Usage Guidelines

Use this command for troubleshooting purposes.

Usage Guidelines

The spatial reuse protocol (SRP) interface provides commands to enforce quality of service (QoS) functionality on the transmit side and receive side of Cisco routers. SRP uses the IP type of service (ToS) field values to determine packet priority.

The SRP interface classifies traffic on the transmit side into high- and low-priority traffic. High-priority traffic is rate shaped and has higher priority than low-priority traffic. You have the option to configure high- or low-priority traffic and can rate limit the high-priority traffic.

The srppriority-maptransmit command enables the user to specify IP packets with values equal to or greater than the ToS value to be considered as high-priority traffic.

On the receive side, when WRED is enabled, SRP hardware classifies packets into high-, medium-, and low-priority packets on the basis of the IP ToS value. After classification, it stores the packet into the internal receive buffer. The receive buffer is partitioned for each priority packet. Cisco routers can employ WRED on the basis of the IP ToS value. Routers also employ the Deficit Round Robin (DRR) algorithm to transfer packets from the internal receive buffer to Cisco IOS software.

The srppriority-mapreceive command enables the user to classify packets as high, medium, or low based on the IP ToS value.

Usage Guidelines

The srpshutdown command disables all functions on the specified side.

Usage Guidelines

Using the stack-mib command to set a name string to a port corresponds to the portName MIB object in the portTable of CISCO-STACK-MIB. portName is the MIB object in the portTable of CISCO-STACK-MIB. You can set this object to be descriptive text describing the function of the interface.

Usage Guidelines

Use the storm-control command to enable or disable broadcast, multicast, or unicast storm control on a port. After a port is disabled during a storm, use the no shutdown interface configuration command to enable the port.

The suppression levels are entered as a percentage of total bandwidth. A suppression value of 100 percent means that no limit is placed on the specified traffic type. This command is enabled only when the rising suppression level is less than 100 percent. If no other storm-control configuration is specified, the default action is to filter the traffic that is causing the storm.

When a storm occurs and the action is to filter traffic, and the falling suppression level is not specified, the networking device blocks all traffic until the traffic rate drops below the rising suppression level. If the falling suppression level is specified, the networking device blocks traffic until the traffic rate drops below this level.

When a multicast or unicast storm occurs and the action is to filter traffic, the networking device blocks all traffic (broadcast, multicast, and unicast traffic) and sends only Spanning Tree Protocol (STP) packets.

When a broadcast storm occurs and the action is to filter traffic, the networking device blocks only broadcast traffic.

The trap action is used to send an SNMP trap when a broadcast storm occurs.

Note	Adding or removing of storm control configuration under the member link of LACP is not supported.

Note	On Cisco Catalyst 3750 Series Switches, when the storm-control command is applied, it is rejected and the port is not put into a suspended state.

Usage Guidelines

You can enter this command on switch ports and router ports.

Enter the storm-control level command to enable traffic storm control on the interface, configure the traffic storm-control level, and apply the traffic storm-control level to all traffic storm-control modes that are enabled on the interface.

Only one suppression level is shared by all three suppression modes. For example, if you set the broadcast level to 30 and set the multicast level to 40, both levels are enabled and set to 40.

The Cisco 7600 series router supports storm control for multicast and unicast traffic only on Gigabit Ethernet LAN ports. The switch supports storm control for broadcast traffic on all LAN ports.

The multicast and unicast keywords are supported on Gigabit Ethernet LAN ports only. These keywords are not supported on 10 Mbps, 10/100 Mbps, 100 Mbps, or 10-Gigabit Ethernet modules.

The period is required when you enter the fractional-suppression level.

The suppression level is entered as a percentage of the total bandwidth. A threshold value of 100 percent means that no limit is placed on traffic. A threshold value of 0 or 0.0 (fractional) percent means that all specified traffic is blocked on a port, with the following guidelines:

• A fractional level value of 0.33 or lower is the same as 0.0 on the following modules:

  • WS-X6704-10GE
  • WS-X6748-SFP
  • WS-X6724-SFP
  • WS-X6748-GE-TX

• A fractional level value of 0.29 or lower is the same as 0.0 on the WS-X6716-10G-3C / 3CXL in Oversubscription Mode.

• Enter 0 on all other modules to block all specified traffic on a port.

