D-Link DGS-3000 series Reference Manual

I Table of Contents Chapter 1 Using Command Line Interface ............................................................................................. 1 Chapter 2 Basic Command List ............................................................................................................. 8 Chapter 3 802.1Q VLAN Command List .............................................................................................. 22 Chapter 4 802.1X Command List ......................................................................................................... 37 Chapter 5 Access Authentication Control Command List .................................................................... 55 Chapter 6 Access Control List (ACL) Command List ........................................................................... 82 Chapter 7 Address Resolution Protocol (ARP) Command List .......................................................... 103 Chapter 8 ARP Spoofing Prevention Command List ......................................................................... 108 Chapter 9 Auto-Configuration Command List .................................................................................... 110 Chapter 10 Basic Commands Command List ...................................................................................... 113 Chapter 11 BPDU Attack Protection Command List ............................................................................ 129 Chapter 12 Cable Diagnostics Command List ..................................................................................... 134 Chapter 13 Command Logging Command List.................................................................................... 137 Chapter 14 Compound Authentication Command List ........................................................................ 139 Chapter 15 Configuration Command List ............................................................................................. 143 Chapter 16 Connectivity Fault Management (CFM) Command List .................................................... 148 Chapter 17 CPU Interface Filtering Command List ............................................................................. 175 Chapter 18 Debug Software Command List ........................................................................................ 184 Chapter 19 DHCP Local Relay Command List .................................................................................... 191 Chapter 20 DHCP Relay Command List .............................................................................................. 197 Chapter 21 DHCP Server Screening Command List ........................................................................... 215 Chapter 22 Digital Diagnostic Monitoring (DDM) Commands ............................................................. 218 Chapter 23 D-Link Unidirectional Link Detection (DULD) Command List ........................................... 223 Chapter 24 Domain Name System (DNS) Resolver Command List.................................................... 225 Chapter 25 DoS Attack Prevention Command List .............................................................................. 231 Chapter 26 Energy Efficient Ethernet (EEE) Commands .................................................................... 235 Chapter 27 Ethernet Ring Protection Switching (ERPS) Command List ............................................. 237 Chapter 28 External Alarm Command List .......................................................................................... 246 Chapter 29 Filter Command List .......................................................................................................... 248 Chapter 30 Filter Database (FDB) Command List ............................................................................... 251 Chapter 31 Flash File System (FFS) Command List ........................................................................... 261 Chapter 32 Gratuitous ARP Command List ......................................................................................... 270 Chapter 33 IGMP Snooping Command List ......................................................................................... 276 Chapter 34 IP-MAC-Port Binding (IMPB) Command List .................................................................... 302

II Chapter 35 IPv6 Neighbor Discover Command List ............................................................................ 325 Chapter 36 IPv6 Route Command List ................................................................................................ 329 Chapter 37 Japanese Web-Based Access Control (JWAC) Command List ....................................... 332 Chapter 38 Jumbo Frame Command List ............................................................................................ 355 Chapter 39 Layer 2 Protocol Tunneling (L2PT) Command List ........................................................... 357 Chapter 40 Link Aggregation Command List ....................................................................................... 361 Chapter 41 Link Layer Discovery Protocol (LLDP) Command List ...................................................... 368 Chapter 42 Loop Back Detection (LBD) Command List ...................................................................... 393 Chapter 43 MAC Notification Command List ....................................................................................... 399 Chapter 44 MAC-based Access Control Command List ...................................................................... 404 Chapter 45 MAC-based VLAN Command List..................................................................................... 420 Chapter 46 Mirror Command List ......................................................................................................... 423 Chapter 47 MLD Snooping Command List .......................................................................................... 426 Chapter 48 MSTP debug enhancement Command List ...................................................................... 449 Chapter 49 Multicast Filter Command List ........................................................................................... 455 Chapter 50 Multicast VLAN Command List ......................................................................................... 468 Chapter 51 Multiple Spanning Tree Protocol (MSTP) Command List ................................................. 479 Chapter 52 Network Load Balancing (NLB) Command List ................................................................ 492 Chapter 53 Network Monitoring Command List ................................................................................... 497 Chapter 54 OAM Commands ............................................................................................................... 504 Chapter 55 Peripherals Command List ................................................................................................ 512 Chapter 56 Ping Command List ........................................................................................................... 515 Chapter 57 Port Security Command List ............................................................................................. 518 Chapter 58 Power Saving Command List ............................................................................................ 526 Chapter 59 PPPoE Circuit ID Insertions Command List ...................................................................... 533 Chapter 60 Protocol VLAN Command List .......................................................................................... 537 Chapter 61 QinQ Command List .......................................................................................................... 543 Chapter 62 Quality of Service (QoS) Command List ........................................................................... 551 Chapter 63 RADIUS Client Command List .......................................................................................... 568 Chapter 64 Safeguard Engine Command List ..................................................................................... 574 Chapter 65 Secure Shell (SSH) Command List ................................................................................... 576 Chapter 66 Secure Sockets Layer (SSL) Command List .................................................................... 585 Chapter 67 Show Technical Support Command List ........................................................................... 591 Chapter 68 Simple Mail Transfer Protocol (SMTP) Command List ..................................................... 594 Chapter 69 Simple Network Management Protocol (SNMP) Command List ...................................... 599 Chapter 70 Single IP Management Command List ............................................................................. 625

III Chapter 71 Syslog and Trap Source-interface Command List ............................................................ 635 Chapter 72 System Log Command List ............................................................................................... 639 Chapter 73 System Severity Command List ........................................................................................ 650 Chapter 74 Telnet Client Command List .............................................................................................. 652 Chapter 75 TFTP/FTP Client Command List ....................................................................................... 653 Chapter 76 Time and SNTP Command List ........................................................................................ 663 Chapter 77 Trace Route Command List .............................................................................................. 670 Chapter 78 Traffic Control Command List ........................................................................................... 673 Chapter 79 Traffic Segmentation Command List ................................................................................. 678 Chapter 80 Trusted Host Command List ............................................................................................. 680 Chapter 81 Unicast Routing Command List ......................................................................................... 684 Chapter 82 VLAN Trunking Command List .......................................................................................... 687 Chapter 83 Voice VLAN Command List ............................................................................................... 692 Chapter 84 Password Recovery Command List .................................................................................. 703 Appendix A Password Recovery Procedure ......................................................................................... 705 Appendix B System Log Entries ........................................................................................................... 707 Appendix C Trap Log Entries ................................................................................................................ 718 Appendix D RADIUS Attributes Assignment ......................................................................................... 725

1 Chapter 1 Using Command Line Interface The Switch can be managed through the Switch’s serial port, Telnet, SNMP or the Web-based management agent. The Command Line Interface (CLI) can be used to configure and manage the Switch via the serial port or Telnet interfaces. This manual provides a reference for all of the commands contained in the CLI. Every command will be introduced in terms of purpose, format, description, parameters, and examples. Configuration and management of the Switch via the Web-based management agent are discussed in the Web UI Reference Guide. For detailed information on installing hardware please also refer to the Hardware Installation Guide. 1-1 Accessing the Switch via the Serial Port The Switch’s serial port’s default settings are as follows: • 115200 baud • no parity • 8 data bits • 1 stop bit A computer running a terminal emulation program capable of emulating a VT-100 terminal and a serial port configured as above are then connected to the Switch’s Console port via an included RS-232 to RJ-45 convertor cable. With the serial port properly connected to a management computer, the following screen should be visible. If this screen does not appear, try pressing Ctrl+r to refresh the console screen. DGS-3000-26TC Gigabit Ethernet Switch Command Line Interface Firmware: Build 1.00.015 Copyright(C) 2013 D-Link Corporation. All rights reserved. UserName: PassWord: DGS-3000-26TC:admin# There is no initial username or password. Just press the Enter key twice to display the CLI input cursor − DGS-3000-26TC:admin#. This is the command line where all commands are input. 1-2 Setting the Switch’s IP Address Each Switch must be assigned its own IP Address, which is used for communication with an SNMP network manager or other TCP/IP application (for example BOOTP, TFTP). The Switch’s

2 default IP address is 10.90.90.90. You can change the default Switch IP address to meet the specification of your networking address scheme. The Switch is also assigned a unique MAC address by the factory. This MAC address cannot be changed, and can be found on the initial boot console screen – shown below. Boot Procedure V1.00.001 ------------------------------------------------------------------------------- Power On Self Test ........................................ 100 % MAC Address : 00-01-02-03-04-00 H/W Version : A1 Please Wait, Loading V1.00.015 Runtime Image .............. 100 % UART init ................................................. 100 % Starting runtime image Device Discovery .......................................... 100 % Configuration init ........................................ | The Switch’s MAC address can also be found in the Web management program on the Switch Information (Basic Settings) window on the Configuration menu. The IP address for the Switch must be set before it can be managed with the Web-based manager. The Switch IP address can be automatically set using BOOTP or DHCP protocols, in which case the actual address assigned to the Switch must be known. Starting at the command line prompt, enter the commands config ipif System ipaddress xxx.xxx.xxx.xxx/yyy.yyy.yyy.yyy. Where the x’s represent the IP address to be assigned to the IP interface named System and the y’s represent the corresponding subnet mask. Alternatively, you can enter config ipif System ipaddress xxx.xxx.xxx.xxx/z. Where the x’s represent the IP address to be assigned to the IP interface named System and the z represents the corresponding number of subnets in CIDR notation. The IP interface named System on the Switch can be assigned an IP address and subnet mask which can then be used to connect a management station to the Switch’s Telnet or Web-based management agent. DGS-3000-26TC:admin#config ipif System ipaddress 10.24.22.100/255.0.0.0 Command: config ipif System ipaddress 10.24.22.100/8 Success. DGS-3000-26TC:admin# In the above example, the Switch was assigned an IP address of 10.24.22.100 with a subnet mask of 255.0.0.0. The system message Success indicates that the command was executed successfully. The Switch can now be configured and managed via Telnet, SNMP MIB browser and

3 the CLI or via the Web-based management agent using the above IP address to connect to the Switch. There are a number of helpful features included in the CLI. Entering the ? command will display a list of all of the top-level commands. .. ? cable_diag ports cd cfm linktrace cfm loopback clear clear address_binding dhcp_snoop binding_entry ports clear address_binding nd_snoop binding_entry ports clear arptable clear attack_log clear cfm pkt_cnt clear counters clear ethernet_oam ports clear fdb clear igmp_snooping data_driven_group clear igmp_snooping statistics counter clear jwac auth_state clear log clear mac_based_access_control auth_state clear mld_snooping data_driven_group clear mld_snooping statistics counter CTRL+C ESC q Quit SPACE n Next Page ENTER Next Entry a All When entering a command without its required parameters, the CLI will prompt you with a Next possible completions: message. DGS-3000-26TC:admin#config account Command: config account Next possible completions: DGS-3000-26TC:admin# In this case, the command config account was entered with the parameter . The CLI will then prompt to enter the with the message, Next possible completions:. Every command in the CLI has this feature, and complex commands have several layers of parameter prompting. In addition, after typing any given command plus one space, users can see all of the next possible sub-commands, in sequential order, by repeatedly pressing the Tab key. To re-enter the previous command at the command prompt, press the up arrow cursor key. The previous command will appear at the command prompt.

4 DGS-3000-26TC:admin#config account Command: config account Next possible completions: DGS-3000-26TC:admin#config account In the above example, the command config account was entered without the required parameter , the CLI returned the Next possible completions: prompt. The up arrow cursor control key was pressed to re-enter the previous command (config account) at the command prompt. Now the appropriate username can be entered and the config account command re-executed. All commands in the CLI function in this way. In addition, the syntax of the help prompts are the same as presented in this manual − angle brackets < > indicate a numerical value or character string, braces { } indicate optional parameters or a choice of parameters, and brackets [ ] indicate required parameters. If a command is entered that is unrecognized by the CLI, the top-level commands will be displayed under the Available commands: prompt. DGS-3000-26TC:admin#the Available commands: .. ? cable_diag cd cfm clear config copy create debug del delete dir disable download enable erase login logout md move no ping ping6 rd reboot reconfig rename reset save show smtp telnet traceroute traceroute6 upload DGS-3000-26TC:admin# The top-level commands consist of commands such as show or config. Most of these commands require one or more parameters to narrow the top-level command. This is equivalent to show what? or config what? Where the what? is the next parameter. For example, entering the show command with no additional parameters, the CLI will then display all of the possible next parameters.

5 DGS-3000-26TC:admin#show Command: show Next possible completions: 802.1p 802.1x aaa access_profile account accounting acct_client address_binding arp_spoofing_prevention arpentry attack_log auth_client auth_diagnostics auth_session_statistics auth_statistics authen authen_enable authen_login authen_policy authentication authorization autoconfig bandwidth_control boot_file bpdu_protection cfm command command_history config control_pkt cpu cpu_filter current_config ddm device_status dhcp_local_relay dhcp_relay dos_prevention dot1v_protocol_group dscp duld environment erps error ethernet_oam external_alarm fdb filter flow_meter gratuitous_arp greeting_message gvrp host_name igmp igmp_snooping ipif ipif_ipv6_link_local_auto iproute ipv6 ipv6route jumbo_frame jwac l2protocol_tunnel lacp_port led limited_multicast_addr link_aggregation lldp lldp_med log log_save_timing log_software_module loopdetect mac_based_access_control mac_based_access_control_local mac_based_vlan mac_notification max_mcast_group mcast_filter_profile mirror mld_snooping multicast multicast_fdb name_server nlb packet password_recovery per_queue port port_security port_security_entry port_vlan ports power_saving pppoe private_vlan pvid qinq radius rmon router_ports safeguard_engine scheduling scheduling_mechanism serial_port session sim smtp snmp sntp ssh ssl storage_media_info stp switch syslog system_severity tech_support terminal tftp time time_range traffic traffic_segmentation trap trusted_host utilization vlan vlan_translation vlan_trunk voice_vlan DGS-3000-26TC:admin# In the above example, all of the possible next parameters for the show command are displayed. At the next command prompt, the up arrow was used to re-enter the show command, followed by the account parameter. The CLI then displays the user accounts configured on the Switch.

6 1-3 Command Syntax Symbols Syntax Description angle brackets < > Encloses a variable or value. Users must specify the variable or value. For example, in the syntax create ipif {} {secondary | state [enable | disable] | proxy_arp [enable | disable] {local [enable | disable]}} users must supply an IP interface name for ,a VLAN name for and an address for when entering the command. DO NOT TYPE THE ANGLE BRACKETS. square brackets [ ] Encloses a required value or list of required arguments. Only one value or argument must be specified. For example, in the syntax create account [admin | operator | power_user | user] {encrypt [plain_text | sha_1] } users must specify either the admin-level or user-level account when entering the command. DO NOT TYPE THE SQUARE BRACKETS. vertical bar | Separates mutually exclusive items in a list, one of which must be entered. For example, in the syntax create ipif {} {secondary | state [enable | disable] | proxy_arp [enable | disable] {local [enable | disable]}} users must specify either the community or trap receiver in the command. DO NOT TYPE THE VERTICAL BAR. braces { } Encloses an optional value or a list of optional arguments. One or more values or arguments can be specified. For example, in the syntax reset {[config | system]} {force_agree} users may choose configure or system in the command. DO NOT TYPE THE BRACES. parentheses ( ) Indicates at least one or more of the values or arguments in the preceding syntax enclosed by braces must be specified. For example, in the syntax config bpdu_protection ports [ | all] {state [enable | disable] | mode [drop | block | shutdown]}(1) users have the option to specify hops or time or both of them. The "(1)" following the set of braces indicates at least one argument or value within the braces must be specified. DO NOT TYPE THE PARENTHESES. ipif metric 12 means the maximum length of the IP interface name. 1-31 means the legal range of the metric value.

