D-Link xStack DGS-3400 Series Cli Reference Manual

Product Model: xStack® DGS-3400 Series Layer 2 Managed Gigabit Ethernet Switch Release 2.7

INTRODUCTION .................................................................................................................................................................... 1 USING THE CONSOLE CLI ................................................................................................................................................... 3 COMMAND SYNTAX ............................................................................................................................................................. 7 BASIC SWITCH COMMANDS ............................................................................................................................................... 9 802.1X COMMANDS ............................................................................................................................................................ 23 ACCESS AUTHENTICATION CONTROL COMMANDS .................................................................................................... 45 ACCESS CONTROL LIST (ACL) COMMANDS .................................................................................................................. 66 ACL FLOW METERING COMMANDS ................................................................................................................................ 77 ADDRESS RESOLUTION PROTOCOL (ARP) COMMANDS ............................................................................................ 82 BPDU ATTACK PROTECTION COMMANDS .................................................................................................................... 86 COMMAND HISTORY LIST ................................................................................................................................................. 91 COMMAND LOGGING COMMANDS .................................................................................................................................. 94 COMPOUND AUTHENTICATION COMMANDS ................................................................................................................. 96 CONFIGURATION COMMANDS ....................................................................................................................................... 103 COUNTER COMMANDS ................................................................................................................................................... 108 DEBUG COMMANDS ........................................................................................................................................................ 112 DHCP LOCAL RELAY COMMANDS ................................................................................................................................ 118 DHCP RELAY COMMANDS .............................................................................................................................................. 120 DHCP SERVER SCREENING COMMANDS ..................................................................................................................... 130 DHCP SERVER COMMANDS ........................................................................................................................................... 134 DHCPV6 CLIENT COMMANDS ......................................................................................................................................... 149 DHCPV6 RELAY COMMANDS ......................................................................................................................................... 152 DHCPV6 SERVER COMMANDS ....................................................................................................................................... 158 DIGITAL DIAGNOSTIC MONITORING (DDM) COMMANDS ........................................................................................... 170 D-LINK SINGLE IP MANAGEMENT COMMANDS ........................................................................................................... 177 D-LINK UNIDIRECTIONAL LINK DETECTION (DULD) COMMANDS ............................................................................ 188 DOMAIN NAME SERVER (DNS) RESOLVER COMMANDS ........................................................................................... 190 DOMAIN NAME SERVER (DNS) RELAY COMMANDS ................................................................................................... 195 ETHERNET RING PROTECTION SWITCHING (ERPS) COMMANDS ............................................................................ 199 FILTER DATABASE (FDB) COMMANDS ......................................................................................................................... 209 GRATUITOUS ARP COMMANDS ..................................................................................................................................... 216 IEEE 802.1Q VLAN COMMANDS ..................................................................................................................................... 220 IEEE 802.1QINQ COMMANDS .......................................................................................................................................... 230 IGMP AND MLD SNOOPING COMMANDS ...................................................................................................................... 235 IP DIRECTED BROADCAST COMMANDS ...................................................................................................................... 256 IP-MAC-PORT BINDING (IMPB) COMMANDS ................................................................................................................ 259 IP MULTICAST VLAN REPLICATION COMMANDS ........................................................................................................ 275 IPV6 NEIGHBOR DISCOVER COMMANDS ..................................................................................................................... 281 IPV6 ROUTE COMMANDS ................................................................................................................................................ 287 IPV6 TUNNEL COMMANDS .............................................................................................................................................. 290 JAPANESE WEB-BASED ACCESS CONTROL (JWAC) COMMANDS ......................................................................... 296

LIMITED IP MULTICAST ADDRESS................................................................................................................................. 317 LINK AGGREGATION COMMANDS................................................................................................................................. 320 LINK LAYER DISCOVERY PROTOCOL (LLDP) COMMANDS ....................................................................................... 325 MAC NOTIFICATION COMMANDS .................................................................................................................................. 340 MAC-BASED ACCESS CONTROL COMMANDS ............................................................................................................ 344 MIRROR COMMANDS ....................................................................................................................................................... 356 MSTP DEBUG ENHANCEMENT COMMANDS ................................................................................................................ 360 IGMP SNOOPING MULTICAST (ISM) VLAN COMMANDS ............................................................................................. 367 MULTIPLE SPANNING TREE PROTOCOL (MSTP) COMMANDS ................................................................................. 372 NETWORK LOAD BALANCING (NLB) COMMANDS ...................................................................................................... 382 PASSWORD ENCRYPTION COMMANDS ....................................................................................................................... 385 PASSWORD RECOVERY COMMANDS ........................................................................................................................... 389 PING COMMANDS ............................................................................................................................................................ 392 PORT SECURITY COMMANDS ........................................................................................................................................ 396 POWER OVER ETHERNET (POE) COMMANDS ............................................................................................................. 399 PROTOCOL VLAN GROUP COMMANDS ........................................................................................................................ 403 QUALITY OF SERVICE (QOS) COMMANDS ................................................................................................................... 408 REMOTE COPY PROTOCOL (RCP) COMMANDS .......................................................................................................... 419 REMOTE SWITCHED PORT ANALYZER (RSPAN) COMMANDS .................................................................................. 428 ROUTING INFORMATION PROTOCOL (RIP) COMMANDS ........................................................................................... 434 SAFEGUARD ENGINE COMMANDS ............................................................................................................................... 437 SECURE SHELL (SSH) COMMANDS .............................................................................................................................. 440 SECURE SOCKETS LAYER (SSL) COMMANDS ............................................................................................................ 446 SFLOW COMMANDS ........................................................................................................................................................ 451 STACKING COMMANDS .................................................................................................................................................. 459 STATIC MAC-BASED VLAN COMMANDS ...................................................................................................................... 463 SUBNET VLAN COMMANDS ............................................................................................................................................ 465 SWITCH PORT COMMANDS ............................................................................................................................................ 469 SYSLOG OR TRAP SOURCE-INTERFACE COMMANDS .............................................................................................. 475 SYSTEM LOG COMMANDS .............................................................................................................................................. 478 TECHNICAL SUPPORT COMMANDS .............................................................................................................................. 488 TELNET CLIENT COMMANDS ......................................................................................................................................... 491 TFTP CLIENT COMMANDS .............................................................................................................................................. 492 TIME AND SNTP COMMANDS ......................................................................................................................................... 496 TIME RANGE COMMANDS ............................................................................................................................................... 502 TRACE ROUTE COMMANDS ........................................................................................................................................... 504 TRAFFIC CONTROL COMMANDS ................................................................................................................................... 507 TRAFFIC SEGMENTATION COMMANDS ........................................................................................................................ 511 TRUSTED HOST COMMANDS ......................................................................................................................................... 513 UNICAST ROUTE COMMANDS ........................................................................................................................................ 515 UTILIZATION COMMANDS ............................................................................................................................................... 521

TECHNICAL SPECIFICATIONS ........................................................................................................................................ 534 PASSWORD RECOVERY PROCEDURE ......................................................................................................................... 536

1 1 INTRODUCTION The Switch can be managed through the Switch’s serial port, Telnet, or the Web-based management agent. The Command Line Interface (CLI) can be used to configure and manage the Switch via the serial port or Telnet interfaces. The DGS-3400 Layer 2 stackable Gigabit Ethernet switch series are members of the D-Link xStack® family. Ranging from 10/100Mbps edge switches to core gigabit switches, the xStack® switch family has been future-proof designed to provide a stacking architecture with fault tolerance, flexibility, port density, robust security and maximum throughput with a user-friendly management interface for the networking professional. This manual provides a reference for all of the commands contained in the CLI for the xStack® DGS-3426, DGS-3427, DGS-3450 and DGS-3426P series of switches. Configuration and management of the Switch via the Web-based management agent is discussed in the User’s Guide. NOTE: For the remainder of this manual, all versions of the DGS-3426, DGS-3427, DGS-3450, and DGS-3426P switches will be referred to as simply the Switch or the DGS-3450. Accessing the Switch via the Serial Port The Switch’s serial port’s default settings are as follows: • 115200 baud • no parity • 8 data bits • 1 stop bit A computer running a terminal emulation program capable of emulating a VT-100 terminal and a serial port configured as above is then connected to the Switch’s serial port via an RS-232 DB-9 cable. With the serial port properly connected to a management computer, the following screen should be visible. If this screen does not appear, try pressing Ctrl+r o refresh the console screen. DGS-3450 Gigabit Ethernet Switch Command Line Interface Firmware: Build 2.70.B56 Copyright(C) 2010 D-Link Corporation. All rights reserved. UserName: Figure 1-1. Initial CLI screen There is no initial username or password. Just press the Enter key twice to display the CLI input cursor −DGS- 3650:admin# . This is the command line where all commands are input. Setting the Switch’s IP Address Each Switch must be assigned its own IP Address, which is used for communication with an SNMP network manager or other TCP/IP application (for example BOOTP, TFTP). The Switch’s default IP address is 10.90.90.90. You can change the default Switch IP address to meet the specification of your networking address scheme.

2 The Switch is also assigned a unique MAC address by the factory. This MAC address cannot be changed, and can be found on the initial boot console screen – shown below. Boot Procedure 1.00-B13 ----------------------------------------------------------------------------- Power On Self Test ...................................... 100 % MAC Address : 00-19-5B-F5-26-C0 H/W Version : 1A1G Please wait, loading V2.70.B56 Runtime image ............ 100 % UART init ............................................... 100 % Device Discovery ........................................ - Figure 1-2. Boot screen The Switch’s MAC address can also be found in the Web management program on the Switch Information (Basic Settings) window in the Configuration menu. The IP address for the Switch must be set before it can be managed with the Web-based manager. The Switch IP address can be automatically set using BOOTP or DHCP protocols, in which case the actual address assigned to the Switch must be known. The IP address may be set using the Command Line Interface (CLI) over the console serial port as follows: 1. Starting at the command line prompt, enter the commands config ipif System ipaddress xxx.xxx.xxx.xxx/yyy.yyy.yyy.yyy. Where the x’s represent the IP address to be assigned to the IP interface named System and the y’s represent the corresponding subnet mask. 2. Alternatively, you can enter config ipif System ipaddress xxx.xxx.xxx.xxx/z. Where the x’s represent the IP address to be assigned to the IP interface named System and the z represents the corresponding number of subnets in CIDR notation. The IP interface named System on the Switch can be assigned an IP address and subnet mask which can then be used to connect a management station to the Switch’s Telnet or Web-based management agent. DGS-3450:admin# config ipif System ipaddress 10.24.22.200/255.0.0.0 Command: config ipif System ipaddress 10.24.22.200/8 Success. DGS-3450:admin# Figure 1-3. Assigning an IP Address In the above example, the Switch was assigned an IP address of 10.24.22.200 with a subnet mask of 255.0.0.0. The system message Success indicates that the command was executed successfully. The Switch can now be configured and managed via Telnet, SNMP MIB browser and the CLI or via the Web-based management agent using the above IP address to connect to the Switch.

3 2 USING THE CONSOLE CLI The Switch supports a console management interface that allows the user to connect to the Switch’s management agent via a serial port and a terminal or a computer running a terminal emulation program. The console can also be used over the network using the TCP/IP Telnet protocol. The console program can be used to configure the Switch to use SNMP- based network management software over the network. This chapter describes how to use the console interface to access the Switch, change its settings, and monitor its operation. NOTE: Switch configuration settings are saved to non-volatile RAM using the save command. The current configuration will then be retained in the Switch’s NV-RAM, and reloaded when the Switch is rebooted. If the Switch is rebooted without using the save command, the last configuration saved to NV-RAM will be loaded. Connecting to the Switch The console interface is used by connecting the Switch to a VT100-compatible terminal or a computer running an ordinary terminal emulator program (e.g., the HyperTerminal program included with the Windows operating system) using an RS-232C serial cable. Your terminal parameters will need to be set to: • VT-100 compatible • 115200 baud • 8 data bits • No parity • One stop bit No flow control Users can also access the same functions over a Telnet interface. Once an IP address has been set for the Switch, users can use a Telnet program (in VT-100 compatible terminal mode) to access and control the Switch. All of the screens are identical, whether accessed from the console port or from a Telnet interface. After the Switch reboots and you have logged in, the console looks like this: DGS-3450 Gigabit Ethernet Switch Command Line Interface Firmware: Build 2.70.B56 Copyright(C) 2010 D-Link Corporation. All rights reserved. UserName: PassWord: DGS-3450:admin# _ Figure 2- 1. Initial Console Screen after logging in Commands are entered at the command prompt, DGS-3450:admin# . There are a number of helpful features included in the CLI. Entering the ? command will display a list of all of the top- level commands.

4 DGS-3450:admin# ? Command: ? .. ? cable_diag ports clear clear address_binding dhcp_snoop binding_entry ports clear address_binding nd_snoop binding_entry ports clear arptable clear attack_log clear counters clear dhcp_binding clear dhcpv6 binding clear fdb clear igmp_snooping date_driven_group clear jwac auth_state clear log clear mac_based_access_control auth_state clear mld_snooping data_driven_group clear port_security_entry port clear wac auth_state config 802.1p default_priority config 802.1p user_priority config 802.1x auth_failoverCTRL+C ESC q Quit SPACE n Next Page Enter Next Entry a All Figure 2- 2. The ? Command When users enter a command without its required parameters, the CLI will prompt a Next possible completions: message. DGS-3450:admin# config account Command: config account Next possible completions: DGS-3450:admin# Figure 2- 3. Example Command Parameter Help In this case, the command config account was entered with the parameter . The CLI will then prompt to enter the with the message, Next possible completions:. Every command in the CLI has this feature, and complex commands have several layers of parameter prompting. In addition, after typing any given command plus one space, all of the next possible sub-commands can be seen, in sequential order, by repeatedly pressing the Tab key. To re-enter the previous command at the command prompt, press the up arrow cursor key. The previous command will appear at the command prompt.

5 DGS-3450:admin# config account Command: config account Next possible completions: DGS-3450:admin# config account Figure 2- 4. Using the Up Arrow to Re-enter a Command In the above example, the command config account was entered without the required parameter , the CLI returned the Next possible completions: prompt. The up arrow cursor control key was pressed to re- enter the previous command (config account) at the command prompt. Now the appropriate username can be entered and the config account command re-executed. All commands in the CLI function in this way. In addition, the syntax of the help prompts are the same as presented in this manual − angle brackets < > indicate a numerical value or character string, braces { } indicate optional parameters or a choice of parameters, and brackets [ ] indicate required parameters. If a command is entered that is unrecognized by the CLI, the top-level commands will be displayed under the Available commands: prompt. DGS-3450:admin# the Available commands: .. ? cable_diag clear config create debug delete disable download enable login logout no ping ping6 reboot reconfig reset save show telnet traceroute traceroute6 upload DGS-3450:admin# Figure 2- 5. Available Commands The top-level commands consist of commands such as show or config. Most of these commands require one or more parameters to narrow the top-level command. This is equivalent to show what? or config what? Where the what? is the next parameter. For example, if you enter the create command with no additional parameters, the CLI will then display all of the possible next parameters.

6 DGS-3450:admin# create Command: create Next possible completions: 802.1x access_profile account address_binding arpentry authen authen_enable authen_login authentication cpu dhcp dhcpv6 dot1v_protocol_group double_vlan erps fdb host_name igmp_snooping ip_tunnel ipif ipmc_vlan_replication_entry iproute ipv6 ipv6route jwac link_aggregation mac_based_access_control mac_based_access_control_local mac_based_vlan mirror multicast_fdb nlb route rspan sflow snmp stp subnet_vlan syslog trusted_host vlan vlan_translation wac DGS-3450:admin# Figure 2- 6. Next possible completions: Create command In the above example, all of the possible next parameters for the create command are displayed.

