a network will have a single MSTP configuration that will have the following three attributes: a) A configuration name defined by an alphanumeric string of up to 32 characters (defined in the config stp mst_config_id command as name <string>).

XStack DES-6500 Modular Layer 3 Chassis Ethernet Switch CLI Manual Example usage: To create a spanning tree instance 2: DES-6500:4#create stp instance_id 2 Command: create stp instance_id 2 Success. DES-6500:4#

config stp instance_id

Purpose Syntax Description Used to add or delete an STP instance ID. config stp instance_id <value 1-15> [add_vlan | remove_vlan] <vidlist> This command is used to map VIDs (VLAN IDs) to previously configured STP instances on the Switch by creating an instance_id. A STP instance may have multiple members with the same MSTP configuration. There is no limit to the number of STP regions in a network but each region only supports a maximum of 16 spanning tree instances (one unchangeable default entry). VIDs can belong to only one spanning tree instance at a time. Note that switches in the same spanning tree region having the same STP instance_id must be mapped identically, and have the same configuration revision_level number and the same name. Parameters <value 1-15> - Enter a number between 1 and 15 to define the instance_id. The Switch supports 16 STP regions with one unchangeable default instance ID set as 0. add_vlan Along with the vid_range <vidlist> parameter, this command will add VIDs to the previously configured STP instance_id. remove_vlan Along with the vid_range <vidlist> parameter, this command will remove VIDs to the previously configured STP instance_id. <vidlist> Specify the VID range from configured VLANs set on the Switch. Supported VIDs on the Switch range from ID number 1 to 4094. Restrictions Example usage: To configure instance ID 2 to add VID 10: DES-6500:4#config stp instance_id 2 add_vlan 10 Command : config stp instance_id 2 add_vlan 10 Success. DES-6500:4# Example usage: To remove VID 10 from instance ID 2: 83 Only administrator-level users can issue this command.
DES-6500:4#config stp instance_id 2 remove_vlan 10 Command : config stp instance_id 2 remove_vlan 10 Success. DES-6500:4#

delete stp instance_id

Purpose Syntax Description Parameters Restrictions Example usage: To delete STP instance id 2 from the Switch. DES-6500:4#delete stp instance_id 2 Command: delete stp instance_id 2 Success. DES-6500:4# Used to delete a STP instance ID from the Switch. delete stp instance_id <value 1-15> This command allows the user to delete a previously configured STP instance ID from the Switch. <value 1-15> - Enter a value between 1 and 15 to identify the Spanning Tree instance on the Switch. Only administrator-level users can issue this command.

create authen_enable method_list_name
Purpose Used to create a user-defined method list of authentication methods for promoting normal user level privileges to Administrator level privileges on the Switch. create authen_enable method_list_name <string 15> This command is used to promote users with normal level privileges to Administrator level privileges using authentication methods on the Switch. Once a user acquires normal user level privileges on the Switch, he or she must be authenticated by a method on the Switch to gain administrator privileges on the Switch, which is defined by the Administrator. A maximum of eight (8) enable method lists can be implemented on the Switch. <string 15> Enter an alphanumeric string of up to 15 characters to define the given enable method list to create. Only administrator-level users can issue this command.
To create a user-defined method list, named Permit for promoting user privileges to Administrator privileges:
XStack DES-6500 Modular Layer 3 Chassis Ethernet Switch CLI Manual DES-6500:4#create authen_enable method_list_name Permit Command: show authen_login method_list_name Permit Success. DES-6500:4#