7 1-4 Line Editing Keys Keys Description Delete Delete character under cursor and shift remainder of line to left. Backspace Delete character to left of cursor and shift remainder of line to left. Insert Toggle on and off. When toggled on, inserts text and shifts previous text to right. Left Arrow Move cursor to left. Right Arrow Move cursor to right Tab Help user to select appropriate token. P Display the previous page. N or Space Display the next page. CTRL+C Escape from displayed pages. ESC Escape from displayed pages. Q Escape from displayed pages. R refresh the displayed pages a Display the remaining pages. (The screen display will not pause again.) Enter Display the next line. The screen display pauses when the show command output reaches the end of the page. In the above example, all of the possible next parameters for the show command are displayed. At the next command prompt, the up arrow was used to re-enter the show command, followed by the account parameter. The CLI then displays the user accounts configured on the Switch.

8 Chapter 2 Basic Command List show session show serial_port config serial_port {baud_rate [9600 | 19200 | 38400 | 115200] | auto_logout [never | 2_minutes | 5_minutes | 10_minutes | 15_minutes]} enable clipaging disable clipaging login logout ? clear show command_history config command_history config greeting_message {default} show greeting_message config command_prompt [ | username | default] config terminal width [default | ] show terminal width config ports [ | all] {medium_type [fiber | copper]} {speed [auto | 10_half | 10_full | 100_half | 100_full | 1000_full {[master | slave]}] | flow_control [enable | disable] | learning [enable | disable] | state [enable | disable] | mdix [auto | normal | cross] | [description | clear_description]} show ports {} {[description | err_disabled | details | media_type]} 2-1 show session Description This command is used to display a list of currently users which are login to the Switch. Format show session Parameters None. Restrictions Only Administrators and Operators can issue this command. Example To display the session entries:

9 DGS-3000-26TC:admin#show session Command: show session ID Live Time From Level Name --- ------------ --------------------------------------- ----- --------------- 0 00:01:46.360 10.90.90.10 puser puser 8 00:05:49.340 Serial Port admin admin Total Entries: 2 CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh 2-2 show serial_port Description This command is used to display the current serial port settings. Format show serial_port Parameters None. Restrictions None. Example To display the serial port setting: DGS-3000-26TC:admin#show serial_port Command: show serial_port Baud Rate : 115200 Data Bits : 8 Parity Bits : None Stop Bits : 1 Auto-Logout : 10 mins DGS-3000-26TC:admin#

10 2-3 config serial_port Description This command is used to configure the serial bit rate that will be used to communicate with the management host and the auto logout time for idle connections. Format config serial_port {baud_rate [9600 | 19200 | 38400 | 115200] | auto_logout [never | 2_minutes | 5_minutes | 10_minutes | 15_minutes]} Parameters baud_rate - (Optional) The serial bit rate that will be used to communicate with the management host. The default baud rate is 115200. 9600 - Specifies the serial bit rate to be 9600. 19200 - Specifies the serial bit rate to be 19200. 38400 - Specifies the serial bit rate to be 38400. 115200 - Specifies the serial bit rate to be 115200. auto_logout - (Optional) The auto logout time out setting. never - Never timeout. 2_minutes - When idle over 2 minutes, the device will auto logout. 5_minutes - When idle over 5 minutes, the device will auto logout. 10_minutes - When idle over 10 minutes, the device will auto logout. 15_minutes - When idle over 15 minutes, the device will auto logout. Restrictions Only Administrators and Operators can issue this command. Example To configure baud rate: DGS-3000-26TC:admin#config serial_port baud_rate 9600 Command: config serial_port baud_rate 9600 Success. DGS-3000-26TC:admin# 2-4 enable clipaging Description This command is used to enable the pausing of the screen display when the show command output reaches the end of the page. The default setting is enabled. Format enable clipaging

11 Parameters None. Restrictions Only Administrators and Operators can issue this command. Example To enable pausing of the screen display when show command output reaches the end of the page: DGS-3000-26TC:admin#enable clipaging Command: enable clipaging Success. DGS-3000-26TC:admin# 2-5 disable clipaging Description This command is used to disable the pausing of the screen display when the show command output reaches the end of the page. The default setting is enabled. Format disable clipaging Parameters None. Restrictions Only Administrators and Operators can issue this command. Example To disable pausing of the screen display when show command output reaches the end of the page: DGS-3000-26TC:admin#disable clipaging Command: disable clipaging Success. DGS-3000-26TC:admin#

12 2-6 login Description This command is used to allow user login to the Switch. Format login Parameters None. Restrictions None. Example To login the Switch with a user name dlink: DGS-3000-26TC:admin#login Command: login UserName:dlink PassWord:**** DGS-3000-26TC:admin# 2-7 logout Description This command is used to logout the facility. Format logout Parameters None. Restrictions None. Example To logout current user:

13 DGS-3000-26TC:admin#logout Command: logout ********** * Logout * ********** DGS-3000-26TC Gigabit Ethernet Switch Command Line Interface Firmware: Build 1.00.015 Copyright(C) 2013 D-Link Corporation. All rights reserved. UserName: 2-8 ? Description This command is used to display the usage description for all commands or the specific one. Format ? Parameters None. Restrictions None. Example To get “ping” command usage, descriptions: DGS-3000-26TC:admin#? ping Command: ? ping Command: ping Usage: { times | timeout } Description: Used to test the connectivity between network devices. DGS-3000-26TC:admin# 2-9 clear Description The command is used to clear screen.

14 Format clear Parameters None. Restrictions None. Example To clear screen: DGS-3000-26TC:admin#clear Command: clear DGS-3000-26TC:admin# 2-10 show command_history Description The command is used to display command history. Format show command_history Parameters None. Restrictions None. Example To display command history:

15 DGS-3000-26TC:admin#show command_history Command: show command_history ? ping login show serial_port show session ? config bpdu_protection ports ? reset ? create account ? create ipif show the ? DGS-3000-26TC:admin# 2-11 config command_history Description This command is used to configure the number of commands that the Switch can recall. The Switch “remembers” upto the last 40 commands you entered. Format config command_history Parameters - Enter the number of commands that the Switch can recall. This value must be between 1 and 40. Restrictions Only Administrators and Operators can issue this command. Example To configure the number of command history: DGS-3000-26TC:admin#config command_history 25 Command: config command_history 25 Success. DGS-3000-26TC:admin# 2-12 config greeting_message Description This command is used to configure the greeting message (or banner).

16 Format config greeting_message {default} Parameters default - (Optional) Adds this parameter to the config greeting_message command will return the greeting message (banner) to its original factory default entry. Restrictions Only Administrators and Operators can issue this command. Example To edit the banner: DGS-3000-26TC:admin#config greeting_message Command: config greeting_message Greeting Messages Editor ================================================================================ DGS-3000-26TC Gigabit Ethernet Switch Command Line Interface Firmware: Build 1.00.015 Copyright(C) 2013 D-Link Corporation. All rights reserved. ================================================================================ Ctrl+C Quit without save left/right/ Ctrl+W Save and quit up/down Move cursor Ctrl+D Delete line Ctrl+X Erase all setting Ctrl+L Reload original setting -------------------------------------------------------------------------------- 2-13 show greeting_message Description The command is used to display greeting message. Format show greeting_message Parameters None.

17 Restrictions Only Administrators and Operators can issue this command. Example To display greeting message: DGS-3000-26TC:admin#show greeting_message Command: show greeting_message ================================================================================ DGS-3000-26TC Gigabit Ethernet Switch Command Line Interface Firmware: Build 1.00.015 Copyright(C) 2013 D-Link Corporation. All rights reserved. ================================================================================ DGS-3000-26TC:admin# 2-14 config command_prompt Description This command is used to modify the command prompt. The current command prompt consists of four parts: “product name” + “:” + ”user level” + ”#” (e.g. “DGS-3000-26TC:admin#”). This command is used to modify the first part (1. “product name”) with a string consisting of a maximum of 16 characters, or to be replaced with the users’ login user name. When users issue the “reset” command, the current command prompt will remain in tact. Yet, issuing the “reset system” will return the command prompt to its original factory default value. Format config command_prompt [ | username | default] Parameters - Enter the new command prompt string of no more than 16 characters. username - Enter this command to set the login username as the command prompt. default - Enter this command to return the command prompt to its original factory default value. Restrictions Only Administrators and Operators can issue this command.

18 Example To edit the command prompt: DGS-3000-26TC:admin#config command_prompt Prompt# Command: config command_prompt Prompt# Success. Prompt#:admin# 2-15 config terminal width Description The command is used to set current terminal width. The usage is described as below: 1. Users login and configure the terminal width to 120, this configuration take effect on this login section. If users implement “save” command, the configuration is saved. After users log out and log in again, the terminal width is 120. 2. If user did not save the configuration, another user login, the terminal width is default value. 3. If at the same time, two CLI sessions are running, once section configure to 120 width and save it, the other section will not be effected, unless it log out and then log in. Format config terminal width [default | ] Parameters default - The default setting of terminal width. The default value is 80. - The terminal width which will be configured. The width is between 80 and 200 characters. Restrictions None. Example To configure the current terminal width: DGS-3000-26TC:admin#config terminal width 120 Command: config terminal width 120 Success. DGS-3000-26TC:admin#

19 2-16 show terminal width Description The command is used to display the configuration of current terminal width. Format show terminal width Parameters None. Restrictions None. Example To display the configuration of current terminal width: DGS-3000-26TC:admin#show terminal width Command: show terminal width Global terminal width : 80 Current terminal width : 80 DGS-3000-26TC:admin# 2-17 config ports Description This commands is used to configure the Switch's port settings. Format config ports [ | all] {medium_type [fiber | copper]} {speed [auto | 10_half | 10_full | 100_half | 100_full | 1000_full {[master | slave]}] | flow_control [enable | disable] | learning [enable | disable] | state [enable | disable] | mdix [auto | normal | cross] | [description | clear_description]} Parameters - Enter a list of ports used here. all - Specifies that all the ports will be used for this configuration. medium_type - (Optional) Specifies the medium type while the configure ports are combo ports fiber - Specifies that the medium type will be set to fiber. copper - Specifies that the medium type will be set to copper. speed - (Optional) Specifies the port speed of the specified ports . auto - Sets port speed to auto negotiation. 10_half - Sets port speed to 10_half.

20 10_full - Sets port speed to 10_full. 100_half - Sets port speed to 100_half. 100_full - Sets port speed to 100_full._ 1000_full - Sets port speed to 1000_full. While set port speed to 1000_full,user should specify master or slave mode for 1000BASE-T interface, and leave the 1000_full without any master or slave setting for other interface. master - Specifies that the port(s) will be set to master. slave - Specifies that the port(s) will be set to slave. flow_control - (Optional) Turns on or turns off the flow control on one or more ports by enabling or disabling this function. enable - Specifies that the flow control option will be enabled. disable - Specifies that the flow control option will be disabled. learning - (Optional) Turns on or turns off the MAC address learning on one or more ports. enable - Specifies that the learning option will be enabled. disable - Specifies that the learning option will be disabled. state - (Optional) Enables or disables the specified port. If the specificed ports are in error- disabled status, configure their state to enable will recover these ports from disabled to enable state. enable - Specifies that the port state will be enabled. disable - Specifies that the port state will be disabled. mdix - (Optional) The MDIX mode can be specified as auto, normal, and cross. If set to the normal state, the port is in the MDIX mode and can be connected to PC NIC using a straight cable. If set to the cross state, the port is in the MDI mode, and can be connected to a port (in the MDIX mode) on another switch through a straight cable. auto - Specifies that the MDIX mode for the port will be set to auto. normal - Specifies that the MDIX mode for the port will be set to normal. cross - Specifies that the MDIX mode for the port will be set to cross. description - (Optional) Specifies the description of the port interface. - Enter the port interface description. This value can be up to 32 characters long. clear_description - (Optional) Specifies that the description field will be cleared. Restrictions Only Administrators and Operators can issue this command. Example To configure the ports: DGS-3000-26TC:admin#config ports all medium_type copper speed auto Command: config ports all medium_type copper speed auto Success. DGS-3000-26TC:admin# 2-18 show ports Description This command is used to display the current configurations of a range of ports. Format show ports {} {[description | err_disabled | details | media_type]}

21 Parameters ports - Specifies a range of ports to be displayed. - (Optional) Enter the list of ports to be configured. description - (Optional) Indicates if the port description will be included in the display. err_disabled - (Optional) Displays ports that were disabled because of an error condidtion. details - (Optional) Displays the port details. media_type - (Optional) Displays the port transceiver type. Restrictions None. Example To display the port details: DGS-3000-26TC:admin#show ports details Command: show ports details Port : 1 -------------------- Port Status : Link Up Description : HardWare Type : Fast Ethernet MAC Address : 00-01-02-03-04-01 Bandwidth : 100000Kbit Auto-Negotiation : Enabled Duplex Mode : Full Duplex Flow Control : Disabled MDI : Normal Address Learning : Enabled Last Clear of Counter : 2 hours 43 mins ago BPDU Hardware Filtering Mode: Disabled Queuing Strategy : FIFO TX Load : 0/100, 0 bits/sec, 0 packets/sec RX Load : 0/100, 0 bits/sec, 0 packets/sec CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh

22 Chapter 3 802.1Q VLAN Command List create vlan tag {type [1q_vlan | private_vlan]} {advertisement} create vlan vlanid {type [1q_vlan | private_vlan]} {advertisement} delete vlan delete vlan vlanid config vlan {[add [tagged | untagged | forbidden] | delete] | advertisement [enable | disable]}(1) config vlan vlanid {[add [tagged | untagged | forbidden] | delete] | advertisement [enable | disable] | name }(1) config port_vlan [ | all] {gvrp_state [enable | disable] | ingress_checking [enable | disable] | acceptable_frame [tagged_only | admit_all] | pvid }(1) show vlan {} show vlan ports {} show vlan vlanid show port_vlan {} enable pvid auto_assign disable pvid auto_assign show pvid auto_assign config gvrp [timer {join < value 100-100000> | leave < value 100-100000> | leaveall } | nni_bpdu_addr [dot1d | dot1ad]] show gvrp enable gvrp disable gvrp config private_vlan [ | vid ] [add [isolated | community] | remove] [ | vlanid ] show private_vlan {[ | vlanid]} 3-1 create vlan Description This command is used to create a VLAN on the Switch. The VLAN ID must be always specified for creating a VLAN. Format create vlan tag {type [1q_vlan | private_vlan]} {advertisement} Parameters - Enter the VLAN name to be created. The VLAN name can be up to 32 characters long. tag - Creates the VLAN ID. - Enter the VLAN ID. The VLAN ID value must be between 2 and 4094. type - (Optional) Specifies the type of VLAN here. 1q_vlan - (Optional) Specifies that the type of VLAN used is based on the 802.1Q standard. private_vlan – (Optional) Specifies that the private VLAN type will be used. advertisement - (Optional) Specifies the VLAN as being able to be advertised out.