7 3 COMMAND SYNTAX The following symbols are used to describe how command entries are made and values and arguments are specified in this manual. The online help contained in the CLI and available through the console interface uses the same syntax. NOTE: All commands are case-sensitive. Be sure to disable Caps Lock or any other unwanted function that changes text case. Purpose Encloses a variable or value that must be specified. Syntax create ipif () {secondary | state [enable | disable]} Description In the above syntax example, users must supply an IP interface name in the space, a VLAN name in the space, and the network address, including the netmask, in the () space. Do not type the angle brackets. Example Command create ipif Engineering 10.24.22.5/255.0.0.0 Design [square brackets] Purpose Encloses a required value or set of required arguments. One value or argument can be specified. Syntax create account [admin | operator | user] Description In the above syntax example, users must specify the admin, operator, or user level account to be created. Do not type the square brackets. Example Command create account admin ctsnow | vertical bar Purpose Separates two or more mutually exclusive items in a list, one of which must be entered. Syntax create account [admin | operator |user] Description In the above syntax example, you must specify the admin, operator, or user level account to be created. Do not type the backslash. Example Command create account admin ctsnow {braces} Purpose Encloses an optional value or set of optional arguments. Syntax reset {[config | system]} Description In the above syntax example, users have the option to specify config or system. It is not

8 {braces} necessary to specify either optional value, however the effect of the system reset is dependent on which, if any, value is specified. Therefore, with this example there are three possible outcomes of performing a system reset. See the following chapter, Basic Commands for more details about the reset command. Example command reset config Line Editing Key Usage Delete Deletes the character under the cursor and then shifts the remaining characters in the line to the left. Backspace Deletes the character to the left of the cursor and then shifts the remaining characters in the line to the left. Insert or Ctrl+R Toggle on and off. When toggled on, inserts text and shifts previous text to the right. Left Arrow Moves the cursor to the left. Right Arrow Moves the cursor to the right. Up Arrow Repeats the previously entered command. Each time the up arrow is pressed, the command previous to that displayed appears. This way it is possible to review the command history for the current session. Use the down arrow to progress sequentially forward through the command history list. Down Arrow The down arrow will display the next command in the command history entered in the current session. This displays each command sequentially as it was entered. Use the up arrow to review previous commands. Tab Shifts the cursor to the next field to the left. Multiple Page Display Control Keys Space Displays the next page. CTRL+c Stops the display of remaining pages when multiple pages are to be displayed. ESC Stops the display of remaining pages when multiple pages are to be displayed. n Displays the next page. p Displays the previous page. q Stops the display of remaining pages when multiple pages are to be displayed. r Refreshes the pages currently displayed. a Displays the remaining pages without pausing between pages. Enter Displays the next line or table entry.

9 4 BASIC SWITCH COMMANDS The basic switch commands in the Command Line Interface (CLI) are listed (with the appropriate parameters) in the following table. Command Parameters create account [admin | operator | user] config account {encrypt [plain_text| sha_1] } show account delete account {} show session show switch show serial_port config serial_port {baud_rate [9600 | 19200 | 38400 | 115200] auto_logout [never | 2_minutes | 5_minutes | 10_minutes | 15_minutes]} enable clipaging disable clipaging enable telnet disable telnet telnet [ | ] {tcp_port } enable web disable web Save {[config | log | all]} reboot {} reset {[config |system]} {} login logout show device_status config command_prompt [ | username | default] config greeting_message {default} show greeting_message Each command is listed, in detail, in the following sections.

10 create account Purpose Used to create user accounts. Syntax create account [admin | operator | user] Description The create account command is used to create user accounts that consist of a username of 1 to 15 characters and a password of 0 to 15 characters. Up to eight user accounts can be created. Parameters admin – Enter a name between 1 and 15 alphanumeric characters to define the administrator account created here. operator – Enter a name between 1 and 15 alphanumeric characters to define the operator account created here. user – Enter a name between 1 and 15 alphanumeric characters to define the user account created here. Restrictions Only Administrator-level users can issue this command. Example usage: To create an administrator-level user account with the username “dlink”. DGS-3450:admin# create account admin dlink Command: create account admin dlink Enter a case-sensitive new password:**** Enter the new password again for confirmation:**** Success. DGS-3450:admin# To create an operator-level user account with the username “frazier”. DGS-3450:admin# create account operator frazier Command: create account operator frazier Enter a case-sensitive new password:**** Enter the new password again for confirmation:**** Success. DGS-3450:admin# To create a user-level user account with the username “reed”. DGS-3450:admin# create account user reed Command: create account user reed Enter a case-sensitive new password:**** Enter the new password again for confirmation:**** Success. DGS-3450:admin#

11 config account Purpose Used to configure user accounts. Syntax config account {encrypt [plain_text| sha_1] } Description The config account command configures a user account that has been created using the create account command. Parameters – Enter a name between 1 and 15 alphanumeric characters to define the administrator account to configure here. encrypt - Specifies that the account uses encryption. plain_text - Specifies that the account uses the plain text encryption. sha_1 - Specifies that the account uses the SHA-1 encryption. - Enter the password here. Restrictions Only Administrator-level users can issue this command. Example usage: To configure the user password of “dlink” account: DGS-3450:admin# config account dlink Command: config account dlink Enter a old password:**** Enter a case-sensitive new password:**** Enter the new password again for confirmation:**** Success. DGS-3450:admin# show account Purpose Used to display user accounts Syntax show account Description Displays all user accounts created on the Switch. Up to eight user accounts can exist at one time. Parameters None. Restrictions Only Administrator-level users can issue this command. Example usage: To display the accounts that have been created: DGS-3450:admin# show account Command: show account Current Accounts: Username Access Level --------------- ------------ dlink Admin DGS-3450:admin#

12 delete account Purpose Used to delete an existing user account. Syntax delete account {} Description The delete account command deletes a user account that has been created using the create account command. Parameters – Enter an alphanumeric string of up to 15 characters to define the username. Restrictions Only Administrator-level users can issue this command. Example usage: To delete the user account “System”: DGS-3450:admin# delete account System Command: delete account System Are you sure to delete the last administrator account?(y/n)y Success. DGS-3450:admin# show session Purpose Used to display a list of currently logged-in users. Syntax show session Description This command displays a list of all the users that are logged-in at the time the command is issued. Parameters None Restrictions None. Example usage: To display the way that the users logged in: DGS-3450:admin# show session Command: show session ID Live Time From Level Name -- --------- ------------ ----- ----------- 8 03:36:27 Serial Port 5 Anonymous Total Entries: 1 CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh

13 show switch Purpose Used to display general information about the Switch. Syntax show switch Description This command displays information about the Switch. Parameters None. Restrictions None. Example usage: To display the Switch’s information: DGS-3450:admin# show switch Command: show switch Device Type : DGS-3612 Gigabit Ethernet Switch MAC Address : 00-1C-F0-B5-40-00 IP Address : 10.24.73.21 (Manual) VLAN Name : default Subnet Mask : 255.0.0.0 Default Gateway : 0.0.0.0 Boot PROM Version : Build 1.10-B13 Firmware Version : Build 2.70.B56 Hardware Version : A1 Serial Number : P4F7191000001 System Name : System Location : System Contact : Spanning Tree : Disabled GVRP : Disabled IGMP Snooping : Disabled MLD Snooping : Disabled RIP : Disabled DVMRP : Disabled PIM : Disabled OSPF : Disabled TELNET : Enabled (TCP 23) CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh show serial_port Purpose Used to display the current serial port settings. Syntax show serial_port Description This command displays the current serial port settings. Parameters None. Restrictions None Example usage: To display the serial port setting:

14 DGS-3450:admin# show serial_port Command: show serial_port Baud Rate : 115200 Data Bits : 8 Parity Bits : None Stop Bits : 1 Auto-Logout : 10 mins DGS-3450:admin# config serial_port Purpose Used to configure the serial port. Syntax config serial_port {baud_rate [9600 | 19200 | 38400 | 115200] | auto_logout [never | 2_minutes | 5_minutes | 10_minutes | 15_minutes]} Description This command is used to configure the serial port’s baud rate and auto logout settings. Parameters baud_rate [9600 | 19200 | 38400 | 115200] − The serial bit rate that will be used to communicate with the management host. There are four options: 9600, 19200, 38400, and 115200. never − No time limit on the length of time the console can be open with no user input. 2_minutes − The console will log out the current user if there is no user input for 2 minutes. 5_minutes − The console will log out the current user if there is no user input for 5 minutes. 10_minutes − The console will log out the current user if there is no user input for 10 minutes. 15_minutes − The console will log out the current user if there is no user input for 15 minutes. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure baud rate: DGS-3450:admin# config serial_port baud_rate 115200 Command: config serial_port baud_rate 115200 Success. DGS-3450:admin# enable clipaging Purpose Used to pause the scrolling of the console screen when the show command displays more than one page. Syntax enable clipaging Description This command is used when issuing the show command which causes the console screen to rapidly scroll through several pages. This command will cause the console to pause at the end of each page. The default setting is enabled. Parameters None. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To enable pausing of the screen display when the show command output reaches the end of the page:

15 DGS-3450:admin# enable clipaging Command: enable clipaging Success. DGS-3450:admin# disable clipaging Purpose Used to disable the pausing of the console screen scrolling at the end of each page when the show command displays more than one screen of information. Syntax disable clipaging Description This command is used to disable the pausing of the console screen at the end of each page when the show command would display more than one screen of information. Parameters None. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To disable pausing of the screen display when show command output reaches the end of the page: DGS-3450:admin# disable clipaging Command: disable clipaging Success. DGS-3450:admin# enable telnet Purpose Used to enable communication with and management of the Switch using the Telnet protocol. Syntax enable telnet {} Description This command is used to enable the Telnet protocol on the Switch. The user can specify the TCP or UDP port number the Switch will use to listen for Telnet requests. Parameters {} − The TCP port number. TCP ports are numbered between 1 and 65535. The “well-known” TCP port for the Telnet protocol is 23. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To enable Telnet and configure port number: DGS-3450:admin# enable telnet 23 Command: enable telnet 23 Success. DGS-3450:admin#

16 disable telnet Purpose Used to disable the Telnet protocol on the Switch. Syntax disable telnet Description This command is used to disable the Telnet protocol on the Switch. Parameters None. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To disable the Telnet protocol on the Switch: DGS-3450:admin# disable telnet Command: disable telnet Success. DGS-3450:admin# telnet Purpose Used to login remote system with telnet protocol. Syntax telnet [ | ] {tcp_port } Description This command is used to login remote system with Telnet protocol on the Switch. Parameters – Specify the IP address of telnet server system - Specify the domain name used. tcp_port – The TCP port number. TCP ports are numbered between 1 and 65535. The “ well-known” TCP port for the Telnet protocol is 23. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To login to the remote system using telnet on the Switch: DGS-3450:admin# telnet 10.0.0.8 Command: telnet 10.0.0.8 Success. DGS-3450:admin#

17 enable web Purpose Used to enable the HTTP-based management software on the Switch. Syntax enable web {} Description This command is used to enable the Web-based management software on the Switch. The user can specify the TCP port number the Switch will use to listen for Telnet requests. Parameters {} − The TCP port number. TCP ports are numbered between 1 and 65535. The “well-known” port for the Web-based management software is 80. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To enable HTTP and configure port number: DGS-3450:admin# enable web 80 Command: enable web 80 Note: SSL will be disabled if web is enabled. Success. DGS-3450:admin# disable web Purpose Used to disable the HTTP-based management software on the Switch. Syntax disable web Description This command disables the Web-based management software on the Switch. Parameters None. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To disable HTTP: DGS-3450:admin# disable web Command: disable web Success. DGS-3450:admin#

18 save Purpose Used to save changes in the Switch’s configuration to non-volatile RAM. Syntax save {[config | log | all]} Description This command is used to enter the current switch configuration or log file into non-volatile RAM. The saved switch configuration will be loaded into the Switch’s memory each time the Switch is restarted. Parameters log – Specify to save current Switch log to NV-RAM. all – Use to save the configuration and log file to NV-RAM. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To save the Switch’s current configuration to non-volatile RAM: DGS-3450:admin# save Command: save Saving all configurations to NV-RAM... Done. DGS-3450:admin# reboot Purpose Used to restart the Switch. Syntax reboot {} Description This command is used to restart the Switch. Parameters None. Restrictions Only Administrator-level users can issue this command. Example usage: To restart the Switch: DGS-3450:admin# reboot Command: reboot Are you sure want to proceed with the system reboot? (y|n) y Please wait, the switch is rebooting...

19 reset Purpose Used to reset the Switch to the factory default settings. Syntax reset {[config |system]} {} Description This command is used to restore the Switch’s configuration to the default settings assigned from the factory. Parameters config − If the keyword ‘config’ is specified, all of the factory default settings are restored on the Switch including the IP address, user accounts, and the switch history log. The Switch will not save or reboot. system − If the keyword ‘system’ is specified all of the factory default settings are restored on the Switch. The Switch will save and reboot after the settings are changed to default. Rebooting will clear all entries in the Forwarding Data Base. If no parameter is specified, the Switch’s current IP address, user accounts, and the switch history log are not changed. All other parameters are restored to the factory default settings. The Switch will not save or reboot. Restrictions Only Administrator-level users can issue this command. Example usage: To restore all of the Switch’s parameters to its default values: DGS-3450:admin# reset config Command: reset config Are you sure to proceed with system reset?(y/n) y Success. DGS-3450:admin# login Purpose Used to log in a user to the Switch’s console. Syntax login Description This command is used to initiate the login procedure. The user will be prompted for a Username and Password. Parameters None. Restrictions None. Example usage: To initiate the login procedure: DGS-3450:admin# login Command: login UserName:

20 logout Purpose Used to log out a user from the Switch’s console. Syntax logout Description This command terminates the current user’s session on the Switch’s console. Parameters None. Restrictions None. Example usage: To terminate the current user’s console session: DGS-3450:admin# logout show device_status Purpose Used to display the current status of the hardware of the Switch. Syntax show device_status Description This command displays the current status of the power and fans on the system. In the fan status display there are fans on the left of the switch, on the right, at the back and a CPU fan, if the fans are working normally the display will read “OK” in the fan field. If any of the fans fail the corresponding field will read ‘Fail’. Parameters None. Restrictions None. Example usage: To show the device status of the Switch: DGS-3450:admin# show device_status Command: show device_status Unit 1: Internal Power: Active External Power: Fail Left Fan : OK Right Fan : OK Back Fan : OK CPU Fan : OK CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh

21 Example usage: To configure the command prompt: DGS-3450:admin# config command_prompt Tiberius Command: config command_prompt Tiberius Success. Tiberius:admin# config greeting_message Purpose Used to configure the greeting message or banner for the opening screen of the Command Line Interface. Syntax config greeting_message {default} Description This command is used to configure the greeting message or login banner for the opening screen of the CLI. Parameters default – Adding this parameter will return the greeting command to its original factory default configuration. Restrictions The reset command will not alter the configured greeting message, yet the reset system command will return the greeting message to its original factory default setting. The maximum character capacity for the greeting banned is 6 lines and 80 characters per line. Entering Ctrl+W will save the current configured banner to the DRAM only. To save it into the FLASH memory, the user must enter the save command. Only Administrator and Operator-level users can issue this command. Example usage: To configure the greeting message: config command_prompt Purpose Used to configure the command prompt for the Command Line Interface. Syntax config command_prompt [ | username | default] Description This command is used to configure the command prompt for the CLI interface of the Switch. The current command prompt consists of “product name + : + user level + product name” (ex. DGS- 3450:admin# ). The user may replace all parts of the command prompt, except the # by entering a string of 16 alphanumerical characters with no spaces, or the user may enter the current login username configured on the Switch. Parameters – Enter an alphanumeric string of no more than 16 characters to define the command prompt for the CLI interface. username – Entering this parameter will replace the current CLI command prompt with the login username configured on the Switch. default – Entering this parameter will return the command prompt to its original factory default setting. Restrictions The reset command will not alter the configured command prompt, yet the reset system command will return the command prompt to its original factory default setting. Only Administrator and Operator-level users can issue this command.

22 DGS-3450:admin# config greeting_message Command: config greeting_message Greeting Messages Editor =============================================================================== DGS-3450 Gigabit Ethernet Switch Command Line Interface Firmware: Build 2.70.B56 Copyright(C) 2010 D-Link Corporation. All rights reserved. ================================================================================ Ctrl+C Quit without save left/right/ Ctrl+W Save and quit up/down Move cursor Ctrl+D Delete line Ctrl+X Erase all setting Ctrl+L Reload original setting show greeting_message Purpose Used to view the currently configured greeting message configured on the Switch. Syntax show greeting_message Description This command is used to view the currently configured greeting message on the Switch. Parameters None. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To view the currently configured greeting message: DGS-3450:admin# show greeting_message Command: show greeting_message ================================================================================ DGS-3450 Gigabit Ethernet Switch Command Line Interface Firmware: Build 2.70.B56 Copyright(C) 2010 D-Link Corporation. All rights reserved. ================================================================================ DGS-3450:admin#

23 5 802.1X COMMANDS The Switch implements the server-side of the IEEE 802.1X Port-based and MAC-based Network Access Control. This mechanism is intended to allow only authorized users, or other network devices, access to network resources by establishing criteria for each port on the Switch that a user or network device must meet before allowing that port to forward or receive frames. The 802.1X commands in the Command Line Interface (CLI) are listed (along with the appropriate parameters) in the following table.