config authen_enable

Purpose Used to configure a user-defined method list of authentication methods for promoting normal user level privileges to Administrator level privileges on the Switch. config authen_enable [default | method_list_name <string 15>] method {tacacs | xtacacs | tacacs+ | radius | server_group <string 15> | local_enable | none} This command is used to promote users with normal level privileges to Administrator level privileges using authentication methods on the Switch. Once a user acquires normal user level privileges on the Switch, he or she must be authenticated by a method on the Switch to gain administrator privileges on the Switch, which is defined by the Administrator. A maximum of eight (8) method lists can be implemented on the Switch. The sequence of methods implemented in this command will affect the authentication result. For example, if a user enters a sequence of methods like tacacs xtacacs local_enable, the Switch will send an authentication request to the first tacacs host in the server group. If no verification is found, the Switch will send an authentication request to the second tacacs host in the server group and so on, until the list is exhausted. At that point, the Switch will restart the same sequence with the following protocol listed, xtacacs. If no authentication takes place using the xtacacs list, the local_enable password set in the Switch is used to authenticate the user. Successful authentication using any of these methods will give the user a Admin privilege. Parameters default The default method list for administration rights authentication, as defined by the user. The user may choose one or a combination of up to four (4) of the following authentication methods: tacacs Adding this parameter will require the user to be authenticated using the TACACS protocol from the remote TACACS server hosts of the TACACS server group list. xtacacs Adding this parameter will require the user to be authenticated using the XTACACS protocol from the remote XTACACS server hosts of the XTACACS server group list. tacacs+ Adding this parameter will require the user to be authenticated using the TACACS+ protocol from the remote TACACS+ server hosts of the TACACS+ server group list. radius - Adding this parameter will require the user to be authenticated using the RADIUS protocol from a remote RADIUS server previously implemented on the Switch. server_group <string 15> Adding this parameter will 160

show authen server_host

Purpose Syntax Description Used to view a user-defined authentication server host. show authen server_host This command is used to view user-defined authentication server hosts previously created on the Switch. The following parameters are displayed: IP address The IP address of the authentication server host. Protocol The protocol used by the server host. Possible results will include tacacs, xtacacs, tacacs+ and radius. Port The virtual port number on the server host. The default value is 49. Timeout - The time in seconds the Switch will wait for the server host to reply to an authentication request. Retransmit - The value in the retransmit field denotes how many times the device will resend an authentication request when the TACACS server does not respond. This field is inoperable for the tacacs+ protocol. Key - Authentication key to be shared with a configured TACACS+ server only. Parameters Restrictions Example usage: To view authentication server hosts currently set on the Switch: None. Only administrator-level users can issue this command.
XStack DES-6500 Modular Layer 3 Chassis Ethernet Switch CLI Manual DES-6500:4#show authen server_host Command: show authen server_host IP Address Protocol Port Timeout Retransmit Key --------------- ------------ --------------------- -------10.53.13.94 TACACS 2 -------Total Entries : 1 DES-6500:4#
create authen server_group
Purpose Syntax Description Used to create a user-defined authentication server group. create authen server_group <string 15> This command will create an authentication server group. A server group is a technique used to group TACACS/XTACACS/TACACS+ and RADIUS server hosts into user defined categories for authentication using method lists. The user may add up to eight (8) authentication server hosts to this group using the config authen server_group command. <string 15> - Enter an alphanumeric string of up to 15 characters to define the newly created server group. Only administrator-level users can issue this command.
To create the server group group_1: DES-6500:4#create authen server_group group_1 Command: create authen server_group group_1 Success. DES-6500:4#
config authen server_group
Purpose Syntax Used to configure a user-defined authentication server group. config authen server_group [tacacs | xtacacs | tacacs+ | radius | <string 15>] [add | delete] server_host <ipaddr> protocol [tacacs | xtacacs | tacacs+ | radius] This command will configure an authentication server group. A server group is a technique used to group TACACS/XTACACS/TACACS+ and RADIUS server hosts into user defined categories for authentication using method lists. The user may define the type of server group by protocol or by previously defined server group. Up to eight (8) authentication server hosts may be added to any particular group. server_group - The user may define the group by protocol groups b ilt i t th S it h (TACACS/XTACACS/TACACS /RADIUS) b 169