23 Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To create a VLAN with name “p1” and VLAN ID 2: DGS-3000-26TC:admin#create vlan p1 tag 2 type private_vlan advertisement Command: create vlan p1 tag 2 type private_vlan advertisement Success. DGS-3000-26TC:admin# 3-2 create vlan vlanid Description This command is used to create more than one VLANs at a time. A unique VLAN name (e.g. VLAN10) will be automatically assigned by the system. The automatic assignment of VLAN name is based on the following rule: “VLAN”+ID. For example, for VLAN ID 100, the VLAN name will be VLAN100. If this VLAN name is conflict with the name of an existing VLAN, then it will be renamed based on the following rule: “VLAN”+ID+”ALT”+ collision count. For example, if this conflict is the second collision, then the name will be VLAN100ALT2. Format create vlan vlanid {type [1q_vlan | private_vlan]} {advertisement} Parameters - Enter the VLAN ID list to be created. type - (Optional) Specifies the type of VLAN to be created. 1q_vlan - (Optional) Specifies that the VLAN created will be a 1Q VLAN. private_vlan – (Optional) Specifies that the private VLAN type will be used. advertisement - (Optional) Specifies the VLAN as being able to be advertised out. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To create some VLANs using VLAN ID: DGS-3000-26TC:admin#create vlan vlanid 10-30 Command: create vlan vlanid 10-30 Success. DGS-3000-26TC:admin#

24 3-3 delete vlan Description This command is used to delete a previously configured VLAN by the name on the Switch. Format delete vlan Parameters vlan - The VLAN name of the VLAN to be deleted. - Enter the VLAN name here. This name can be up to 32 characters long. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To remove a vlan v1: DGS-3000-26TC:admin#delete vlan v1 Command: delete vlan v1 Success. DGS-3000-26TC:admin# 3-4 delete vlan vlanid Description This command is used to delete one or a number of previously configured VLAN by VID list. Format delete vlan vlanid Parameters vlanid - The VLAN ID list to be deleted. - Enter the VLAN ID list here. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To remove VLANs from 10-30:

25 DGS-3000-26TC:admin#delete vlan vlanid 10-30 Command: delete vlan vlanid 10-30 Success. DGS-3000-26TC:admin# 3-5 config vlan Description This command is used to configure a VLAN based on the name. Format config vlan {[add [tagged | untagged | forbidden] | delete] | advertisement [enable | disable]}(1) Parameters - Enter the VLAN name you want to add ports to. This name can be up to 32 characters long. add - (Optional) Specifies to add tagged, untagged or forbidden ports to the VLAN. tagged - Specifies the additional ports as tagged. untagged - Specifies the additional ports as untagged. forbidden - Specifies the additional ports as forbidden. delete - (Optional) Specifies to delete ports from the VLAN. - (Optional) Enter the list of ports used for the configuration here. advertisement - (Optional) Specifies the GVRP state of this VLAN. enable - Specifies to enable advertisement for this VLAN. disable - Specifies to disable advertisement for this VLAN. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To add 4 through 8 as tagged ports to the VLAN v2: DGS-3000-26TC:admin#config vlan v2 add tagged 4-8 Command: config vlan v2 add tagged 4-8 Success. DGS-3000-26TC:admin# 3-6 config vlan vlanid Description This command allows you to configure multiple VLANs at one time. But conflicts will be generated if you configure the name of multiple VLANs at one time.

26 Format config vlan vlanid {[add [tagged | untagged | forbidden] | delete] | advertisement [enable | disable] | name }(1) Parameters - Enter a list of VLAN IDs to configure. add - (Optional) Specifies to add tagged, untagged or forbidden ports to the VLAN. tagged - Specifies the additional ports as tagged. untagged - Specifies the additional ports as untagged. forbidden - Specifies the additional ports as forbidden. delete - (Optional) Specifies to delete ports from the VLAN. - (Optional) Enter the list of ports used for the configuration here. advertisement - (Optional) Specifies the GVRP state of this VLAN. enable - Specifies to enable advertisement for this VLAN. disable - Specifies to disable advertisement for this VLAN. name - (Optional) The new name of the VLAN. - Enter the VLAN name here. This name can be up to 32 characters long. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To add 4 through 8 as tagged ports to the VLAN ID from 10-20: DGS-3000-26TC:admin#config vlan vlanid 10-20 add tagged 4-8 Command: config vlan vlanid 10-20 add tagged 4-8 Success. DGS-3000-26TC:admin# 3-7 config port_vlan Description This command is used to set the ingress checking status, the sending and receiving GVRP information. Format config port_vlan [ | all] {gvrp_state [enable | disable] | ingress_checking [enable | disable] | acceptable_frame [tagged_only | admit_all] | pvid }(1) Parameters - A range of ports for which you want ingress checking. The port list is specified by listing the beginning port number on the Switch, separated by a colon. Then highest port number of the range (also separated by a colon) are specified. The beginning and end of the

27 port list range are separated by a dash. all - Specifies all ports for ingress checking. gvrp_state - (Optional) Enables or disables the GVRP for the ports specified in the port list. enable - Specifies that GVRP for the specified ports will be enabled. disable - Specifies that GVRP for the specified ports will be disabled. ingress_checking - (Optional) Enables or disables ingress checking for the specified portlist. enable - Specifies that ingress checking will be enabled for the specified portlist. disable - Specifies that ingress checking will be disabled for the specified portlist. acceptable_frame - (Optional) The type of frame will be accepted by the port. There are two types: tagged_only - Only tagged packets can be accepted by this port. admit_all - All packets can be accepted. pvid - (Optional) Specifies the PVID of the ports. - Enter the VLAN ID here. The VLAN ID value must be between 1 and 4094. Restrictions Only Administrators and Operators can issue this command. Example To sets the ingress checking status, the sending and receiving GVRP information: DGS-3000-26TC:admin#config port_vlan 1-5 gvrp_state enable ingress_checking enabl e acceptable_frame tagged_only pvid 2 Command: config port_vlan 1-5 gvrp_state enable ingress_checking enable acceptab le_frame tagged_only pvid 2 Success. DGS-3000-26TC:admin# 3-8 show vlan Description This command is used to display the vlan information including of parameters setting and operational value. Format show vlan {} Parameters - (Optional) Enter the VLAN name to be displayed. The VLAN name can be up to 32 characters long. Restrictions None.

28 Example To display VLAN settings: DGS-3000-26TC:admin#show vlan Command: show vlan VLAN Trunk State : Disabled VLAN Trunk Member Ports : VID : 1 VLAN Name : default VLAN Type : Static Advertisement : Enabled Member Ports : 1-26 Static Ports : 1-26 Current Tagged Ports : Current Untagged Ports: 1-26 Static Tagged Ports : Static Untagged Ports : 1-26 Forbidden Ports : Total Static VLAN Entries: 1 Total GVRP VLAN Entries: 0 DGS-3000-26TC:admin# 3-9 show vlan ports Description This command is used to display the vlan information per ports. Format show vlan ports {} Parameters - (Optional) Enter the list of ports for which the VLAN information will be displayed. Restrictions None. Example To display the VLAN configuration for port 6:

29 DGS-3000-26TC:admin#show vlan ports 6 Command: show vlan ports 6 Port VID Untagged Tagged Dynamic Forbidden ----- ---- -------- ------ ------- --------- 6 1 X - - - 6 2 - X - - DGS-3000-26TC:admin# 3-10 show vlan vlanid Description This command is used to display the vlan information using the VLAN ID. Format show vlan vlanid Parameters - Enter the VLAN ID to be displayed. Restrictions None. Example To display the VLAN configuration for VLAN ID 1: DGS-3000-26TC:admin#show vlan vlanid 1 Command: show vlan vlanid 1 VID : 1 VLAN Name : default VLAN Type : Static Advertisement : Enabled Member Ports : 1-26 Static Ports : 1-26 Current Tagged Ports : Current Untagged Ports: 1-26 Static Tagged Ports : Static Untagged Ports : 1-26 Forbidden Ports : Total Entries : 1 DGS-3000-26TC:admin#

30 3-11 show port_vlan Description This command is used to display the ports’ VLAN attributes on the Switch. Format show port_vlan {} Parameters - (Optional) Specifies a range of ports to be displayed. If no parameter specified, system will display all ports gvrp information. Restrictions None. Example To display 802.1Q port setting: DGS-3000-26TC:admin#show port_vlan Command: show port_vlan Port PVID GVRP Ingress Checking Acceptable Frame Type ------- ---- -------- ---------------- --------------------------- 1 2 Enabled Enabled Only VLAN-tagged Frames 2 2 Enabled Enabled Only VLAN-tagged Frames 3 2 Enabled Enabled Only VLAN-tagged Frames 4 2 Enabled Enabled Only VLAN-tagged Frames 5 2 Enabled Enabled Only VLAN-tagged Frames 6 1 Disabled Enabled All Frames 7 1 Disabled Enabled All Frames 8 1 Disabled Enabled All Frames 9 1 Disabled Enabled All Frames 10 1 Disabled Enabled All Frames 11 1 Disabled Enabled All Frames 12 1 Disabled Enabled All Frames 13 1 Disabled Enabled All Frames 14 1 Disabled Enabled All Frames 15 1 Disabled Enabled All Frames 16 1 Disabled Enabled All Frames 17 1 Disabled Enabled All Frames 18 1 Disabled Enabled All Frames 19 1 Disabled Enabled All Frames 20 1 Disabled Enabled All Frames CTRL+C ESC q Quit SPACE n Next Page ENTER Next Entry a All

31 3-12 enable pvid auto assign Description This command is used to enable the auto-assignment of PVID. If “Auto-assign PVID” is enabled, PVID will be possibly changed by PVID or VLAN configuration. When user configures a port to VLAN X’s untagged membership, this port’s PVID will be updated with VLAN X. In the form of VLAN list command, PVID is updated with last item of VLAN list. When user removes a port from the untagged membership of the PVID’s VLAN, the port’s PVID will be assigned with “default VLAN”. The default setting is enabled. Format enable pvid auto_assign Parameters None. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To enable the auto-assign PVID: DGS-3000-26TC:admin#enable pvid auto_assign Command: enable pvid auto_assign Success. DGS-3000-26TC:admin# 3-13 disable pvid auto assign Description This command is used to disable auto assignment of PVID. Format disable pvid auto_assign Parameters None.

32 Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To disable the auto-assign PVID: DGS-3000-26TC:admin#disable pvid auto_assign Command: disable pvid auto_assign Success. DGS-3000-26TC:admin# 3-14 show pvid auto_assign Description This command is used to display the PVID auto-assignment state. Format show pvid auto_assign Parameters None. Restrictions None. Example To display PVID auto-assignment state: DGS-3000-26TC:admin#show pvid auto_assign Command: show pvid auto_assign PVID Auto-assignment: Enabled DGS-3000-26TC:admin# 3-15 config gvrp Description The config gvrp timer command set the GVRP timer’s value. The default value for Join time is 200 milliseconds; for Leave time is 600 milliseconds; for LeaveAll time is 10000 milliseconds.

33 Format config gvrp [timer {join < value 100-100000> | leave < value 100-100000> | leaveall } | nni_bpdu_addr [dot1d | dot1ad]] Parameters timer - Specifies that the GVRP timer parameter will be configured. join - (Optional) Specifies the Join time will be set. - Enter the time used here. This value must be between 100 and 100000. leave - (Optional) Specifies the Leave time will be set. - Enter the time used here. This value must be between 100 and 100000. leaveall - (Optional) Specifies the LeaveAll time will be set. - Enter the time used here. This value must be between 100 and 100000. nni_bpdu_addr - Determines the BPDU protocol address for GVRP in service provide site. It can use 802.1d GVRP address, 802.1ad service provider GVRP address or a user-defined multicast address. The range of the user defined address is 0180C2000000 - 0180C2FFFFFF. dot1d - Specifies that the NNI BPDU protocol address value will be set to Dot1d. dot1ad - Specifies that the NNI BPDU protocol address value will be set to Dot1ad. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To set the Join time to 200 milliseconds: DGS-3000-26TC:admin#config gvrp timer join 200 Command: config gvrp timer join 200 Success. DGS-3000-26TC:admin# 3-16 show gvrp Description This command is used to display the GVRP global setting. Format show gvrp Parameters None.

34 Restrictions None. Example To display the global setting of GVRP: DGS-3000-26TC:admin#show gvrp Command: show gvrp Global GVRP : Disabled Join Time : 200 Milliseconds Leave Time : 600 Milliseconds LeaveAll Time : 10000 Milliseconds NNI BPDU Address: dot1d DGS-3000-26TC:admin# 3-17 enable gvrp Description This commands is used to enable the Generic VLAN Registration Protocol (GVRP). Format enable gvrp Parameters None. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To enable the generic VLAN Registration Protocol (GVRP): DGS-3000-26TC:admin#enable gvrp Command: enable gvrp Success. DGS-3000-26TC:admin# 3-18 disable gvrp Description This command is used to disable the Generic VLAN Registration Protocol (GVRP).

35 Format disable gvrp Parameters None. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To disable the Generic VLAN Registration Protocol (GVRP): DGS-3000-26TC:admin#disable gvrp Command: disable gvrp Success. DGS-3000-26TC:admin# 3-19 config private_vlan Description This command is used to add or remove a secondary VLAN from a private VLAN. Format config private_vlan [ | vid ] [add [isolated | community] | remove] [ | vlanid ] Parameters - Specifies the name of the private VLAN. vid - Specifies the VLAN ID of the private VLAN. - Enter the VLAN ID used here. This value must be between 2 and 4094. add - Specifies that a secondary VLAN will be added to the private VLAN. isolated - Specifies the secondary VLAN as isolated VLAN. community - Specifies the secondary VLAN as community VLAN. remove - Specifies that a secondary VLAN will be removed from the private VLAN. - Specifies the secondary VLAN name used. This name can be up to 32 characters long. vlanid - A range of secondary VLAN to add or remove to the private VLAN. - Enter the secondary VLAN ID used here. Restrictions Only Administrators and Operators can issue this command.

36 Example To associate secondary vlan to private vlan p1: DGS-3000-26TC:admin#config private_vlan p1 add community vlanid 3 Command: config private_vlan p1 add community vlanid 3 Success. DGS-3000-26TC:admin# 3-20 show private_vlan Description This command is used to show the private VLAN information. Format show private_vlan {[ | vlanid]} Parameters - (Optional) Specifies the name of the private VLAN or its secondary VLAN. This name can be up to 32 characters long. vlanid - (Optional) Specifies the VLAN ID of the private VLAN or its secondary VLAN. - Enter the VLAN ID used here. Restrictions Only Administrators and Operators can issue this command. Example To display private VLAN settings: DGS-3000-26TC:admin#show private_vlan Command: show private_vlan Primary VLAN 3 ------------------------------------------ Promiscuous Ports : Trunk Ports : Total Entries: 1 DGS-3000-26TC:admin#

37 Chapter 4 802.1X Command List enable 802.1x disable 802.1x create 802.1x user delete 802.1x user show 802.1x user config 802.1x auth_protocol [local | radius_eap] config 802.1x fwd_pdu system [enable | disable] config 802.1x fwd_pdu ports [ | all] [enable | disable] config 802.1x authorization attributes radius [enable | disable] show 802.1x {[auth_state | auth_configuration] ports {}} config 802.1x capability ports [ | all] [authenticator | none] config 802.1x max_users [ | no_limit] config 802.1x auth_parameter ports [ | all] [default | {direction [both | in] | port_control [force_unauth | auto | force_auth] | quiet_period | tx_period | supp_timeout | server_timeout | max_req | reauth_period | max_users [ | no_limit] | enable_reauth [enable | disable]}(1)] config 802.1x auth_mode [port_based | mac_based] config 802.1x init [port_based ports [ | all] | mac_based ports [ | all] {mac_address }] config 802.1x reauth [port_based ports [ | all] | mac_based ports [ | all] {mac_address }] create 802.1x guest_vlan delete 802.1x guest_vlan config 802.1x guest_vlan ports [ | all] state [enable | disable] show 802.1x guest_vlan show auth_statistics {ports } show auth_diagnostics {ports } show auth_session_statistics {ports } 4-1 enable 802.1x Description This command is used to enable the 802.1X function. Format enable 802.1x Parameters None. Restrictions Only Administrators, Operators and Power-Users can issue this command.

