Dell Networking Z9500 Manual de usuario

Dell Networking Configuration Guide for the Z9500 SwitchVersion 9.5(0.1)

DHCP Client Operation with Other Features...272Configure Secure DHCP...

CAM space. The optimization is enabled only if you specify the optimized option with the ip access-group command. This option is not valid for VLAN an

Allocating ACL VLAN CAMCAM optimization for ACL VLAN groups is not enabled by default. You must allocate blocks of ACL VLAN CAM to enable ACL CAM opti

ip access-group access-list-name {in} [implicit-permit] [vlan vlan-range]NOTE: The number of entries allowed per ACL is hardware-dependent. For detail

seq 10 deny icmp any anyseq 15 permit 1.1.1.2Configure Egress ACLsEgress ACLs are supported on interfaces and affect the traffic leaving the system.

CONFIGURATION modeip control-plane [egress filter]2. Apply Egress ACLs to IPv6 system traffic.CONFIGURATION modeipv6 control-plane [egress filter]3. C

• To deny routes with a mask less than /24, enter deny x.x.x.x/x le 24.• To permit routes with a mask greater than /20, enter permit x.x.x.x/x ge 20.T

Example of Assigning Sequence Numbers to FiltersIf you want to forward all routes that do not match the prefix list criteria, configure a prefix list

Dell(conf-nprefixl)#show conf!ip prefix-list awe seq 5 permit 123.23.0.0/16 seq 10 deny 133.0.0.0/8Dell(conf-nprefixl)#To delete a filter, enter the

• Enter RIP mode.CONFIGURATION moderouter rip• Apply a configured prefix list to incoming routes. You can specify an interface.If you enter the name o

Dell(conf-router_ospf)#show config!router ospf 34 network 10.2.1.1 255.255.255.255 area 0.0.0.1 distribute-list prefix awe inDell(conf-router_ospf)#

Clearing the FRRP Counters...296Viewing the FRRP C

EXEC moderesequence prefix-list {ipv4 | ipv6} {prefix-list-name StartingSeqNum Step-to-Increment}Examples of Resequencing ACLs When Remarks and Rules

remark 2 XYZremark 4 this remark corresponds to permit any host 1.1.1.1seq 4 permit ip any host 1.1.1.1remark 6 this remark has no corresponding ruler

Creating a Route MapRoute maps, ACLs, and prefix lists are similar in composition because all three contain filters, but route map filters do not cont

Set clauses: tag 35 level stub-areaDell#The following example shows a route map with multiple instances. The show config command displays only

route-map for any permit statement. If there is a match anywhere, the route is permitted. However, other instances of the route-map deny it.Example of

CONFIG-ROUTE-MAP modematch ipv6 next-hop {access-list-name | prefix-list prefix-list-name}• Match source routes specified in a prefix list (IPv4).CONF

set local-preference value• Specify a value for redistributed routes.CONFIG-ROUTE-MAP modeset metric {+ | - | metric-value}• Specify an OSPF or ISIS t

that have a next hop of Tengigabitethernet interface 0/0 and that have a metric of 255 are redistributed into the OSPF backbone area.NOTE: When re-dis

set community 1:1 1:2 1:3set as-path prepend 1 2 3 4 5continue 30!118Access Control Lists (ACLs)

7Bare Metal Provisioning (BMP)Starting with Dell Networking OS Release 9.2(1.0), BMP is supported on the Z9500 switch. This chapter describes the late

Basic Interface Configuration...318Advanced In

8Bidirectional Forwarding Detection (BFD)BFD is a protocol that is used to rapidly detect communication failures between two adjacent systems. It is a

BFD Packet FormatControl packets are encapsulated in user datagram protocol (UDP) packets. The following illustration shows the complete encapsulation

Field DescriptionNOTE: The Dell Networking OS does not currently support multi-point sessions, Demand mode, authentication, or control plane independe

Active The active system initiates the BFD session. Both systems can be active for the same session.Passive The passive system does not initiate a ses

system sends a final response indicating the state change. After this, periodic control packets are exchanged.Figure 9. BFD Three-Way Handshake State

receives a Down status notification from the remote system, the session state on the local system changes to Init.Figure 10. Session State ChangesImpo

• Configure BFD for IS-IS• Configure BFD for BGP• Configure BFD for VRRP• Configuring Protocol LivenessConfigure BFD for Static RoutesConfiguring BFD

R1(conf)#ip route 2.2.3.0/24 2.2.2.2R1(conf)#ip route bfdR1(conf)#do show bfd neighbors* - Active session roleAd Dn - Admin DownC - CLII - ISISO - OSP

agent on the line card notifies the BFD manager, which in turn notifies the OSPF protocol that a link state change occurred.NOTE: If you enable BFD af

Establishing Sessions with OSPF NeighborsBFD sessions can be established with all OSPF neighbors at once or sessions can be established with all neigh

Bulk Configuration Examples... 339Defining Interface

INTERFACE modeip ospf bfd all-neighborsExample of Verifying Sessions with OSPF NeighborsTo view the established sessions, use the show bfd neighbors c

To disable BFD sessions, use the following commands.• Disable BFD sessions with all OSPFv3 neighbors.ROUTER-OSPFv3 modeno bfd all-neighbors• Disable B

Disabling BFD for OSPFv3If you disable BFD globally, all sessions are torn down and sessions on the remote system are placed in a Down state.If you di

Establishing Sessions with IS-IS NeighborsBFD sessions can be established for all IS-IS neighbors at once or sessions can be established for all neigh

The bold line shows that IS-IS BFD sessions are enabled.R2(conf-router_isis)#bfd all-neighborsR2(conf-router_isis)#do show bfd neighbors* - Active

INTERFACE moseisis bfd all-neighbors disableConfigure BFD for BGPIn a BGP core network, BFD provides rapid detection of communication failures in BGP

Figure 14. Establishing Sessions with BGP NeighborsThe sample configuration shows alternative ways to establish a BFD session with a BGP neighbor:• By

typical response is to terminate the peering session for the routing protocol and reconverge by bypassing the failed neighboring router. A log message

ROUTER BGP modeneighbor {ip-address | peer-group-name} bfd disable• Remove the disabled state of a BFD for BGP session with a specified neighbor.ROUTE

Examples of Verifying BGP InformationThe following example shows viewing a BGP configuration.R2# show running-config bgp!router bgp 2 neighbor 1.1.1