built into the Switch (TACACS/XTACACS/TACACS+/RADIUS), or by a user-defined group previously created using the create authen server_group command. tacacs Use this parameter to utilize the built-in TACACS server protocol on the Switch. Only server hosts utilizing the TACACS protocol may be added to this group. xtacacs Use this parameter to utilize the built-in XTACACS server protocol on the Switch. Only server hosts utilizing the XTACACS protocol may be added to this group. tacacs+ Use this parameter to utilize the built-in TACACS+ server protocol on the Switch. Only server hosts utilizing the TACACS+ protocol may be added to this group. radius - Use this parameter to utilize the built-in RADIUS server protocol on the Switch. Only server hosts utilizing the RADIUS protocol may be added to this group. <string 15> - Enter an alphanumeric string of up to 15 characters to define the previously created server group. This group may add any combination of server hosts to it, regardless of protocol. [add | delete] Enter the correct parameter to add or delete a server host from a server group. server_host <ipaddr> - Enter the IP address of the previously configured server host to add or delete. protocol Enter the protocol utilized by the server host. There are four options: tacacs Use this parameter to define the protocol if the server host is using the TACACS authentication protocol. xtacacs Use this parameter to define the protocol if the server host is using the XTACACS authentication protocol. tacacs+ Use this parameter to define the protocol if the server host is using the TACACS+ authentication protocol. radius Use this parameter to define the protocol if the server host is using the RADIUS authentication protocol. Restrictions Example usage: To add an authentication host to server group group_1: DES-6500:4#config authen server_group group_1 add server_host 10.1.1.121 protocol tacacs+ Command: config authen server_group group_1 add server_host 10.1.1.121 protocol tacacs+ Success. DES-6500:4# Only administrator-level users can issue this command.
delete authen server_group
Purpose Syntax Description Parameters Restrictions Example usage: To delete the server group group_1: DES-6500:4#delete server_group group_1 Command: delete server_group group_1 Success. DES-6500:4# Used to delete a user-defined authentication server group. delete authen server_group <string 15> This command will delete an authentication server group. <string 15> - Enter an alphanumeric string of up to 15 characters to define the previously created server group to delete. Only administrator-level users can issue this command.

show authen server_group

Purpose Syntax Description Used to view authentication server groups on the Switch. show authen server_group <string 15> This command will display authentication server groups currently configured on the Switch. This command will display the following fields: Group Name: The name of the server group currently configured on the Switch, including built in groups and user defined groups. IP Address: The IP address of the server host. Protocol: The authentication protocol used by the server host. Parameters <string 15> - Enter an alphanumeric string of up to 15 characters to define the previously created server group to view. Entering this command without the <string> parameter will display all authentication server groups on the Switch. Restrictions Example usage: To view the authen server groups located on the Switch: None.

To set the maximum number of authentication attempts at 5: DES-6500:4#config authen parameter attempt 5 Command: config authen parameter attempt 5 Success. DES-6500:4#

show authen parameter

Purpose Syntax Description Used to display the authentication parameters currently configured on the Switch. show authen parameter This command will display the authentication parameters currently configured on the Switch, including the response timeout and user authentication attempts. This command will display the following fields: Response timeout The configured time allotted for the Switch to wait for a response of authentication from the user attempting to log in from the command line interface or telnet interface. User attempts The maximum number of attempts the user may try to become authenticated by the Switch, before being locked out. Parameters Restrictions Example usage: To show the authentication parameters currently located on the Switch: None. None.
XStack DES-6500 Modular Layer 3 Chassis Ethernet Switch CLI Manual DES-6500:4#show authen parameter Command: show authen parameter Response timeout: 60 seconds User attempts DES-6500:4# :5