24 Command Parameters enable 802.1x disable 802.1x create 802.1x user < username 15 > delete 802.1x user < username 15 > show 802.1x user config 802.1x auth_protocol [ local | radius_eap ] config 802.1x fwd_pdu system [ enable | disable ] config 802.1x fwd_pdu ports [ < portlilst > | all ] [ enable | disable ] config 802.1x authorization network radius [ enable | disable ] show 802.1x { [ auth_state | auth_configuration ] ports { < portlist > } } config 802.1x capability ports [ < portlist > | all ] [ authenticator | none ] config 802.1x max_users [ | no_limit] config 802.1x auth_parameter ports [ | all ][ default |{ direction [ both | in ]| port_control [ force_unauth | auto | force_auth ] | quiet_period < sec 0-65535> | tx_period < sec 1-65535> | supp_timeout < sec 1-65535>| server_timeout < sec 1-65535> | max_req < value 1-10> | reauth_period < sec 1-65535> | enable_reauth [ enable | disable ] | max_users [ < value 1 – 128 > | no_limit ]} (1)] config 802.1x auth_mode [ port_based | mac_based ] config 802.1x init [ port_based ports [ < portlist | all > ] | mac_based ports [ < portlist > | all ] { mac_address < macaddr > }] config 802.1x reauth [ port_based ports [ < portlist | all >]| mac_based ports [ < portlist > | all ] { mac_address < macaddr > }] create 802.1x guest_vlan { < vlan_name 32 > } delete 802.1x guest_vlan { < vlan_name 32 > } config 802.1x guest_vlan ports [ < portlist > | all ] state [ enable | disable ] show 802.1x guest_vlan config radius add < server_index 1-3 > [ < server_ip > | < ipv6addr > ] key < passwd 32 > [ default | { auth_port < udp_port_number 1-65535 > | acct_port < udp_port_number 1- 65535 > | timeout < int 1-255 > | retransmit < int 1-20 > } (1)] config radius delete < server_index 1-3 > config radius { ipaddress [ | ] | key | auth_port [| default ] | acct_port [ | default ] | timeout [ | default ] | retransmit [ | default ]} (1) show radius show auth_statistics {ports [ | all]} show auth_diagnostics {ports [ | all]} show auth_session_statistics {ports [ | all]} show auth_client show acct_client config accounting service [ network | shell | system ] state [ enable | disable ] show accounting service

25 Each command is listed, in detail, in the following sections. enable 802.1x Purpose Used to enable the 802.1X function. Syntax enable 802.1x Description The enable 802.1x command enables 802.1X function. Parameters None. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: Used to enable the 802.1X function: DGS-3450:admin#enable 802.1x Command: enable 802.1x Success. DGS-3450:admin# disable 802.1x Purpose Used to disable the 802.1X function. Syntax disable 802.1x Description The disable 802.1x command disable 802.1X function. Parameters None. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To disable the 802.1X function: DGS-3450:admin# disable 802.1x Command: disable 802.1x Success. DGS-3450:admin# create 802.1x user Purpose Used to create an 802.1X user. Syntax create 802.1x user < username 15 > Description The create 802.1x user command create an 802.1X user. Parameters username - Specifies adding user name. Restrictions Only Administrator and Operator-level users can issue this command. Example usage:

26 To create an 802.1x user “test”: DGS-3450:admin# create 802.1x user test Command: create 802.1x user test Enter a case-sensitive new password: Enter the new password again for confirmation: Success. DGS-3450:admin# delete 802.1x user Purpose Used to delete an 802.1X user. Syntax delete 802.1x user < username 15 > Description The delete 802.1x user command delete an 802.1X user. Parameters username - Specifies the adding user name. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To delete user “test”: DGS-3450:admin# delete 802.1x user test Command: delete 802.1x user test Are you sure to delete the user?(y/n) Success. DGS-3450:admin# show 802.1x user Purpose Used to display the 802.1X user. Syntax show 802.1x user Description The show 802.1x user command displays the 802.1X user account information. Parameters None. Restrictions None. Example usage: To display the 802.1X user information:

27 DGS-3450:admin# show 802.1x user Command: show 802.1x user Username Password ---------- ---------- user1 abcds Total Entries : 1 DGS-3450:admin# config 802.1x auth_protocol Purpose Used to configure the 802.1X auth protocol. Syntax config 802.1x auth_protocol [ local | radius_eap ] Description The config 802.1x auth_protocol command configures the 802.1X authentication protocol. Parameters local - Specifies the authentication protocol as local. radius_eap - Specifies the authentication protocol as RADIUS EAP. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure the 802.1X authentication protocol to RADIUS EAP: DGS-3450:admin# config 802.1x auth_protocol radius_eap Command: config 802.1x auth_protocol radius_eap Success. DGS-3450:admin# config 802.1x fwd_pdu system Purpose Used to configure forwarding of EAPOL PDU when 802.1X is disabled. Syntax config 802.1x fwd_pdu system [ enable | disable ] Description This is a global setting to control the forwarding of EAPOL PDU. When 802.1X functionality is disabled globally or for a port, and if 802.1X fwd_pdu is enabled both globally and for the port, a received EAPOL packet on the port will be flooded in the same VLAN to those ports for which 802.1X fwd_pdu is enabled and 802.1X is disabled (globally or just for the port). The default state is disabled. Parameters enable - Enable the forwarding of EAPOL PDU. disable - Disable the forwarding of EAPOL PDU. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure forwarding of EAPOL PDU system state enable:

28 DGS-3450:admin# config 802.1x fwd_pdu system enable Command: config 802.1x fwd_pdu system enable Success. DGS-3450:admin# config 802.1x fwd_pdu ports Purpose Used to configure if the port will flood EAPOL PDU when 802.1X functionality is disabled. Syntax config 802.1x fwd_pdu ports [ < portlilst > | all ] [ enable | disable ] Description This is a per port setting to control the forwarding of EAPOL PDU. When 802.1X functionality is disabled globally or for a port, and if 802.1X fwd_pdu is enabled both globally and for the port, a received EAPOL packet on the port will be flooded in the same VLAN to those ports for which 802.1X fwd_pdu is enabled and 802.1X is disabled (globally or just for the port). The default state is disabled. Parameters ports - Specifies a range of ports to be configured. all - All ports. enable - Enable forwarding EAPOL PDU receive on the ports. disable - Disable forwarding EAPOL PDU receive on the ports. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure 802.1X fwd_pdu for ports: DGS-3450:admin# config 802.1x fwd_pdu ports 1,2 enable Command: config 802.1x fwd_pdu ports 1,2 enable Success. DGS-3450:admin# config 802.1x authorization network radius Purpose The enable or disable the acceptation of an authorized configuration. Syntax config 802.1x authorization network radius [ enable | disable ] Description The command config 802.1x authorization attributes is used to enable or disable the acception of authorized configuration. When the authorization is enabled for 802.1X’s RADIUS authentication, the authorized attributes (for example VLAN and 802.1p default priority) assigned by the RADUIS server will be accepted if the global authorization status is enabled. Parameters radius - If specified to enable, the authorization attributes (for example VLAN and 802.1p default priority) assigned by the RADUIS server will be accepted if the global authorization status is enabled. The default state is enabled. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: The following example will disable to accept the authorized data assigned from the RADIUS server:

29 DGS-3450:admin# config 802.1x authorization network radius disable Command: config 802.1x authorization network radius disable Success. DGS-3450:admin# show 802.1x Purpose Used to display the 802.1X state or configurations. Syntax show 802.1x { [ auth_state | auth_configuration ] ports { < portlist > } } Description The show 802.1x command displays the 802.1X state or configurations. Parameters auth_state - Used to display 802.1X authentication state machine of some or all ports auth_configuration - Used to display 802.1X configurations of some or all ports. portlist - Specifies a range of ports to be displayed. If no port is specified, all ports will be displayed. If no parameter is specified, the 802.1X system configurations will be displayed. Restrictions None. Example usage: To display the 802.1X states: DGS-3450:admin# show 802.1x auth_state ports 1-4 Command: show 802.1x auth_state ports 1-4 Status: A – Authorized; U – Unauthorized; (P): Port-Based 802.1X Port MAC Address PAE State Backend State Status VID Priority ---- --------------------- ---------------- -------------- ------- ---- 1 00-00-00-00-00-01 Authenticated Idle A 4004 3 1 00-00-00-00-00-02 Authenticated Idle A 1234 - 1 00-00-00-00-00-04 Authenticating Response U - - 2 -(P) Authenticating Request U - - 3 -(P) Connecting Idle U - - 4 -(P) Held Idle U - - Total Authenticating Hosts :2 Total Authenticated Hosts :2 DGS-3450:admin# To display the 802.1X system level configurations:

30 DGS-3450:admin# show 802.1x Command: show 802.1x 802.1X : Enabled Authentication Mode : Port_based Authentication Protocol : Radius_Eap Forward EAPOL PDU : Enabled Max Users : no_limit RADIUS Authorization : Enabled DGS-3450:admin# To display the 802.1X port level configurations: DGS-3450:admin# show 802.1x auth_configuration ports 1:1 Command: show 802.1x auth_configuration ports 1:1 Port number : 1:1 Capability : None AdminCrlDir : Both OpenCrlDir : Both Port Control : Auto QuietPeriod : 60 sec TxPeriod : 30 sec SuppTimeout : 30 sec ServerTimeout : 30 sec MaxReq : 2 times ReAuthPeriod : 3400 sec ReAuthenticate : Disabled Forward EAPOL PDU On Port : Enabled Max Users On Port : 10 DGS-3450:admin# config 802.1x capability Purpose Used to configure the port capability. Syntax config 802.1x capability ports [ < portlist > | all ] [ authenticator | none ] Description The config 802.1x capability command configures the port capability. Parameters portlist - Specifies a range of ports to be configured. all - Specifies all ports to be configured. authenticator - The port that wishes to enforce authentication before allowing access to services that are accessible via that port adopts the authenticator role. none - Disable authentication on the specified ports. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure the port capability:

31 DGS-3450:admin# config 802.1x capability ports 1:1-1:10 authenticator Command: config 802.1x capability ports 1:1-1:10 authenticator Success. DGS-3450:admin# config 802.1x max_users Purpose Used to configure the maximum number of users that can be learned via 802.1X authentication. Syntax config 802.1x max_users [ | no_limit] Description The setting is a global limitation on the maximum number of users that can be learned via 802.1X authentication. In addition to the global limitation, maximum user for per port is also limited. It is specified by config 802.1x auth_parameter command. Parameters max_users - Specifies the maximum number of users. The range is 1 to 4000. By default, there is no limit on the maximum users. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure 802.1X number of users to be limited to 200: DGS-3450:admin# config 802.1x max_users 200 Command: config 802.1x max_users 200 Success. DGS-3450:admin# config 802.1x auth_parameter Purpose Used to configure the parameters that control the operation of the authenticator associated with a port. Syntax config 802.1x auth_parameter ports [ | all ][ default |{ direction [ both | in ]| port_control [ force_unauth | auto | force_auth ] | quiet_period < sec 0-65535> | tx_period < sec 1-65535> | supp_timeout < sec 1-65535>| server_timeout < sec 1- 65535> | max_req < value 1-10> | reauth_period < sec 1-65535> | enable_reauth [ enable | disable ] | max_users [ | no_limit ]} (1)] Description The config 802.1x auth_parameter command configures the parameters that control the operation of the authenticator associated with a port. Parameters portlist - Specifies a range of ports to be configured. all - All ports. default - Sets all parameter to be default value. direction - Sets the direction of access control. both - For bidirectional access control. in - For unidirectional access control. port_control - You can force a specific port to be unconditionally authorized or unauthorized by setting the parameter of port_control to be force_authorized or force_unauthorized. Besides, the controlled port will reflect the outcome of authentication if port_control is auto. force_authorized - Force a specific port to be unconditionally authorized. auto - The controlled port will reflect the outcome of authentication.

32 config 802.1x auth_parameter force_unauthorized - Force a specific port to be unconditionally unauthorized. quiet_period - It is the initialization value of the quietWhile timer. The default value is 60 seconds and can be any value among 0 to 65535. tx_period - It is the initialization value of the txWhen timer. The default value is 30 seconds and can be any integer value among 1 to 65535. supp_timeout - The initialization value of the aWhile timer when timing out the supplicant. Its default value is 30 seconds and can be any integer value among 1 to 65535. server_timeout - The initialization value of the aWhile timer when timing out the authentication server. Its default value is 30 seconds and can be any integer value among 1 to 65535. max_req - The maximum number of times that the authentication PAE state machine will retransmit an EAP Request packet to the supplicant. Its default value is 2 and can be any integer number among 1 to 10. reauth_period - It’s a nonzero number of seconds, which is used to be the re-authentication timer. The default value is 3400. enable_reauth - You can enable or disable the re-authentication mechanism for a specific port. max_users - Specifies per port maximum number of users. The range is 1 to 128. The default value is 16. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure the parameters that control the operation of the authenticator associated with a port: DGS-3450:admin# config 802.1x auth_parameter ports 1:1-1:20 direction both Command: config 802.1x auth_parameter ports 1:1-1:20 direction both Success. DGS-3450:admin# config 802.1x auth_mode Purpose Used to configure 802.1X authentication mode. Syntax config 802.1x auth_mode [ port_based | mac_based ] Description The config 802.1x auth_mode command configures the authentication mode. Parameters port_based - Configure the authentication as port based mode. mac_based - Configure the authentication as MAC based mode. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure the authentication mode:

33 DGS-3450:admin# config 802.1x auth_mode port_based Command: config 802.1x auth_mode port_based Success. DGS-3450:admin# config 802.1x init Purpose Used to initialize the authentication state machine of some or all ports. Syntax config 802.1x init [ port_based ports [ < portlist | all > ] | mac_based ports [ < portlist > | all ] { mac_address < macaddr > }] Description The config 802.1x init command used to initialize the authentication state machine of some or all. Parameters port_based - Configure the authentication as port based mode. mac_based - Configure the authentication as MAC based mode. portlist - Specifies a range of ports to be configured. all - All ports. mac_address - MAC address of client. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To initialize the authentication state machine of some or all: DGS-3450:admin# config 802.1x init port_based ports all Command: config 802.1x init port_based ports all Success. DGS-3450:admin# config 802.1x reauth Purpose Used to re-authenticate the device connected to the port. Syntax config 802.1x reauth [ port_based ports [ < portlist | all >]| mac_based ports [ < portlist > | all ] { mac_address < macaddr > }] Description The config 802.1x reauth command re-authenticates the device connected to the port. During the re-authentication period, the port status remains authorized until failed re-authentication. Parameters port_based - Configure the authentication as port based mode. mac_based - Configure the authentication as MAC based mode. portlist - Specifies a range of ports to be configured. all - All ports. mac_address - MAC address of client. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To re-authenticate the device connected to the port:

34 DGS-3450:admin# config 802.1x reauth port_based ports all Command: config 802.1x reauth port_based ports all Success. DGS-3450:admin# create 802.1x guest_vlan Purpose Used to assign a static VLAN to be guest VLAN. Syntax create 802.1x guest_vlan { < vlan_name 32 > } Description The create 802.1x guest_vlan command will assign a static VLAN to be guest VLAN. The specific VLAN which assigned to guest VLAN must be existed. The specific VLAN which assigned to guest VLAN can’t be deleting. Parameters - Specify the static VLAN to be guest VLAN. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To create a VLAN named “guestVLAN” as 802.1X guest VLAN: DGS-3450:admin# create 802.1x guest_vlan guestVLAN Command: create 802.1x guest_vlan guestVLAN Success. DGS-3450:admin# delete 802.1x guest_vlan Purpose Used to delete guest VLAN configuration. Syntax delete 802.1x guest_vlan { < vlan_name 32 > } Description The delete 802.1x guest_vlan command will delete guest VLAN setting, but not delete the static VLAN. All ports which enabled guest VLAN will remove to original VLAN after deleted guest VLAN. Parameters - Specify the static VLAN to be guest VLAN. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To delete the guest VLAN named “guestVLAN”: DGS-3450:admin# delete 802.1x guest_vlan guestVLAN Command: delete 802.1x guest_vlan guestVLAN Success. DGS-3450:admin#

35 config 802.1x guest_vlan Purpose Used to configure guest VLAN settings. Syntax config 802.1x guest_vlan ports [ < portlist > | all ] state [ enable | disable ] Description The config 802.1x guest_vlan command configures guest VLAN setting. If the specific port state is changed from enabled state to disable state, this port will move to its original VLAN. Parameters ports - A range of ports enable or disable guest VLAN function. state - Specify the guest VLAN port state of the configured ports. enable - join the guest VLAN. disable - remove from guest VLAN. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: Enable on port 1 – 8 to configure 802.1X guest VLAN: DGS-3450:admin# config 802.1x guest_vlan ports 1-8 state enable Command: config 802.1x guest_vlan ports 1-8 state enable Warning! GVRP of the ports were disabled! Success. DGS-3450:admin# show 802.1x guest_vlan Purpose Used to show guest VLAN setting. Syntax show 802.1x guest_vlan Description The show guest_vlan command allows you to show the information of guest VLANs. Parameters None. Restrictions None. Example usage: To show 802.1X guest VLAN on the switch: DGS-3450:admin# show 802.1x guest_vlan Command: show 802.1x guest_vlan Guest VLAN Setting ----------------------------------------------------------- Guest VLAN : guest Enable Guest VLAN Ports : 1-10 DGS-3450:admin# config radius add Purpose Use to add a new RADIUS server. The server with lower index has higher authenticative priority.