38 Example Used to enable the 802.1X function: DGS-3000-26TC:admin#enable 802.1x Command: enable 802.1x Success. DGS-3000-26TC:admin# 4-2 disable 802.1x Description This command is used to disable the 802.1X function. Format disable 802.1x Parameters None. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To disable the 802.1X function: DGS-3000-26TC:admin#disable 802.1x Command: disable 802.1x Success. DGS-3000-26TC:admin# 4-3 create 802.1x user Description This command is used to create an 802.1X user. Format create 802.1x user

39 Parameters - Enter the username to be added. This value can be up to 15 characters long. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To create a 802.1x user “test”: DGS-3000-26TC:admin#create 802.1x user test Command: create 802.1x user test Enter a case-sensitive new password:**** Enter the new password again for confirmation:**** Success. DGS-3000-26TC:admin# 4-4 delete 802.1x user Description This command is used to delete an 802.1X user. Format delete 802.1x user Parameters - Enter the username to be deleted. This value can be up to 15 characters long. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To delete user “test”: DGS-3000-26TC:admin#delete 802.1x user test Command: delete 802.1x user test Success. DGS-3000-26TC:admin#

40 4-5 show 802.1x user Description This command is used to display the 802.1X user. Format show 802.1x user Parameters None. Restrictions None. Example To display the 802.1X user information: DGS-3000-26TC:admin#show 802.1x user Command: show 802.1x user Current Accounts: Username Password --------------- --------------- test test Total Entries:1 DGS-3000-26TC:admin# 4-6 config 802.1x auth_protocol Description This command is used to configure the 802.1X auth protocol. Format config 802.1x auth_protocol [local | radius_eap] Parameters local - Specifies the authentication protocol as local. radius_eap - Specifies the authentication protocol as RADIUS EAP.

41 Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure the 802.1X authentication protocol to RADIUS EAP: DGS-3000-26TC:admin#config 802.1x auth_protocol radius_eap Command: config 802.1x auth_protocol radius_eap Success. DGS-3000-26TC:admin# 4-7 config 802.1x fwd_pdu system Description This command is used to globally control the forwarding of EAPOL PDU. When 802.1X functionality is disabled globally or for a port, and if 802.1X fwd_pdu is enabled both globally and for the port, a received EAPOL packet on the port will be flooded in the same VLAN to those ports for which 802.1X fwd_pdu is enabled and 802.1X is disabled (globally or just for the port). The default state is disabled. Format config 802.1x fwd_pdu system [enable | disable] Parameters enable - Enables the forwarding of EAPOL PDU. disable - Disables the forwarding of EAPOL PDU. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure forwarding of EAPOL PDU system state enable: DGS-3000-26TC:admin#config 802.1x fwd_pdu system enable Command: config 802.1x fwd_pdu system enable Success. DGS-3000-26TC:admin#

42 4-8 config 802.1x fwd_pdu ports Description This command is used to control the forwarding of EAPOL PDU. When 802.1X functionality is disabled globally or for a port, and if 802.1X fwd_pdu is enabled both globally and for the port, a received EAPOL packet on the port will be flooded in the same VLAN to those ports for which 802.1X fwd_pdu is enabled and 802.1X is disabled (globally or just for the port). The default state is disabled. Format config 802.1x fwd_pdu ports [ | all] [enable | disable] Parameters - Enter the list of ports used for the configuration. all - Specifies that all the ports will be used. enable - Enables forwarding EAPOL PDU receive on the ports. disable - Disables forwarding EAPOL PDU receive on the ports. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure 802.1X fwd_pdu for ports: DGS-3000-26TC:admin#config 802.1x fwd_pdu ports 1-2 enable Command: config 802.1x fwd_pdu ports 1-2 enable Success. DGS-3000-26TC:admin# 4-9 config 802.1x authorization attributes Description This command is used to enable or disable acception of authorized configuration. When the authorization is enabled for 802.1X’s RADIUS authentication, the authorized attributes (for example VLAN, 802.1p default priority, and ACL) assigned by the RADUIS server will be accepted. Format config 802.1x authorization attributes radius [enable | disable] Parameters radius - If specified to enable, the authorization attributes (for example VLAN, 802.1p default

43 priority, and ACL) assigned by the RADUIS server will be accepted. The default state is enabled. enable - Specifies to enable the authorization attributes. disable - Specifies to disable the authorization attributes. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example The following example will disable to accept the authorized data assigned from the RADIUS server: DGS-3000-26TC:admin#config 802.1x authorization attributes radius disable Command: config 802.1x authorization attributes radius disable Success. DGS-3000-26TC:admin# 4-10 show 802.1x Description This command is used to display the 802.1X state or configurations. Format show 802.1x {[auth_state | auth_configuration] ports {}} Parameters auth_state - (Optional) Displays 802.1X authentication state machine of some or all ports. auth_configuration - (Optional) Used to display 802.1X configurations of some or all ports. port - (Optional) Specifies a range of ports to be displayed. If no port is specified, all ports will be displayed. - Enter the list of ports used for the configuration here. If no parameter is specified, the 802.1X system configurations will be displayed. Restrictions None. Example To display the 802.1X port level configurations:

44 DGS-3000-26TC:admin#show 802.1x auth_configuration ports 1 Command: show 802.1x auth_configuration ports 1 Port Number : 1 Capability : None AdminCrlDir : Both OpenCrlDir : Both Port Control : Auto QuietPeriod : 60 sec TxPeriod : 30 sec SuppTimeout : 30 sec ServerTimeout : 30 sec MaxReq : 2 times ReAuthPeriod : 3600 sec ReAuthenticate : Disabled Forward EAPOL PDU On Port : Enabled Max User On Port : 16 CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh 4-11 config 802.1x capability Description This command is used to configure the port capability. Format config 802.1x capability ports [ | all] [authenticator | none] Parameters ports - Specifies a range of ports to be configured. - Enter the list of ports used for the configuration here. all - Specifies all ports to be configured. authenticator - Specifies the port that will enforce authentication before allowing access to services that are accessible from that port. This port will adopt the authenticator role. none - Disables authentication on the specified ports. Restrictions Only Administrators, Operators and Power-Users can issue this command.

45 Example To configure the port capability: DGS-3000-26TC:admin#config 802.1x capability ports 1-10 authenticator Command: config 802.1x capability ports 1-10 authenticator Success. DGS-3000-26TC:admin# 4-12 config 802.1x max_users Description This command is used to limit the maximum number of users that can be learned via 802.1X authentication. In addition to the global limitation, maximum user for per port is also limited. It is specified by config 802.1x auth_parameter command. Format config 802.1x max_users [ | no_limit] Parameters - Enter the maximum number of users. This value must be between 1 and 448. no_limit – Specifies that the maximum user limit will be set to 448. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure 802.1X number of users to be limited to 200: DGS-3000-26TC:admin#config 802.1x max_users 200 Command: config 802.1x max_users 200 Success. DGS-3000-26TC:admin# 4-13 config 802.1x auth_parameter Description This command is used to configure the parameters that control the operation of the authenticator associated with a port.

46 Format config 802.1x auth_parameter ports [ | all] [default | {direction [both | in] | port_control [force_unauth | auto | force_auth] | quiet_period | tx_period | supp_timeout | server_timeout | max_req | reauth_period | max_users [ | no_limit] | enable_reauth [enable | disable]}(1)] Parameters ports - Specifies a range of ports to be configured. - Enter the list of ports used for the configuration here. all - Specifies that all the ports will be used. default - Sets all parameter to be default value. direction - (Optional) Sets the direction of access control. both - For bidirectional access control. in - For unidirectional access control. port_control - (Optional) You can force a specific port to be unconditionally authorized or unauthorized by setting the parameter of port_control to be force_auth or force_unauth. Besides, the controlled port will reflect the outcome of authentication if port_control is auto. force_unauth - Forces a specific port to be unconditionally unauthorized. auto - The controlled port will reflect the outcome of authentication. force_auth - Forces a specific port to be unconditionally authorized. quiet_period - (Optional) It is the initialization value of the quietWhile timer. The default value is 60 seconds and can be any value among 0 to 65535. - Enter the quiet period value here. This value must be between 0 and 65535 seconds. tx_period - (Optional) It is the initialization value of the transmit timer period. The default value is 30 seconds and can be any integer value among 1 to 65535. - Enter the tx period value here. This value must be between 1 and 65535 seconds. supp_timeout - (Optional) The initialization value of the aWhile timer when timing out the supplicant. Its default value is 30 seconds and can be any integer value among 1 to 65535. - Enter the supplicant timeout value here. This value must be between 1 and 65535 seconds. server_timeout - (Optional) The initialization value of the aWhile timer when timing out the authentication server. Its default value is 30 seconds and can be any integer value among 1 to 65535. - Enter the server timeout value here. This value must be between 1 and 65535 seconds. max_req - (Optional) The maximum number of times that the authentication PAE state machine will retransmit an EAP Request packet to the supplicant. Its default value is 2 and can be any integer number among 1 to 10. - Enter the maximum required value here. This value must be between 1 and 10. reauth_period - (Optional) It’s a nonzero number of seconds, which is used to be the re- authentication timer. The default value is 3600. - Enter the re-authentication period value here. This value must be between 1 and 65535 seconds. max_users - (Optional) Specifies per port maximum number of users. The default value is 16. - Enter the maximum users value here. This value must be between 1 and 448. no_limit - Specifies that no limit is enforced on the maximum users used. enable_reauth - (Optional) You can enable or disable the re-authentication mechanism for a specific port. enable - Specifies to enable the re-authentication mechanism for a specific port. disable - Specifies to disable the re-authentication mechanism for a specific port.

47 Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure the parameters that control the operation of the authenticator associated with a port: DGS-3000-26TC:admin#config 802.1x auth_parameter ports 1-20 direction both Command: config 802.1x auth_parameter ports 1-20 direction both Success. DGS-3000-26TC:admin# 4-14 config 802.1x auth_mode Description This command is used to configure 802.1X authentication mode. Format config 802.1x auth_mode [port_based | mac_based] Parameters port_based - Specifies the authentication as the port-based mode. mac_based - Specifies the authentication as the MAC-based mode. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure the authentication mode: DGS-3000-26TC:admin#config 802.1x auth_mode port_based Command: config 802.1x auth_mode port_based Success. DGS-3000-26TC:admin# 4-15 config 802.1x init Description This command is used to initialize the authentication state machine of some or all ports.

48 Format config 802.1x init [port_based ports [ | all] | mac_based ports [ | all] {mac_address }] Parameters port_based ports- Specifies the authentication as the port-based mode. - Enter the list of ports used for the configuration here. all - Specifies that all ports will be used. mac_based ports - Specifies the authentication as the MAC-based mode. - Enter the list of ports used for the configuration here. all - Specifies that all ports will be used. mac_address - (Optional) Specifies the MAC address of client. - Enter the MAC address used here. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To initialize the authentication state machine of some or all: DGS-3000-26TC:admin#config 802.1x init port_based ports all Command: config 802.1x init port_based ports all Success. DGS-3000-26TC:admin# 4-16 config 802.1x reauth Description This command is used to re-authenticate the device connected to the port. During the re- authentication period, the port status remains authorized until failed re-authentication. Format config 802.1x reauth [port_based ports [ | all] | mac_based ports [ | all] {mac_address }] Parameters port_based ports - Specifies the authentication as the port-based mode. - Enter the list of ports used for the configuration here. all - Specifies that all ports will be used. mac_based ports - Specifies the authentication as the MAC-based mode. - Enter the list of ports used for the configuration here. all - Specifies that all ports will be used. mac_address - (Optional) Specifies the MAC address of client. - Enter the MAC address used here.

49 Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To re-authenticate the device connected to the port: DGS-3000-26TC:admin#config 802.1x reauth port_based ports all Command: config 802.1x reauth port_based ports all Success. DGS-3000-26TC:admin# 4-17 create 802.1x guest_vlan Description This command is used to assign a static VLAN to be guest VLAN. The specific VLAN which assigned to guest VLAN must be existed. The specific VLAN which assigned to guest VLAN can’t be deleting. Format create 802.1x guest_vlan Parameters - Specifies the VLAN to be guest VLAN. The VLAN name can be up to 32 characters long. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To create a VLAN named “guestVLAN” as 802.1X guest VLAN: DGS-3000-26TC:admin#create 802.1x guest_vlan guestVLAN Command: create 802.1x guest_vlan guestVLAN Success. DGS-3000-26TC:admin# 4-18 delete 802.1x guest_vlan Description This command is used to delete guest VLAN setting, but not delete the static VLAN. All ports which enabled guest VLAN will remove to original VLAN after deleted guest VLAN.

50 Format delete 802.1x guest_vlan Parameters - Enter the VLAN name here. The VLAN name can be up to 32 characters long. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To delete the guest VLAN named “guestVLAN”: DGS-3000-26TC:admin#delete 802.1x guest_vlan guestVLAN Command: delete 802.1x guest_vlan guestVLAN Success. DGS-3000-26TC:admin# 4-19 config 802.1x guest_vlan Description This command is used to configure guest VLAN setting. If the specific port state is changed from enabled state to disable state, this port will move to its original VLAN. Format config 802.1x guest_vlan ports [ | all] state [enable | disable] Parameters ports - A range of ports enable or disable guest VLAN function. - Enter the list of ports used for the configuration here. all - Specifies that all the port will be included in this configuration. state - Specifies the guest VLAN port state of the configured ports. enable - Specifies to join the guest VLAN. disable - Specifies to be removed from the guest VLAN. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example Enable on port 2 to 8 to configure 802.1X guest VLAN:

51 DGS-3000-26TC:admin#config 802.1x guest_vlan ports 2-8 state enable Command: config 802.1x guest_vlan ports 2-8 state enable Warning, The ports are moved to Guest VLAN. Success. DGS-3000-26TC:admin# 4-20 show 802.1x guest_vlan Description This command is used to show the information of guest VLANs. Format show 802.1x guest_vlan Parameters None. Restrictions None. Example To show 802.1X guest VLAN on the Switch: DGS-3000-26TC:admin#show 802.1x guest_vlan Command: show 802.1x guest_vlan Guest VLAN Setting ----------------------------------------------------------- Guest VLAN : guestVLAN Enabled Guest VLAN Ports : 2-8 DGS-3000-26TC:admin# 4-21 show auth_statistics Description This command is used to display information of authenticator statistics. Format show auth_statistics {ports }

52 Parameters ports - (Optional) Specifies a range of ports to be displayed. - Enter the list of ports that will be displayed here. Restrictions None. Example To display authenticator statistics information for port 1: DGS-3000-26TC:admin#show auth_statistics ports 1 Command: show auth_statistics ports 1 Port Number : 1 EapolFramesRx 0 EapolFramesTx 9 EapolStartFramesRx 0 EapolReqIdFramesTx 6 EapolLogoffFramesRx 0 EapolReqFramesTx 0 EapolRespIdFramesRx 0 EapolRespFramesRx 0 InvalidEapolFramesRx 0 EapLengthErrorFramesRx 0 LastEapolFrameVersion 0 LastEapolFrameSource 00-00-00-00-00-00 CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh 4-22 show auth_diagnostics Description This command is used to display information of authenticator diagnostics. Format show auth_diagnostics {ports } Parameters ports - (Optional) Specifies a range of ports to be displayed.