enable admin

Purpose Syntax Description Used to promote user level privileges to administrator level privileges. enable admin This command is for users who have logged on to the Switch on the normal user level, to become promoted to the administrator level. After logging on to the Switch users, will have only user level privileges. To gain access to administrator level privileges, the user will enter this command and will have to enter an authentication password. Possible authentication methods for this function include TACACS/XTACACS/TACACS+/RADIUS, user defined server groups, local enable (local account on the Switch), or no authentication (none). Because XTACACS and TACACS do not support the enable function, the user must create a special account on the server host which has the username enable, and a password configured by the administrator that will support the enable function. This function becomes inoperable when the authentication policy is disabled. None. Only administrator-level users can issue this command.
To enable administrator privileges on the Switch: DES-6500:4#enable admin Password: ****** DES-6500:4#
config admin local_enable
Purpose Syntax Description Used to configure the local enable password for administrator level privileges. config admin local_enable <password 15> This command will configure the locally enabled password for the enable admin command. When a user chooses the local_enable method to promote user level privileges to administrator privileges, the user will be prompted to enter the password configured here, that is set locally on the Switch. 174

sending packets to a supplicant (user). reauth_period <sec 1-65535> Configures the time interval between successive re-authentications. enable_reauth [enable | disable] Determines whether or not the Switch will re-authenticate. Enabled causes re-authentication of users at the time interval specified in the Re-authentication Period field, above. Restrictions Example usage: To configure 802.1x authentication parameters for ports of switch 1: DES-6500:4#config 802.1x auth_parameter ports 1:1 1:20 direction both Command: config 802.1x auth_parameter ports 1:1 1:20 direction both Success. DES-6500:4# Only administrator-level users can issue this command.
config 802.1x auth_protocol
Purpose Syntax Description Parameters Restrictions Example usage: To configure the authentication protocol on the Switch: DES-6500:4# config 802.1x auth_protocol local Command: config 802.1x auth_protocol local Success. DES-6500:4# Used to configure the 802.1x authentication protocol on the Switch. config 802.1x auth_protocol [local | radius_eap] The config 802.1x auth_protocol command enables you to configure the authentication protocol. [local | radius_eap] Specify the type of authentication protocol desired. Only administrator-level users can issue this command.

config 802.1x init

Purpose Syntax Description Used to initialize the 802.1x function on a range of ports. config 802.1x init [port_based ports [<portlist>| all] | mac_based [ports] [<portlist> | all] {mac_address <macaddr>] The config 802.1x init command is used to immediately initialize the 802.1x functions on a specified range of ports or for specified MAC addresses operating from a specified range of ports. port_based This instructs the Switch to initialize 802.1x functions based only on the port number. Ports approved for initialization can then be specified. ports <portlist> Specifies a range of ports. The port list is specified by listing the lowest slot number and the beginning port number on that slot, separated by a colon. Then the highest slot number, and the highest port number of the range (also separated by a colon) are specified. The beginning and end of the port list range are separated by a dash. For example, 1:3 specifies slot number 1, port 3. 2:4 specifies slot number 2, port 4. 1:3-2:4 specifies all of the ports between slot 1, port 3 and slot 2, port 4 in numerical order. all Specifies all of the ports on the Switch. mac_based - This instructs the Switch to initialize 802.1x functions based on the MAC address of a device on a specific port or range of ports. MAC address approved for initialization can then be specified. ports <portlist> Specifies a range of ports. The port list is specified by listing the lowest slot number and the beginning port number on that slot, separated by a colon. Then the highest slot number, and the highest port number of the range (also separated by a colon) are specified. The beginning and end of the port list range are separated by a dash. For example, 1:3 specifies slot number 1, port 3. 2:4 specifies slot number 2, port 4. 1:3-2:4 specifies all of the ports between slot 1, port 3 and slot 2, port 4 in numerical order. all Specifies all of the ports on the Switch. mac_address <macaddr> - Specifies the MAC address of the client to be added. Restrictions Example usage: To initialize the authentication state machine of some or all: DES-6500:4# config 802.1x init port_based ports all Command: config 802.1x init port_based ports all Success. DES-6500:4# Only administrator-level users can issue this command.