Enter the show interfaces counters broadcast command to display the discard count.

Enter the show running-config command to display the enabled suppression mode and level setting.

To turn off suppression for the specified traffic type, you can do one of the following:

• Set the level to 100 percent for the specified traffic type.

• Use the no form of this command.

Usage Guidelines

To complete the configuration of a Blade Failure Group, you must repeat the subslot command for each IPSec VPN SPA in the group.

Usage Guidelines

Cisco 3550, 4000, and 4500 Series Switches

Use the no switchport command to put the interface into the routed-interface status and to erase all Layer 2 configurations. You must use this command before assigning an IP address to a routed port. Entering the no switchport command shuts down the port and then reenables it, which might generate messages on the device to which the port is connected.

You can verify the switchport status of an interface by entering the show running-config privileged EXEC command.

Cisco Catalyst 6500 and 6000 Series Switches and Cisco 7600 Series Routers

You must enter the switchport command without any keywords to configure the LAN interface as a Layer 2 interface before you can enter additional switchport commands with keywords. This action is required only if you have not entered the switchport command for the interface.

Entering the no switchport command shuts down the port and then reenables it. This action may generate messages on the device to which the port is connected.

To optimize the port configuration, entering the switchport host command sets the switch port mode to access, enables spanning tree PortFast, and disables channel grouping. Only an end station can accept this configuration.

Because spanning-tree PortFast is enabled, you should enter the switchport host command only on ports that are connected to a single host. Connecting other Cisco 7600 series routers, hubs, concentrators, switches, and bridges to a fast-start port can cause temporary spanning-tree loops.

Enable the switchport host command to decrease the time that it takes to start up packet forwarding.

The no form of the switchport nonegotiate command removes nonegotiate status.

When using the nonegotiate keyword, Dynamic Inter-Switch Link Protocol and Dynamic Trunking Protocol (DISL/DTP)-negotiation packets are not sent on the interface. The device trunks or does not trunk according to the mode parameter given: access or trunk. This command returns an error if you attempt to execute it in dynamic (auto or desirable) mode.

You must force a port to trunk before you can configure it as a SPAN-destination port. Use the switchport nonegotiate command to force the port to trunk.

Usage Guidelines

You must enter the switchport command without any keywords to configure the LAN interface as a Layer 2 interface before you can enter the switchport access vlan command. This action is required only if you have not entered the switchport command for the interface.

Entering the no switchport command shuts down the port and then reenables it. This action may generate messages on the device to which the port is connected.

The no form of the switchport access vlan command resets the access-mode VLAN to the appropriate default VLAN for the device.

Usage Guidelines

You must enter the switchport command without any keywords to configure the LAN interface as a Layer 2 interface before you can enter the switchport autostateexclude command. This action is required only if you have not entered the switchport command for the interface.

Note	The switchport command is not used on platforms that do not support Cisco-routed ports. All physical ports on such platforms are assumed to be Layer 2 switched interfaces.

A VLAN interface configured on the MSFC is considered up if there are ports forwarding in the associated VLAN. When all ports on a VLAN are down or blocking, the VLAN interface on the MSFC is considered down. For the VLAN interface to be considered up, all the ports in the VLAN need to be up and forwarding. You can enter the switchport autostate exclude command to exclude a port from the VLAN interface link-up calculation.

The switchport autostate exclude command marks the port to be excluded from the interface VLAN up calculation when there are multiple ports in the VLAN.

The showinterface interface switchport command displays the autostate mode if the mode has been set. If the mode has not been set, the autostate mode is not displayed.

Usage Guidelines

When you enable Flexlink, both the active and standby links are up physically, and mutual backup is provided.

Flexlink is supported on Layer 2 interfaces only and does not support routed ports.

The number arguement designates the module and port number. Valid values depend on the chassis and module that are used. For example, if you have a 48-port 10/100BASE-T Ethernet module that is installed in a 13-slot chassis, valid values for the slot number are from 1 to 13, and valid values for the port number are from 1 to 48.

Flexlink is designed for simple access topologies (two uplinks from a leaf node). You must ensure that there are no loops from the wiring closet to the distribution/core network to enable Flexlink to perform correctly.

Flexlink converges faster for directly connected link failures. Flexlink fast convergence does not impact any other type of network failure.