53 - Enter the list of ports that will be displayed here. Restrictions None. Example To display authenticator diagnostics information for port 1: DGS-3000-26TC:admin#show auth_diagnostics ports 1 Command: show auth_diagnostics ports 1 Port Number : 1 EntersConnecting 11 EapLogoffsWhileConnecting 0 EntersAuthenticating 0 SuccessWhileAuthenticating 0 TimeoutsWhileAuthenticating 0 FailWhileAuthenticating 0 ReauthsWhileAuthenticating 0 EapStartsWhileAuthenticating 0 EapLogoffWhileAuthenticating 0 ReauthsWhileAuthenticated 0 EapStartsWhileAuthenticated 0 EapLogoffWhileAuthenticated 0 BackendResponses 0 BackendAccessChallenges 0 BackendOtherRequestsToSupplicant 0 BackendNonNakResponsesFromSupplicant 0 BackendAuthSuccesses 0 BackendAuthFails 0 CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh 4-23 show auth_session_statistics Description This command is used to display information of authenticator session statistics. Format show auth_session_statistics {ports } Parameters ports - (Optional) Specifies a range of ports to be displayed. - Enter the list of ports that will be displayed here.

54 Restrictions None. Example To display authenticator session statistics information for port 1: DGS-3000-26TC:admin#show auth_session_statistics ports 1 Command: show auth_session_statistics ports 1 Port Number : 1 SessionOctetsRx 0 SessionOctetsTx 0 SessionFramesRx 0 SessionFramesTx 0 SessionId SessionAuthenticMethod Remote Authentication Server SessionTime 0 SessionTerminateCause SupplicantLogoff SessionUserName CTRL+C ESC q Quit SPACE n Next Page p Previous Page r Refresh

55 Chapter 5 Access Authentication Control Command List enable password encryption disable password encryption enable authen_policy disable authen_policy show authen_policy create authen_login method_list_name config authen_login [default | method_list_name ] method {tacacs | xtacacs | tacacs+ | radius | server_group | local | none} delete authen_login method_list_name show authen_login [default | method_list_name | all] create authen_enable method_list_name config authen_enable [default | method_list_name ] method {tacacs | xtacacs | tacacs+ | radius | server_group | local _enable | none} delete authen_enable method_list_name show authen_enable [default | method_list_name | all] config authen application [console | telnet | ssh | http | all] [login | enable] [default | method_list_name ] show authen application create authen server_group config authen server_group [tacacs | xtacacs | tacacs+ | radius | ] [add | delete] server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+ | radius] delete authen server_group show authen server_group {} create authen server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+ | radius] {port | [key [ | none]] | timeout | retransmit } config authen server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+ | radius] {port | [ key [ | none] ] | timeout | retransmit } delete authen server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+ | radius] show authen server_host config authen parameter response_timeout config authen parameter attempt show authen parameter enable admin config admin local_enable {encrypt [plain_text | sha_1] } create accounting method_list_name config accounting [default | method_list_name ] method {tacacs+ | radius | server_group | none} delete accounting method_list_name show accounting [default | method_list_name | all] config accounting service command {administrator | operator | power_user | user} [method_list_name | none] config accounting service [network | shell | system] state [enable {[radius_only | method_list_name | default_method_list]} | disable] show accounting service show aaa

56 5-1 enable password encryption Description This command is used to enable password encryption. The user account configuration information will be stored in the configuration file, and can be applied to the system later. If the password encryption is enabled, the password will be in encrypted form. Format enable password encryption Parameters None. Restrictions Only Administrators can issue this command. Example To enable the password encryption: DGS-3000-26TC:admin#enable password encryption Command: enable password encryption Success. DGS-3000-26TC:admin# 5-2 disable password encryption Description This command is used to disable password encryption. The user account configuration information will be stored in the configuration file, and can be applied to the system later. When password encryption is disabled, if the user specifies the password in plain text form, the password will be in plan text form. However, if the user specifies the password in encrypted form, or if the password has been converted to encrypted form by the last enable password encryption command, the password will still be in the encrypted form. It can not be reverted to the plaintext. Format disable password encryption Parameters None.

57 Restrictions Only Administrators can issue this command. Example To disable the password encryption: DGS-3000-26TC:admin#disable password encryption Command: disable password encryption Success. DGS-3000-26TC:admin# 5-3 enable authen_policy Description This command is used to enable system access authentication policy. Enable system access authentication policy. When authentication is enabled, the device will adopt the login authentication method list to authenticate the user for login, and adopt the enable authentication method list to authenticate the enable password for promoting the user‘s privilege to Admin level. Format enable authen_policy Parameters None. Restrictions Only Administrators can issue this command. Example To enable system access authentication policy: DGS-3000-26TC:admin#enable authen_policy Command: enable authen_policy Success. DGS-3000-26TC:admin#

58 5-4 disable authen_policy Description This command is used to disable system access authentication policy. Disable system access authentication policy. When authentication is disabled, the device will adopt the local user account database to authenticate the user for login, and adopt the local enable password to authenticate the enable password for promoting the user‘s privilege to Admin level. Format disable authen_policy Parameters None. Restrictions Only Administrators can issue this command. Example To disable system access authentication policy: DGS-3000-26TC:admin#disable authen_policy Command: disable authen_policy Success. DGS-3000-26TC:admin# 5-5 show authen_policy Description This command is used to display that system access authentication policy is enabled or disabled. Format show authen_policy Parameters None. Restrictions Only Administrators can issue this command.

59 Example To display system access authentication policy: DGS-3000-26TC:admin#show authen_policy Command: show authen_policy Authentication Policy : Enabled DGS-3000-26TC:admin# 5-6 create authen_login Description This command is used to create a user-defined method list of authentication methods for user login. The maximum supported number of the login method lists is 8. Format create authen_login method_list_name Parameters - The user-defined method list name. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To create a user-defined method list for user login: DGS-3000-26TC:admin#create authen_login method_list_name login_list_1 Command: create authen_login method_list_name login_list_1 Success. DGS-3000-26TC:admin# 5-7 config authen_login Description Configure a user-defined or default method list of authentication methods for user login. The sequence of methods will effect the altercation result. For example, if the sequence is tacacs+ first, then tacacs and local, when user trys to login, the authentication request will be sent to the first server host in tacacs+ built-in server group. If the first server host in tacacs+ group is missing, the authentication request will be sent to the second server host in tacacs+ group, and so on. If all server hosts in tacacs+ group are missing, the authentication request will be sent to the first server host in tacacs group…If all server hosts in tacacs group are missing, the local account database in the device is used to authenticate this user. When user logins the device successfully while using methods like tacacs/xtacacs/tacacs+/radius built-in or user-defined server groups or none, the

60 “user” privilege level is assigned only. If user wants to get admin privilege level, user must use the “enable admin” command to promote his privilege level. But when local method is used, the privilege level will depend on this account privilege level stored in the local device. Format config authen_login [default | method_list_name ] method {tacacs | xtacacs | tacacs+ | radius | server_group | local | none} Parameters default - The default method list of authentication methods. method_list_name - The user-defined method list of authentication methods. - Enter the method list name here. This value can be up to 15 characters long. method - Specifies the authentication method used. tacacs - (Optional) Specifies to authenticate by using the built-in server group called “tacacs”. xtacacs - (Optional) Specifies to authenticate by using the built-in server group called “xtacacs”. tacacs+ - (Optional) Specifies to authenticate by using the built-in server group called “tacacs+”. radius - (Optional) Specifies to authenticate by using the built-in server group called “radius”. server_group - (Optional) Specifies to authenticate by using the user-defined server group. - Enter the server group value here. This value can be up 15 characters long. local - (Optional) Specifies to authenticate by local user account database in device. none - (Optional) No authentication. Restrictions Only Administrators can issue this command. Example To configure a user-defined method list for user login: DGS-3000-26TC:admin#config authen_login method_list_name login_list_1 method tacacs+ tacacs local Command: config authen_login method_list_name login_list_1 method tacacs+ tacacs local Success. DGS-3000-26TC:admin# 5-8 delete authen_login Description This command is used to delete a user-defined method list of authentication methods for user login. Format delete authen_login method_list_name

61 Parameters - The user-defined method list name. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To delete a user-defined method list for user login: DGS-3000-26TC:admin#delete authen_login method_list_name login_list_1 Command: delete authen_login method_list_name login_list_1 Success. DGS-3000-26TC:admin# 5-9 show authen_login Description This command is used to display the method list of authentication methods for user login. Format show authen_login [default | method_list_name | all] Parameters default - Displays default user-defined method list for user login. method_list_name - Displays the specific user-defined method list for user login. - Enter the method list name here. This value can be up to 15 characters long. all - Displays all method lists for user login. Restrictions Only Administrators can issue this command. Example To display a user-defined method list for user login:

62 DGS-3000-26TC:admin#show authen_login method_list_name login_list_1 Command: show authen_login method_list_name login_list_1 Method List Name Priority Method Name Comment ---------------- -------- --------------- ------------------ login_list_1 1 tacacs+ Built-in Group 2 tacacs Built-in Group 3 mix_1 User-defined Group 4 local Keyword DGS-3000-26TC:admin# 5-10 create authen_enable Description This command is used to create a user-defined method list of authentication methods for promoting user's privilege to Admin level. Format create authen_enable method_list_name Parameters - The user-defined method list name. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To create a user-defined method list for promoting user's privilege to Admin level: DGS-3000-26TC:admin#create authen_enable method_list_name enable_list_1 Command: create authen_enable method_list_name enable_list_1 Success. DGS-3000-26TC:admin# 5-11 config authen_enable Description This command is used to configure a user-defined or default method list of authentication methods for promoting user's privilege to Admin level. The sequence of methods will affect the altercation result. For example, if the sequence is tacacs+ first, then tacacs and local_enable, when user try to promote user's privilege to Admin level, the authentication request will be sent to the first server host in tacacs+ built-in server group. If the first server host in tacacs+ group is missing, the authentication request will be sent to the second server host in tacacs+ group, and so on. If all

63 server hosts in tacacs+ group are missing, the authentication request will be sent to the first server host in tacacs group…If all server hosts in tacacs group are missing, the local enable password in the device is used to authenticate this user’s password. Format config authen_enable [default | method_list_name ] method {tacacs | xtacacs | tacacs+ | radius | server_group | local _enable | none} Parameters default - The default method list of authentication methods. method_list_name - The user-defined method list of authentication methods. Enter the method list name here. This value can be up to 15 characters long. method - Specifies the authentication method used. tacacs - (Optional) Specifies to authenticate by using the built-in server group called “tacacs”. xtacacs - (Optional) Specifies to authenticate by using the built-in server group called “xtacacs”. tacacs+ - (Optional) Specifies to authenticate by using the built-in server group called “tacacs+”. radius - (Optional) Specifies to authenticate by using the built-in server group called “radius”. server_group - (Optional) Specifies to authenticate by the user-defined server group. - Enter the server group name here. This value can be up to 15 characters long. local_enable - (Optional) Specifies to authenticate by local enable password in device. none - (Optional) No authentication. Restrictions Only Administrators can issue this command. Example To configure a user-defined method list for promoting user's privilege to Admin level: DGS-3000-26TC:admin#config authen_enable method_list_name enable_list_1 method tacacs+ tacacs local_enable Command: config authen_ enable method_list_name enable_list_1 method tacacs+ tacacs local_enable Success. DGS-3000-26TC:admin# 5-12 delete authen_enable Description This command is used to delete a user-defined method list of authentication methods for promoting user's privilege to Admin level. Format delete authen_enable method_list_name

64 Parameters - The user-defined method list name. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To delete a user-defined method list for promoting user's privilege to Admin level: DGS-3000-26TC:admin#delete authen_enable method_list_name enable_list_1 Command: delete authen_enable method_list_name enable_list_1 Success. DGS-3000-26TC:admin# 5-13 show authen_enable Description This command is used to display the method list of authentication methods for promoting user's privilege to Admin level. Format show authen_enable [default | method_list_name | all] Parameters default - Displays default user-defined method list for promoting user's privilege to Admin level. method_list_name - Displays the specific user-defined method list for promoting user's privilege to Admin level. - Enter the method list name here. This value can be up to 15 characters long. all - Displays all method lists for promoting user's privilege to Admin level. Restrictions Only Administrators can issue this command. Example To display all method lists for promoting user's privilege to Admin level:

65 DGS-3000-26TC:admin#show authen_enable method_list_name enable_list_1 Command: show authen_enable method_list_name enable_list_1 Method List Name Priority Method Name Comment ---------------- -------- --------------- ------------------ enable_list_1 1 tacacs+ Built-in Group 2 tacacs Built-in Group 3 mix_1 User-defined Group 4 local_enable Keyword DGS-3000-26TC:admin# 5-14 config authen application Description This command is used to configure login or enable method list for all or the specified application. Format config authen application [console | telnet | ssh | http | all] [login | enable] [default | method_list_name ] Parameters console - Application: console. telnet - Application: TELNET. ssh - Application: SSH. http - Application: web. all - Application: console, TELNET, SSH, and web. login - Selects the method list of authentication methods for user login. enable - Selects the method list of authentication methods for promoting user's privilege to Admin level. default - Default method list. method_list_name - The user-defined method list name. - Enter the method list name here. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To configure the login method list for TELNET: DGS-3000-26TC:admin#config authen application telnet login method_list_name login_list_1 Command: config authen application telnet login method_list_name login_list_1 Success. DGS-3000-26TC:admin#

66 5-15 show authen application Description This command is used to display the login/enable method list for all applications. Format show authen application Parameters None. Restrictions Only Administrators can issue this command. Example To display the login/enable method list for all applications: DGS-3000-26TC:admin#show authen application Command: show authen application Application Login Method List Enable Method List ----------- ----------------- ------------------ Console default default Telnet login_list_1 default SSH default default HTTP default default DGS-3000-26TC:admin# 5-16 create authen server_group Description This command is used to create a user-defined authentication server group. The maximum supported number of server groups including built-in server groups is 8. Each group consists of 8 server hosts as maximum. Format create authen server_group Parameters - The user-defined server group name. This value can be up to 15 characters long.

67 Restrictions Only Administrators can issue this command. Example To create a user-defined authentication server group: DGS-3000-26TC:admin#create authen server_group mix_1 Command: create authen server_group mix_1 Success. DGS-3000-26TC:admin# 5-17 config authen server_group Description This command is used to add or remove an authentication server host to or from the specified server group. Built-in server group “tacacs”, “xtacacs”, “tacacs+”, “radius” accepts the server host with the same protocol only, but user-defined server group can accept server hosts with different protocols. Format config authen server_group [tacacs | xtacacs | tacacs+ | radius | ] [add | delete] server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+ | radius] Parameters server_group - User-defined server group. tacacs - Built-in server group “tacacs”. xtacacs - Built-in server group “xtacacs”. tacacs+ - Built-in server group “tacacs+”. radius - Built-in server group “radius”. - Enter the server group name here. This value can be up to 15 characters long. add - Adds a server host to a server group. delete - Removes a server host from a server group. server_host - Specifies the IP address of the server host. - Enter the server host IPv4 address. ipv6 - Specifies the server host IPv6 address. - Enter the server host IPv6 address. protocol - Specifies the authentication protocol used. tacacs - Specifies that the TACACS authentication protocol will be used. xtacacs - Specifies that the XTACACS authentication protocol will be used. tacacs+ - Specifies that the TACACS+ authentication protocol will be used. radius - Specifies that the radius authentication protocol will be used. Restrictions Only Administrators can issue this command.