Configuration Tasks for ARP...370Configuring

Number of messages communicated b/w Manager and Agent: 5Session Discriminator: 10Neighbor Discriminator: 11Local Addr: 2.2.2.3Local MAC Addr: 00:01:e8

The following example shows viewing BFD summary information. The bold line shows the message that displays when you enable BFD for BGP connections.R2#

Foreign host: 2.2.2.2, Foreign port: 179R2#R2# show ip bgp neighbors 2.2.2.3BGP neighbor is 2.2.2.3, remote AS 1, external link Member of peer-group

Establishing Sessions with All VRRP NeighborsBFD sessions can be established for all VRRP neighbors at once, or a session can be established with a pa

The following example shows viewing sessions with VRRP neighbors. The bold line shows that VRRP BFD sessions are enabled.R1(conf-if-te-4/25)#vrrp bfd

Disabling BFD for VRRPIf you disable any or all VRRP sessions, the sessions are torn down.A final Admin Down control packet is sent to all neighbors a

9Border Gateway Protocol IPv4 (BGPv4)This chapter provides a general description of BGPv4 as it is supported in the Dell Networking OS.BGP protocol st

Figure 16. Interior BGPBGP version 4 (BGPv4) supports classless interdomain routing and aggregate routes and AS paths. BGP is a path vector protocol —

Figure 17. BGP Routers in Full MeshThe number of BGP speakers each BGP peer must maintain increases exponentially. Network management quickly becomes

Establish a SessionInformation exchange between peers is driven by events and timers. The focus in BGP is on the traffic routing policies.In order to

Assigning a Static IPv6 Route... 394Configuring Teln

Route reflection divides iBGP peers into two groups: client peers and nonclient peers. A route reflector and its client peers form a route reflection

• Local Preference• Multi-Exit Discriminators (MEDs)• Origin• AS Path• Next HopBest Path Selection CriteriaPaths for active routes are grouped in asce

Figure 19. BGP Best Path SelectionBest Path Selection Details1. Prefer the path with the largest WEIGHT attribute.2. Prefer the path with the largest

c. Paths with no MED are treated as “worst” and assigned a MED of 4294967295.7. Prefer external (EBGP) to internal (IBGP) paths or confederation EBGP

and AS300. This is advertised to all routers within AS100, causing all BGP speakers to prefer the path through Router B.Figure 20. BGP Local Preferenc

Figure 21. Multi-Exit DiscriminatorsOriginThe origin indicates the origin of the prefix, or how the prefix came into BGP. There are three origin codes

AS PathThe AS path is the list of all ASs that all the prefixes listed in the update have passed through.The local AS number is added by the BGP speak

Implement BGP The following sections describe how BGP is implemented on the Z9500 switch.Additional Path (Add-Path) SupportThe add-path feature reduce

Ignore Router-ID for Some Best-Path CalculationsYou can avoid unnecessary BGP best-path transitions between external paths under certain conditions. T

• All AS numbers between 0 and 65535 are represented as a decimal number, when entered in the CLI and when displayed in the show commands outputs.• AS

Configuring the LAG Interfaces as Dynamic...427Setting the LACP Long Timeou

Example of the Running Configuration When AS Notation is DisabledAS NOTATION DISABLEDDell(conf-router_bgp)#no bgp asnotationDell(conf-router_bgp)#sho

Figure 22. Before and After AS Number Migration with Local-AS EnabledWhen you complete your migration, and you have reconfigured your network with the

BGP4 Management Information Base (MIB)The FORCE10-BGP4-V2-MIB enhances support for the BGP management information base (MIB) with many new simple netw

• High CPU utilization may be observed during an SNMP walk of a large BGP Loc-RIB.• To avoid SNMP timeouts with a large-scale configuration (large num

Table 7. BGP Default ValuesItem DefaultBGP Neighbor Adjacency changes All BGP neighbor changes are logged.Fast External Fallover feature DisabledGrace

• as-number: from 0 to 65535 (2 Byte) or from 1 to 4294967295 (4 Byte) or 0.1 to 65535.65535 (Dotted format).Only one AS is supported per system.NOTE:

To view the BGP configuration, enter show config in CONFIGURATION ROUTER BGP mode. To view the BGP status, use the show ip bgp summary command in EXEC

The following example displays two neighbors: one is an external internal BGP neighbor and the second one is an internal BGP neighbor. The first line

neighbor 10.10.21.1 remote-as 65123 neighbor 10.10.21.1 filter-list ISP1in neighbor 10.10.21.1 no shutdown neighbor 10.10.32.3 remote-as 65123 n

Examples of the bgp asnotation CommandsThe following example shows the bgp asnotation asplain command.Dell(conf-router_bgp)#bgp asnotation asplainDell

Important Points to Remember... 464LLDP Compatibility...

NOTE: Sample Configurations for enabling peer groups are found at the end of this chapter.1. Create a peer group by assigning a name to it.CONFIG-ROUT

• neighbor distribute-list out• neighbor filter-list out• neighbor next-hop-self• neighbor route-map out• neighbor route-reflector-client• neighbor se

Peer-group zanzibar, remote AS 65535BGP version 4Minimum time between advertisement runs is 5 secondsFor address family: IPv4 UnicastBGP neighbor is z

Examples of Verifying that Fast Fail-Over is EnabledTo verify fast fail-over is enabled on a particular BGP neighbor, use the show ip bgp neighbors co

For address family: IPv4 Unicast BGP neighbor is test Number of peers in this group 1 Peer-group members (* - outbound optimized): 100.100.100

Only after the peer group responds to an OPEN message sent on the subnet does its BGP state change to ESTABLISHED. After the peer group is ESTABLISHED

neighbor 192.168.12.2 no shutdownR2(conf-router_bgp)#Allowing an AS Number to Appear in its Own AS PathThis command allows you to set the number of

With the graceful restart feature, the system enables the receiving/restarting mode by default. In Receiver-Only mode, graceful restart saves the adve

{deny | permit} filter parameterThis is the filter that is used to match the AS-path. The entries can be any format, letters, numbers, or regular expr

Regular Expressions as FiltersRegular expressions are used to filter AS paths or community lists. A regular expression is a special character used to

Preventing MSDP from Caching a Remote Source...495Preventing MSDP from Advertisi

neighbor AAA no shutdown neighbor 10.155.15.2 remote-as 32 neighbor 10.155.15.2 shutdownDell(conf-router_bgp)#neigh 10.155.15.2 filter-list 1 inDe

redistribute ospf process-id [match external {1 | 2} | match internal] [metric-type {external | internal}] [route-map map-name]Configure the following