36 config radius add Syntax config radius add < server_index 1-3 > [ < server_ip > | < ipv6addr > ] key < passwd 32 > [ default | { auth_port < udp_port_number 1-65535 > | acct_port < udp_port_number 1-65535 > | timeout < int 1-255 > | retransmit < int 1-20 > } (1)] Description The “config radius add” command adds a new RADIUS server. Parameters server_index - RADIUS server index. server_ip - The IP address of the RADIUS server. ipv6addr - The IPv6 address of the RADIUS server. passwd - The key pre-negotiated between switch and the RADIUS server. It is used to encrypt user’s authentication data before being transmitted over internet. The maximum length of the key is 32. default - Sets the authentication UDP port number to 1812 accounting UDP port number to 1813, timeout to 5 seconds and retransmit to 2. auth_port - Specifies the UDP port number which is used to transmit RADIUS authentication data between the switch and the RADIUS server. The range is 1 to 65535. acct_port - Specifies the UDP port number which is used to transmit RADIUS accounting statistics between the switch and the RADIUS server. The range is 1 to 65535. timeout - The time in second for waiting server reply. Default value is 5 seconds. retransmit - The count for re-transmitting. Default value is 2. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To add a new RADIUS server: DGS-3450:admin# config radius add 1 10.48.74.121 key dlink default Command: config radius add 1 10.48.74.121 key dlink default Success. DGS-3450:admin# config radius delete Purpose Used to delete a RADIUS server. Syntax config radius delete < server_index 1-3 > Description The config radius delete command delete a RADIUS server. Parameters server_index - RADIUS server index. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To delete a radius server: DGS-3450:admin# config radius delete 1 Command: config radius delete 1 Success. DGS-3450:admin#

37 config radius Purpose Used to configure a RADIUS server. Syntax config radius { ipaddress [ | ] | key | auth_port [| default ] | acct_port [ | default ] | timeout [ | default ] | retransmit [ | default ]} (1) Description The config radius command configures a RADIUS server. Parameters server_index - RADIUS server index. server_ip - The IP address of the RADIUS server. ipv6addr - The IPv6 address of the RADIUS server passwd - The key pre-negotiated between switch and RADIUS server. It is used to encrypt user’s authentication data before being transmitted over internet. The maximum length of the key is 32. auth_port - Specifies the UDP port number which is used to transmit RADIUS authentication data between the switch and the RADIUS server. The range is 1 to 65535. Default value is 1812. acct_port - Specifies the UDP port number which is used to transmit RADIUS accounting statistics between the switch and the RADIUS server. The range is 1 to 65535. Default value is 1813. timeout - The time in second for waiting server reply. Default value is 5 seconds. retransmit - The count for re-transmitting. Default value is 2. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure a radius server: DGS-3450:admin# config radius server 1 auth_port 60 Command: config radius server 1 auth_port 60 Success. DGS-3450:admin# show radius Purpose Used to display RADIUS server configurations. Syntax show radius Description The show radius command displays RADIUS server configurations. Parameters None. Restrictions None. Example usage: To display RADIUS server configurations:

38 DGS-3450:admin# show radius Command: show radius Index 1 IP Address : fe80:fec0:56ab:34b0:20b2:6aff:fecf:7ec6 Auth-Port : 1812 Acct-Port : 1513 Timeout : 5 Retransmit : 2 Key : adfdslkfjefiefdkgjdassdwtgjk6y1w Index 2 IP Address : 172.18.211.71 Auth-Port : 1812 Acct-Port : 1813 Retransmit : 2 Key : 1234567 Index 3 IP Address : 172.18.211.108 Auth-Port : 1812 Acct-Port : 1813 Retransmit : 2 Key : adfdslkfjefiefdkgjdassdwtgjk6y1w Total Entries: 3 DGS-3450:admin# show auth_statistics Purpose Use to display information of authenticator statistics. Syntax show auth_statistics {ports [ | all]} Description The show auth_statistics command displays information of authenticator statistics. Parameters portlist - Specifies a range of ports to be displayed. all - Specifies that all the ports will be used for the configuration. Restrictions None. Example usage: To display authenticator statistics information for port 1:

39 DGS-3450:admin# show auth_statistics ports 1 Command: show auth_statistics ports 1 Port number : 1 EapolFramesRx 0 EapolFramesTx 6 EapolStartFramesRx 0 EapolReqIdFramesTx 6 EapolLogoffFramesRx 0 EapolReqFramesTx 0 EapolRespIdFramesRx 0 EapolRespFramesRx 0 InvalidEapolFramesRx 0 EapLengthErrorFramesRx 0 LastEapolFrameVersion 0 LastEapolFrameSource 00-00-00-00-00-00 DGS-3450:admin# show auth_diagnostics Purpose Used to display information of authenticator diagnostics. Syntax show auth_diagnostics {ports [ | all]} Description The show auth_diagnostics command displays information of authenticator diagnostics. Parameters portlist - Specifies a range of ports to be displayed. all - Specifies that all the ports will be used for the configuration. Restrictions None. Example usage: To display authenticator diagnostics information for port 1:

40 DGS-3450:admin# show auth_diagnostics ports 1 Command: show auth_diagnostics ports 1 Port number : 1 EntersConnecting 20 EapLogoffsWhileConnecting 0 EntersAuthenticating 0 SuccessWhileAuthenticating 0 TimeoutsWhileAuthenticating 0 FailWhileAuthenticating 0 ReauthsWhileAuthenticating 0 EapStartsWhileAuthenticating 0 EapLogoffWhileAuthenticating 0 ReauthsWhileAuthenticated 0 EapStartsWhileAuthenticated 0 EapLogoffWhileAuthenticated 0 BackendResponses 0 BackendAccessChallenges 0 BackendOtherRequestsToSupplicant 0 BackendNonNakResponsesFromSupplicant 0 BackendAuthSuccesses 0 BackendAuthFails 0 DGS-3450:admin# show auth_session_statistics Purpose Use to display information of authenticator session statistics. Syntax show auth_session_statistics {ports [ | all]} Description The show auth_session_statistics command displays information of authenticator session statistics. Parameters portlist - Specifies a range of ports to be displayed. all - Specifies that all the ports will be used for the configuration. Restrictions None. Example usage: To display authenticator session statistics information for port 1:

41 DGS-3450:admin# show auth_session_statistics ports 1 Command: show auth_session_statistics ports 1 Port number : 1 SessionOctetsRx 0 SessionOctetsTx 0 SessionFramesRx 0 SessionFramesTx 0 SessionId SessionAuthenticMethod Remote Authentication Server SessionTime 0 SessionTerminateCause SupplicantLogoff SessionUserName DGS-3450:admin# show auth_client Purpose Use to display information of RADIUS authentication client. Syntax show auth_client Description The show auth_client command displays information of RADIUS authentication client. Parameters None. Restrictions None. Example usage: To display authentication client information:

42 DGS-3450:admin# show auth_client Command: show auth_client radiusAuthClient ==> radiusAuthClientInvalidServerAddresses 0 radiusAuthClientIdentifier D-Link radiusAuthServerEntry ==> radiusAuthServerIndex :1 radiusAuthServerAddress 0.0.0.0 radiusAuthClientServerPortNumber 0 radiusAuthClientRoundTripTime 0 radiusAuthClientAccessRequests 0 radiusAuthClientAccessRetransmissions 0 radiusAuthClientAccessAccepts 0 radiusAuthClientAccessRejects 0 radiusAuthClientAccessChallenges 0 radiusAuthClientMalformedAccessResponses 0 radiusAuthClientBadAuthenticators 0 radiusAuthClientPendingRequests 0 radiusAuthClientTimeouts 0 radiusAuthClientUnknownTypes 0 radiusAuthClientPacketsDropped 0 DGS-3450:admin# show acct_client Purpose Used to display information of RADIUS accounting client. Syntax show acct_client Description The show acct_client command displays information of RADIUS accounting client. Parameters None. Restrictions None. Example usage: To display information of RADIUS accounting client:

43 DGS-3450:admin# show acct_client Command: show acct_client radiusAcctClient ==> radiusAcctClientInvalidServerAddresses 0 radiusAcctClientIdentifier D-Link radiusAuthServerEntry ==> radiusAccServerIndex : 1 radiusAccServerAddress 0.0.0.0 radiusAccClientServerPortNumber 0 radiusAccClientRoundTripTime 0 radiusAccClientRequests 0 radiusAccClientRetransmissions 0 radiusAccClientResponses 0 radiusAccClientMalformedResponses 0 radiusAccClientBadAuthenticators 0 radiusAccClientPendingRequests 0 radiusAccClientTimeouts 0 radiusAccClientUnknownTypes 0 radiusAccClientPacketsDropped 0 DGS-3450:admin# config accounting service Purpose Used to configure the state of the specified RADIUS accounting service. Syntax config accounting service [ network | shell | system ] state [ enable | disable ] Description The config accounting service command is used to enable or disable the specified RADIUS accounting service. Parameters network - Accounting service for 802.1X port access control. By default, the service is disabled. shell - Accounting service for shell events: When user logs on or out the switch (via the console, Telnet, or SSH) and timeout occurs, accounting information will be collected and sent to RADIUS server. By default, the service is disabled. system - Accounting service for system events: reset, reboot. By default, the service is disabled. enable - Enable the specified accounting service. disable - Disable the specified accounting service. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: Enable it to configure accounting shell state:

44 DGS-3450:admin# config accounting service shell state enable Command: config accounting service shell state enable Success. DGS-3450:admin# show accounting service Purpose Used to show the status of RADIUS accounting services. Syntax show accounting service Description The show accounting service command displays the state for RADIUS accounting service. Parameters portlist - Specifies a range of ports to be configured. Restrictions None. Example usage: To show information of RADIUS accounting services: DGS-3450:admin# show accounting service Command: show accounting service Accounting Service ------------------- Network : Enabled Shell : Enabled System : Enabled DGS-3450:admin#

45 6 ACCESS AUTHENTICATION CONTROL COMMANDS The TACACS / XTACACS / TACACS+ / RADIUS commands allow users to secure access to the Switch using the TACACS / XTACACS / TACACS+ / RADIUS protocols. When a user logs in to the Switch or tries to access the administrator level privilege, he or she is prompted for a password. If TACACS / XTACACS / TACACS+ / RADIUS authentication is enabled on the Switch, it will contact a TACACS / XTACACS / TACACS+ / RADIUS server to verify the user. If the user is verified, he or she is granted access to the Switch. There are currently three versions of the TACACS security protocol, each a separate entity. The Switch’s software supports the following versions of TACACS: • TACACS (Terminal Access Controller Access Control System) —Provides password checking and authentication, and notification of user actions for security purposes utilizing via one or more centralized TACACS servers, utilizing the UDP protocol for packet transmission. • Extended TACACS (XTACACS) — An extension of the TACACS protocol with the ability to provide more types of authentication requests and more types of response codes than TACACS. This protocol also uses UDP to transmit packets. • TACACS+ (Terminal Access Controller Access Control System plus) — Provides detailed access control for authentication for network devices. TACACS+ is facilitated through Authentication commands via one or more centralized servers. The TACACS+ protocol encrypts all traffic between the Switch and the TACACS+ daemon, using the TCP protocol to ensure reliable delivery. The Switch also supports the RADIUS protocol for authentication using the Access Authentication Control commands. RADIUS or Remote Authentication Dial In User Server also uses a remote server for authentication and can be responsible for receiving user connection requests, authenticating the user and returning all configuration information necessary for the client to deliver service through the user. RADIUS may be facilitated on this Switch using the commands listed in this section. In order for the TACACS / XTACACS / TACACS+ / RADIUS security function to work properly, a TACACS / XTACACS / TACACS+ / RADIUS server must be configured on a device other than the Switch, called a server host and it must include usernames and passwords for authentication. When the user is prompted by the Switch to enter usernames and passwords for authentication, the Switch contacts the TACACS / XTACACS / TACACS+ / RADIUS server to verify, and the server will respond with one of three messages: a. The server verifies the username and password, and the user is granted normal user privileges on the Switch. b. The server will not accept the username and password and the user is denied access to the Switch. c. The server doesn’t respond to the verification query. At this point, the Switch receives the timeout from the server and then moves to the next method of verification configured in the method list. The Switch has four built-in server groups, one for each of the TACACS, XTACACS, TACACS+ and RADIUS protocols. These built-in server groups are used to authenticate users trying to access the Switch. The users will set server hosts in a preferable order in the built-in server group and when a user tries to gain access to the Switch, the Switch will ask the first server host for authentication. If no authentication is made, the second server host in the list will be queried, and so on. The built-in server group can only have hosts that are running the specified protocol. For example, the TACACS server group can only have TACACS server hosts. The administrator for the Switch may set up five different authentication techniques per user-defined method list (TACACS / XTACACS / TACACS+ / RADIUS / local / none) for authentication. These techniques will be listed in an order preferable, and defined by the user for normal user authentication on the Switch, and may contain up to eight authentication techniques. When a user attempts to access the Switch, the Switch will select the first technique listed for authentication. If the first technique goes through its server hosts and no authentication is returned, the Switch will then go to the next technique listed in the server group for authentication, until the authentication has been verified or denied, or the list is exhausted.

46 Please note that user granted access to the Switch will be granted normal user privileges on the Switch. To gain access to admin level privileges, the user must enter the enable admin command and then enter a password, which was previously configured by the administrator of the Switch. The Access Authentication Control commands in the Command Line Interface (CLI) are listed (along with the appropriate parameters) in the following table. NOTE: TACACS, XTACACS and TACACS+ are separate entities and are not compatible. The Switch and the server must be configured exactly the same, using the same protocol. (For example, if the Switch is set up for TACACS authentication, so must be the host server.)

47 Command Parameters enable password encryption disable password encryption create account [admin | operator | user] config account {encrypt [plain_text | sha_1] } show account delete account enable authen_policy disable authen_policy show authen_policy create authen_login method_list_name config authen_login [default | method_list_name ] method {tacacs | xtacacs | tacacs+ | radius | server_group | local | none} delete authen_login method_list_name show authen_login [default | method_list_name | all] create authen_enable method_list_name config authen_enable [default | method_list_name ] method {tacacs | xtacacs | tacacs+ | radius | server_group | local _enable | none} delete authen_enable method_list_name show authen_enable [default | method_list_name | all] config authen application [console | telnet | ssh | http | all] [login | enable] [default | method_list_name ] show authen application create authen server_group config authen server_group [tacacs | xtacacs | tacacs+ | radius | ] [add | delete] server_host protocol [tacacs | xtacacs | tacacs+ | radius] delete authen server_group show authen server_group {} create authen server_host protocol [tacacs | xtacacs | tacacs+ | radius] { port | key [ | none] | timeout | retransmit } config authen server_host protocol [tacacs | xtacacs | tacacs+ | radius] { port | key [ | none ] | timeout | retransmit } delete authen server_host protocol [tacacs | xtacacs | tacacs+ | radius] show authen server_host config authen parameter response_timeout config authen parameter attempt show authen parameter enable admin

48 Command Parameters config admin local_enable Each command is listed, in detail, in the following sections. enable password encryption Purpose This command is used to enable password encryption. Syntax enable password encryption Description The user account configuration information will be stored in the configuration file, and can be applied to the system later. If password encryption is enabled, the passwords will be in encrypted form. When password encryption is disabled, if the user specifies the password in plain text form, the password will be in plan text form. However, if the user specifies the password in encrypted form, or if the password has been converted to encrypted form by the last enable password encryption command, the password will always be in the encrypted form and can not be reverted back to plaintext. Parameters None Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To enable password encryption: DGS-3450:admin# enable password encryption Command: enable password encryption DGS-3450:admin# disable password encryption Purpose This command is used to disable password encryption. Syntax disable password encryption Description The user account configuration information will be stored in the configuration file, and can be applied to the system later. If password encryption is enabled, the passwords will be in encrypted form. When password encryption is disabled, if the user specifies the password in plain text form, the password will be in plan text form. However, if the user specifies the password in encrypted form, or if the password has been converted to encrypted form by the last enable password encryption command, the password will always be in the encrypted form and can not be reverted back to plaintext. Parameters None. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To disable password encryption:

49 DGS-3450:admin# disable password encryption Command: disable password encryption DGS-3450:admin# create account Purpose This command is used to create user accounts. Syntax create account [admin | operator | user] Description The create account command is used to create user accounts. A username can be between 1 and 15 characters. The password is between 0 and 15 characters and is case sensitive. The total number of accounts supported by the Switch (including admin and user level accounts) is 8. Parameters admin - Specify an administrator level account. The administrator is the highest privilege level in the Switch. operator - Specify an operator level account. user - Specify a user level account. - The user name, which must be a minimum of 1 character and a maximum of 15 characters. Restrictions Only Administrator can issue this command. Example usage: To create the admin-level user “alpha”: DGS-3450:admin# create account admin alpha Command: create account admin alpha Enter a case-sensitive new password:**** Enter the new password again for confirmation:**** Success. DGS-3450:admin# config account Purpose This command is used to configure user accounts. Syntax config account {encrypt [plain_text | sha_1] } Description When the password information is not specified in the command, the system will prompt the user to input the password interactively. In this case, the user can only input a plain text password. If the user specifies a password in the command, the user can select to input the password in plain text form or in encrypted form. The encryption algorithm is based on SHA-1. Parameters - Specify the name of the account. The account must already be defined. plain_text - Specify the password in plain text form. sha_1 - Specify the password in SHA-1 encrypted form. password - The password for the user account. The length of a password in plain-text form and encrypted form are different. For a plain-text form password, the password must be a minimum of 0 characters and a maximum of 15 characters. For an encrypted form password, the length is fixed to 35 bytes long. The password is case-sensitive. Restrictions Only Administrator can issue this command.