You must enter the switchport command without any keywords to configure a LAN interface as a Layer 2 interface before you can enter the switchport backup command.

You can remove all Flexilink configurations on an interface by using the no switchport backup command. You can remove specific backup configurations by using the optional keywords in the no form of this command.

Note	The switchport command is used only on platforms that support Cisco-routed ports. All physical ports on such platforms are assumed to be Layer 2 switched interfaces.

Usage Guidelines

You can block the unknown unicast traffic on the switch ports.

Blocking the unknown unicast traffic is not automatically enabled on the switch ports; you must explicitly configure it.

Note	For more information about blocking the packets, refer to the Cisco 7600 Series Router Cisco IOS Software Configuration Guide.

You can verify your setting by entering the showinterfaces interface-idswitchport command.

Usage Guidelines

You must enter the switchport command without any keywords to configure the LAN interface as a Layer 2 switched interface before you can enter additional switchport commands with keywords. This action is required only if you have not entered the switchport command for the interface.

The VACL capture function for the NAM is supported on the Supervisor Engine 720 but is not supported with the IDSM-2.

The switchportcapture command applies only to Layer 2 switched interfaces.

WAN interfaces support only the capture functionality of VACLs.

Entering the noswitchport command shuts down the port and then reenables it. This action may generate messages on the device to which the port is connected.

Entering the switchportcapture command sets the capture function on the interface so that the packets with the capture bit set are received by the interface.

There is no restriction on the order that you enter the switchportcapture and switchportcaptureallowedvlan commands. The port does not become a capture port until you enter the switchportcapture (with no arguments) command.

The capture port must allow the destination VLANs of the captured packets. Once you enable a capture port, the packets are allowed from all VLANs by default, the capture port is on longer in the originally configured mode, and the capture mode enters monitor mode. In monitor mode, the capture port does the following:

• Does not belong to any VLANs that it was in previously.

• Does not allow incoming traffic.

• Preserves the encapsulation on the capture port if you enable the capture port from a trunk port and the trunking encapsulation was ISL or 802.1Q. The captured packets are encapsulated with the corresponding encapsulation type. If you enable the capture port from an access port, the captured packets are not encapsulated.

• When you enter the noswitchportcapture command to disable the capture function, the port returns to the previously configured mode (access or trunk).

• Packets are captured only if the destination VLAN is allowed on the capture port.

Usage Guidelines

You must enter the switchport command without any keywords to configure the LAN interface as a Layer 2-switched interface before you can enter additional switchport commands with keywords. This action is required only if you have not entered the switchport command for the interface.

The switchport capture allowed vlan command applies only to Layer 2-switched interfaces.

Entering the noswitchport command shuts down the port and then reenables it. This action may generate messages on the device to which the port is connected.

You can enter the vlan-id as a single VLAN, a group of VLANs, or both. For example, you would enter switchportcaptureallowedvlan1-1000,2000,3000-3100 .

There is no restriction on the order in which you enter the switchportcapture and switchportcaptureallowedvlan commands. The port does not become a capture port until you enter the switchportcapture (with no arguments) command.

WAN interfaces support only the capture functionality of VACLs.

Usage Guidelines

You can configure a custom EtherType-field value on trunk ports and on access ports.

Each port supports only one EtherType-field value. A port that is configured with a custom EtherType-field value does not recognize frames that have any other EtherType-field value as tagged frames.

Caution

A port that is configured with a custom EtherType-field value considers frames that have any other EtherType-field value to be untagged frames. A trunk port that is configured with a custom EtherType-field value puts frames that are tagged with any other EtherType-field value into the native VLAN. An access port or tunnel port that is configured with a custom EtherType-field value puts frames that are tagged with any other EtherType-field value into the access VLAN.

You can configure a custom EtherType-field value on the following modules:

• Supervisor engines

• WS-X6516A-GBIC

• WS-X6516-GBIC

Note	The WS-X6516A-GBIC and WS-X6516-GBIC modules apply a configured custom EtherType-field value to all ports that are supported by each port ASIC (1 through 8 and 9 through 16).

• WS-X6516-GE-TX

• WS-X6748-GE-TX

• WS-X6724-SFP

• WS-X6704-10GE

• WS-X6816-GBIC

You cannot configure a custom EtherType-field value on the ports in an EtherChannel.