The system also supports BGP Extended Communities as described in RFC 4360 — BGP Extended Communities Attribute.To configure an IP community list, use

Configuring an IP Extended Community ListTo configure an IP extended community list, use these commands.1. Create a extended community list and enter

Filtering Routes with Community ListsTo use an IP community list or IP extended community list to filter routes, you must apply a match community filt

To view the BGP configuration, use the show config command in CONFIGURATION ROUTER BGP mode.If you want to remove or add a specific COMMUNITY number f

Dell>show ip bgp communityBGP table version is 3762622, local router ID is 10.114.8.48Status codes: s suppressed, d damped, h history, * valid, >

CONFIG-ROUTER-BGP modebgp default local-preference value– value: the range is from 0 to 4294967295.The default is 100.To view the BGP configuration, u

set next-hop ip-addressChanging the WEIGHT AttributeTo change how the WEIGHT attribute is used, enter the first command. You can also use route maps t

• prefix lists (using the neighbor distribute-list command)• AS-PATH ACLs (using the neighbor filter-list command)• route maps (using the neighbor rou

Protocol Overview...531Auton

configure a prefix list filter to permit all routes. For example, you could have the following filter as the last filter in your prefix list permit 0.

ip as-path access-list as-path-name2. Create a AS-PATH ACL filter with a deny or permit action.AS-PATH ACL mode{deny | permit} as-regular-expression3.

• Configure the local router as a route reflector and the neighbor or peer group identified is the route reflector client.CONFIG-ROUTER-BGP modeneighb

• Specifies the confederation ID.CONFIG-ROUTER-BGP modebgp confederation identifier as-number– as-number: from 0 to 65535 (2 Byte) or from 1 to 429496

bgp dampening [half-life | reuse | suppress max-suppress-time] [route-map map-name]Enter the following optional parameters to configure route dampenin

• Change the best path selection method to non-deterministic.Change the best path selection method to non-deterministic.CONFIG-ROUTER-BGP modebgp non-

Changing BGP TimersTo configure BGP timers, use either or both of the following commands.Timer values configured with the neighbor timers command over

To use soft reconfiguration (or soft reset) without preconfiguration, both BGP peers must support the soft route refresh capability, which is advertis

Match a Clause with a Continue ClauseThe continue feature can exist without a match clause.Without a match clause, the continue clause executes and ju

• Enables support for the IPv4 multicast family on the BGP node.CONFIG-ROUTER-BGP modeaddress family ipv4 multicast• Enable IPv4 multicast support on

Notes, Cautions, and WarningsNOTE: A NOTE indicates important information that helps you make better use of your computer.CAUTION: A CAUTION indicates

Refuse Multicast Traffic...576Send Multica

• Enable soft-reconfiguration debug.EXEC Privilege modedebug ip bgp {ip-address | peer-group-name} soft-reconfigurationTo enhance debugging of soft re

Last reset 00:00:12, due to Missing well known attributeNotification History 'UPDATE error/Missing well-known attr' Sent : 1 Recv: 0 &apos

Outgoing packet capture enabled for BGP neighbor 20.20.20.2Available buffer size 40958758, 27 packet(s) captured using 562 bytes PDU[1] : len 41, cap

Figure 23. Sample ConfigurationsExample of Enabling BGP (Router 1)R1# confR1(conf)#int loop 0R1(conf-if-lo-0)#ip address 192.168.128.1/24R1(conf-if-lo

no shutdownR1(conf-if-te-1/31)#router bgp 99R1(conf-router_bgp)#network 192.168.128.0/24R1(conf-router_bgp)#neighbor 192.168.128.2 remote 99R1(conf-ro

R2(conf-if-te-2/31)#router bgp 99R2(conf-router_bgp)#network 192.168.128.0/24R2(conf-router_bgp)#neighbor 192.168.128.1 remote 99R2(conf-router_bgp)#n

no shutdownR3(conf-if-te-3/21)#R3(conf-if-te-3/21)#router bgp 100R3(conf-router_bgp)#show config!router bgp 100R3(conf-router_bgp)#network 192.168.1

neighbor 192.168.128.3 update-source Loopback 0 neighbor 192.168.128.3 no shutdownR1#R1#show ip bgp summaryBGP router identifier 192.168.128.1, loc

Received 30 messages, 0 in queue 4 opens, 2 notifications, 4 updates 20 keepalives, 0 route refresh requests Sent 29 messages, 0 in queue

Neighbor AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/Pfx192.168.128.1 99 140 136 2 0 (0) 00:11:24 1192.168.128.3 100 13

37 Private VLANs (PVLAN)...608Private VLAN Concepts...

85 keepalives, 0 route refresh requests Minimum time between advertisement runs is 30 seconds Minimum time before advertisements start is 0 seco

Minimum time before advertisements start is 0 secondsCapabilities advertised to neighbor for IPv4 Unicast : MULTIPROTO_EXT(1) Capabilities recei

10Content Addressable Memory (CAM)CAM is a type of memory that stores information in the form of a lookup table.On the Z9500, CAM stores Layer 2 and L

Ipv4Qos : 2L2Qos : 1L2PT : 0IpMacAcl : 0VmanQos : 0EcfmAcl : 0Openfl

Test CAM UsageThe test cam-usage command applies to both IPv4 and IPv6 CAM profiles, but is best used when verifying QoS optimization for IPv6 ACLs.Us

Openflow : 0 -- linecard 0 -- Current Settings(in block sizes) 1 block = 256 entriesL2Acl : 6Ip

| | IN-L3-PBR | 1024 | 0 | 1024 | | IN-V6 ACL | 0 | 0 | 0 |

Applications for CAM ProfilingThe following describes link aggregation group (LAG) hashing.LAG HashingThe Dell Networking OS includes a CAM profile an

11Control Plane Policing (CoPP)Control plane policing (CoPP) protects the Z9500 routing, control, and line-card processors from undesired or malicious

Queue-based Control Plane PolicingWhen configuring a queue-based CoPP policy, take into account that there are twenty-four CP queues divided into grou

Enabling QoS Rate Adjustment... 647Enabling Stric

19 — 120 Source miss, Station move, Trace flow 60021 BFD 700022 HyperPull, FRRP 80023 sFlow 5000NOTE: In the line-card CPU, some queues have no protoc