50 Example usage: To configure the user password of the “alpha” account: DGS-3450:admin# config account alpha Command: config account alpha Enter an old password:**** Enter a case-sensitive new password:**** Enter the new password again for confirmation:**** Success. DGS-3450:admin# show account Purpose This command is used to display the user accounts that have been created on the Switch. Syntax show account Description The show account command displays the user accounts that have been created on the Switch. Parameters None Restrictions Only Administrator can issue this command. Example usage: To display the user accounts that have been created on the Switch: DGS-3450:admin# show account Command: show account Current Accounts: Username Access Level --------------- ------------ System User dlink Admin Total Entries : 2 DGS-3450:admin# delete account Purpose This command is used to delete an existing account. Syntax delete account Description The delete account command deletes an existing account. Parameters - Specify the name of the user that will be deleted. Restrictions Only Administrator can issue this command. Example usage: To delete the user account “System”:

51 DGS-3450:admin# delete account System Command: delete account System Success. DGS-3450:admin# enable authen_policy Purpose This command is used to enable the system access authentication policy. Syntax enable authen_policy Description Enable system access authentication policy- When authentication is enabled, the device will adopt the login authentication method list to authenticate the user attempting to log in, and adopt the enable authentication method list to authenticate the enable password for promoting the user‘s privilege to Admin level. Parameters None. Restrictions Only Administrator can issue this command. Example usage: To enable the system access authentication policy: DGS-3450:admin# enable authen_policy Command: enable authen_policy Success. DGS-3450:admin# disable authen_policy Purpose This command is used to disable the system access authentication policy. Syntax disable authen_policy Description Disable system access authentication policy- When authentication is disabled, the device will adopt the local user account database to authenticate the user attempting to log in, and adopt the local enable password to authenticate the enable password for promoting the user ‘s privilege to Admin level. Parameters None. Restrictions Only Administrator can issue this command. Example usage: To disable the system access authentication policy: DGS-3450:admin# disable authen_policy Command: disable authen_policy Success. DGS-3450:admin#

52 show authen_policy Purpose This command is used to display if the system access authentication policy is enabled or disabled. Syntax show authen_policy Description Displays if the system access authentication policy is enabled or disabled. Parameters None. Restrictions Only Administrator can issue this command. Example usage: To display if the system access authentication policy is enabled or disabled: DGS-3450:admin# show authen_policy Command: show authen_policy Authentication Policy : Enabled DGS-3450:admin# create authen_login method_list_name Purpose This command is used to create a user-defined method list of authentication methods for users attempting to log in to the Switch. Syntax create authen_login method_list_name Description Creates a user-defined method list of authentication methods for users attempting to log into the Switch. The maximum number of supported login method lists is 8. Parameters - The user-defined method list name Restrictions Only Administrator can issue this command. Example usage: To create a user-defined method list called “login_list_1” for users attempting to log in to the Switch: DGS-3450:admin# create authen_login method_list_name login_list_1 Command: create authen_login method_list_name login_list_1 Success. DGS-3450:admin# config authen_login Purpose This command is used to configure a user-defined or default method list of authentication methods for users attempting to log in to the Switch. Syntax config authen_login [default | method_list_name ] method {tacacs | xtacacs | tacacs+ | radius | server_group | local | none} Description Configures a user-defined or default method list of authentication methods for users attempting to log in to the Switch. The method sequence will affect the authentication result. For example, if the user specifies tacacs+ first, then tacacs and local, when the user tries to log in, the authentication request will be sent to the first server host in the tacacs+ built-in server group. If the first server host in the tacacs+ group is missing, the authentication request will be sent to the second server host in the tacacs+ group, and so on. If all server

53 config authen_login hosts in the tacacs+ group are missing, the authentication request will be sent to the first server host in the tacacs group. If all server hosts in the tacacs group are missing, the local account database in the device will be used to authenticate the user. When a user logs in to the device successfully, using either the tacacs/xtacacs/tacacs+/radius built-in, user-defined server groups methods, or none, only the “user” privilege level will be assigned. If the user wants to access admin privilege level, the user must use the “enable admin” command to promote the privilege level. However, when the local method is used, the privilege level will depend on the account privilege level stored in the local device. Parameters default - Specify the default method list of authentication methods. method_list_name - Specify the user-defined method list of authentication methods. tacacs - Specify authentication by the built-in server group “tacacs”. xtacacs - Specify authentication by the built-in server group “xtacacs”. tacacs+ - Specify authentication by the built-in server group “tacacs+”. radius - Specify authentication by the built-in server group “radius”. server_group - Specify authentication by the user-defined server group. local - Specify authentication by the local user account database in the device. none - Specify no authentication. Restrictions Only Administrator can issue this command. Example usage: To configure a user-defined method list called “login_list_1”, that specifies a sequence of the built-in “tacacs+” server group, followed by the “tacacs” server group, and finally the local account database for users attempting to log in to the Switch: DGS-3450:admin# config authen_login method_list_name login_list_1 method tacacs+ tac acs local Command: config authen_login method_list_name login_list_1 method tacacs+ tacac s local Success. DGS-3450:admin# delete authen_login method_list_name Purpose This command is used to delete a user-defined method list of authentication methods for users logging into the Switch. Syntax delete authen_login method_list_name Description Deletes a user-defined method list of authentication methods for users attempting to log in to the Switch. Parameters - The user-defined method list name. Restrictions Only Administrator can issue this command. Example usage: To delete the user-defined method list called “login_list_1” for users attempting to log in to the Switch:

54 DGS-3450:admin# delete authen_login method_list_name login_list_1 Command: delete authen_login method_list_name login_list_1 Success. DGS-3450:admin# show authen_login Purpose This command is used to display the method list of authentication methods that will be used for users attempting to log in to the Switch. Syntax show authen_login [default | method_list_name | all] Description Displays the method list of authentication methods that will be used for users attempting to log in to the Switch. Parameters default - Displays the default user-defined method list for users logging into the Switch. method_list_name - Displays the specific user-defined method list for users logging into the Switch. all - Displays all the method lists for users attempting to log in to the Switch. Restrictions Only Administrator can issue this command. Example usage: To display the user-defined method list called “login_list_1” for users attempting to log in to the Switch: DGS-3450:admin# show authen_login method_list_name login_list_1 Command: show authen_login method_list_name login_list_1 Method List Name Priority Method Name Comment ---------------- -------- --------------- ------------------ login_list_1 1 tacacs+ Built-in Group 2 tacacs Built-in Group 3 mix_1 User-defined Group 4 local Keyword DGS-3450:admin# create authen_enable method_list_name Purpose This command is used to create a user-defined method list of authentication methods for promoting a user's privilege to Admin level. Syntax create authen_enable method_list_name Description Creates a user-defined method list of authentication methods for promoting a user's privilege to Admin level. The maximum number of supported enable method lists is 8. Parameters - The user-defined method list name Restrictions Only Administrator can issue this command. Example usage: To create a user-defined method list called “enable_list_1” for promoting a user's privilege to Admin level:

55 DGS-3450:admin# create authen_enable method_list_name enable_list_1 Command: create authen_enable method_list_name enable_list_1 Success. DGS-3450:admin# config authen_enable Purpose This command is used to configure a user-defined or default method list of authentication methods for promoting a user's privilege to Admin level. Syntax config authen_enable [default | method_list_name ] method {tacacs | xtacacs | tacacs+ | radius | server_group | local _enable | none} Description Configures a user-defined or default method list of authentication methods for promoting a user's privilege to Admin level. The sequence of methods will affect the authentication result. For example, if the sequence is tacacs+ first, followed by tacacs and local_enable, when a user tries to login, the authentication request will be sent to the first server host in the tacacs+ built-in server group. If the first server host in the tacacs+ group is missing, the authentication request will be sent to the second server host in the tacacs+ group, and so on. If all server hosts in the tacacs+ group are missing, the authentication request will be sent to the first server host in the tacacs group. If all server hosts in the tacacs group are missing, the local enable password in the device will be used to authenticate the user’s password. The local enable password in the device can be configured using the “config admin local_password” CLI command. Parameters default - Specify the default method list of authentication methods. method_list_name - Specify the user-defined method list of authentication methods. tacacs - Specify authentication by the built-in server group “tacacs”. xtacacs - Specify authentication by the built-in server group “xtacacs”. tacacs+ - Specify authentication by the built-in server group “tacacs+”. radius - Specify authentication by the built-in server group “radius”. server_group - Specify authentication by the user-defined server group. local_enable - Specify authentication by the local enable password in the device. none - Specify no authentication. Restrictions Only Administrator can issue this command. Example usage: To configure a user-defined method list called “method_list_name” that will be used to promote a user's privilege to Admin level: DGS-3450:admin# config authen_enable method_list_name enable_list_1 method tacacs+ tac acs local_enable Command: config authen_ enable method_list_name enable_list_1 method tacacs+ tacac s local_enable Success. DGS-3450:admin# delete authen_enable method_list_name Purpose This command is used to delete a user-defined method list of authentication methods for promoting a user's privilege to Admin level. Syntax delete authen_enable method_list_name

56 delete authen_enable method_list_name Description Deletes a user-defined method list of authentication methods for promoting a user's privilege to Admin level. Parameters - The user-defined method list name Restrictions Only Administrator can issue this command. Example usage: To delete the user-defined method list called “enable_list_1”, that is used to promote a user's privilege to Admin level: DGS-3450:admin# delete authen_enable method_list_name enable_list_1 Command: delete authen_enable method_list_name enable_list_1 Success. DGS-3450:admin# show authen_enable Purpose This command is used to display the method list of authentication methods for promoting a user's privilege to Admin level. Syntax show authen_enable [default | method_list_name | all] Description Displays the method list of authentication methods used for promoting a user's privilege to Admin level. Parameters default - Display the default user-defined method list for promoting a user's privilege to Admin level. method_list_name - Display the specific user-defined method list for promoting a user's privilege to Admin level. all - Display all the method lists for promoting a user's privilege to Admin level. Restrictions Only Administrator can issue this command. Example usage: To display all the method lists that are used for promoting a user's privilege to Admin level: DGS-3450:admin# show authen_enable all Command: show authen_enable all Method List Name Priority Method Name Comment ---------------- -------- --------------- ------------------ enable_list_1 1 tacacs+ Built-in Group 2 tacacs Built-in Group 3 mix_1 User-defined Group 4 local Keyword enable_list_2 1 tacacs+ Built-in Group 2 radius Built-in Group Total Entries : 2 DGS-3450:admin#

57 config authen application Purpose This command is used to configure login or enable method lists for all or the specified applications. Syntax config authen application [console | telnet | ssh | http | all] [login | enable] [default | method_list_name ] Description Configures login or enable method lists for all or the specified applications. Parameters console - Application: Console. telnet - Application: Telnet. ssh - Application: SSH. http - Application: Web. all - Application: Console, Telnet, SSH, and Web. login - Specify the method list of authentication methods for user’s attempting to log in. enable - Specify the method list of authentication methods for promoting a user's privilege to Admin level. default - Specify the default method list. method_list_name - Specify the user-defined method list name. Restrictions Only Administrator can issue this command. Example usage: To configure a login method list for Telnet called “login_list_1”: DGS-3450:admin# config authen application telnet login method_list_name login_list_1 Command: config authen application telnet login method_list_name login_list_1 Success. DGS-3450:admin# show authen application Purpose This command is used to display the login/enable method list for all applications. Syntax show authen application Description Displays the login/enable method list for all applications. Parameters None. Restrictions Only Administrator can issue this command. Example usage: To display the login/enable method lists for all applications: DGS-3450:admin# show authen application Command: show authen application Application Login Method List Enable Method List ----------- ----------------- ------------------ Console default default Telnet login_list_1 default HTTP default default DGS-3450:admin#

58 create authen server_group Purpose This command is used to create a user-defined authentication server group. Syntax create authen server_group Description Creates a user-defined authentication server group. The maximum number of supported server groups, including the built-in server groups, is 8. Each group can have a maximum of 8 server hosts.. Parameters - Specify the user-defined server group name. Restrictions Only Administrator can issue this command. Example usage: To create a user-defined authentication server group called “mix_1”: DGS-3450:admin# create authen server_group mix_1 Command: create authen server_group mix_1 Success. DGS-3450:admin# config authen server_group Purpose This command is used to add or remove an authentication server host to or from the specified server group. Syntax config authen server_group [tacacs | xtacacs | tacacs+ | radius | ] [add | delete] server_host protocol [tacacs | xtacacs | tacacs+ | radius] Description Adds or removes an authentication server host to or from the specified server group. The built-in “tacacs”, “xtacacs”, “tacacs+”, and “radius” server groups only accept server hosts with the same protocol, but a user-defined server group can accept server hosts with different protocols. The server host must be created first by using the “create authen server_host” CLI command. Parameters server_group tacacs - Specify the built-in server group “tacacs”. server_group xtacacs - Specify the built-in server group “xtacacs”. server_group tacacs+ - Specify the built-in server group “tacacs+”. server_group radius - Specify the built-in server group “radius”. server_group - Specify a user-defined server group. add - Add a server host to a server group. delete - Remove a server host from a server group. server_host - Specify the server host’s IP address. protocol tacacs - Specify TACACS for the server host’s authentication protocol protocol xtacacs - Specify XTACACS for the server host’s authentication protocol protocol tacacs+ - Specify TACACS+ for the server host’s authentication protocol protocol radius - Specify RADIUS for the server host’s authentication protocol Restrictions Only Administrator can issue this command. Example usage: To add an authentication server host with an IP address of 10.1.1.222 to server group “mix_1”, specifying the TACACS+ protocol:

59 DGS-3450:admin# config authen server_group mix_1 add server_host 10.1.1.222 protocol tacacs+ Command: config authen server_group mix_1 add server_host 10.1.1.222 protocol tacacs+ Success. DGS-3450:admin# delete authen server_group Purpose This command is used to delete a user-defined authentication server group. Syntax delete authen server_group Description Deletes a user-defined authentication server group. Parameters - Specify the user-defined server group name that will be deleted. Restrictions Only Administrator can issue this command. Example usage: To delete a user-defined authentication server group called “mix_1”: DGS-3450:admin# delete authen server_group mix_1 Command: delete authen server_group mix_1 Success. DGS-3450:admin# show authen server_group Purpose This command is used to display the authentication server groups. Syntax show authen server_group {} Description Displays the authentication server groups. Parameters - Specify the built-in or user-defined server group name to display. Restrictions Only Administrator can issue this command. Example usage: To display all authentication server groups:

60 DGS-3450:admin# show authen server_group Command: show authen server_group Server Group : mix_1 Group Name IP Address Protocol --------------- --------------- -------- mix_1 10.1.1.222 TACACS+ 10.1.1.223 TACACS radius 10.1.1.224 RADIUS tacacs 10.1.1.225 TACACS tacacs+ 10.1.1.226 TACACS+ xtacacs 10.1.1.227 XTACACS Total Entries : 5 DGS-3450:admin# create authen server_host Purpose This command is used to create an authentication server host. Syntax create authen server_host protocol [tacacs | xtacacs | tacacs+ | radius] { port | key [ | none] | timeout | retransmit } Description Creates an authentication server host. When an authentication server host is created, the IP address and protocol are the index. This means that more than one authentication protocol service can be run on the same physical host. The maximum number of supported server hosts is 16. Parameters server_host - Specify the server host’s IP address. protocol tacacs - Specify that the server host’s authentication protocol will be TACACS. protocol xtacacs - Specify that the server host’s authentication protocol will be XTACACS. protocol tacacs+ - Specify that the server host’s authentication protocol will be TACACS+.. protocol radius - Specify that the server host’s authentication protocol will be RADIUS. port - The port number of the authentication protocol for the server host. Default value for TACACS/XTACACS/TACACS+ is 49. Default value for RADIUS is 1812. key - The key for TACACS+ and RADIUS authentication. If the value is null, no encryption will apply. This value is meaningless for TACACS and XTACACS. none - No encryption for TACACS+ and RADIUS authentication. This value is meaningless for TACACS and XTACACS. timeout - The time in seconds to wait for the server reply. Default value is 5 seconds. retransmit - The count for re-transmissions. This value is meaningless for TACACS+. Default value is 2. Restrictions Only Administrator can issue this command. Example usage: To create a TACACS+ authentication server host, specifying a listening port number of 15555 and a timeout value of 10 seconds:

61 DGS-3450:admin# reate authen server_host 10.1.1.222 protocol tacacs+ port 15555 timeout 10 Command: create authen server_host 10.1.1.222 protocol tacacs+ port 15555 timeout 10 Success. DGS-3450:admin# config authen server_host Purpose This command is used to configure an authentication server host. Syntax config authen server_host protocol [tacacs | xtacacs | tacacs+ | radius] { port | key [ | none ] | timeout | retransmit } Description Configures an authentication server host. Parameters server_host - Specify the server host’s IP address. protocol tacacs - Specify that the server host’s authentication protocol will be TACACS. protocol xtacacs - Specify that the server host’s authentication protocol will be XTACACS. protocol tacacs+ - Specify that the server host’s authentication protocol will be TACACS+. protocol radius - Specify that the server host’s authentication protocol will be RADIUS. port - The port number of the authentication protocol for the server host. Default value for TACACS/XTACACS/TACACS+ is 49. Default value for RADIUS is 1812. key - The key for TACACS+ and RADIUS authentication. If the value is null, no encryption will apply. This value is meaningless for TACACS and XTACACS. none - No encryption for TACACS+ and RADIUS authentication. This value is meaningless for TACACS and XTACACS. timeout - The time in seconds for waiting for the server reply. Default value is 5 seconds. retransmit - The count for re-transmissions. This value is meaningless for TACACS+. Default value is 2. Restrictions Only Administrator can issue this command. Example usage: To configure the TACACS+ authentication server host with an IP address of 10.1.1.222 to have the key value “This is a secret”: DGS-3450:admin# config authen server_host 10.1.1.222 protocol tacacs+ key "This is a secret" Command: config authen server_host 10.1.1.222 protocol tacacs+ key "This is a se cret" Success. DGS-3450:admin# delete authen server_host Purpose This command is used to delete an authentication server host. Syntax delete authen server_host protocol [tacacs | xtacacs | tacacs+ | radius] Description Deletes an authentication server host. Parameters server_host - Specify the server host’s IP address. protocol tacacs - Specify that the server host’s authentication protocol is TACACS.