You cannot form an EtherChannel from ports that are configured with custom EtherType-field values.

Usage Guidelines

Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series Routers

If you enter a forced mode, the interface does not negotiate the link to the neighboring interface. Ensure that the interface ends match.

The no form of the command is not supported on the Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers.

Cisco Catalyst 6500/6000 Switches and Cisco 7600 Series Routers

If you enter access mode, the interface goes into permanent nontrunking mode and negotiates to convert the link into a nontrunk link even if the neighboring interface does not agree to the change.

If you enter trunk mode, the interface goes into permanent trunking mode and negotiates to convert the link into a trunk link even if the neighboring interface does not agree to the change.

If you enter dynamic auto mode, the interface converts the link to a trunk link if the neighboring interface is set to trunk or desirable mode.

If you enter dynamic desirable mode, the interface becomes a trunk interface if the neighboring interface is set to trunk , desirable , or auto mode.

If you configure a port as a promiscuous or host-PVLAN port and one of the following applies, the port becomes inactive:

• The port does not have a valid PVLAN association or mapping configured.

• The port is a SPAN destination.

If you delete a private-port PVLAN association or mapping, or if you configure a private port as a SPAN destination, the deleted private-port PVLAN association or mapping or the private port that is configured as a SPAN destination becomes inactive.

If you enter dot1q-tunnel mode, PortFast Bridge Protocol Data Unit (BPDU) filtering is enabled and Cisco Discovery Protocol (CDP) is disabled on protocol-tunneled interfaces.

Usage Guidelines

Follow these guidelines when configuring port security:

• With Release 12.2(18)SXE and later releases, port security is supported on trunks.

• With releases earlier than Release 12.2(18)SXE, port security is not supported on trunks.

• With Release 12.2(18)SXE and later releases, port security is supported on 802.1Q tunnel ports.

• With releases earlier than Release 12.2(18)SXE, port security is not supported on 802.1Q tunnel ports.

• A secure port cannot be a destination port for a Switch Port Analyzer (SPAN).

• A secure port cannot belong to an EtherChannel.

• A secure port cannot be a trunk port.

• A secure port cannot be an 802.1X port. If you try to enable 802.1X on a secure port, an error message appears, and 802.1X is not enabled. If you try to change an 802.1X-enabled port to a secure port, an error message appears, and the security settings are not changed.

Usage Guidelines

Follow these guidelines when configuring port security:

• With Release 12.2(18)SXE and later releases, port security is supported on trunks. With releases earlier than Release 12.2(18)SXE, port security is not supported on trunks.

• With Release 12.2(18)SXE and later releases, port security is supported on 802.1Q tunnel ports. With releases earlier than Release 12.2(18)SXE, port security is not supported on 802.1Q tunnel ports.

You can apply one of two types of aging for automatically learned addresses on a secure port:

• Absolute aging times out the MAC address after the age-time has been exceeded, regardless of the traffic pattern. This default is for any secured port, and the age-time is set to 0.

• Inactivity aging times out the MAC address only after the age_time of inactivity from the corresponding host has been exceeded.

Usage Guidelines

If you configure fewer secure MAC addresses than the maximum number of secure MAC addresses on all interfaces, the remaining MAC addresses are dynamically learned.

To clear multiple MAC addresses, you must enter the no form of this command once for each MAC address to be cleared.

The vlan-list argument is visible only if the port has been configured and is operational as a trunk. Enter the switchportmodetrunk command and then enter the switchportnonegotiate command.

The sticky keyword configures the dynamic MAC addresses as sticky on an interface. Sticky MAC addresses configure the static Layer 2 entry to stay sticky to a particular interface. This feature can prevent MAC moves or prevent the entry from being learned on a different interface.

You can configure the sticky feature even when the port security feature is not enabled on the interface. It becomes operational once port security is enabled on the interface.

Note	You can enter the switchportport-securitymac-addresssticky command only if sticky is enabled on the interface.

When port security is enabled, disabling the sticky feature causes all configured and learned sticky addresses to be deleted from the configuration and converted into dynamic secure addresses.

When port security is disabled, disabling the sticky feature causes all configured and learned sticky addresses to be deleted from the configuration.