Figure 25. CoPP Versus Non-CoPP OperationConfigure Control Plane PolicingYou can create a CoPP service policy on a per-protocol and/or a per-queue bas

For complete information about creating ACL rules and QoS policies, refer to Access Control Lists (ACLs) and Quality of Service (QoS).1. Create a Laye

Dell(conf-ip-acl-cpuqos)#exitDell(conf)#mac access-list extended lacp cpu-qosDell(conf-mac-acl-cpuqos)#permit lacpDell(conf-mac-acl-cpuqos)#exitDell(c

Configuring CoPP for CPU QueuesThis section describes how to create a queue-based CoPP service policy and apply it to control plane traffic.Controllin

Example of Assigning a QoS Policy to a CPU QueueDell(conf)#policy-map-input cpuq_rate_policy cpu-qosDell(conf-qos-policy-in)#service-queue 5 qos-polic

-------- --------------- --------- ----- ------ -----------ARP any 0x0806 Q2/Q10/Q3/Q11 C

-------- ----- ------ --------------- -----------ARP Q2/Q10/Q3/Q11 CP/RP 600 600v

2000ICMP Q6 CP 300 300 2000 2000IGMP Q14 RP 300 300 2

Troubleshooting CoPP OperationTo troubleshoot CoPP operation, use the debug commands described in this section. Enabling CPU Traffic StatisticsDuring

Configuring Interfaces for Layer 2 Mode...678Enabling Rapid Span

system-flow layer2 [cp-switch | linecard slot-id portset port-pipe] command. The number of hits for each system flow is also displayed.Dell#show hardw

MASK=0x0000ffff ffffffff action={act=DropPrecedence, param0=1(0x1), param1=0(0), param2=0(0), param3=0(0)} action={act=Drop, para

--More--######################## FP Entry for VLT IGMP Sync frames ##########################--More--######################## FP Entry for VLT ARP Rep

GVRP 14988129080 551480 14987577600ARP RESP/ARP REQ 29604578172 3559868 2960101

OSPF 0 0 0RIP 0 0 0VRRP

In the show output, Rx Counters displays the number of bytes of control-plane traffic received, on which queue-based rate limiting is applied. Tx Coun

12Debugging and DiagnosticsThis chapter describes the debugging and diagnostics tasks you can perform on the switch.Offline DiagnosticsThe offline dia

3. Start diagnostics on the switch.diag system unitWhen the tests complete, the system displays a syslog message:00:13:17 : Diagnostic test results ar

is issued.Proceed with Offline [confirm yes/no]:yes00:10:29: %SYSTEM:CP %CHMGR-2-UNIT_DOWN: linecard 0 down - linecard offlineFTOS-BMP#00:10:30: %SYST

00:13:17 : Diagnostic test results are stored on file: flash:/TestReport-LP-0.txt00:13:19 : Diagnostic test results are stored on file: flash:/TestRep

VTY Line and Access-Class Configuration...725VTY Line Local Authen

PPID Rev -- X00 Service Tag -- 6NHW6Z1 Part Number -- 7520072402 Part Number

Sensor "BrdTmpPwr0" temperature 31.5 C Sensor "BrdTmpPwr1" temperature 34.0 C Sensor "BrdTmpPwr2" temperature 31.0 C Se

+Fan tray[3] Speed test PASSERROR: Tray[4] fan[0] speed 49% is out of expected range [80-100%]ERROR: Fan speed variation failed for tray[4]fanTest ..

Available free memory: 2,646,888,448 bytes LEVEL 0 DIAGNOSTICeepromTest ...

--------- Group Test Statistics ---------Total : 22Passed : 21Failed : 1Elapsed time : 00H:00M:56SStop reason : after completi

Port card[2]: Average temperature 42.8 C, maximum 44.9 C Ethernet MAC temperature 45.0 CtemperatureTest ...

Last Restart ReasonIf a switch restarted for some reason (automatically or manually), the show system command output includes the reason for the resta

show hardware linecard {0-2} buffer unit {0-3} port {1-104} queue {0-20 | all} buffer-info• Display input and output statistics on the party bus, whic

backplane. unit defines the Network Processing unit (NPU) of a HiGig port channel. hg-port-channel defines the HiGig port-channel number.NOTE: In the

Unit Bay Status Type FanStatus FanSpeed(rpm) Power Usage (W)-------------------------------------------------------------------------

sFlow on LAG ports...749Enabli

2 8 Media not present or accessible 2 12 Media not present or accessible 2 16 QSFP 40GB

===================================QSFP 168 Temp High Alarm threshold = 80.000CQSFP 168 Voltage High Alarm threshold = 3.630VQSFP 168 Bias

S8 66 61 66 61 N/AS9 66 61 66 61 N/A-- Switching Core ---- Temperature Limits (deg C)

Port Modules 49 101[M] 60 49 62 52 78 55 53 50 46Threshold crossed [m]: minor [M]: major, [S]: shutdownWhen a temperat

NOTE: The Z9500 fan trays and power supplies always blow air from the front (I/O side) to the back (Utility/power supply and fan side) of the switch.

UserPort PortNumber Ingress Drops IngMac Drops Total Mmu Drops EgMac Drops Egress Drops 0 1 0

Displaying Dataplane StatisticsThe show hardware linecard {0–2} cpu data-plane statistics command provides information about the packet types entering

RCDE frames = 0RCSE frames = 0Dell#show hardware party-bus port 0 statistics Party Bus Transmit Counters for port 0: Tx Octets = 350320163 Tx Drop Pac

TDBGC6.cpu0 : 528,687 +528,687PERQ_PKT(0).cpu0 : 1,172 +1,172PERQ_PKT(41).cpu

To disable the automatic uploading of application core dumps, enter the no logging coredump server command.Mini Core DumpsThe system supports mini cor

Configuring Storm Control from CONFIGURATION Mode... 77548 Spanning Tree Protocol (STP)...