62 delete authen server_host protocol xtacacs - Specify that the server host’s authentication protocol is XTACACS. protocol tacacs+ - Specify that the server host’s authentication protocol is TACACS+. protocol radius - Specify that the server host’s authentication protocol is RADIUS. Restrictions Only Administrator can issue this command. Example usage: To delete an authentication server host, with an IP address of 10.1.1.222, that is running the TACACS+ protocol: DGS-3450:admin# delete authen server_host 10.1.1.222 protocol tacacs+ Command: delete authen server_host 10.1.1.222 protocol tacacs+ Success. DGS-3450:admin# show authen server_host Purpose This command is used to display the authentication server hosts. Syntax show authen server_host Description Displays the authentication server hosts. Parameters None. Restrictions Only Administrator can issue this command. Example usage: To display all authentication server hosts: DGS-3450:admin# show authen server_host Command: show authen server_host SRV IP Address Protocol Port Timeout Retransmit Key --------------- -------- ----- ------- ---------- ------------------------- 10.1.1.222 TACACS+ 15555 10 No Use This is a secret Total Entries : 1 DGS-3450:admin# config authen parameter response_timeout Purpose This command is used to configure the amount of time the Switch will wait for a user to authenticate through a console, Telnet, or SSH application. Syntax config authen parameter response_timeout Description Configure the amount of time the Switch will wait for a user to authenticate through a console, Telnet, or SSH application. Parameters - The amount time the Switch will wait for a user to authenticate through a console, Telnet, or SSH application. 0 means there is no time out. Default value is 30 seconds. Restrictions Only Administrator can issue this command.

63 Example usage: To configure the amount of time the Switch will wait for a user to authenticate through a console, Telnet, or SSH application to 60 seconds: DGS-3450:admin# config authen parameter response_timeout 60 Command: config authen parameter response_timeout 60 Success. DGS-3450:admin# config authen parameter attempt Purpose This command is used to configure the maximum number of attempts a user can try to login or promote the privilege on a console, Telnet, or SSH application. Syntax config authen parameter attempt Description Used to configure the maximum number of attempts that a user can try to login or promote the privilege on a console, Telnet, or SSH application. If failed login attempts exceeds this number, the connection or access will be locked. Parameters - Specify the maximum number of attempts that a user can try to login or promote the privilege on a console or telnet or SSH application. Default value is 3. Restrictions Only Administrator can issue this command. Example usage: To configure the maximum attempts for user's trying to login or promote the privilege to be 9: DGS-3450:admin# config authen parameter attempt 9 Command: config authen parameter attempt 9 Success. DGS-3450:admin# show authen parameter Purpose This command is used to display the parameters of authentication. Syntax show authen parameter Description Displays the parameters of authentication. Parameters None. Restrictions Only Administrator can issue this command. Example usage: To display the parameters of authentication:

64 DGS-3450:admin# show authen parameter Command: show authen parameter Response timeout : 60 seconds User attempts : 9 DGS-3450:admin# enable admin Purpose This command is used to enter the administrator level privilege Syntax enable admin Description Promote the "user" privilege level to "admin" level. When the user enters this command, the authentication method tacacs, xtacacs, tacacs+, user-defined server groups, local_enable or none will be used to authenticate the user. Since TACACS, XTACACS and RADIUS do not support the "enable" function by their selves,, if the user wants to use either one of these three protocols to enable authentication, the user must create a special account on the server host first, which has a username of "enable", and then configure its password as the enable password to support the "enable" function. This command can not be used when the authentication policy is disabled. For switches with 3-levels of privilege, this command can be used by users with user level and operator level privileges to access the administrator privilege level. Parameters None. Restrictions None. Example usage: To enable administrator level privileges: DGS-3450:admin# enable admin Password:******** DGS-3450:admin# config admin local_enable Purpose This command is used to configure the local enable password of the administrator level privilege. Syntax config admin local_enable Description Configure the local enable password for the enable command. When the user chooses the “local_enable” method to promote the privilege level, the enable password of the local device is needed. When the password information is not specified in the command, the system will prompt the user to input the password interactively. In this case, the user can only input a plain text password. If the password is present in the command, the user can select to input the password in plain text or encrypted form. The encryption algorithm is based on SHA-1. Parameters None. Restrictions Only Administrator can issue this command. Example usage: To configure the administrator password:

65 DGS-3450:admin# config admin local_enable Command: config admin local_enable Enter the old password: Enter the case-sensitive new password:****** Enter the new password again for confirmation:****** Success. DGS-3450:admin#

66 7 ACCESS CONTROL LIST (ACL) COMMANDS The Access Control List (ACL) commands in the Command Line Interface (CLI) are listed (along with the appropriate parameters) in the following table.

67 Command Parameters create access_profile [ethernet {vlan | source_mac | destination_mac | 802.1p | ethernet_type} | ip {vlan | source_ip_mask | destination_ip_mask | dscp | [icmp {type | code} | igmp {type} | tcp {src_port_mask | dst_port_mask | flag_mask [ all | {urg | ack | psh | rst | syn | fin}]} | udp {src_port_mask | dst_port_mask } | protocol_id_mask {user_define_mask }]}| packet_content_mask { offset_chunk_1 | offset_chunk_2 | offset_chunk_3 | offset_chunk_4 }| ipv6 {class | flowlabel | source_ipv6_mask | destination_ipv6_mask | [ tcp {src_port_mask | dst_port_mask } | udp {src_port_mask | dst_port_mask }]}] profile_id delete access_profile [profile_id |all] config access_profile profile_id [add access_id [auto_assign | ] [ethernet {vlan | source_mac | destination_mac | 802.1p | ethernet_type } port [ | all] [permit {priority {replace_priority} | rx_rate [no_limit | ] | replace_dscp | counter [enable | disable]} | mirror {group_id } | deny] | ip {vlan | source_ip | destination_ip | dscp | [icmp {type | code } | igmp {type } | tcp {src_port | dst_port | urg | ack | psh | rst | syn | fin} | udp {src_port | dst_port } | protocol_id {user_define }]} port [ | all] [permit {priority {replace_priority} | rx_rate [ no_limit | ] | replace_dscp | counter [enable | disable]} | mirror {group_id } | deny] | packet_content {offset_chunk_1 | offset_chunk_2 | offset_chunk_3 | offset_chunk_4 } port [ | all] [permit {priority {replace_priority} | rx_rate [no_limit | ] | replace_dscp | counter [enable | disable]} | mirror {group_id } | deny] | ipv6 {class | flowlabel | source_ipv6 | destination_ipv6 | [ tcp {src_port | dst_port } | udp {src_port | dst_port }]} port [ | all] [permit {priority {replace_priority} | rx_rate [no_limit | ] | counter [enable | disable]} | mirror {group_id } | deny]]{time_range } | delete access_id ] config flow_meter profile_id access_id [ [ tr_tcm cir {cbs } pir {pbs } | sr_tcm cir cbs ebs ] {conform [permit | replace_dscp ] {counter [enable |disable]}} exceed [permit | replace_dscp | drop] {counter [enable |disable]} violate [permit | replace_dscp | drop] {counter [enable |disable]} | delete] show flow_meter {profile_id {access_id }} config time_range [hours start_time end_time weekdays |delete] show time_range Each command is listed, in detail, in the following sections. create access_profile Purpose Used to create access list rules.

68 create access_profile Syntax create access_profile [ethernet {vlan | source_mac | destination_mac | 802.1p | ethernet_type} | ip {vlan | source_ip_mask | destination_ip_mask | dscp | [icmp {type | code} | igmp {type} | tcp {src_port_mask | dst_port_mask | flag_mask [ all | {urg | ack | psh | rst | syn | fin}]} | udp {src_port_mask | dst_port_mask } | protocol_id_mask {user_define_mask }]}| packet_content_mask { offset_chunk_1 | offset_chunk_2 | offset_chunk_3 | offset_chunk_4 }| ipv6 {class | flowlabel | source_ipv6_mask | destination_ipv6_mask | [ tcp {src_port_mask | dst_port_mask } | udp {src_port_mask | dst_port_mask }]}] profile_id Description The create access_profile command creates access list rules. Parameters vlan - Specifies a vlan mask. Only the last 12 bits of the mask will be considered. source_mac - Specifies the source mac mask. destination_mac - Specifies the destination mac mask. 802.1p - Specifies 802.1p priority tag mask. ethernet_type - Specifies the ethernet type mask. vlan - Specifies a vlan mask. Only the last 12 bits of the mask will be considered. source_ip_mask - Specifies an IP source submask. destination_ip_mask - Specifies an IP destination submask. dscp - Specifies the dscp mask. icmp - Specifies that the rule applies to icmp traffic. type - Specifies that the rule applies to icmp type traffic. code - Specifies that the rule applies to icmp code traffic. igmp - Specifies that the rule applies to igmp traffic. type - Specifies that the rule applies to igmp type traffic. tcp - Specifies that the rule applies to tcp traffic. src_port_mask - Specifies the tcp source port mask. dst_port_mask - Specifies the tcp destination port mask. flag_mask - Specifies the TCP flag field mask. udp - Specifies that the rule applies to udp traffic. src_port_mask - Specifies theudp source port mask. dst_port_mask - Specifies theudp destination port mask. protocod_id_mask - Specifies that the rule applies to the ip protocol id traffic. user_define_mask - Specifies that the rule applies to the ip protocol id and the mask options behind the IP header length is 20 bytes. ipv6 - Specifies ipv6 filtering mask. The field is optional by project. class - Specifies the ipv6 class. flowlabel - Specifies the ipv6 flowlabel. source_ipv6_mask - Specifies an IPv6 source submask. destination_ipv6_mask - Specifies an IPv6 destination submask. src_port_mask - Specifies an IPv6 L4(TCP/UDP) source port submask des_port_mask - Specifies an IPv6 L4(TCP/UDP) destination port submask profile_id - Specifies the index of access list profile. The range is depend on project.. offset_chunk_1, offset_chunk_2, offset_chunk_3, offset_chunk_4 - Specifies the frame content offset and mask. Up to 4 trunk offset and masks in maximum could be configured. A trunk mask presents 4 bytes. Restrictions Only Administrator and Operator-level users can issue this command.

69 Example usage: To create an Ethernet access profile: DGS-3450:admin# create access_profile ethernet vlan source_mac 00-00-00-00-00-01 destination_mac 00-00-00-00-00-02 802.1p ethernet_type profile_id 1 Command: create access_profile ethernet vlan source_mac 00-00-00-00-00-01 destination_mac 00-00-00-00-00-02 802.1p ethernet_type profile_id 1 Success. DGS-3450:admin# create access_profile ip source_ip_mask 20.0.0.0 destination_ip_mask 10.0.0.0 dscp icmp type code profile_id 2 Command: create access_profile ip source_ip_mask 20.0.0.0 destination_ip_mask 10.0.0.0 dscp icmp type code profile_id 2 Success. DGS-3450:admin# To create an option 2 packet content mask access profile: DGS-3450:admin# create access_profile packet_content_mask offset_chunk_1 0 0xFFFFFFFF offset_chunk_2 1 0xFFFFFFFF offset_chunk_3 2 0xFFFFFFFF offset_chunk_4 3 0xFFFFFFFF profile_id 3 Command: create access_profile packet_content_mask offset_chunk_1 0 0xFFFFFFFF offset_chunk_2 1 0xFFFFFFFF offset_chunk_3 2 0xFFFFFFFF offset_chunk_4 3 0xFFFFFFFF profile_id 3 Success. DGS-3450:admin# delete access_profile Purpose Used to delete access list rules. Syntax delete access_profile [profile_id |all] Description The delete access_profile command deletes access list rules. Delete access_profile command can only delete the profile which is created by ACL module. Parameters profile_id - Specifies the index of access list profile. The range is depend on project.. all - Specifies the whole access list profile to delete. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To delete access list rules:

70 DGS-3450:admin#delete access_profile profile_id 6 Command: delete access_profile profile_id 6 Success. DGS-3450:admin# config access_profile Purpose Used to configure access list entry. Syntax config access_profile profile_id [add access_id [auto_assign | ] [ethernet {vlan | source_mac | destination_mac | 802.1p | ethernet_type } port [ | all] [permit {priority {replace_priority} | rx_rate [no_limit | ] | replace_dscp | counter [enable | disable]} | mirror {group_id } | deny] | ip {vlan | source_ip | destination_ip | dscp | [icmp {type | code } | igmp {type } | tcp {src_port | dst_port | urg | ack | psh | rst | syn | fin} | udp {src_port | dst_port } | protocol_id {user_define }]} port [ | all] [permit {priority {replace_priority} | rx_rate [ no_limit | ] | replace_dscp | counter [enable | disable]} | mirror {group_id } | deny] | packet_content {offset_chunk_1 | offset_chunk_2 | offset_chunk_3 | offset_chunk_4 } port [ | all] [permit {priority {replace_priority} | rx_rate [no_limit | ] | replace_dscp | counter [enable | disable]} | mirror {group_id } | deny] | ipv6 {class | flowlabel | source_ipv6 | destination_ipv6 | [ tcp {src_port | dst_port } | udp {src_port | dst_port }]} port [ | all] [permit {priority {replace_priority} | rx_rate [no_limit | ] | counter [enable | disable]} | mirror {group_id } | deny]]{time_range } | delete access_id ] Description The config access_profile command configures access list entry. ACL mirror function will be worked after mirror enabled and mirror port has been configured by mirror command. When apply a access rule to a target, if the target is VLAN, then the setting for value the VLAN field will not take effect. Parameters profile_id - Specifies the index of access list profile. The range is depend on project. access_id - Specifies the index of access list entry. The range of this value is 1-65535, but the supported max entry number is depend on project. auto_assign - while add to multiple ports , the access id will be auto assigned. vlan - Specifies a vlan name source_mac - Specifies the source mac destination_mac - Specifies the destination mac 802.1p - Specifies the value of 802.1p priority tag, the vaule can be configured between 1 to 7 ethernet_type - Specifies the Ethernet type vlan - Specifies a vlan name source_ip - Specifies an IP source address destination_ip - Specifies an IP destination address dscp - Specifies the value of dscp, the value can be configured 0 to 63 icmp – See below: type - Specifies that the rule applies to the value of icmp type traffic code - Specifies that the rule applies to the value of icmp code traffic