For trunk ports, if you enter the noswitchportport-securitymac-addresssticky command, a search is conducted for the MAC address in the native VLAN. An error message is displayed if the MAC address is not found in the native VLAN. You must specify the VLAN in the no form of the switchportport-securitymac-addresssticky command to remove the MAC address.

For voice ports, you must specify the vlanvoice keywords in the no form of the command.

Usage Guidelines

If you enter this command more than once, subsequent use of this command overrides the previous value of maximum . If the new maximum argument is larger than the current number of the secured addresses on this port, there is no effect except to increase the value of the maximum .

If the new maximum is smaller than the old maximum and there are more secure addresses on the old maximum , the command is rejected.

If you configure fewer secure MAC addresses than the maximum number of secure MAC addresses on the port, the remaining MAC addresses are dynamically learned.

Once the maximum number of secure MAC addresses for the port is reached, no more addresses are learned on that port even if the per-VLAN port maximum is different from the aggregate maximum number.

You can override the maximum number of secure MAC addresses for the port for a specific VLAN or VLANs by entering the switchportport-securitymaximum maximum vlan vlan|vlan-list command.

The vlan-list argument allows you to enter ranges, commas, and delimited entries such as 1,7,9-15,17.

The vlan-list argument is visible only if the port has been configured and is operational as a trunk. Enter the switchportmodetrunk command and then enter the switchportnonegotiate command.

Usage Guidelines

When a security violation is detected, one of the following actions occurs:

• Protect--When the number of port-secure MAC addresses reaches the maximum limit that is allowed on the port, the packets with unknown source addresses are dropped until you remove a sufficient number of secure MAC addresses. Platform port-security disable traps is configurable only when the violation mode is set to protect . When this option is configured, drop entries will not be installed into hardware for violating addresses, thus allowing traffic to continue to flow to violating address from legitimate ports. To protect switch CPU against overload when this option is enabled, we recommend that you configure the port-security rate-limiter to 2000 packets per second with a burst rate of 10.

Note	This feature also permits traffic to legitimate ports from insecure MAC addresses.

• Restrict--A port-security violation restricts data and causes the security-violation counter to increment.

• Shutdown--The interface is error disabled when a security violation occurs.

Note	When a secure port is in the error-disabled state, you can bring it out of this state by entering the errdisablerecoverycausepsecure-violation global configuration command or you can manually reenable it by entering the shutdown and noshutdown commands in interface-configuration mode.

Usage Guidelines

There is no run-time effect on the port unless it is in PVLAN-host mode. If the port is in PVLAN-host mode but neither of the VLANs exist, the command is allowed but the port is made inactive.

The secondary VLAN may be an isolated or community VLAN.

Usage Guidelines

There is no run-time effect on the port unless it is in PVLAN-promiscuous mode. If the port is in PVLAN-promiscuous mode but the VLANs do not exist, the command is allowed but the port is made inactive.

The secondary VLAN may be an isolated or community VLAN.

Usage Guidelines

The switchport protection feature is local to the switch; communication between protected ports on the same switch is possible only through a Layer 3 device. To prevent communication between protected ports on different switches, you must configure the protected ports for unique VLANs on each switch and configure a trunk link between the switches.

Beginning with Cisco IOS Release 12.4(15)T, the following Cisco ISRs support port protection when an appropriate high-speed WAN interface card (HWIC) is installed:

• Cisco 1841 ISR

• Cisco 2800 Series ISRs, including models 2801, 2811, 2821, and 2851

• Cisco 3800 Series ISRs, including models 3825 and 3845

To support port protection, the Cisco routers listed above must be equipped with one of the following HWICs:

• HWIC-4ESW

• HWIC-D-9ESW

Note	Only the ports attached to the HWICs can be configured with port protection.

A protected port does not forward any unicast, multicast, or broadcast traffic to any other protected port. A protected port continues to forward unicast, multicast, and broadcast traffic to unprotected ports and vice versa.

Port monitoring does not work if both the monitor and monitored ports are protected ports.

A protected port is different from a secure port.

Usage Guidelines

802.1Q Trunks

• When you connect Cisco switches through an 802.1Q trunk, make sure that the native VLAN for an 802.1Q trunk is the same on both ends of the trunk link. If the native VLAN on one end of the trunk is different from the native VLAN on the other end, spanning-tree loops might result.