68 Example To add an authentication server host to an server group: DGS-3000-26TC:admin#config authen server_group mix_1 add server_host 10.1.1.222 protocol tacacs+ Command: config authen server_group mix_1 add server_host 10.1.1.222 protocol ta cacs+ Success. DGS-3000-26TC:admin# 5-18 delete authen server_group Description This command is used to delete a user-defined authentication server group. Format delete authen server_group Parameters - The user-defined server group name. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To delete a user-defined authentication server group: DGS-3000-26TC:admin#delete authen server_group mix_1 Command: delete authen server_group mix_1 Success. DGS-3000-26TC:admin# 5-19 show authen server_group Description This command is used to display the authentication server groups. Format show authen server_group {}

69 Parameters - (Optional) The built-in or user-defined server group name. This value can be up to 15 characters long. Restrictions Only Administrators can issue this command. Example To display all authentication server groups: DGS-3000-26TC:admin#show authen server_group Command: show authen server_group Group Name IP Address Protocol --------------- --------------- -------- mix_1 10.1.1.222 TACACS+ 10.1.1.223 TACACS radius 10.1.1.224 RADIUS tacacs 10.1.1.225 TACACS tacacs+ 10.1.1.226 TACACS+ xtacacs 10.1.1.227 XTACACS Total Entries : 5 DGS-3000-26TC:admin# 5-20 create authen server_host Description This command is used to create an authentication server host. When an authentication server host is created, IP address and protocol are the index. That means over 1 authentication protocol services can be run on the same physical host. The maximum supported number of server hosts is 16. Format create authen server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+ | radius] {port | [key [ | none]] | timeout | retransmit } Parameters - Enter the server host IP address. ipv6 - Specifies the server host IPv6 address. - Enter the server host IPv6 address. protocol - Specifies the host's authentication protocol. tacacs - Server host’s authentication protocol. xtacacs - Server host’s authentication protocol.

70 tacacs+ - Server host’s authentication protocol. radius - Server host’s authentication protocol. port - (Optional) The port number of authentication protocol for server host. Default value for TACACS/XTACACS/TACACS+ is 49. Default value for RADIUS is 1812. - Enter the authentication protocol port number here. This value must be between 1 and 65535. key - (Optional) The key for TACACS+ and RADIUS authentication. If the value is null, no encryption will apply. This value is meaningless for TACACS and XTACACS. - Enter the TACACS+ or the RADIUS key here. This key can be up to 254 characters long. none - No encryption for TACACS+ and RADIUS authentication. This value is meaningless for TACACS and XTACACS. timeout - (Optional) The time in second for waiting server reply. Default value is 5 seconds. - Enter the timeout value here. This value must be between 1 and 255 seconds. retransmit - (Optional) The count for re-transmit. This value is meaningless for TACACS+. Default value is 2. - Enter the re-transmit value here. This value must be between 1 and 20. Restrictions Only Administrators can issue this command. Example To create a TACACS+ authentication server host, its listening port number is 15555 and timeout value is 10 seconds: DGS-3000-26TC:admin#create authen server_host 10.1.1.222 protocol tacacs+ port 15555 timeout 10 Command: create authen server_host 10.1.1.222 protocol tacacs+ port 15555 timeout 10 Key is empty for TACACS+ or RADIUS. Success. DGS-3000-26TC:admin# 5-21 config authen server_host Description This command is used to configure an authentication server host. Format config authen server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+ | radius] {port | [ key [ | none] ] | timeout | retransmit } Parameters - Enter the server host IP address. ipv6 - Specifies the server host IPv6 address. - Enter the server host IPv6 address. protocol - Specifies the server host's authentication protocol.

71 tacacs - Server host’s authentication protocol. xtacacs - Server host’s authentication protocol. tacacs+ - Server host’s authentication protocol. radius - Server host’s authentication protocol. port - (Optional) The port number of authentication protocol for server host. Default value for TACACS/XTACACS/TACACS+ is 49. Default value for RADIUS is 1812. - Enter the port number here. This value must be between 1 and 65535. key - (Optional) The key for TACACS+ and RADIUS authentication. If the value is null, no encryption will apply. This value is meaningless for TACACS and XTACACS. - Enter the TACACS+ key here. This value can be up to 254 characters long. none - No encryption for TACACS+ and RADIUS authentication. This value is meaningless for TACACS and XTACACS. timeout - (Optional) The time in second for waiting server reply. Default value is 5 seconds. - Enter the timeout value here. This value must be between 1 and 255 seconds. retransmit - (Optional) The count for re-transmit. This value is meaningless for TACACS+. Default value is 2. - Enter the re-transmit value here. This value must be between 1 and 20. Restrictions Only Administrators can issue this command. Example To configure a TACACS+ authentication server host’s key value: DGS-3000-26TC:admin#config authen server_host 10.1.1.222 protocol tacacs+ key "This is a secret." Command: config authen server_host 10.1.1.222 protocol tacacs+ key "This is a secret." Success. DGS-3000-26TC:admin# 5-22 delete authen server_host Description This command is used to delete an authentication server host. Format delete authen server_host [ | ipv6 ] protocol [tacacs | xtacacs | tacacs+ | radius] Parameters - Enter the server host's IP address. ipv6 - Specifies the server host IPv6 address. - Enter the server host IPv6 address. protocol - Specifies that server host's authentication protocol. tacacs - Server host’s authentication protocol. xtacacs - Server host’s authentication protocol.

72 tacacs+ - Server host’s authentication protocol. radius - Server host’s authentication protocol. Restrictions Only Administrators can issue this command. Example To delete an authentication server host: DGS-3000-26TC:admin#delete authen server_host 10.1.1.222 protocol tacacs+ Command: delete authen server_host 10.1.1.222 protocol tacacs+ Success. DGS-3000-26TC:admin# 5-23 show authen server_host Description This command is used to display the authentication server hosts. Format show authen server_host Parameters None. Restrictions Only Administrators can issue this command. Example To display all authentication server hosts: DGS-3000-26TC:admin#show authen server_host Command: show authen server_host IP Address Protocol Port Timeout Retransmit Key --------------- -------- ----- ------- ---------- ------------------------- 10.1.1.222 TACACS+ 15555 10 ------ This is a secret. Total Entries : 1 DGS-3000-26TC:admin#

73 5-24 config authen parameter response_timeout Description This command is used to configure the amount of time waiting or user input on console, TELNET, SSH application. Format config authen parameter response_timeout Parameters - The amount of time for user input on console, TELNET or SSH. 0 means there is no time out. This value must be between 0 and 255. Default value is 30 seconds. Restrictions Only Administrators can issue this command. Example To configure the amount of time waiting or user input to be 60 seconds: DGS-3000-26TC:admin#config authen parameter response_timeout 60 Command: config authen parameter response_timeout 60 Success. DGS-3000-26TC:admin# 5-25 config authen parameter attempt Description This command is used to configure the maximum attempts for user's trying to login or promote the privilege on console, TELNET, or SSH application. Format config authen parameter attempt Parameters - The amount of attempts for user's trying to login or promote the privilege on console, TELNET or SSH. This value must be between 1 and 255. Default value is 3. Restrictions Only Administrators can issue this command.

74 Example To configure the maximum attempts for user's trying to login or promote the privilege to be 9: DGS-3000-26TC:admin#config authen parameter attempt 9 Command: config authen parameter attempt 9 Success. DGS-3000-26TC:admin# 5-26 show authen parameter Description This command is used to display the parameters of authentication. Format show authen parameter Parameters None. Restrictions Only Administrators can issue this command. Example To display the parameters of authentication: DGS-3000-26TC:admin#show authen parameter Command: show authen parameter Response Timeout : 60 seconds User Attempts : 9 DGS-3000-26TC:admin# 5-27 enable admin Description This command is used to enter the administrator level privilege. Promote the "user" privilege level to "admin" level. When the user enters this command, the authentication method tacacs, xtacacs, tacacs+, user-defined server groups, local_enable or none will be used to authenticate the user. Because TACACS, XTACACS and RADIUS don't support "enable" function in itself, if user wants to use either one of these 3 protocols to do enable authentication, user must create a special account on the server host first, which has a username "enable" and then configure its password as the enable password to support "enable" function. This command can not be used when authentication policy is disabled.

75 Format enable admin Parameters None. Restrictions None. Example To enable administrator lever privilege: DGS-3000-26TC:puser#enable admin Command: enable admin PassWord:***** Success. DGS-3000-26TC:admin# 5-28 config admin local_enable Description This command is used to config the local enable password of administrator level privilege. When the user chooses the “local_enable” method to promote the privilege level, the enable password of local device is needed. When the password information is not specified in the command, the system will prompt the user to input the password interactively. For this case, the user can only input the plain text password. If the password is present in the command, the user can select to input the password in the plain text form or in the encrypted form. The encryption algorithm is based on SHA-I. Format config admin local_enable {encrypt [plain_text | sha_1] } Parameters encrypt - (Optional) Specifies the password form. plain_text - Specifies the password in plain text form. sha_1 - Specifies the password in SHA-1 encrypted form. - (Optional) The password for promoting the privilege level. The length for a password in plain-text form and SHA-1 encrypted form are different. plain-text: Passwords can be from a minimum of 0 to a maximum of 15 characters. SHA-1: The length of Encrypted passwords is fixed to 35 bytes longand the password is case- sensitive.

76 Restrictions Only Administrators can issue this command. Example To configure the administrator password: DGS-3000-26TC:admin#config admin local_enable Command: config admin local_ebable Enter the old password: Enter the case-sensitive new password:****** Enter the new password again for confirmation:****** Success. DGS-3000-26TC:admin# 5-29 create accounting method_list_name Description This command is used to create a user-defined list of accounting methods for accounting services on the Switch. The maximum supported number of accounting method lists is 8. Format create accounting method_list_name Parameters - Specifies the built-in or user-defined method list. Restrictions Only Administrators can issue this command. Example To create a user-defined accounting method list called “shell_acct”: DGS-3000-26TC:admin#create accounting method_list_name shell_acct Command: create accounting method_list_name shell_acct Success. DGS-3000-26TC:admin# 5-30 config accounting Description This command is used to configure a user-defined or default method list of accounting methods.

77 Format config accounting [default | method_list_name ] method {tacacs+ | radius | server_group | none} Parameters default - Specifies the default method list of accounting methods. method_list_name - Specifies the user-defined method list of accounting methods. - Enter the name of the method list. method - Specifies the protocol. tacacs+ - Specifies the built-in TACACS+ server group. radius – Specifies the built-in RADIUS server group. server_group - Specifies the user-defined server group. If the group contains TACACS and XTACACS server, it will be skipped in accounting. - Enter the name of server group. none - Specifies no accounting. Restrictions Only Administrators can issue this command. Example To configure a user-defined method list called “shell_acct”, that specifies a sequence of the built-in TACACS+ server group, followed by the RADIUS server group for accounting service on the Switch: DGS-3000-26TC:admin#config accounting method_list_name shell_acct method tacacs+ radius Command: config accounting method_list_name shell_acct method tacacs+ radius Success. DGS-3000-26TC:admin# 5-31 delete accounting method_list_name Description This command is used to delete a user-defined method list of accounting methods. Format delete accounting method_list_name Parameters - Specifies the built-in or user-defined method list.

78 Restrictions Only Administrators can issue this command. Example To delete the user-defined accounting method list called “shell_acct” from the Switch: DGS-3000-26TC:admin#delete accounting method_list_name shell_acct Command: delete accounting method_list_name shell_acct Success. DGS-3000-26TC:admin# 5-32 show accounting Description This command is used to display the list of accounting methods on the Switch. Format show accounting [default | method_list_name | all] Parameters default - Displays the user-defined list of default accounting methods. method_list_name - Specifies the user-defined list of specific accounting methods. - Enter the name of the method list. all - Displays all accounting method lists on the Switch. Restrictions Only Administrators can issue this command. Example To display the user-defined accounting method list called “shell_acct”: DGS-3000-26TC:admin#show accounting method_list_name shell_acct Command: show accounting method_list_name shell_acct Method List Name Priority Method Name Comment ---------------- -------- --------------- ------------------ shell_acct 1 tacacs+ Built-in Group 2 radius Built-in Group DGS-3000-26TC:admin#

79 5-33 config accounting service command Description This command is used to configure the state of the specified accounting service. Format config accounting service command {administrator | operator | power_user | user} [method_list_name | none] Parameters administrator - Accounting service for all administrator level commands. operator - Accounting service for all operator level commands. power_user - Accounting service for all power-user level commands. user - Accounting service for all user level commands. method_list_name - Specifies accounting service by the AAA user-defined method list specified by the create accounting method_list_name command. - Enter the name of the method list. none - Disables AAA command accounting services by specified command level. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To enable AAA accounting methodlist “shell_acct” to configure accounting shell state: DGS-3000-26TC:admin#config accounting service command method_list_name shell_acct Command: config accounting service command method_list_name shell_acct Success. DGS-3000-26TC:admin# 5-34 config accounting service Description This command is used to configure the state of the specified RADIUS accounting service. Format config accounting service [network | shell | system] state [enable {[radius_only | method_list_name | default_method_list]} | disable] Parameters network - Accounting service for 802.1X, JWAC and WAC port access control. By default, the service is disabled.

80 shell - Accounting service for shell events: When user logs on or out the Switch (via the console, Telnet, or SSH) and timeout occurs, accounting information will be collected and sent to RADIUS server. By default, the service is disabled. system - Accounting service for system events: reset, reboot. By default, the service is disabled. state - Specifies the state of the specified service. enable - Specifies to enable the specified accounting service. radius_only - (Optional) Specifies accounting service to only use radius group specified by the config radius add command. method_list_name - (Optional) Specifies accounting service by the AAA user-defined method list specified by the “create accounting method_list_name ” command. - Enter the method list name. default_method_list - - (Optional) Specifies accounting service by the AAA default method list. disable - Specifies to disable the specified accounting service. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example Enable it to configure accounting shell state: DGS-3000-26TC:admin#config accounting service shell state enable Command: config accounting service shell state enable Success. DGS-3000-26TC:admin# 5-35 show accounting service Description This command is used to show the status of RADIUS accounting services. Format show accounting service Parameters None. Restrictions None. Example To show information of RADIUS accounting services:

81 DGS-3000-26TC:admin#show accounting service Command: show accounting service Accounting State Method ------------------- --------------- Network : Disabled Shell : Disabled System : Disabled DGS-3000-26TC:admin# 5-36 show aaa Description This command is used to display AAA global configuration Format show aaa Parameters None. Restrictions Only Administrators can issue this command. Example To display AAA global configuration: DGS-3000-26TC:admin#show aaa Command: show aaa Authentication Policy: Enabled Accounting Network Service State: Disabled Accounting Network Service Method: Accounting Shell Service State: Disabled Accounting Shell Service Method: Accounting System Service State: Disabled Accounting System Service Method: Accounting Admin Command Service Method: Accounting Operator Command Service Method: Accounting PowerUser Command Service Method: Accounting User Command Service Method: DGS-3000-26TC:admin#