Enabling TCP DumpsA TCP dump captures CPU-bound control-plane traffic to improve troubleshooting and system manageability. You can perform a TCP dump

13Dynamic Host Configuration Protocol (DHCP)DHCP is an application layer protocol that dynamically assigns IP addresses and other configuration parame

Option Number and DescriptionSubnet Mask Option 1Specifies the client’s subnet mask.Router Option 3Specifies the router IP addresses that may serve as

Option Number and DescriptionIdentifiers a user-defined string used by the Relay Agent to forward DHCP client packets to a specific server.L2 DHCP Sno

Figure 27. Client and Server MessagingImplementation InformationThe following describes DHCP implementation.• Dell Networking implements DHCP based on

Configure the System to be a DHCP ServerA DHCP server is a network device that has been programmed to provide network configuration parameters to clie

DHCP <POOL> modenetwork network/prefix-length• network: the subnet address.• prefix-length: specifies the number of bits used for the network po

lease {days [hours] [minutes] | infinite}The default is 24 hours.Specifying a Default GatewayThe IP address of the default router should be on the sam

Creating Manual Binding EntriesAn address binding is a mapping between the IP address and the media access control (MAC) address of a client.The DHCP

Configure the System to be a Relay AgentDHCP clients and servers request and offer configuration information via broadcast DHCP messages.Routers do no

50 Tunneling ... 803Configuring a Tunnel...

Figure 28. Configuring a Relay AgentTo view the ip helper-address configuration for an interface, use the show ip interface command from EXEC privileg

ICMP redirects are not sentICMP unreachables are not sentConfigure the System to be a DHCP ClientA DHCP client is a network device that requests an IP

DHCP Client Operation with Other FeaturesA DHCP client also operates with the following software features.Virtual Link Trunking (VLT)A DHCP client is

• Source Address ValidationOption 82RFC 3046 (the relay agent information option, or Option 82) is used for class-based IP address assignment.The code

packet arrived on the correct port. Packets that do not pass this check are forwarded to the server for validation. This checkpoint prevents an attack

• Delete all of the entries in the binding table.EXEC Privilege modeclear ip dhcp snooping bindingDisplaying the Contents of the Binding TableTo displ

IP Address MAC Address Expires(Sec) Type VLAN Interface================================================================10.1.1.251 00:00:4d

NOTE: Dynamic ARP inspection (DAI) uses entries in the L2SysFlow CAM region, a sub-region of SystemFlow. One CAM entry is required for every DAI-enabl

Invalid ARP Replies : 0Dell#Bypassing the ARP InspectionYou can configure a port to skip ARP inspection by defining the interface as trusted,

NOTE: If you enable IP source guard using the ip dhcp source-address-validation command and there are 187 entries or more in the current DHCP snooping

Important Points to Remember...831Configuration Notes..

14Equal Cost Multi-Path (ECMP)Equal cost multi-path (ECMP) supports multiple paths in next-hop packet forwarding to a destination device.ECMP for Flow

NOTE: While the seed is stored separately on each port-pipe, the same seed is used across all CAMs.NOTE: You cannot separate LAG and ECMP, but you can

NOTE: Save the new ECMP settings to the startup-config (write-mem) then reload the system for the new settings to take effect.• Configure the maximum

The default is 60%.• Display details for an ECMP group bundle.EXEC modeshow link-bundle-distribution ecmp-group ecmp-group-id The range is from 1 to 6

-------------------------------------------------- [ 132] 20::1 00:00:20:d5:ec:a0 Fo 0/16 0 1[ 132] 20::1 00:00:20:d5:ec:a1 Fo 0/24 0 1T

15Enabling FIPS CryptographyFederal information processing standard (FIPS) cryptography provides cryptographic algorithms conforming to various FIPS s

Enabling FIPS ModeTo enable or disable FIPS mode, use the console port.Secure the host attached to the console port against unauthorized access. Any a

Monitoring FIPS Mode StatusTo view the status of the current FIPS mode (enabled/disabled), use the following commands.• Use either command to view the

• To disable FIPS mode from a console port.CONFIGURATION modeno fips mode enableThe following Warning message displays:WARNING: Disabling FIPS mode wi

16Force10 Resilient Ring Protocol (FRRP)Force10 resilient ring protocol (FRRP) provides fast network convergence to Layer 2 switches interconnected in

LLDP organizational TLV for proxy gateway... 877Sample Configuration Scenar

The Member VLAN is the VLAN used to transmit data as described earlier.The Control VLAN is used to perform the health checks on the ring. The Control

Multiple FRRP RingsUp to 255 rings are allowed per system and multiple rings can be run on one system.More than the recommended number of rings may ca

Concept ExplanationControl VLAN Each ring has a unique Control VLAN through which tagged ring health frames (RHF) are sent. Control VLANs are used onl

Concept ExplanationThere is no periodic transmission of TCRHFs. The TCRHFs are sent on triggered events of ring failure or ring restoration only.Imple

Configuring the Control VLANControl and member VLANS are configured normally for Layer 2. Their status as control or member is determined at the FRRP

4. Configure the Master node.CONFIG-FRRP mode.mode master5. Identify the Member VLANs for this FRRP group.CONFIG-FRRP mode.member-vlan vlan-id {range}

Interface:• For a 10-Gigabit Ethernet interface, enter the keyword TenGigabitEthernet then the slot/port information.• For a 40-Gigabit Ethernet inter

Viewing the FRRP ConfigurationTo view the configuration for the FRRP group, use the following command.• Show the configuration for this FRRP group.CON

no shutdown!interface TengigabitEthernet 1/34 no ip address switchport no shutdown!interface Vlan 101 no ip address tagged TengigabitEthernet 1

!interface Vlan 101 no ip address tagged TengigabitEthernet 3/14,21 no shutdown!interface Vlan 201 no ip address tagged TengigabitEthernet 3/14,2

Contents1 About this Guide... 30Audience...

1About this GuideThis guide describes the protocols and features that the Dell Networking Operating Software (OS) supports on the Z9500 system and pro

17GARP VLAN Registration Protocol (GVRP)GARP VLAN registration protocol (GVRP), defined by the IEEE 802.1q specification, is a Layer 2 network protoco

Configure GVRPTo begin, enable GVRP.To facilitate GVRP communications, enable GVRP globally on each switch. GVRP configuration is per interface on a s

Enabling GVRP GloballyTo configure GVRP globally, use the following command.• Enable GVRP for the entire switch.CONFIGURATION modegvrp enableExample o

not be unconfigured when it receives a Leave PDU. Therefore, the registration mode on that interface is FIXED.• Forbidden Mode — Disables the port to

LeaveAll Timer 5000Dell(conf)#The system displays this message if an attempt is made to configure an invalid GARP timer: Dell(conf)#garp timers join

18Internet Group Management Protocol (IGMP)Internet group management protocol (IGMP) is a Layer 3 multicast protocol that hosts use to join or leave a

Figure 30. IGMP Messages in IP PacketsJoin a Multicast GroupThere are two ways that a host may join a multicast group: it may respond to a general que

response, the querier removes the group from the list associated with forwarding port and stops forwarding traffic for that group to the subnet.IGMP V