In order to address this functional limitation of the chip set, an additional function, CPU Interface Filtering, has been added. CPU Filtering may be universally enabled or disabled. Setting up CPU Interface Filtering follows the same syntax as ACL configuration and requires some of the same input parameters. To configure CPU Interface Filtering, see the descriptions below for create cpu access_profile and config cpu access_profile. To enable CPU Interface Filtering, see config cpu_interface_filtering. The DES-6500 has four ways of creating access profile entries on the Switch which include Ethernet (MAC Address), IP, Packet Content and IPv6. Due to the present complexity of the access profile commands, it has been decided to split this command into four pieces to be better understood by the user and therefore simpler for the user to configure. The beginning of this section displays the create access_profile and config access_profile commands in their entirety. The following table divides these commands up into the defining features necessary to properly configure the access profile. Remember these are not the total commands but the easiest way to implement Access Control Lists for the Switch.
create access_profile config access_profile profile_id
profile_id <value 1-8> [ethernet {vlan | source_mac <macmask> | destination_mac <macmask> | 802.1p | ethernet_type} <value 1-8> [add access_id <value 1-65535> [ethernet {vlan <vlan_name 32> | source_mac <macaddr> | destination_mac <macaddr> | 802.1p <value 0-7> | ethernet_type <hex 0x0-0xffff>} port <port> [permit {priority <value 0-7> {replace_priority} | replace_dscp <value 0-63>} | deny] delete <value 1-65535> profile_id <value 1-8> ip {vlan | source_ip_mask <netmask> | destination_ip_mask <netmask> | dscp | [icmp {type | code} | igmp {type} | tcp {src_port_mask <hex 0x0-0xffff> | dst_port_mask <hex 0x0-0xffff> | flag_mask [all | {urg | ack | psh | rst | syn | fin}]} | udp {src_port_mask <hex 0x0-0xffff> | dst_port_mask <hex 0x0-xffff>} | protocol_id {user _mask <hex 0x0-0xffffffff> }]} <value 1-8> [add access_id <value 1-65535> ip {vlan <vlan_name 32> | source_ip <ipaddr> | destination_ip <ipaddr> | dscp <value 0-63> | [icmp {type <value 0-255> | code <value 0-255>} | igmp {type <value 0-255>} | tcp {src_port <value 0-65535> | dst_port <value 0-65535> | urg | ack | psh | rst | syn | fin} | udp {src_port <value 0-65535> | dst_port <value 0-65535>} | protocol_id <value 0 - 255> {user_define <hex 0x0-0xffffffff> }]} port <port> [permit {priority <value 0-7> {replace_priority} | replace_dscp <value 063>} | deny] delete <value 1-65535>] profile_id <value 1-8>packet_content_mask {offset_0-15 <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x00xffffffff> | offset_16-31 <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_32-47 <hex 0x00xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x00xffffffff> | offset_48-63 <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_64-79 <hex 0x00xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x00xffffffff>} <value 1-8> [add access_id <value 1-65535> packet_content {offset_0-15 <hex0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x00xffffffff> <hex 0x0-0xffffffff> | offset_16-31 <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_32-47 <hex 0x0-0xffffffff> <hex 0x0-0xffffffff><hex 0x00xffffffff> <hex 0x0-0xffffffff> | offset_48-63 <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> | offset_64-79 <hex 0x0-0xffffffff> <hex 0x0-0xffffffff> <hex 0x00xffffffff> <hex0x0-0xffffffff>} port <port> [permit {priority <value 07> {replace_priority} | replace_dscp <value 0-63>} | deny] delete <value 1-65535>] profile_id <value 1-8> ipv6 {class | flowlabel | source_ipv6_mask <ipv6mask> | destination_ipv6_mask <ipv6mask>}] <value 1-8> add access_id <value 1-65535> ipv6 {class <value 0255> | flowlabel <hex 0x0-0xfffff> | source_ipv6 <ipv6addr> | destionation_ipv6 <ipv6addr>} port <port> [permit {priority <value 0-7> {replace_priority}} | deny] | delete <value 1-65535>]