82 Chapter 6 Access Control List (ACL) Command List create access_profile profile_id {profile_name } [ethernet {vlan {} | source_mac | destination_mac | 802.1p | ethernet_type} | ip {vlan {} | source_ip_mask | destination_ip_mask | dscp | [icmp {type | code } | igmp {type } | tcp {src_port_mask | dst_port_mask | flag_mask [all | {urg | ack | psh | rst | syn | fin}]} | udp {src_port_mask | dst_port_mask } | protocol_id_mask {user_define_mask }]} | packet_content_mask { offset_chunk_1 | offset_chunk_2 | offset_chunk_3 | offset_chunk_4 } | ipv6 {class | flowlabel | source_ipv6_mask | destination_ipv6_mask | [tcp {src_port_mask | dst_port_mask } | udp { src_port_mask | dst_port_mask } | icmp {type | code }]}] delete access_profile [profile_id | profile_name |all] config access_profile [profile_id | profile_name ] [add access_id [auto_assign | ][ethernet {[vlan | vlan_id ] {mask } | source_mac {mask } | destination_mac {mask } | 802.1p | ethernet_type } | ip {[vlan | vlan_id ] {mask } | source_ip {mask } | destination_ip {mask } | dscp | [icmp {type | code } | igmp {type } | tcp {src_port {mask } | dst_port {mask } | flag [all | {urg | ack | psh | rst | syn | fin}]} | udp {src_port {mask } | dst_port {mask }} | protocol_id {user_define {mask }}]} | packet_content {offset_chunk_1 {mask } | offset_chunk_2 {mask } | offset_chunk_3 {mask } | offset_chunk_4 {mask }} | ipv6 {class | flowlabel | source_ipv6 {mask} | destination_ipv6 {mask } | [tcp {src_port {mask } | dst_port {mask }} | udp {src_port {mask } | dst_port {mask }} | icmp {type | code }]}] [port [ | all] | vlan_based [vlan | vlan_id ]] [permit {priority {replace_priority} | [replace_dscp_with | replace_tos_precedence_with ] | counter[enable | disable]} | mirror | deny] {time_range } | delete access_id ] show access_profile {[profile_id | profile_name ]} config flow_meter [profile_id | profile_name ] access_id [rate [] {burst_size []} rate_exceed [drop_packet | remark_dscp ] | tr_tcm cir {cbs } pir {pbs } {[color_blind | color_aware]} {conform [permit | replace_dscp ] {counter [enable | disable]}} exceed [permit {replace_dscp } | drop] {counter [enable | disable]} violate [permit {replace_dscp } | drop] {counter [enable |disable]} | sr_tcm cir cbs ebs {[color_blind | color_aware]} {conform [permit | replace_dscp ] {counter [enable | disable]}} exceed [permit {replace_dscp } | drop] {counter [enable | disable]} violate [permit {replace_dscp } | drop] {counter [enable | disable]} | delete] show flow_meter {[profile_id | profile_name ] {access_id }}

83 config time_range [hours start_time end_time weekdays | delete] show time_range show current_config access_profile 6-1 create access_profile Description This command is used to create access control list profiles. When creating ACL, each profile can have 256 rules/access IDs. However, when creating ACL type as Ethernet or IPv4 at the first time, 62 rules are reserved for the system. In this case, only 194 rules are available to configure. You can use the show access_prfile command to see the available rules. Support for field selections can have additional limitations that are project dependent. For example, for some hardware, it may be invalid to specify a destination and source IPv6 address at the same time. The user will be prompted with these limitations. The Switch supports the following profile types: 1. MAC DA, MAC SA, Ethernet Type, Outer VLAN Tag 2. Outer VLAN Tag, Source IPv4, Destination IPv4, DSCP, Protocol ID, TCP/UDP Source Port, TCP/UDP Destination Port, ICMP type/code, IGMP type, TCP flags 3. Source IPv6 Address, Class, Flow Label, IPv6 Protocol (Next Header) 4. Destination IPv6 Address, Class, Flow Label, IPv6 Protocol (Next Header) 5. Class, Flow Label, IPv6 Protocol (Next Header), TCP/UDP source port, TCP/UDP destination port, ICMP type/code, Outer VLAN Tag 6. Packet Content, Outer VLAN Tag 7. MAC SA, Ethernet Type, Source IPv4/ARP sender IP, Outer VLAN Tag 8. LLC Header/SNAP Header, Outer VLAN Tag 9. Source IPv6 Address, Class, IPv6 Protocol (Next Header), Outer VLAN Tag 10. Destination IPv6 Address, Class, IPv6 Protocol (Next Header), Outer VLAN Tag Note: Profile Types 7 and 8 are not user configurable. Only system applications are allowed to create this type of profiles. Format create access_profile profile_id {profile_name } [ethernet {vlan {} | source_mac | destination_mac | 802.1p | ethernet_type} | ip {vlan {} | source_ip_mask | destination_ip_mask | dscp | [icmp {type | code } | igmp {type } | tcp {src_port_mask | dst_port_mask | flag_mask [all | {urg | ack | psh | rst | syn | fin}]} | udp {src_port_mask | dst_port_mask } | protocol_id_mask {user_define_mask }]} | packet_content_mask { offset_chunk_1 | offset_chunk_2 | offset_chunk_3

84 | offset_chunk_4 } | ipv6 {class | flowlabel | source_ipv6_mask | destination_ipv6_mask | [tcp {src_port_mask | dst_port_mask } | udp { src_port_mask | dst_port_mask } | icmp {type | code }]}] Parameters profile_id - Specifies the index of the access list profile. - Enter the profile ID here. This value must be between 1 and 512. profile_name - The name of the profile must be specified. The maximum length is 32 characters. - Enter the profile name here. ethernet - Specifies this is an ethernet mask. vlan - (Optional) Specifies a VLAN mask. Only the last 12 bits of the mask will be considered. - Enter the VLAN mask value here. source_mac - (Optional) Specifies the source MAC mask. - Enter the source MAC address used here. destination_mac - (Optional) Specifies the destination MAC mask. - Enter the destination MAC address used here. 802.1p - (Optional) Specifies the 802.1p priority tag mask. ethernet_type - (Optional) Specifies the Ethernet type mask. ip - Specifies this is a IPv4 mask. vlan - (Optional) Specifies a VLAN mask. Only the last 12 bits of the mask will be considered. -Enter the VLAN mask value here. source_ip_mask - (Optional) Specifies a source IP address mask. - Enter the source IP address mask here. destination_ip_mask - (Optional) Specifies a destination IP address mask. - Enter the destination IP address mask here. dscp - (Optional) Specifies the DSCP mask. icmp - (Optional) Specifies that the rule applies to ICMP traffic. type - Specifies the type of ICMP traffic. code - Specifies the code of ICMP traffic igmp - (Optional) Specifies that the rule applies to IGMP traffic. type - Specifies the type of IGMP traffic. tcp - (Optional) Specifies that the rule applies to TCP traffic. src_port_mask - (Optional) Specifies the TCP source port mask. - Enter the TCP source port mask here. dst_port_mask - (Optional) Specifies the TCP destination port mask. - Enter the TCP destination port mask here. flag_mask - (Optional) Specifies the TCP flag field mask. all – Specifies that all the flags will be used for the TCP mask. urg – (Optional) Specifies that the TCP flag field will be set to ‘urg’. ack - (Optional) Specifies that the TCP flag field will be set to ‘ack’. psh - (Optional) Specifies that the TCP flag field will be set to ‘psh’. rst - (Optional) Specifies that the TCP flag field will be set to ‘rst’. syn - (Optional) Specifies that the TCP flag field will be set to ‘syn’. fin - (Optional) Specifies that the TCP flag field will be set to ‘fin’. udp - (Optional) Specifies that the rule applies to UDP traffic. src_port_mask - (Optional) Specifies the UDP source port mask. - Enter the UDP source port mask here. dst_port_mask - (Optional) Specifies the UDP destination port mask. - Enter the UDP destination port mask here. protocol_id_mask - (Optional) Specifies that the rule applies to IP protocol ID traffic. <0x0-0xff> - Enter the protocol ID mask here. user_define_mask - (Optional) Specifies that the rule applies to the IP protocol ID, and that the mask option behind the IP header length is 4 bytes. - Enter a user-defined mask value here. packet_content_mask - Specifies the packet content mask. Only one packet_content_mask profile can be created.

85 offset_chunk_1 - (Optional) Specifies that the offset chunk 1 will be used. - Enter the offset chunk 1 value here. This value must be between 0 and 31. - Enter the offset chunk 1 mask here. offset_chunk_2 - (Optional) Specifies that the offset chunk 2 will be used. - Enter the offset chunk 2 value here. This value must be between 0 and 31. - Enter the offset chunk 2 mask here. offset_chunk_3 - (Optional) Specifies that the offset chunk 3 will be used. - Enter the offset chunk 3 value here. This value must be between 0 and 31. - Enter the offset chunk 3 mask here. offset_chunk_4 - (Optional) Specifies that the offset chunk 4 will be used. - Enter the offset chunk 4 value here. This value must be between 0 and 31. - Enter the offset chunk 4 mask here. ipv6 - Specifies this is the IPv6 mask. class - (Optional) Specifies the IPv6 class. flowlabel - (Optional) Specifies the IPv6 flow label. source_ipv6_mask - (Optional) Specifies an IPv6 source sub-mask. - Enter the source IPv6 mask value here. destination_ipv6_mask - (Optional) Specifies an IPv6 destination sub-mask. -Enter the destination IPv6 mask value here. tcp - (Optional) Specifies that the rule applies to TCP traffic. src_port_mask - (Optional) Specifies an IPv6 TCP source port mask. - Enter the TCP source port mask value here. dst_port_mask - (Optional) Specifies an IPv6 TCP destination port mask. - Enter the TCP destination port mask value here. udp - (Optional) Specifies that the rule applies to UDP traffic. src_port_mask - Specifies the UDP source port mask. - Enter the UDP source port mask value here. dst_port_mask - Specifies the UDP destination port mask. - Enter the UDP destination port mask value here. icmp - (Optional) Specifies a mask for ICMP filtering. type - (Optional) Specifies the inclusion of the ICMP type field in the mask. code - (Optional) Specifies the inclusion of the ICMP code field in the mask. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To create three access profiles:

86 DGS-3000-26TC:admin#create access_profile profile_id 1 profile_name t1 ethernet vlan source_mac 00-00-00-00-00-01 destination_mac 00-00-00-00-00-02 802.1p ethernet_type Command: create access_profile profile_id 1 profile_name 1 ethernet vlan source_mac 00-00-00-00-00-01 destination_mac 00-00-00-00-00-02 802.1p ethernet_type Success. DGS-3000-26TC:admin#create access_profile profile_id 2 profile_name 2 ip vlan source_ip_mask 20.0.0.0 destination_ip_mask 10.0.0.0 dscp icmp type code Command: create access_profile profile_id 2 profile_name t2 ip vlan source_ip_mask 20.0.0.0 destination_ip_mask 10.0.0.0 dscp icmp type code Success. DGS-3000-26TC:admin#create access_profile profile_id 4 profile_name 4 packet_content_mask offset_chunk_1 3 0xFFFF offset_chunk_2 5 0xFF00 offset_chunk_3 14 0xFFFF0000 offset_chunk_4 16 0xFF000000 Command: create access_profile profile_id 4 profile_name 4 packet_content_mask offset_chunk_1 3 0xFFFF offset_chunk_2 5 0xFF00 offset_chunk_3 14 0xFFFF0000 offset_chunk_4 16 0xFF000000 Success. DGS-3000-26TC:admin# 6-2 delete access_profile Description This command is used to delete access list profiles. This command can only delete profiles that were created using the ACL module. Format delete access_profile [profile_id | profile_name |all] Parameters profile_id - Specifies the index of the access list profile. - Enter the profile ID value here. This value must be between 1 and 512. profile_name - Specifies the name of the profile. - Enter the profile name.. The maximum length is 32 characters. all - Specifies that the whole access list profile will be deleted. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To delete the access list rule with a profile ID of 1:

87 DGS-3000-26TC:admin#delete access_profile profile_id 1 Command: delete access_profile profile_id 1 Success. DGS-3000-26TC:admin# 6-3 config access_profile Description This command is used to configure an access list entry. The ACL mirror function works after the mirror has been enabled and the mirror port has been configured using the mirror command. When applying an access rule to a target, the setting specified in the VLAN field will not take effect if the target is a VLAN. Format config access_profile [profile_id | profile_name ] [add access_id [auto_assign | ][ethernet {[vlan | vlan_id ] {mask } | source_mac {mask } | destination_mac {mask } | 802.1p | ethernet_type } | ip {[vlan | vlan_id ] {mask } | source_ip {mask } | destination_ip {mask } | dscp | [icmp {type | code } | igmp {type } | tcp {src_port {mask } | dst_port {mask } | flag [all | {urg | ack | psh | rst | syn | fin}]} | udp {src_port {mask } | dst_port {mask }} | protocol_id {user_define {mask }}]} | packet_content {offset_chunk_1 {mask } | offset_chunk_2 {mask } | offset_chunk_3 {mask } | offset_chunk_4 {mask }} | ipv6 {class | flowlabel | source_ipv6 {mask} | destination_ipv6 {mask } | [tcp {src_port {mask } | dst_port {mask }} | udp {src_port {mask } | dst_port {mask }} | icmp {type | code }]}] [port [ | all] | vlan_based [vlan | vlan_id ]] [permit {priority {replace_priority} | [replace_dscp_with | replace_tos_precedence_with ] | counter[enable | disable]} | mirror | deny] {time_range } | delete access_id ] Parameters profile_id - Specifies the index of the access list profile. - Enter the profile ID value here. This value must be between 1 and 512. profile_name - Specifies the name of the profile. - Enter the profile name here. This name can be up to 32 characters long. add - Specifies that a profile or a rule will be added. access_id - Specifies the index of the access list entry. The value range is 1-256, but the supported maximum number of entries depends on the project. If the auto_assign option is selected, the access ID is automatically assigned, when adding multiple ports.

88 auto_assign - Specifies that the access ID will automatically be assigned. - Enter the access ID used here. This value must be between 1 and 256. ethernet - Specifies to configure the ethernet access profile. vlan - (Optional) Specifies the VLAN name. - Enter the name of the VLAN here. This name can be up to 32 characters long. vlan_id - (Optional) Specifies the VLAN ID used. - Enter the VLAN ID used here. This value must be between 1 and 4094. mask - (Optional) Specifies an additional mask parameter that can be configured. - Enter the mask value here. source_mac - (Optional) Specifies the source MAC address. - Enter the source MAC address used for this configuration here. mask - (Optional) Specifies an additional mask parameter that can be configured. - Enter the source MAC mask used here. destination_mac - (Optional) Specifies the destination MAC address. - Enter the destination MAC address used for this configuration here. mask - (Optional) Specifies an additional mask parameter that can be configured. - Enter the destination MAC mask here. 802.1p - (Optional) Specifies the value of the 802.1p priority tag. - Enter the 802.1p priority tag value. The priority tag ranges from 1 to 7. ethernet_type - (Optional) Specifies the Ethernet type. - Enter the Ethernet type mask here. ip - Specifies to configure the IP access profile. vlan - (Optional) Specifies a VLAN name. - Enter the name of the VLAN here. This name can be up to 32 characters long. vlan_id - (Optional) Specifies that VLAN ID used. - Enter the VLAN ID used here. This value must be between 1 and 4094. mask – (Optional) Specifies an additional mask parameter that can be configured. - Enter the mask value here. source_ip - (Optional) Specifies an IP source address. - Enter the source IP address used for this configuration here. mask - (Optional) Specifies an additional mask parameter that can be configured. - Enter the source netmask used here. destination_ip - (Optional) Specifies an IP destination address. - Enter the destination IP address used for this configuration here. mask - (Optional) Specifies an additional mask parameter that can be configured. - Enter the destination netmask used here. dscp - (Optional) Specifies the value of DSCP. The DSCP value ranges from 0 to 63. - Enter the DSCP value here. icmp - (Optional) Specifies to configure the ICMP parameters. type - (Optional) Specifies that the rule will apply to the ICMP Type traffic value. - Enter the ICMP type traffic value here. This value must be between 0 and 255. code - (Optional) Specifies that the rule will apply to the ICMP Code traffic value. - Enter the ICMP code traffic value here. This value must be between 0 and 255. igmp - (Optional) Specifies to configure the IGMP parameters. type - (Optional) Specifies that the rule will apply to the IGMP Type traffic value. - Enter the IGMP type traffic value here. This value must be between 0 and 255. tcp - Specifies to configure the TCP parameters. src_port - (Optional) Specifies that the rule will apply to a range of TCP source ports. - Enter the TCP source port value here. This value must be between 0 and 65535. mask - (Optional) Specifies an additional mask parameter that can be configured. - Enter the source port mask here. dst_port - (Optional) Specifies that the rule will apply to a range of TCP destination ports. - Enter the TCP destination port value here. This value must be between 0 and 65535.