Figure 32. IGMP Version 3–Capable Multicast Routers Address StructureJoining and Filtering Groups and SourcesThe following illustration shows how mult

Figure 33. Membership Reports: Joining and FilteringLeaving and Staying in GroupsThe following illustration shows how multicast routers track and refr

2Configuration FundamentalsThe Dell Networking OS command line interface (CLI) is a text-based interface you can use to configure interfaces and proto

Figure 34. Membership Queries: Leaving and StayingConfigure IGMPConfiguring IGMP is a two-step process.1. Enable multicast routing using the ip multic

• Fast Convergence after MSTP Topology Changes• Designating a Multicast Router InterfaceViewing IGMP Enabled InterfacesInterfaces that are enabled wit

IGMP version is 3Dell(conf-if-te-1/13)#Viewing IGMP GroupsTo view both learned and statically configured IGMP groups, use the following command.• Vi

INTERFACE modeip igmp query-interval• Adjust the maximum response time.INTERFACE modeip igmp query-max-resp-time• Adjust the last member query interva

Enabling IGMP Immediate-LeaveIf the querier does not receive a response to a group-specific or group-and-source query, it sends another (querier robus

• View the configuration.CONFIGURATION modeshow running-config• Disable snooping on a VLAN.INTERFACE VLAN modeno ip igmp snoopingRelated Configuration

• Configure the switch to only forward unregistered packets to ports on a VLAN that are connected to mrouter ports.CONFIGURATION modeno ip igmp snoopi

ip igmp snooping last-member-query-intervalFast Convergence after MSTP Topology ChangesWhen a port transitions to the Forwarding state as a result of

19InterfacesThis chapter describes interface types, both physical and logical, and how to configure them on the Z9500 switch.• 10-Gigabit Ethernet and

installed, the resulting four 10GbE ports are numbered with the remaining numbers. For example, 40GbE port 0 contains 10GbE ports 0, 1, 2, and 3; 40Gb

• EXEC mode is the default mode and has a privilege level of 1, which is the most restricted level. Only a limited selection of commands is available,

EXEC modeshow interfacesThis command has options to display the interface status, IP and MAC addresses, and multiple counters for the amount and type

TengigabitEthernet 1/0 unassigned NO Manual administratively down downTengigabitEthernet 1/1 unassigned NO Manual administratively down down

To confirm that the interface is enabled, use the show config command in INTERFACE mode. To leave INTERFACE mode, use the exit command or end command.

• Overview of Layer Modes• Configuring Layer 2 (Data Link) Mode• Configuring Layer 2 (Interface) Mode• Management Interfaces• Auto-Negotiation on Ethe

Configuring Layer 2 (Interface) ModeTo configure an interface in Layer 2 mode, use the following commands.• Enable the interface.INTERFACE modeno shut

Configuring Layer 3 (Interface) ModeTo assign an IP address, use the following commands.• Enable the interface.INTERFACE modeno shutdown• Configure a

Important Points to Remember• Deleting a management route removes the route from both the EIS routing table and the default routing table.• If the man

INTERFACE modeip address ip-address mask– ip-address mask: enter an address in dotted-decimal format (A.B.C.D). The mask must be in /prefix format (/x

• Executing the show interfaces and show ip interface brief commands on themanagement interface displays the virtual IP address and not the actual IP

Destination Gateway Dist/Metric Last Change ----------- ------- ----------- -----

VIRTUAL TERMINAL LLDP LLDP MANAGEMENT INTERFACE MONITOR SESSION MULTIPLE SPANNING TREE

Loopback InterfacesA Loopback interface is a virtual interface in which the software emulates an interface. Packets routed to it are processed locally

Port Channel Definition and StandardsLink aggregation is defined by IEEE 802.3ad as a method of grouping multiple physical interfaces into a single lo

The system brings up 10/40 GbE interfaces that are set to auto negotiate so that their speed is identical to the speed of the first channel member in

interface port-channel id-number2. Ensure that the port channel is active.INTERFACE PORT-CHANNEL modeno shutdownAfter you enable the port channel, you

Examples of the show interfaces port-channel CommandsTo view the port channel’s status and channel members in a tabular format, use the show interface

following example, interface TengigabitEthernet 1/6 is part of port channel 5, which is in Layer 2 mode, and an error message appeared when an IP addr

Configuring the Minimum Oper Up Links in a Port ChannelYou can configure the minimum links in a port channel (LAG) that must be in “oper up” status to

Assigning an IP Address to a Port ChannelYou can assign an IP address to a port channel and use port channels in Layer 3 routing protocols.To assign a

• Replace the default IP 4-tuple method of balancing traffic over a port channel.CONFIGURATION mode[no] load-balance {ip-selection [dest-ip | source-i

• dest-ip — uses destination IP address as part of the hash key.• lsb — always uses the least significant bit of the hash key to compute the egress po

LLDP LLDP MANAGEMENT INTERFACE MONITOR SESSION MULTIPLE SPANNING TREE OPENFLOW INSTANCE

Create a Single-RangeThe following is an example of a single range.Example of the interface range Command (Single Range)Dell(config)# interface range

CommasThe following is an example of how to use commas to add different interface types to the range, enabling all Ten Gigabit Ethernet interfaces in

Define the Interface RangeThe following example shows how to define an interface-range macro named “test” to select 10–GigabitEthernet interfaces 5/1

• a — Page down• q — QuitDell#monitor interface te 3/1FTOS uptime is 1 day(s), 4 hour(s), 31 minute(s) Monitor time: 00:00:00 Refresh Intvl.: 2sInter

Use the clear hardware sfm hg-stats and clear hardware linecard hg-stats commands to reset HiGig port statistics.Link Bundle MonitoringMonitoring link

You can enable the capability to detect uneven traffic distribution in the member links of a HiGig link bundle on a line-card or SFM NPU. You can also

• You can enable SNMP traps and syslog messages to be generated when an uneven traffic distribution is detected in a HiGig link bundle.• Traffic distr

Splitting QSFP Ports to SFP+ PortsThe Z9500 supports splitting a single 40G QSFP port into four 10G SFP+ ports using a supported breakout cable. (For

NOTE: Although it is possible to configure the remaining three 10 Gigabit ports, the Link UP event does not occur for these ports leaving the lanes un

For these configurations, the following examples show the command output that the show interfaces tengigbitethernet transceiver, show interfaces tengi