port <portlist> - The access profile for the CPU may be defined for each port on the Switch. The port list is specified by listing the lowest switch number and the beginning port number on that switch, separated by a colon. Then the highest switch number, and the highest port number of the range (also separated by a colon) are specified. The beginning and end of the port list range are separated by a dash. For example, 1:3 specifies switch number 1, port 3. 2:4 specifies switch number 2, port 4. 1:3-2:4 specifies all of the ports between switch 1, port 3 and switch 2, port 4 in numerical order. permit | deny Specify that the packet matching the criteria configured with command will either be permitted entry to the cpu or denied entry to the cpu. delete access_id <value 1-65535> - Use this to remove a previously created access rule in a profile ID. Restrictions Example usage: To configure cpu access list entry: DES-6500:4#config cpu access_profile profile_id 10 add access_id 1 ip vlan default source_ip 20.2.2.3 destination_ip 10.1.1.252 dscp 3 icmp type 11 code 32 port 1 deny Command: config cpu access_profile profile_id 10 add access_id 1 ip vlan default source_ip 20.2.2.3 destination_ip 10.1.1.252 dscp 3 icmp type 11 code 32 port 1 deny Success. DES-6500:4# 232 Only administrator-level users can issue this command.
enable cpu_interface_filtering
Purpose Syntax Description Used to enable CPU interface filtering on the Switch. enable cpu_interface_filtering This command is used, in conjunction with the disable cpu_interface_filtering command below, to enable and disable CPU interface filtering on the Switch. None. Only administrator-level users can issue this command.
To enable CPU interface filtering: DES-6500:4#enable cpu_interface_filtering Command: enable cpu_interface_filtering Success. DES-6500:4#
disable cpu_interface_filtering
Purpose Syntax Description Used to disable CPU interface filtering on the Switch. disable cpu_interface_filtering This command is used, in conjunction with the enable cpu_interface_filtering command above, to enable and disable CPU interface filtering on the Switch without affecting configurations. None. Only administrator-level users can issue this command.
DES-6500:4#disable cpu_interface_filtering Command: disable cpu_interface_filtering Success. DES-6500:4#
show cpu_interface_filtering
Purpose Syntax Description Used to view the current running state of the CPU filtering mechanism on the Switch. show cpu_interface_filtering The show cpu_interface_filtering command is used view the current running state of the CPU interface filtering mechanism on the Switch. 233
Parameters Restrictions Example usage: To show the CPU filtering state on the Switch: DES-6500:4#show cpu_interface_filtering Command: show cpu_interface_filtering Cpu_interface_filtering State Disabled DES-6500:4# None. Only administrator-level users can issue this command.

delete ospf host_route

Purpose Syntax Description Parameters Restrictions Usage Example To delete an OSPF host route: DES-6500:4#delete ospf host_route 10.48.74.122 Command: delete ospf host_route 10.48.74.122 Success. DES-6500:4# Used to delete an OSPF host route. delete ospf host_route <ipaddr> This command is used to delete an OSPF host route. <ipaddr> The IP address of the OSPF host. Only administrator-level users can issue this command.

config ospf host_route

Purpose Syntax Description Parameters Used to configure OSPF host route settings. config ospf host_route <ipaddr> {area <area_id> | metric <value>} This command is used to configure an OSPF host route settings. <ipaddr> The IP address of the host. <area_id> A 32-bit number in the form of an IP address (xxx.xxx.xxx.xxx) that uniquely identifies the OSPF area in the OSPF domain. <value> A metric between 1 and 65535 that will be advertised for the route. Restrictions Usage Example To configure an OSPF host route: DES-6500:4#config ospf host_route 10.48.74.122 area 10.1.1.1 metric 2 Command: config ospf host_route 10.48.74.122 area 10.1.1.1 metric 2 Success. DES-6500:4# Only administrator-level users can issue this command.

show ospf host_route

Purpose Syntax Description Parameters Restrictions Usage Example: To display the current OSPF host route table: DES-6500:4#show ospf host_route Command: show ospf host_route Host Address --------------10.48.73.21 10.48.74.122 Total Entries: 2 DES-6500:4# 310 Metric --------------Area_ID ----------10.1.1.1 10.1.1.1 Used to display the current OSPF host route table. show ospf host_route {<ipaddr>} This command will display the current OSPF host route table. <ipaddr> The IP address of the host. None.