• Disabling spanning tree on the native VLAN of an 802.1Q trunk without disabling spanning tree on every VLAN in the network can cause spanning-tree loops. Cisco recommends that you leave spanning tree enabled on the native VLAN of an 802.1Q trunk. If this is not possible, disable spanning tree on every VLAN in the network. Make sure that your network is free of physical loops before disabling spanning tree.

• When you connect two Cisco switches through 802.1Q trunks, the switches exchange spanning-tree bridge protocol data units (BPDUs) on each VLAN allowed on the trunks. The BPDUs on the native VLAN of the trunk are sent untagged to the reserved IEEE 802.1d spanning-tree multicast MAC address (01-80-C2-00-00-00). The BPDUs on all other VLANs on the trunk are sent tagged to the reserved Shared Spanning Tree Protocol (SSTP) multicast MAC address (01-00-0c-cc-cc-cd).

• The 802.1Q switches that are not Cisco switches maintain only a single instance of spanning-tree (Mono Spanning Tree [MST]) that defines the spanning-tree topology for all VLANs. When you connect a Cisco switch to a switch through an 802.1Q trunk without a Cisco switch, the MST of the switch and the native VLAN spanning tree of the Cisco switch combine to form a single spanning-tree topology known as the Common Spanning Tree (CST).

• Because Cisco switches transmit BPDUs to the SSTP multicast MAC address on VLANs other than the native VLAN of the trunk, switches that are not Cisco switches do not recognize these frames as BPDUs and flood them on all ports in the corresponding VLAN. Other Cisco switches connected to the 802.1Q cloud receive these flooded BPDUs. This condition allows Cisco switches to maintain a per-VLAN spanning-tree topology across a cloud of 802.1Q switches that are not Cisco switches. The 802.1Q cloud of switches separating the Cisco switches is treated as a single broadcast segment among all switches connected to the 802.1Q cloud of switches that are not Cisco switches through 802.1Q trunks.

• Make sure that the native VLAN is the same on all of the 802.1Q trunks that connect the Cisco switches to the 802.1Q cloud of switches that are not Cisco switches.

• If you are connecting multiple Cisco switches to a 802.1Q cloud of switches that are not Cisco switches, all of the connections must be through 802.1Q trunks. You cannot connect Cisco switches to an 802.1Q cloud of switches that are not Cisco switches through ISL trunks or through access ports. Doing so will cause the switch to place the ISL trunk port or access port into the spanning-tree “port inconsistent” state and no traffic will pass through the port.

Cisco 2600 Series, Cisco 3600 Series, and Cisco 3700 Series Routers

The switchport trunk encapsulation command is supported only for platforms and interface hardware that can support 802.1Q formats.

The vlan list format is all | none | add | remove | except vlan list [,vlan list ...] where:

• all --Specifies all VLANs from 1 to 1005. Beginning with Cisco IOS Release 12.4(15)T, the valid VLAN ID range is from 1 to 4094.

• none --Indicates an empty list. This keyword is not supported in the switchport trunk allowed vlan form of the command.

• add --Adds the defined list of VLANs to those currently set instead of replacing the list.

• remove --Removes the defined list of VLANs from those currently set instead of replacing the list.

• except --Lists the VLANs that should be calculated by inverting the defined list of VLANs.

• vlan list-- Is either a single VLAN number from 1 to 1005 or a continuous range of VLANs described by two VLAN numbers, the lesser one first, separated by a hyphen that represents the VLAN IDs of the allowed VLANs when this port is in trunking mode. Beginning with Cisco IOS Release 12.4(15)T, the valid VLAN ID range is from 1 to 4094.

Cisco 7600 Series Routers and Catalyst 6500 Series Switches

This command is not supported on GE Layer 2 WAN ports.

You can enter the switchport trunk command only on the PO. If you enter the switchport trunk command on a port member the following message is displayed:

Configuration is not allowed on Port members. Remove the interface from the Port Channel to modify its config

The switchport trunk encapsulation dot1q command is supported only for platforms and interface hardware that can support both ISL and 802.1Q formats. Only 802.1Q encapsulation is supported by shared port adapters (SPAs).

If you enter the switchport trunk encapsulation isl command on a port channel containing an interface that does not support ISL-trunk encapsulation, the command is rejected.

You can enter the switchport trunk allowed vlan command on interfaces where the span destination port is either a trunk or an access port.