89 mask - (Optional) Specifies an additional mask parameter that can be configured. - Enter the destination port mask here. flag - (Optional) Specifies the TCP flag fields. all - Specifies that all the TCP flags will be used in this configuration. urg - (Optional) Specifies that the TCP flag field will be set to 'urg'. ack - (Optional) Specifies that the TCP flag field will be set to 'ack'. psh - (Optional) Specifies that the TCP flag field will be set to 'psh'. rst - (Optional) Specifies that the TCP flag field will be set to 'rst'. syn - (Optional) Specifies that the TCP flag field will be set to 'syn'. fin - (Optional) Specifies that the TCP flag field will be set to 'fin'. udp - Specifies to configure the UDP parameters. src_port - (Optional) Specifies the UDP source port range. - Enter the UDP source port value here. This value must be between 0 and 65535. mask - (Optional) Specifies an additional mask parameter that can be configured. - Enter the source port mask here. dst_port - (Optional) Specifies the UDP destination port range. - Enter the UDP destination port value here. This value must be between 0 and 65535. mask - (Optional) Specifies an additional mask parameter that can be configured. - Enter the destination port mask here. protocol_id - Specifies that the rule will apply to the value of IP protocol ID traffic. - Enter the protocol ID used here. user_define - (Optional) Specifies that the rule will apply to the IP protocol ID and that the mask options behind the first 4 bytes of the IP payload. - Enter the user-defined mask value here. mask - Specifies an additional mask parameter that can be configured. - Enter the mask value here. packet_content - A maximum of 4 offsets can be specified. Each offset defines 4 bytes of data which is identified as a single UDF field. offset_chunk_1 – (Optional) Specifies the value of the packet bytes to be matched. Offset chunk 1 will be used. - Enter the offset chunk 1 mask here. offset_chunk_2 - (Optional) Specifies the value of the packet bytes to be matched. Offset chunk 2 will be used. - Enter the offset chunk 2 mask here. offset_chunk_3 - (Optional) Specifies the value of the packet bytes to be matched. Offset chunk 3 will be used. - Enter the offset chunk 3 mask here. offset_chunk_4 - (Optional) Specifies the value of the packet bytes to be matched. Offset chunk 4 will be used. - Enter the offset chunk 4 mask here. ipv6 - Specifies that the rule applies to IPv6 fields. class - (Optional) Specifies the value of the IPv6 class. - Enter the IPv6 class value here. This value must be between 0 and 255. flowlabel - (Optional) Specifies the value of the IPv6 flow label. - Enter the IPv6 flow label mask used here. source_ipv6 - (Optional) Specifies the value of the IPv6 source address. - Enter the source IPv6 address used for this configuration here. mask - (Optional) Specifies an additional mask parameter that can be configured. - Enter the source IPv6 mask here. destination_ipv6 - (Optional) Specifies the value of the IPv6 destination address. - Enter the destination IPv6 address used for this configuration here. mask - (Optional) Specifies an additional mask parameter that can be configured. - Enter the destination IPv6 mask here. tcp - (Optional) Specifies to configure the TCP parameters. src_port - Specifies the value of the IPv6 Layer 4 TCP source port. - Enter the TCP source port value here. This value must be between 0 and 65535. mask - Specifies an additional mask parameter that can be configured.

90 - Enter the TCP source port mask value here. dst_port - (Optional) Specifies the value of the IPv6 Layer 4 TCP destination port. - Enter the TCP destination port value here. This value must be between 0 and 65535. mask - Specifies an additional mask parameter that can be configured. - Enter the TCP destination port mask value here. udp - (Optional) Specifies to configure the UDP parameters. src_port - Specifies the value of the IPv6 Layer 4 UDP source port. - Enter the UDP source port value here. This value must be between 0 and 65535. mask - Specifies an additional mask parameter that can be configured. - Enter the UDP source port mask value here. dst_port - Specifies the value of the IPv6 Layer 4 UDP destination port. - Enter the UDP destination port value here. This value must be between 0 and 65535. mask - Specifies an additional mask parameter that can be configured. - Enter the UDP destination port mask value here. icmp - (Optional) Specifies to configure the ICMP parameters used. type - (Optional) Specifies that the rule applies to the value of ICMP type traffic. - Enter the ICMP type traffic value here. This value must be between 0 and 255. code - (Optional) Specifies that the rule applies to the value of ICMP code traffic. - Enter the ICMP code traffic value here. This value must be between 0 and 255. port - Specifies the port list used for this configuration. - Enter a list of ports used for the configuration here. all - Specifies that all the ports will be used for this configuration. vlan_based - Specifies that the rule will be VLAN based. vlan - Specifies the VLAN name used for this configuration. - Enter the VLAN name used for this configuration here. vlan_id - Specifies the VLAN ID used for this configuration. - Enter the VLAN ID used here. This value must be between 1 and 4094. permit - Specifies that packets matching the access rule are permitted by the Switch. priority - (Optional) Specifies that the priority of the packet will change if the packet matches the access rule. - Enter the priority value here. This value must be between 0 and 7. replace_priority - (Optional) Specifies that the 802.1p priority of the outgoing packet will be replaced. replace_dscp_with - (Optional) Specifies that the DSCP of the outgoing packet is changed with the new value. If using this action without an action priority, the packet will be sent to the default TC. - Enter the replace DSCP with value here. This value must be between 0 and 63. replace_tos_precedence_with - (Optional) Specifies that the IP precedence of the outgoing packet is changed with the new value. If used without an action priority, the packet is sent to the default TC. - Enter the replace ToS precedence with value here. This value must be between 0 and 7. counter - (Optional) Specifies whether the ACL counter feature is enabled or disabled. This parameter is optional. The default option is disabled. If the rule is not bound with the flow_meter, all matching packets are counted. If the rule is bound with the flow_meter, then the “counter” is overridden. enable - Specifies that the ACL counter feature will be enabled. disable - Specifies that the ACL counter feature will be disabled. mirror - Specifies that packets matching the access rules are copied to the mirror port. deny - Specifies that packets matching the access rule are filtered by the Switch. time_range - (Optional) Specifies the name of the time range entry. - Enter the time range name here. This name can be up to 32 characters long.

91 delete - Specifies that a profile or a rule will be deleted. access_id - Specifies the index of the access list entry. The value range is 1-256, but the supported maximum number of entries depends on the project. - Enter the access ID used here. This value must be between 1 and 256. Restrictions Only Administrators, Operators and Power-Users can issue this command. Example To configure a rule entry for a packet content mask profile: DGS-3000-26TC:admin#config access_profile profile_id 3 add access_id auto_assign packet_content offset_chunk_3 0xF0 port all deny Command: config access_profile profile_id 3 add access_id auto_assign packet_content offset_chunk_3 0xF0 port all deny Success. DGS-3000-26TC:admin# 6-4 show access_profile Description This command is used to display the current access list table. Format show access_profile {[profile_id | profile_name ]} Parameters profile_id - (Optional) Specifies the index of the access list profile. - Enter the profile ID used here. This value must be between 1 and 512. profile_name - (Optional) Specifies the name of the profile. - Enter the profile name used here. This name can be up to 32 characters long. Restrictions None. Example To display the current access list table: DGS-3000-26TC:admin#show access_profile Command: show access_profile Access Profile Table Total User Set Rule Entries : 4

92 Total Used HW Entries : 128 Total Available HW Entries : 896 ============================================================================== Profile ID: 1 Profile name: EtherACL Type: Ethernet MASK on VLAN : 0xFFF 802.1p Ethernet Type Available HW Entries : 193 ------------------------------------------------------------------------------ Rule ID : 1 Ports: 1 Match on VLAN ID : 1 802.1p : 0 Ethernet Type : 0xFFFE Action: Permit ============================================================================== ============================================================================== Profile ID: 2 Profile name: IPv4ACL Type: IPv4 MASK on VLAN : 0xFFF DSCP ICMP Available HW Entries : 193 ------------------------------------------------------------------------------ Rule ID : 1 Ports: 2 Match on VLAN ID : 1 DSCP : 0 Action: Permit ============================================================================== ============================================================================== Profile ID: 3 Profile name: IPv6ACL Type: IPv6 MASK on Class TCP

93 Available HW Entries : 255 ------------------------------------------------------------------------------ Rule ID : 1 Ports: 3 Match on Class : 0 Action: Permit ============================================================================== ============================================================================== Profile ID: 4 Profile name: PCACL Type: User Defined MASK on offset_chunk_1 : 0 value : 0x00000000 offset_chunk_2 : 1 value : 0x00000000 offset_chunk_3 : 2 value : 0x00000000 offset_chunk_4 : 3 value : 0x00000000 Available HW Entries : 255 -------------------------------------------------------------------------------- Rule ID : 1 Ports: 4 Match on offset_chunk_1 : 0 value : 0x0000FFEE Mask : 0x0000FFEE Action: Permit Priority : 1 Replace DSCP : 1 ============================================================================== DGS-3000-26TC:admin# The following example displays an access profile that supports an entry mask for each rule:

94 DGS-3000-26TC:admin#show access_profile profile_id 2 Command: show access_profile profile_id 2 Access Profile Table Profile ID: 2 Profile Name: 2 Type : Ethernet Mask on VLAN : 0xF Source MAC : FF-FF-FF-00-00-00 Destination MAC : 00-00-00-FF-FF-FF Available HW Entries: 255 -------------------------------------------------------------------------------- Rule ID : 22 Ports: 1-7 Match on VLAN ID : 8 Mask : 0xFFF Source MAC : 00-01-02-03-04-05 Mask : FF-FF-FF-FF-FF-FF Destination MAC :00-05-04-03-02-00 Mask : FF-FF-FF-FF-FF-00 Action: Deny DGS-3000-26TC:admin# The following example displays the packet content mask profile for the profile with an ID of 4: DGS-3000-26TC:admin#show access_profile profile_id 4 Command: show access_profile profile_id 4 Access Profile Table Profile ID: 4 Profile name:4 Type: User Defined MASK on offset_chunk_1 : 3 value : 0x0000FFFF offset_chunk_2 : 5 value : 0x0000FF00 offset_chunk_3 : 14 value : 0xFFFF0000 offset_chunk_4 : 16 value : 0xFF000000 Available HW Entries : 255 -------------------------------------------------------------------------------- Rule ID : 1 Ports: 1-2 Match on offset_chunk_1 : 3 value : 0x000086DD offset_chunk_2 : 5 value : 0x00003A00 offset_chunk_3 : 14 value : 0x86000000 Action: Deny DGS-3000-26TC:admin#

95 6-5 config flow_meter Description This command is used to configure the flow-based metering function. The metering function supports three modes: single rate two color, single rate three color, and two rate three color. The access rule must be created before the parameters of this function can be applied. For the single rate two color mode, users may set the preferred bandwidth for this rule, in Kbps, and once the bandwidth has been exceeded, overflowing packets will either be dropped or have a drop precedence set, depending on the user configuration. For single rate three color mode, users need to specify the committed rate, in Kbps, the committed burst size, and the excess burst size. For the two rate three color mode, users need to specify the committed rate in Kbps, the committed burst size, the peak rate and the peak burst size. There are two cases for mapping the color of a packet: Color-blind mode and Color-aware mode. In the Color-blind case, the determination for the packet’s color is based on the metering result. In the Color-aware case, the determination for the packet’s color is based on the metering result and the ingress DSCP. When color-blind or color-aware is not specified, color-blind is the default mode. The green color packet will be treated as the conforming action, the yellow color packet will be treated as the exceeding action, and the red color packet will be treated as the violating action. The replace DSCP action can be performed on packets that conform (GREEN) and packets that do not conform (YELLOW and RED). If drop YELLOW/RED is selected, the action to replace the DSCP will not take effect. Format config flow_meter [profile_id | profile_name ] access_id [rate [] {burst_size []} rate_exceed [drop_packet | remark_dscp ] | tr_tcm cir {cbs } pir {pbs } {[color_blind | color_aware]} {conform [permit | replace_dscp ] {counter [enable | disable]}} exceed [permit {replace_dscp } | drop] {counter [enable | disable]} violate [permit {replace_dscp } | drop] {counter [enable |disable]} | sr_tcm cir cbs ebs {[color_blind | color_aware]} {conform [permit | replace_dscp ] {counter [enable | disable]}} exceed [permit {replace_dscp } | drop] {counter [enable | disable]} violate [permit {replace_dscp } | drop] {counter [enable | disable]} | delete] Parameters profile_id - Specifies the profile ID. - Enter the profile ID here. This value must be between 1 and 512. profile_name - Specifies the name of the profile. The maximum length is 32 characters. - Enter the profile name used here. access_id - Specifies the access ID. - Enter the access ID used here. This value must be between 1 and 256. rate - Specifies the rate for single rate two color mode. Specifies the committed bandwidth in Kbps for the flow. - Enter the rate for single rate two color mode here. This value must be

96 between 1 and 1048576. burst_size - (Optional) Specifies the burst size for the single rate two color mode. The unit is Kbytes. - Enter the burst size value here. This value must be between 1 and 262144. rate_exceed - Specifies the action for packets that exceeds the committed rate in single rate, two color mode. drop_packet - Drops the packet immediately. remark_dscp - Marks the packet with a specified DSCP. The packet is set to have a high drop precedence. - Enter the remark DSCP value here. This value must be between 0 and 63. tr_tcm - Specifies the “two rate three color mode”. cir - Specifies the Committed Information Rate. The unit is in Kbps. CIR should always be equal or less than PIR. - Enter the commited information rate value here. This value must be between 1 and 1048576. cbs - (Optional) Specifies the “Committed Burst Size”. The unit is Kbytes. That is to say, 1 means 1Kbytes. This parameter is an optional parameter. The default value is 4*1024. - Enter the commited burst size value here. This value must be between 1 and 262144. pir - Specifies the “Peak Information Rate”. The unit is in Kbps. PIR should always be equal to or greater than CIR. - Enter the peak information rate value here. This value must be between 1 and 1048576. pbs - (Optional) Specifies the “Peak Burst Size”. The unit is in Kbytes. This parameter is an optional parameter. The default value is 4*1024. - Enter the peak burst size value here. This value must be between 1 and 262144. color_blind - (Optional) Specifies the meter mode as color-blind. The default is color-blind mode. color_aware - (Optional) Specifies the meter mode as color-aware. The final color of the packet is determined by the initial color of the packet and the metering result. conform - (Optional) Specifies the action when a packet is mapped to the “green” color. permit - Permits the packet. replace_dscp - Changes the DSCP of the packet. - Enter the replace DSCP value here. This value must be between 0 and 63. counter - (Optional) Specifies the ACL counter. This is optional. The default is “disable”. The resource may be limited so that a counter cannot be turned on. Counters will be cleared when the function is disabled. enable - Specifies that the ACL counter option will be enabled. disable - Specifies that the ACL counter option will be disabled. exceed - Specifies the action when a packet is mapped to the “yellow” color. permit - Permits the packet. replace_dscp - (Optional) Changes the DSCP of the packet. - Enter the replace DSCP value here. This value must be between 0 and 63. drop - Drops the packet. counter - (Optional) Specifies the ACL counter. This is optional. The default is “disable”. The resource may be limited so that a counter cannot be turned on. Counters will be cleared when the function is disabled. enable - Enables the ACL counter option. disable - Disables the ACL counter option. violate - Specifies the action when a packet is mapped to the “red” color. permit - Permits the packet. replace_dscp - (Optional) Changes the DSCP of the packet. - Enter the replace DSCP value here. This value must be between 0 and 63. drop - Drops the packet.