71 config access_profile igmp – See below: type - Specifies that the rule applies to the value of igmp type traffic tcp – See below: src_port - Specifies that the rule applies the range of tcp source port dst_port - Specifies the range of tcp destination port range flag - Specifies the TCP flag fields . udp – See below: src_port - Specifies the range of tcp source port range dst_port - Specifies the range of tcp destination port mask protocod_id - Specifies that the rule applies to the value of ip protocol id traffic user_define - Specifies that the rule applies to the ip protocol id and the mask options behind the IP header length is 20 bytes. packet_content - Specifies the packet content for the user defined mask. ipv6 - Specifies the rule applies to ipv6 fields . The field is optional by project. class - Specifies the value of ipv6 class. flowlabel - Specifies the value of ipv6 flowlabel. source_ipv6 - Specifies the value of ipv6 source address. destination_ipv6 - Specifies the value of ipv6 destination address. src_port - Specifies the value of ipv6 L4(TCP/UDP) source port dst_port - Specifies the value of ipv6 L4(TCP/UDP) destination port port - Specifies a list of port to apply the rule. permit - Specifies the packets that match the access profile are permit by the switch priority - Specifies that priority of the packet will be changed if the packet match the access rule. replace_priority - Specifies 802.1p priority of the outgoing packet will be marked too. replace_dscp - Specifies that DSCP of the outgoing packet will be marked by the new value. counter - Specifies whether counter feature will be enabled / disabled. If the rule is binded with flow_meter, then “counter” here will be overrided. deny - Specifies the packets that match the access profile are filtered by the switch mirror - Specifies the packets that match the access profile are sent the copied one to the mirror port. time_range - Specifies name of this time range entry. offset_chunk_1, offset_chunk_2, offset_chunk_3, offset_chunk_4 - Specifies the content of the trunk to be monitored. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure an access list rule entry: DGS-3450:admin# config access_profile profile_id 1 add access_id 1 ip vlan default source_ip 20.2.2.3 destination_ip 10.1.1.252 dscp 3 icmp type 11 code 32 port 1 mirror group_id 1 time_range testdaily Command: config access_profile profile_id 1 add access_id 1 ip vlan default source_ip 20.2.2.3 destination_ip 10.1.1.252 dscp 3 icmp type 11 code 32 port 1 mirror group_id 1 time_range testdaily Mirror function must be enabled and mirror port must be configured. Success. DGS-3450:admin#

72 To configure an rule entry for packet content mask profile: DGS-3450:admin# config access_profile profile_id 5 add access_id auto_assign packet_content offset_chunk_1 0xAAAAAAAA offset_chunk_2 0xBBBBBBBB offset_chunk_3 0xFFFFFFFF offset_chunk_4 0xEEEEEEEE port all permit Command: config access_profile profile_id 5 add access_id auto_assign packet_content offset_chunk_1 0xAAAAAAAA offset_chunk_2 0xBBBBBBBB offset_chunk_3 0xFFFFFFFF offset_chunk_4 0xEEEEEEEE port all permit Success. DGS-3450:admin# show access_profile Purpose Used to display current access list table. Syntax show access_profile {profile_id } Description The show access_profile command displays current access list table. Parameters profile_id - Specifies the index of access list profile. The range is depend on project. Restrictions None. Example usage: To display current access list table:

73 DGS-3450:admin# show access_profile Command: show access_profile Access Profile Table Total Unused Rule Entries: 765 Total Used Rule Entries : 3 Access Profile ID: 1 TYPE : Packet Content ================================================================================ Owner : ACL MASK Option : ------------------------------------- Offset_chunk_1: 1 value:FFFFFFFF Offset_chunk_2: 2 value:EEEEEEEE Offset_chunk_3: 3 value:DDDDDDDD Offset_chunk_4: 4 value:CCCCCCCC Access ID : 1 Mode: Permit priority: 3 Port: 1:1 ------------------------------------- Offset_chunk_1: 1 value:11111111 Offset_chunk_2: 2 value:22222222 Offset_chunk_3: 3 value:11111111 Offset_chunk_4: 4 value:44444444 ================================================================================ Unused rule entries: 127 DGS-3450:admin# config flow_meter profile_id Purpose To configure packet flow-based metering based on an access profile and rule. Syntax config flow_meter profile_id access_id [ [ tr_tcm cir {cbs } pir {pbs } | sr_tcm cir cbs ebs ] {conform [permit | replace_dscp ] {counter [enable |disable]}} exceed [permit | replace_dscp | drop] {counter [enable |disable]} violate [permit | replace_dscp | drop] {counter [enable |disable]} | delete] Description This command is used to configure the flow-based metering function. The metering function support three modes, single rate two colors, single rate three color, and two rate three color. The access rule must first be created before the parameters of this function can be applied. For the single rate two color mode, users may set the preferred bandwidth for this rule, in Kbps and once the bandwidth has been exceeded, overflow packets will be either dropped or be set to a drop precedence, depending on user configuration. The drop precedence will be used by RED. With RED, the packet with higher drop precedence will be dropped with higher probability. For the single rate three color mode, users need to specify the committed rate in Kbps, the commited burst size and the excess burst size. For the two rate three color mode, users need to specify the committed rate in Kbps, the commited burst size, the peak rate and the peak burst size. There can be two cases to map the color of packet, color blind mode and color aware mode. In the color-blind case, the determination for the color of packet is based on metering result. In the color-aware case, the determination for the color of packet is based metering result and the ingress DSCP. When the color blind or color aware is not specified, color blind is the default mode. The green color packet will be treated the conforming action, the yellow color packet will be

74 config flow_meter profile_id treated the exceeding action, and the red color packet will be treated the violating action. Parameters profile_id - Specifies the profile_ID. access_id - Specifies the access_ID. tr_tcm - Specify the “two rate three color mode”. cir - Specify the “committed information rate”. 1. The unit is 64Kbps 2. The max rate 156249*64Kbps cbs - Specify the “committed burst size”. 1. The unit is Kbytes. That is to say, 1 means 1Kbytes. 2. This parameter is an optional parameter. The default value is 4*1024. 3. The max set value is 16*1024. pir - Specify the “Peak Information Rate”. 1. The unit is 64Kbits 2. The max rate is 156249*64Kbps pbs - Specify the “peak burst size”. 1. The unit is Kbytes. 2. This parameter is an optional parameter.The default value is 4*1024. 3. The max set value is 16*1024. sr_tcm - Specify the “single rate three color mode”. cir - Specify the “committed information rate”. 1. The unit is 64Kbps 2. The max rate is 156249*64Kbps cbs - Specify the “committed burst size”. 1. The unit is Kbytes. 2. The max set value is 16*1024. ebs - Specify the “Excess Burst Size”. 1. The unit is Kbytes. 2. The max set value is 16*1024. conform - Specify the action when packet is in “green color”. permit - Permit the packet. replace_dscp - Change the dscp of packet. exceed - Specify the action when packet is in “yellow color”. permit - Permit the packet. replace_dscp - Change the dscp of packet. drop - Drop the packet. violate - Specify the action when packet is in “red color”. permit - Permit the packet. replace_dscp - Change the dscp of packet. counter - Specify the counter. 1. This is optional. The default is “disable”. 2. The resource may be limited such that counter can not be turned on. The limitation is project dependent. 3. counter will be cleared when the function is disabled. delete - Delete the specified flow_meter. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure a two rates thress color flow meter:

75 DGS-3450:admin# config flow_meter profile_id 1 access_id 1 tr_tcm cir 1000 cbs 200 pir 2000 pbs 200 exceed replace_dscp 21 violate drop Command: config flow_meter profile_id 1 access_id 1 tr_tcm cir 1000 cbs 200 pir 2000 pbs 200 exceed replace_dscp 21 violate drop DGS-3450:admin# show flow_meter Purpose To configure packet flow-based metering based on an access profile and rule. Syntax show flow_meter {profile_id {access_id }} Description This command displays the flow meter configuration. Parameters profile_id - Specifies the profile_ID. access_id - Specifies the access_ID. Restrictions None. Example usage: To display the flow meter configuration: DGS-3450:admin# show flow_meter Command: show flow_meter Flow Meter Information --------------------------------- Profile ID:4 Access ID:1 Mode : trTCM CIR:1000(64Kbps) CBS:200(Kbyte) PIR:2000(64Kbps) PBS:200(Kbyte) Action: Conform : Permit Counter: Disabled Exceed : Permit Replace DSCP: 21 Counter: Disabled Violate : Drop Counter: Disabled Total Entries: 1 DGS-3450:admin# config time_range Purpose Used to configure the range of time to activate a function on the switch. Syntax config time_range [hours start_time end_time weekdays |delete] Description This command defines a specific range of time to activate a function on the Switch by specifying which time range in a day and which days in a week are covered in the time range. Note that the specified time range is based on SNTP time or configured time. If this time is not available, then the time range will not be met. Parameters - Specifies the name of the time range settings. start_time - Specifies the starting time in a day. (24-hr time) For example, 19:00 means 7PM. 19 is also acceptable. start_time must be smaller than end_time. end_time - Specifies the ending time in a day. (24-hr time) weekdays - Specify the list of days contained in the time range. Use a dash to define a period of days. Use a comma to separate specific days. For example, mon-fri (Monday to Friday), sun, mon, fri (Sunday, Monday and Friday) delete - Deletes a time range profile. When a time_range profile has been associated with

76 config time_range ACL entries, the delete of this time_range profile will fail. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure the range of time to activate a function on the switch. DGS-3450:admin# config time_range weekend hours start_time 0:0:0 end_time 23:59:5 9 weekdays sun,sat Command: config time_range weekend hours start_time 0:0:0 end_time 23:59:59 week days sun,sat Success. DGS-3450:admin# show time_range Purpose Used to display time range information. Syntax show time_range Description The show time_range command displays current time range setting. Parameters None. Restrictions None. Example usage: To display current time range setting: DGS-3450:admin#show time_range Command: show time_range Time Range Information ------------------------- Range Name : weekend Weekdays : Sun,Sat Start Time : 00:00:00 End Time : 23:59:59 Total Entries :1 DGS-3450:admin#

77 8 ACL FLOW METERING COMMANDS Before configuring the ACL Flow Meter, here is a list of acronyms and terms users will need to know. trTCM – Two Rate Three Color Marker. This, along with the srTCM, are two methods available on the switch for metering and marking packet flow. The trTCM meters and IP flow and marks it as a color based on the flow’s surpassing of two rates, the CIR and the PIR. • CIR – Committed Information Rate. Common to both the trTCM and the srTCM, the CIR is measured in bytes of IP packets. IP packet bytes are measured by taking the size of the IP header but not the link specific headers. For the trTCM, the packet flow is marked green if it doesn’t exceed the CIR and yellow if it does. The configured rate of the CIR must not exceed that of the PIR. The CIR can also be configured for unexpected packet bursts using the CBS and PBS fields. • CBS – Committed Burst Size. Measured in bytes, the CBS is associated with the CIR and is used to identify packets that exceed the normal boundaries of packet size. The CBS should be configured to accept the biggest IP packet that is expected in the IP flow. • PIR – Peak Information Rate. This rate is measured in bytes of IP packets. IP packet bytes are measured by taking the size of the IP header but not the link specific headers. If the packet flow exceeds the PIR, that packet flow is marked red. The PIR must be configured to be equal or more than that of the CIR. • PBS – Peak Burst Size. Measured in bytes, the PBS is associated with the PIR and is used to identify packets that exceed the normal boundaries of packet size. The PBS should be configured to accept the biggest IP packet that is expected in the IP flow. srTCM – Single Rate Three Color Marker. This, along with the trTCM, are two methods available on the switch for metering and marking packet flow. The srTCM marks its IP packet flow based on the configured CBS and EBS. A packet flow that does not reach the CBS is marked green, if it exceeds the CBS but not the EBS its marked yellow, and if it exceeds the EBS its marked red. • CBS – Committed Burst Size. Measured in bytes, the CBS is associated with the CIR and is used to identify packets that exceed the normal boundaries of packet size. The CBS should be configured to accept the biggest IP packet that is expected in the IP flow. • EBS – Excess Burst Size. Measured in bytes, the EBS is associated with the CIR and is used to identify packets that exceed the boundaries of the CBS packet size. The EBS is to be configured for an equal or larger rate than the CBS. DSCP – Differentiated Services Code Point. The part of the packet header where the color will be added. Users may change the DSCP field of incoming packets. The ACL Flow Meter function will allow users to color code IP packet flows based on the rate of incoming packets. Users have two types of Flow metering to choose from, trTCM and srTCM, as explained previously. When a packet flow is placed in a color code, the user can choose what to do with packets that have exceeded that color-coded rate. Green – When an IP flow is in the green mode, its configurable parameters can be set in the Conform field, where the packets can have their DSCP field changed. This is an acceptable flow rate for the ACL Flow Meter function. Yellow – When an IP flow is in the yellow mode, its configurable parameters can be set in the Exceed field. Users may choose to either Permit or Drop exceeded packets. Users may also choose to change the DSCP field of the packets. Red – When an IP flow is in the red mode, its configurable parameters can be set in the Exceed field. Users may choose to either Permit or Drop exceeded packets. Users may also choose to change the DSCP field of the packets. Users may also choose to count exceeded packets by clicking the Counter check box. If the counter is enabled, the counter setting in the access profile will be disabled. The ACL Flow Meter commands in the Command Line Interface (CLI) are listed (along with the appropriate parameters) in the following table.

78 Command Parameters config flow_meter profile_id access_id [ [ tr_tcm cir {cbs } pir {pbs } | sr_tcm cir cbs ebs ] {conform [permit |replace_dscp ] {counter [enable |disable]}} exceed [permit | replace_dscp | drop] {counter [enable |disable]} violate [permit | replace_dscp | drop] {counter [enable |disable]} | delete ] show flow_meter {profile_id {access_id }} Each command is listed, in detail, in the following sections.

79 config flow_meter profile_id Purpose Used to configure the flow metering function for ACL.. Syntax config flow_meter profile_id access_id [ [ tr_tcm cir {cbs } pir {pbs } | sr_tcm cir cbs ebs ] {conform [permit |replace_dscp ] {counter [enable |disable]}} exceed [permit | replace_dscp | drop] {counter [enable |disable]} violate [permit | replace_dscp | drop] {counter [enable |disable]} | delete ] Description This command is used to configure the parameters for the flow metering function for ACL entries created on the switch. Parameters profile_id − Enter the pre-configured Profile ID for which to configure the ACL Flow Metering parameters. access_id − Enter the pre-configured Access ID for which to configure the ACL Flow Metering parameters. tr_tcm - Choosing this field will allow users to employ the Two Rate Three Color Mode and set the following parameters to determine the color rate of the IP packet flow. • cir – The Committed Information Rate can be set between 1 and 156249. IP flow rates at or below this level will be considered green. IP flow rates that exceed this rate but not the PIR rate are considered yellow. • cbs − The Committed Burst Size. Used to gauge packets that are larger than the normal IP packets. This field does not have to be set for this feature to function properly but is to be used in conjunction with the CIR setting. The CBS should be configured to accept the biggest IP packet that is expected in the IP flow. • pir − The Peak information Rate. IP flow rates that exceed this setting will be considered as red. This field must be set at an equal or higher value than the CIR. • pbs − The Peak Burst Size. This optional field is to be used in conjunction with the PIR. The PBS should be configured to accept the biggest IP packet that is expected in the IP flow. sr_tcm − Choosing this field will allow users to employ the Single Rate Three Color Mode and set the following parameters to determine the color rate of the IP packet flow. • cir – The Committed Information Rate can be set between 1-156249. The color rates are based on the following two fields which are used in conjunction with the CIR. • cbs − Committed Burst Size. Measured in bytes, the CBS is associated with the CIR and is used to identify packets that exceed the normal boundaries of packet size. The CBS should be configured to accept the biggest IP packet that is expected in the IP flow. Packet flows which are lower than this configured value are marked green. Packet flows which exceed this value but are less than the EBS value are marked yellow. ebs − Excess Burst Size. Measured in bytes, the EBS is associated with the CIR and is used to identify packets that exceed the boundaries of the CBS packet size. The EBS is to be configured for an equal or larger rate than the CBS. Packet flows that exceed this value are marked as red. conform − This field denotes the green packet flow. Green packet flows may have their DSCP field rewritten to a value stated in this field. Users may also choose to count green packets by checking the Counter check box. • permit – Enter this parameter to allow packet flows that are in the green flow. • replace_dscp − Packets that are in the green flow may have their DSCP field rewritten using this parameter and entering the DSCP value to replace. • counter [enable | disable] – Use this parameter to enable or disable the packet counter for the specified ACL entry in the green flow. exceed − This field denotes the yellow packet flow. Yellow packet flows may have excess packets permitted through or dropped. Users may replace the DSCP field of these packets by checking its radio button and entering a new DSCP value in the allotted field. • permit – Enter this parameter to allow packet flows that are in the yellow flow.