You can enter the switchport trunk native vlan tag command to enable the tagging of native VLAN traffic on a per-port basis. When tagging is enabled, all the packets on the native VLAN are tagged and all incoming untagged data packets are dropped, but untagged control packets are accepted. When tagging is disabled, the native VLAN packets going out on trunk ports are not tagged and the incoming untagged packets are allowed and assigned to the native VLAN. The no switchport trunk native vlan tag command overrides the vlan dot1q tag native command for global tagging.

Note	The switchport trunk native vlan tag interface configuration mode command does not enable native VLAN tagging unless you first configure the switch to tag native VLAN traffic globally. To enable native VLAN tagging globally, use the vlan dot1q tag native command in global configuration mode.

Note	The switchport trunk pruning vlan vlan-list command does not support extended-range VLANs; valid vlan-list values are from 1 to 1005.

The dot1q ethertype value keyword and argument are not supported on port-channel interfaces. You can enter the command on the individual port interface only. Also, you can configure the ports in a channel group to have different EtherType configurations.

Caution

Be careful when configuring the custom EtherType value on a port. If you enter the negotiate keyword and DISL and Dynamic Trunking Protocol (DTP) negotiation do not resolve the encapsulation format, then ISL is the selected format and may pose as a security risk. The no form of this command resets the trunk-encapsulation format to the default.

• The no form of the switchport trunk native vlan command resets the native mode VLAN to the appropriate default VLAN for the device.

• The no form of the switchport trunk native vlan tag command configures the Layer 2 port not to tag native VLAN traffic.

• The no form of the switchport trunk allowed vlan command resets the list to the default list, which allows all VLANs.

• The no form of the switchport trunk pruning vlan command resets the list to the default list, which enables all VLANs for VTP pruning.

• The no form of the switchport trunk encapsulation dot1qethertype value command resets the list to the default value.

The vlan-list format is all | none | add | remove | except [vlan-list [, vlan-list ...]] where:

• all --Specifies all the appropriate VLANs. This keyword is not supported in the switchporttrunkpruningvlan command.

• none --Indicates an empty list. This keyword is not supported in the switchporttrunkallowedvlan command.

• add vlan-list , vlan-list... ]-- Adds the defined list of VLANs to those currently set instead of replacing the list.

• remove vlan-list , vlan-list... ]-- Removes the defined list of VLANs from those currently set instead of replacing the list. You can remove VLAN 1. If you remove VLAN 1 from a trunk, the trunk interface continues to send and receive management traffic (for example, Cisco Discovery Protocol, version 3; VTP; Port Aggregation Protocol, version 4 (PAgP4); and DTP) in VLAN 1.

Note	You can remove any of the default VLANs (1002 to 1005) from a trunk; this action is not allowed in earlier releases.

• except vlan-list , vlan-list... ] --Excludes the specified list of VLANs from those currently set instead of replacing the list.

• vlan-list , vlan-list... -- Specifies a single VLAN number from 1 to 4094 or a continuous range of VLANs that are described by two VLAN numbers from 1 to 4094. You can specify multiple VLAN numbers or ranges of numbers using a comma-separated list.

To specify a range of VLANs, enter the smaller VLAN number first, separated by a hyphen and the larger VLAN number at the end of the range.

Do not enable the reserved VLAN range (1006 to 1024) on trunks when connecting a Cisco 7600 series router running the Cisco IOS software on both the supervisor engine and the Multilayer Switch Feature Card (MSFC) to a Cisco 7600 series router running the Catalyst operating system. These VLANs are reserved in Cisco 7600 series routers running the Catalyst operating system. If enabled, Cisco 7600 series routers running the Catalyst operating system may disable the ports if a trunking channel is between these systems.

Cisco UCS E-Series Server Installed in Cisco 4400 Integrated Services Routers

Note	To set trunk characteristics, the interface must be in trunk mode.

The vlan-list format is all | none | add | remove | except | WORD , where:

• all —Specifies all VLANs: 1-2349—VLAN IDs in range 1; and 2450-4095—VLAN IDs in range 2.

• none —Indicates an empty list.

• add —Adds the defined list of VLANs to those currently set instead of replacing the list.

• remove —Removes the defined list of VLANs from those currently set instead of replacing the list.