create ospf aggregation

Purpose Syntax Description Parameters Used to configure OSPF area aggregation settings. create ospf aggregation <area_id> <network_address> lsdb_type summary {advertise [enabled | disabled]} This command is used to create an OSPF area aggregation. <area_id> A 32-bit number in the form of an IP address (xxx.xxx.xxx.xxx) that uniquely identifies the OSPF area in the OSPF domain. <network_address> The 32-bit number in the form of an IP address that uniquely identifies the network that corresponds to the OSPF Area. lsdb_type summary The type of address aggregation. advertise [enabled | disabled] Allows for the advertisement trigger to be enabled or disabled. Restrictions Usage Example: To create an OSPF area aggregation: DES-6500:4#create ospf aggregation 10.1.1.1 10.48.76.122/16 lsdb_type summary advertise enable Command: create ospf aggregation 10.1.1.1 10.48.76.122/16 lsdb_type summary advertise enable Success. DES-6500:4# Only administrator-level users can issue this command.

show ospf virtual_link

Purpose Syntax Description Parameters Used to display the current OSPF virtual interface configuration. show ospf virtual_link {<area_id> <neighbor_id>} This command will display the current OSPF virtual interface configuration. <area_id> A 32-bit number in the form of an IP address (xxx.xxx.xxx.xxx) that uniquely identifies the OSPF area in the OSPF domain. <neighbor_id> The OSPF router ID for the remote area. This is a 32-bit number in the form of an IP address (xxx.xxx.xxx.xxx) that uniquely identifies the remote areas Area Border Router. This is the router ID of the neighbor router. Restrictions Usage Example: To display the current OSPF virtual interface configuration: None.
XStack DES-6500 Modular Layer 3 Chassis Ethernet Switch CLI Manual DES-6500:4#show ospf virtual_link Command: show ospf virtual_link Virtual Interface Configuration Transit Area ID --------------10.0.0.0 Virtual Neighbor Router ---------------------20.0.0.0 Hello Interval -----------10 Dead Authentication Link Status Interval ----------- -------------------- -----------60 None DOWN
Total Entries: 1 DES-6500:4#

J UMBO F RAME C OMMANDS

Certain switches can support jumbo frames (frames larger than the standard Ethernet frame size of 1518 bytes). To transmit frames of up to 9K (and 9004 bytes tagged), the user can increase the maximum transmission unit (MTU) size from the default of 1536 by enabling the Jumbo Frame command. The jumbo frame commands in the Command Line Interface (CLI) are listed (along with the appropriate parameters) in the following table.
enable jumbo_frame disable jumbo_frame show jumbo_frame

enable jumbo_frame

Purpose Syntax Description Used to enable the jumbo frame function on the Switch. enable jumbo_frame This command will allow ethernet frames larger than 1536 bytes to be processed by the Switch. The maximum size of the jumbo frame may not exceed 9k. None. None.
To enable the jumbo frame function on the Switch: DES-6500:4#enable jumbo_frame Command: enable jumbo_frame Success. DES-6500:4#

disable jumbo_frame

Purpose Syntax Description Parameters Restrictions Used to disable the jumbo frame function on the Switch. disable jumbo_frame This command will disable the jumbo frame function on the Switch. None. None. 323
XStack DES-6500 Modular Layer 3 Chassis Ethernet Switch CLI Manual Example usage: To enable the jumbo frame function on the Switch: DES-6500:4#disable jumbo_frame Command: disable jumbo_frame Success. DES-6500:4#

show jumbo_frame

Purpose Syntax Description Parameters Restrictions Usage Example: To show the jumbo frame status currently configured on the Switch: DES-6500:4#show jumbo_frame Command: show jumbo_frame Off. DES-6500:4# Used to show the status of the jumbo frame function on the Switch. show jumbo_frame This command will show the status of the jumbo frame function on the Switch. None. None.