80 config flow_meter profile_id • replace_dscp − Packets that are in the yellow flow may have their DSCP field rewritten using this parameter and entering the DSCP value to replace. • drop – Enter this parameter to drop packets that are in the yellow flow. • counter [enable | disable] – Use this parameter to enable or disable the packet counter for the specified ACL entry in the yellow flow. violate − This field denotes the red packet flow. Red packet flows may have excess packets permitted through or dropped. Users may replace the DSCP field of these packets by checking its radio button and entering a new DSCP value in the allotted field. • permit – Enter this parameter to allow packet flows that are in the red flow. • replace_dscp − Packets that are in the red flow may have their DSCP field rewritten using this parameter and entering the DSCP value to replace. • drop – Enter this parameter to drop packets that are in the red flow. • counter [enable | disable] – Use this parameter to enable or disable the packet counter for the specified ACL entry in the red flow. delete – Use this parameter to delete the specified flow meter. Restrictions Only Administrator and Operator-level users can issue this command. Only two counters may be enabled at any given time. Example usage: To enable the sFlow function: DGS-3450:admin# config flow_meter profile_id 1 access_id 1 tr_tcm cir 1000 cbs 200 pir 2000 pbs 200 exceed replace_dscp 21 violate drop Command: config flow_meter profile_id 1 access_id 1 tr_tcm cir 1000 cbs 200 pir 2000 pbs 200 exceed replace_dscp 21 violate drop Success. DGS-3450:admin# show flow_meter Purpose Used to display the ACL flow meter parameters set on the switch. Syntax show flow_meter {profile_id {access_id }} Description This command will display the flow meter parameters set on the switch. Parameters profile_id − Enter the profile ID of the ACL entry to be viewed for flow metering. access_id − Enter the access ID corresponding to the ACL entry to be viewed. Restrictions None. Example usage: To enable the sFlow function:

81 DGS-3450:admin# show flow_meter profile_id 1 access_id 1 Command: show flow_meter profile_id 1 access_id 1 Profile ID : 1 Access ID : 1 Mode: trTCM CIR: 1000(64kbps) CBS: 200(Kbyte) PIR: 2000(64kbps) PBS : 200(Kbyte) Action: Conform : Permit Counter : Disabled Exceed : Permit Replace DSCP: 21 Counter : Disabled Violate : Drop Counter : Disabled Total Entries : 1 DGS-3450:admin#

82 9 ADDRESS RESOLUTION PROTOCOL (ARP) COMMANDS The Address Resolution Protocol (ARP) commands in the Command Line Interface (CLI) are listed (along with the appropriate parameters) in the following table. Command Parameters create arpentry delete arpentry [ | all] config arpentry config arp_aging time clear arptable show arpentry {ipif | ipaddress | static | mac_address } Each command is listed, in detail, in the following sections. create arpentry Purpose Used to create a static entry in the ARP table. Syntax create arpentry Description This command is used to enter a static ARP entry into the switch’s ARP table. Parameters ipaddr - The IP address of the end node or station. macaddr - The MAC address corresponding to the IP address above. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To create a static ARP entry for the IP address 10.48.74.121 and MAC address 00-50-BA-00-07-36: DGS-3450:admin# create arpentry 10.48.74.121 00-50-BA-00-07-36 Command: create arpentry 10.48.74.121 00-50-BA-00-07-36 Success. DGS-3450:admin# delete arpentry Purpose Used to delete a static entry from the ARP table. Syntax delete arpentry [ | all] Description This command is used to delete an ARP entry, by specifying either the IP address of the entry or all. Specifying ‘all’ clears the switch’s ARP table. Parameters ipaddr - The IP address of the end node or station. all - Delete all ARP entries. Restrictions Only Administrator and Operator-level users can issue this command. Example usage:

83 To delete an entry of IP address 10.48.74.121 from the ARP table: DGS-3450:admin# delete arpentry 10.48.74.121 Command: create arpentry 10.48.74.121 Success. DGS-3450:admin# config arpentry Purpose Used to configure a static entry’s MAC address in the ARP table. Syntax config arpentry Description This command configures a static entry’s MAC address in the ARP table. Specify the IP address and MAC address of the entry. Parameters ipaddr - The IP address of the end node or station. macaddr - The MAC address corresponding to the IP address above. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure a static ARP entry with IP address 10.48.74.121 to have a MAC address of 00-50-BA-00-07-37: DGS-3450:admin# config arpentry 10.48.74.121 00-50-BA-00-07-37 Command: config arpentry 10.48.74.121 00-50-BA-00-07-37 Success. DGS-3450:admin# config arp_aging time Purpose Used to configure the aging out time for an ARP entry. Syntax config arp_aging time Description This command sets the maximum amount of time, in minutes, that a dynamic ARP entry can remain in the switch’s ARP table, without being accessed, before it is dropped from the table. Parameters min - The ARP age-out time, in minutes. The default is 20. The range is 0 to 65535. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure an ARP aging time of 30 minutes: DGS-3450:admin# config arp_aging time 30 Command: config arp_aging time 30 Success. DGS-3450:admin#

84 clear arptable Purpose Used to clear all the dynamic ARP entries from the ARP table. Syntax clear arptable Description This command is used to clear all the dynamic entries from ARP table. Parameters None. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To clear the ARP table: DGS-3450:admin# clear arptable Command: clear arptable Success. DGS-3450:admin# show arpentry Purpose Used to display the ARP table. Syntax show arpentry {ipif | ipaddress | static | mac_address } Description This command is used to displays the ARP table. You can filter the display by IP address, interface name, static entries or MAC address. Parameters ipif_name - The name of the IP interface the end node or station for which the ARP table entry was made, resides on. ipaddr - The IP address of the end node or station. static - Display the static entries in the ARP table. macaddr - Displays the ARP entry by MAC address. Restrictions None. Example usage: To display the ARP table:

85 DGS-3450:admin# show arpentry Command: show arpentry ARP Aging Time : 20 Interface IP Address MAC Address Type ------------- --------------- ----------------- --------------- System 10.0.0.0 FF-FF-FF-FF-FF-FF Local/Broadcast System 10.1.1.1 00-02-03-04-05-06 Static System 10.1.1.2 00-02-03-04-05-06 Dynamic System 10.1.1.3 00-02-03-04-05-06 Static System 10.90.90.90 00-01-02-03-04-00 Local System 10.255.255.255 FF-FF-FF-FF-FF-FF Local/Broadcast Total Entries: 6 DGS-3450:admin#

86 10 BPDU ATTACK PROTECTION COMMANDS Users at different sites connected across a service-provider network need to use various Layer 2 protocols to scale their topologies to include all remote sites, as well as the local sites. STP must run properly, and every VLAN should build a proper spanning tree that includes the local site and all remote sites across the service-provider network. Layer 2 protocol tunneling is a feature designed for service providers who carry traffic of multiple customers across their networks and are required to maintain the Layer 2 protocol configurations of each customer without impacting the traffic of other customers. The BPDU Attack Protection commands in the Command Line Interface (CLI) are listed (along with the appropriate parameters) in the following table. Command Parameters config bpdu_protection ports [ | all ] {state [enable | disable] | mode [ drop | block | shutdown} (1) config bpdu_protection recovery_timer [ | infinite] config bpdu_protection [trap | log ] [ none | attack_detected | attack_cleared | both ] enable bpdu_protection disable bpdu_protection show bpdu_protection {ports {}} Each command is listed, in detail, in the following sections. config bpdu_protection ports Purpose Used to configure bpdu_protection state and mode. Syntax config bpdu_protection ports [ | all ] {state [enable | disable] | mode [ drop | block | shutdown} (1) Description The config bpdu_protection ports command is used to configure the BPDP protection function for the ports on the switch. In generally, there are two states in BPDU protection function. One is normal state, and another is under attack state. The under attack state have three modes: drop, block, and shutdown. A BPDU protection enabled port will enter under attack state when it receives one STP BPDU packet. And it will take action based on the configuration. Thus, BPDU protection can only be enabled on STP disabled port. BPDU protection has high priority than fbpdu setting configured by configure STP command in determination of BPDU handling. That is, when fbpbu is configured to forward STP BPDU but BPDU protection is enabled, then the port will not forward STP BPDU. BPDU protection also has high priority than BPDU tunnel port setting in determination of BPDU handling. That is, when a port is configured as BPDU tunnel port for STP, it will forward STP BPDU. But if the port is BPDU protection enabled. Then the port will not forward STP BPDU Parameters portlist - Specified a range of ports to be configured (port number). all - For set all ports in the system, you may use “all” parameter. state - Specified the bpdu_protection state. The default state is disable enable - Enable bpdu_protection disable - Disable bpdu_protection mode - Specified the bpdu_protection mode. The default mode is shutdown drop - Drop all received BPDU packets when the port enters under_attack state. block - Drop all packets (include BPDU and normal packets) when the port enters under_attack state. shutdown - Shut down the port when the port enters under_attack state.

87 config bpdu_protection ports Restrictions Only Administrator and Operator-level users can issue this command.

88 Example usage: To set the port state enable and drop mode: DGS-3450:admin# config bpdu_protection ports 1 state enable mode drop Commands: config bpdu_protection ports 1 state enable mode drop Success. DGS-3450:admin# config bpdu_protection recovery_interval Purpose Used to configure bpdu_protection recovery timer. Syntax config bpdu_protection recovery_timer [ | infinite] Description When a port enters under attack state, it can be disabled or blocked based on the configuration. The state can be recovered manually or by the auto recovery mechanism. This command is used to configure the auto-recovery timer. To manually recover the port, the user needs to disable and re-enable the port. Parameters recovery_timer - Specified the bpdu_protection Auto-Recovery recovery_timer. The default value of recovery_timer is 60. infinite - The port will not be auto recovered. - The timer (in seconds) used by the Auto-Recovery mechanism to recover the port. The valid range is 60 to 1000000. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To configure the bpdu_protection recovery_timer to 120 seconds for the entire switch: DGS-3450:admin# config bpdu_protection recovery_timer 120 Commands: config bpdu_protection recovery_timer 120 Success. DGS-3450:admin# config bpdu_protection Purpose Used to configure bpdu_protection trap state or log state. Syntax config bpdu_protection [trap | log ] [ none | attack_detected | attack_cleared | both ] Description The config bpdu_protection trap command is used to configure the bpdu_protection trap state or state for the entire switch. Parameters trap - To specify the trap state. log - To specify the log state. none - Neither attack_detected nor attack_cleared is trapped or logged. attack_detected - Events will be logged or trapped when the BPDU attacks is detected. attack_cleared - Events will be logged or trapped when the BPDU attacks is cleared. both - The events of attack_detected and attack_cleared shall be trapped or logged. Restrictions Only Administrator and Operator-level users can issue this command.

89 Example usage: To config the bpdu_protection trap state as both for the entire switch: DGS-3450:admin# config bpdu_protection trap both Commands: config bpdu_protection trap both Success. DGS-3450:admin# enable bpdu_protection Purpose Used to enable bpdu_protection globally. Syntax enable bpdu_protection Description The enable bpdu_protection command is used to enable bpdu_protection function globally for the entire switch. Parameters None. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To enable bpdu_protection function globally for the entire switch: DGS-3450:admin# enable bpdu_protection Commands: enable bpdu_protection Success. DGS-3450:admin# disable bpdu_protection Purpose Used to disalbe bpdu_protection globally. Syntax disable bpdu_protection Description The disable bpdu_protection command is used to disable bpdu_protection function globally for the entire switch. Parameters None. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To disable bpdu_protection function globally for the entire switch: DGS-3450:admin# disable bpdu_protection Commands: disable bpdu_protection Success. DGS-3450:admin#

90 show bpdu_protection Purpose Used to show bpdu_protection status. Syntax show bpdu_protection {ports { }} Description The show bpdu_protection command is used to display bpdu_protection global configuration or per port configuration and current status. Parameters portlist - Specified a range of ports to be configured. Restrictions None. Example usage: To show the bpdu_protection for the entire switch: DGS-3450:admin# show bpdu_protection Commands: show bpdu_protection BPDU Protection Global Settings --------------------------------------- BPDU Protection status : Enabled BPDU Protection Recovery Time : 60 seconds BPDU Protection Trap State : None BPDU Protection Log State : None DGS-3450:admin# To show the bpdu_protection status ports 1-12: DGS-3450:admin# show bpdu_protection ports 1-12 Commands: show bpdu_protection ports 1-12 Port State Mode Status ------ ------------ ----------- ---------- 1 Enabled shutdown Normal 2 Enabled shutdown Normal 3 Enabled shutdown Normal 4 Enabled shutdown Normal 5 Enabled shutdown Under Attack 6 Enabled shutdown Normal 7 Enabled shutdown Normal 8 Enabled shutdown Normal 9 Enabled shutdown Normal 10 Enabled Block Normal 11 Disabled shutdown Normal 12 Disabled shutdown Normal DGS-3450:admin#

91 11 COMMAND HISTORY LIST The switch history commands in the Command Line Interface (CLI) are listed (along with the appropriate parameters) in the following table. Command Parameters ? {} config command_history show command_history Each command is listed, in detail, in the following sections. ? Purpose Used to display all commands in the Command Line Interface (CLI). Syntax ? {} Description This command will display all of the commands available through the Command Line Interface (CLI). Parameters {} – Entering the question mark with an appropriate command will list all the corresponding parameters for the specified command, along with a brief description of the commands function and similar commands having the same words in the command. Restrictions None. Example usage: To display all of the commands in the CLI:

92 DGS-3450:admin# ? .. ? cd clear clear address_binding dhcp_snoop binding_entry ports clear arptable clear attack_log clear counters clear dhcp_binding clear fdb clear log clear mac_based_access_control auth_mac clear port_security_entry port config 802.1p default_priority config 802.1p user_priority config 802.1x auth_mode config 802.1x auth_parameter ports config 802.1x auth_protocol config 802.1x capability ports config 802.1x guest_vlan ports config 802.1x init CTRL+C ESC q Quit SPACE n Next Page Enter Next Entry a All To display the parameters for a specific command: DGS-3450:admin# ? config stp Command:? config stp Command: config stp Usage: {maxage |maxhops |hellotime | forwa rddelay |txholdcount |fbpdu [enable|disable]|lbd [enable |disable] |lbd_recover_timer [ | ]} Description: Used to update the STP Global Configuration. config stp instance_id config stp mst_config_id config stp mst_ports config stp ports config stp priority config stp version DGS-3450:admin# config command_history Purpose Used to configure the command history. Syntax config command_history Description This command is used to configure the command history. Parameters − The number of previously executed commands maintained in the buffer. Up to 40 of the latest executed commands may be viewed. Restrictions None. Example usage To configure the command history:

93 DGS-3450:admin# config command_history 20 Command: config command_history 20 Success. DGS-3450:admin# show command_history Purpose Used to display the command history. Syntax show command_history Description This command will display the command history. Parameters None. Restrictions None. Example usage To display the command history: DGS-3450:admin# show command_history Command: show command_history ? ? show show vlan show command history DGS-3450:admin#

94 12 COMMAND LOGGING COMMANDS The command logging function is used to log the commands that have successfully been configured to the switch via the command line interface. The requirement is to log the command itself, along with information about the user account that entered the command into the system log and the informational severity level. Commands that do not cause a change in the switch configuration or operation (such as show) will not be logged. A save command will change the configuration file hence it will be logged. Information about saving or viewing the system log is described in the syslog functional specification and is out of the scope of this UIS. The Command Logging commands in the Command Line Interface (CLI) are listed (along with the appropriate parameters) in the following table. Command Parameters enable command logging disable command logging show command logging Each command is listed, in detail, in the following sections. enable command logging Purpose Used to enable command logging. Syntax enable command logging Description The enable command logging command is used to enable the command logging function. Note: When the switch is under the booting procedure, all configuration commands will not be logged. When the user has logged in using AAA authentication, the user name should not changed if the user has used the “enable admin” command to replace its privilege. Parameters None. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To enable the command logging function: DGS-3450:admin# enable command logging Command: enable command logging Success. DGS-3450:admin# disable command logging Purpose Used to disable the command logging function. Syntax disable command logging Description The disable command logging command is used to disable the command logging function. Parameters None.

95 disable command logging Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To disable the command logging function: DGS-3450:admin# disable command logging Command: disable command logging Success. DGS-3450:admin# show command logging Purpose This command displays the switch’s general command logging configuration status Syntax show command logging Description Use this command to show the command logging configuration status. Parameters None. Restrictions Only Administrator and Operator-level users can issue this command. Example usage: To show the command logging configuration status: DGS-3450:admin# show command logging Command: show command logging Command Logging State : Disabled DGS-3450:admin#

96 13 COMPOUND AUTHENTICATION COMMANDS The Compound Authentication chapter describes the Common feature for access control functionalities and specifications. The Compound Authentication commands in the Command Line Interface (CLI) are listed (along with the appropriate parameters) in the following table. Command Parameters create authentication guest_vlan [vlan | vlanid ] delete authentication guest_vlan [vlan | vlanid ] config authentication guest_vlan [vlan | vlanid ] [add | delete ] ports [ |all ] config authentication ports [ | all] {auth_mode [port_based | host_based { vlanid state [enable | disable] }]| multi_authen_methods[none | any | dot1x_impb | impb_jwac]} (1) show authentication guest_vlan show authentication ports {} enable authorization attributes disable authorization attributes show authorization config authentication server failover [local | permit | block] show authentication Each command is listed, in detail, in the following sections. create authentication guest_vlan Purpose Used to assign a static VLAN to be guest VLAN. Syntax create authentication guest_vlan [vlan | vlanid ] Description The create guest_vlan command will assign a static VLAN to be guest VLAN. The specific VLAN which assigned to guest VLAN must be existed. The specific VLAN which assigned to guest VLAN can’t be deleted. For further description of this command please see description for config authentication guest_vlan ports. Parameters - Specify the guest VLAN by VLAN name. vlanid - Specify the guest VLAN by VLAN ID. Restrictions Only Administrator and Operator-level users can issue this command.