CLI Command Mode Prompt Access CommandNOTE: Access all of the following modes from CONFIGURATION mode.AS-PATH ACLDell(config-as-path)# ip as-path acce

SFP 0 Temp High Alarm threshold = 0.000CSFP 0 Voltage High Alarm threshold = 0.000VSFP 0 Bias High Alarm threshold = 0.000mANOTE: In

QSFP 0 Encoding = 0x00………………………………QSFP 0 Diagnostic Information===================================QSFP 0 Rx Power measurement type

Dell#show interfaces tengigabitethernet 0/6gigabitethernet 0/0 is up, line protocol is downHardware is DellEth, address is 90:b1:1c:f4:9a:fa Curren

Error-Disabled state and for all practical purposes of routing, the interface is deemed to be “down.” After the interface becomes stable and the penal

Te 4/2Dell#Clearing Dampening CountersTo clear dampening counters and accumulated penalties, use the following command.• Clear dampening counters.clea

Using Ethernet Pause Frames for Flow ControlEthernet Pause Frames allow for a temporary stop in data transmission. A situation may arise where a sendi

The pause is started when either the packet pointer or the buffer threshold is met (whichever is met first). When the discard threshold is met, packet

1400-byte IP MTU + 22-byte VLAN Tag = 1422-byte link MTUThe MTU range is from 592 to 9216, with a default of 9216. IP MTU automatically configures.The

NOTE: As a best practice, Dell Networking recommends keeping auto-negotiation enabled. Only disable auto-negotiation on switch ports that attach to de

In EXEC mode, the show interfaces switchport command displays only interfaces in Layer 2 mode and their relevant configuration information. The show i

CLI Command Mode Prompt Access CommandROUTE-MAPDell(config-route-map)# route-mapROUTER BGPDell(conf-router_bgp)# router bgpBGP ADDRESS-FAMILYDell(conf

Input 0 IP Packets, 0 Vlans 0 MPLS 0 64-byte pkts, 0 over 64-byte pkts, 0 over 127-byte pkts 0 over 255-byte pkts, 0 over 511-byte pkts, 0 over 10

• IP FLOW• IP ACL• IP FIB• L2 ACL• L2 FIBClearing Interface CountersThe counters in the show interfaces command are reset by the clear counters comman

20Internet Protocol Security (IPSec)Internet protocol security (IPSec) is an end-to-end security scheme for protecting IP communications by authentica

Configuring IPSec The following sample configuration shows how to configure FTP and telnet for IPSec.1. Define the transform set.CONFIGURATION modecry

21IPv4 RoutingIPv4 routing and various IP addressing features are supported. This chapter describes the basics of domain name service (DNS), address r

• Configure Static Routes for the Management Interface (optional)For a complete listing of all commands related to IP addressing, refer to the Dell Ne

interface TengigabitEthernet 0/0ip address 10.11.1.1/24no shutdown!Dell(conf-if)#Configuring Static RoutesA static route is an IP address that you man

Direct, Lo 0--More--The system installs a next hop that is on the directly connected subnet of current IP address on the interface (for example, if in

Resolution of Host NamesDomain name service (DNS) maps host names to IP addresses. This feature simplifies such commands as Telnet and FTP by allowing

Specifying the Local System Domain and a List of DomainsIf you enter a partial domain, the system can search different domains to finish or fully qual

CLI Command Mode Prompt Access CommandMONITOR SESSIONDell(conf-mon-sess-sessionID)#monitor sessionOPENFLOW INSTANCEDell(conf-of-instance-of-id)#openfl

Dell#traceroute www.force10networks.comTranslating "www.force10networks.com"...domain server (10.11.0.1) [OK]Type Ctrl-C to abort.----------

Configuring Static ARP EntriesARP dynamically maps the MAC and IP addresses, and while most network host support dynamic mapping, you can configure an

– ip ip-address (OPTIONAL): enter the keyword ip then the IP address of the ARP entry you wish to clear.– no-refresh (OPTIONAL): enter the keywords no

Figure 36. ARP Learning via ARP RequestWhen you enable ARP learning via gratuitous ARP, the system installs a new ARP entry, or updates an existing en

CONFIGURATION modearp backoff-timeThe default is 30.The range is from 1 to 3600.• Display all ARP entries learned via gratuitous ARP.EXEC Privilege mo

UDP HelperUser datagram protocol (UDP) helper allows you to direct the forwarding IP/UDP broadcast traffic by creating special broadcast addresses and

--------------------------------------------------Te 1/1 1000Configuring a Broadcast AddressTo configure a broadcast address, use the following comman

1. Packet 1 is dropped at ingress if you did not configure UDP helper address.2. If you enable UDP helper (using the ip udp-helper udp-port command),

Figure 39. UDP Helper with Subnet Broadcast AddressesUDP Helper with Configured Broadcast AddressesIncoming packets with a destination IP address matc

• If the Incoming packet has a destination IP address that matches the subnet broadcast address of any interface, the unaltered packet is routed to th

TenGigabitEthernet 0/8 unassigned YES Manual up upTenGigabitEthernet 0/9 unassigned YES Manual up

22IPv6 RoutingInternet protocol version 6 (IPv6) routing is the successor to IPv4. Due to the rapid growth in internet users and IP addresses, IPv4 is

NOTE: The system provides the flexibility to add prefixes on Router Advertisements (RA) to advertise responses to Router Solicitations (RS). By defaul

IPv6 Header FieldsThe 40 bytes of the IPv6 header are ordered, as shown in the following illustration.Figure 41. IPv6 Header FieldsVersion (4 bits)The

The following lists the Next Header field values.Value Description0 Hop-by-Hop option header4 IPv46 TCP8 Exterior Gateway Protocol (EGP)41 IPv643 Rout

However, if the Destination Address is a Hop-by-Hop options header, the Extension header is examined by every forwarding router along the packet’s rou

of double colons is supported in a single address. Any number of consecutive 0000 groups may be reduced to two colons, as long as there is only one do

IPv6 Implementation on the Dell Networking OSThe Dell Networking OS supports both IPv4 and IPv6 and both may be used simultaneously in your system.The

Feature and Functionality Dell Networking OS Release IntroductionDocumentation and Chapter LocationZ9000IS-IS for IPv6 support for redistribution8.3.1

Configuring the LPM Table for IPv6 Extended PrefixesThe LPM CAM table consists of two partitions: Partition I for IPv6 /65-/128 route-prefix entries a