• except —Lists the VLANs that should be calculated by inverting the defined list of VLANs.

• WORD —Is either a single VLAN number from 1 to 4095 or a continuous range of VLANs described by two VLAN numbers, the lesser one first, separated by a hyphen that represents the VLAN IDs of the allowed VLANs when this port is in trunking mode.

Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

This command is not supported on GE Layer 2 WAN ports.

You must enable VLAN translation on the port where you want VLAN translation to work. Use the switchportvlanmappingenable command to enable VLAN translation.

Do not remove the VLAN that you are translating from the trunk. When you map VLANs, make sure that both VLANs are allowed on the trunk that carries the traffic.

The table below lists the VLAN translation, the type of VLAN translation support, the number of ports that you can configure per port group, and the trunk type for each module that supports VLAN translation.

The mapping that you configured using the switchportvlanmapping command does not become effective until the switch port becomes an operational trunk port.

The VLAN mapping that is configured on a port may apply to all the other ports on the same ASIC. In some cases, a mapping that is configured on one of the ports on an ASIC can overwrite a mapping that is already configured on another port on the same ASIC.

The port VLAN mapping is applied to all the ports on a port ASIC if that ASIC does not support per-port VLAN mapping.

If you configure VLAN mapping on the port ASIC that is a router port, the port-VLAN mapping does not take effect until the port becomes a switch port.

You can map any two VLANs regardless of the trunk types carrying the VLANs.

Usage Guidelines

This command is not supported on Cisco 7600 series routers that are configured with a Supervisor Engine 2.

Note	You must enter the switchportvlanmappingenable command on the port where you want the mapping to take place.

The switchport vlan mapping enable command enables or disables VLAN-mapping lookup in the hardware regardless of whether the mapping is configured by the global VLAN mapping command or the switchport VLAN mapping command.

This command is useful on the hardware that supports VLAN mapping per ASIC only because you can turn on or off VLAN translation selectively on ports that are connected to the same port ASIC.

Usage Guidelines

This command does not create a voice VLAN. You can create a voice VLAN in VLAN-configuration mode by entering the vlan(globalconfigurationmode) command. If you configure both the native VLAN and the voice VLAN in the VLAN database and set the switch port to multiple-VLAN access mode, this command brings up the switch port as operational.

If you enter a voice VLAN identifier, the switch port sends CDP packets that configure the IP phone to transmit voice traffic in the voice VLAN in 802.1Q frames that are tagged with a Layer 2 CoS value . The default Layer 2 CoS is 5. The default Layer 3 IP-precedence value is 5.

If you enter dot1p, the switch port sends CDP packets that configure the IP phone to transmit voice traffic in the default VLAN in 802.1p frames that are tagged with a Layer 2 CoS value.

If you enter none, the switch port does not send CDP packets with VVID TLVs.

If you enter untagged , the switch port is enabled to receive untagged packets only.

Usage Guidelines

This command is supported on Gigabit Ethernet fiber ports only.

The status register records the current status of the link partner.

Usage Guidelines

This command is required in order for the shelf to be managed by the system controller.

Usage Guidelines

Use this command to specify a shelf ID for a managed shelf. Some platforms, such as the Cisco AS5800, use other commands to assign a shelf ID. In these situations, do not specify a shelf ID with the sysconshelf-id command. Use the platform-specific command instead.

Usage Guidelines

Use this command to ensure that all SDP packets sent by the managed shelf have the same source IP address.

Usage Guidelines

Note	We recommend that you leave the system flow control in auto mode and use the other modes under the advice of Cisco TAC only.

Usage Guidelines

The mtu-size parameter specifies the Ethernet packet size, not the total Ethernet frame size. The Layer 3 MTU is changed as a result of entering the system jumbo mtu command.

The system jumbo mtu command enables the global MTU for port ASICs. On a port ASIC after jumbo frames are enabled, the port ASIC accepts any size packet on the ingress side and checks the outgoing packets on the egress side. The packets on the egress side that exceed the global MTU are dropped by the port ASIC.

For example, if you have port A in VLAN 1 and Port B in VLAN 2, and if VLAN 1 and VLAN 2 are configured for mtu 9216 and you enter the system jumbomtu 4000 command, the packets that are larger than 4000 bytes are not transmitted out because Ports B and A drop anything larger than 4000 bytes.