Figure 42. Path MTU Discovery ProcessIPv6 Neighbor DiscoveryThe IPv6 neighbor discovery protocol (NDP) is a top-level protocol for neighbor discovery

Obtaining HelpObtain a list of keywords and a brief functional description of those keywords at any CLI mode using the ? or help command:• To list the

Figure 43. NDP Router RedirectIPv6 Neighbor Discovery of MTU PacketsYou can set the MTU advertised through the RA packets to incoming routers, without

Example for Configuring an IPv6 Recursive DNS ServerThe following example configures a RDNNS server with an IPv6 address of 1000::1 and a lifetime of

ff02::1 ff02::2 ff02::1:ff00:12 ff02::1:ff8b:7570 ND MTU is 0 ICMP redirects are not sent DAD is enabled, number of DAD attempts: 3 N

Adjusting Your CAM ProfileAlthough adjusting your CAM profile is not a mandatory step, if you plan to implement IPv6 ACLs, Dell Networking recommends

You can configure up to two IPv6 addresses on management interfaces, allowing required default router support on the management port that is acting as

Configuring Telnet with IPv6The Telnet client and server on a switch supports IPv6 connections. You can establish a Telnet session directly to the rou

prefix-list List IPv6 prefix listsroute IPv6 routing informationrpf RPF tableDell#Displaying an IPv6 ConfigurationTo view the IPv6 co

• Display IPv6 routing information for the specified route type.EXEC modeshow ipv6 route typeThe following keywords are available:– To display informa

S 8888:9999:5555:6666:1111:2222::/96 [1/0] via 2222:2222:3333:3333::1, Te 9/1, 00:03:16 S 9999:9999:9999:9999

23Intermediate System to Intermediate SystemThe intermediate system to intermediate system (IS-IS) protocol that uses a shortest-path-first algorithm.

4 Switch Management... 53Configuring Privilege Levels...

Short-Cut Key CombinationActionCNTL-D Deletes character at cursor.CNTL-E Moves the cursor to the end of the line.CNTL-F Moves the cursor forward one c

• system address — the router’s MAC address.• N-selector — this is always 0.The following illustration is an example of the ISO-style address to show

Interface SupportMT IS-IS is supported on physical Ethernet interfaces, physical synchronous optical network technologies (SONET) interfaces, port-cha

• The T3 timer sets the overall wait time after which the router determines that it has failed to achieve database synchronization (by setting the ove

IS-IS Parameter Default ValueCircuit Type Level 1 and Level 2IS Type Level 1 and Level 2Equal Cost Multi Paths 16Configuration InformationTo use IS-IS

To configure IS-IS globally, use the following commands.1. Create an IS-IS routing process.CONFIGURATION moderouter isis [tag]tag: (optional) identifi

6. Enable IS-IS on the IPv4 interface.ROUTER ISIS modeip router isis [tag]If you configure a tag variable, it must be the same as the tag variable ass

IS-IS: Level-1 SPF Calculations : 29 IS-IS: Level-2 SPF Calculations : 29 IS-IS: LSP checksum errors received : 0 IS-IS: LSP authentication failu

Configuring IS-IS Graceful RestartTo enable IS-IS graceful restart globally, use the following commands. Additionally, you can implement optional comm

– adjacency: the restarting router receives the remaining time value from its peer and adjusts its T3 value so if user has configured this option.– ma

Level-1 Metric: 10, Priority: 64, Circuit ID: 0000.0000.000B.01 Hello Interval: 10, Hello Multiplier: 3, CSNP Interval: 10 Number of act

• show run | grep ethernet does not return that search result because it only searches for instances containing a non-capitalized “ethernet.”• show ru

Dell#show running-config isis!router isis lsp-refresh-interval 902 net 47.0005.0001.000C.000A.4321.00 net 51.0005.0001.000C.000A.4321.00Dell#Config

The default is Level 1 and Level 2 (level-1–2)To view which metric types are generated and received, use the show isis protocol command in EXEC Privil

Metric Sytle Correct Value Rangewide 0 to 16777215narrow 0 to 63wide transition 0 to 16777215narrow transition 0 to 63transition 0 to 63To view the in

eljefe.02-00 * 0x00000001 0x2E7F 1113 0/0/0Force10.00-00 0x00000002 0xD1A7 1102 0/0/0IS-IS Level-2 Link State Datab

– For the Loopback interface on the RPM, enter the keyword loopback then a number from 0 to 16383.– For a port channel, enter the keywords port-channe

distribute-list prefix-list-name out [bgp as-number | connected | ospf process-id | rip | static]You can configure one of the optional parameters:– co

– metric value the range is from 0 to 16777215. The default is 0.– match external the range is from 1 or 2.– match internal– metric-type: external or

Configuring Authentication PasswordsYou can assign an authentication password for routers in Level 1 and for routers in Level 2.Because Level 1 and Le

Example of Viewing the Overload Bit SettingWhen the bit is set, a 1 is placed in the OL column in the show isis database command output. The overload

– interface: Enter the type of interface and slot/port information to view IS-IS information on that interface only.• View the events that triggered I

508 290 29 10000 0.00% 0.02% 0.09% 0 confdMgr655 270 27 10000 0.00% 0.00% 0.09% 0 login557 180 18 100

Metric Style Correct Value Range for the isis metric Commandwide transition 0 to 16777215narrow transition 0 to 63transition 0 to 63Maximum Values in

Beginning Metric Style Final Metric Style Resulting IS-IS Metric Valuetransition narrow original valuetransition narrow original valuetransition wide

Leaks from One Level to AnotherIn the following scenarios, each IS-IS level is configured with a different metric style.Table 15. Metric Value with Di

NOTE: Whenever you make IS-IS configuration changes, clear the IS-IS process (re-started) using the clear isis command. The clear isis command must in

ipv6 address 24:3::1/76ip router isisipv6 router isisno shutdownDell (conf-if-te-3/17)#Dell(conf-router_isis)#show config!router isismetric-style wide

24Link Aggregation Control Protocol (LACP)A link aggregation group (LAG), referred to as a port channel by the Dell Networking OS, can provide both lo

– The shutdown command on LAG “xyz” disables the LAG and retains the user commands. However, the system does not allow the channel number “xyz” to be

– number: cannot statically contain any links.The default is LACP active.• Configure port priority.LACP mode[no] lacp port-priority priority-valueThe

• Configure the dynamic LAG interfaces.CONFIGURATION modeport-channel-protocol lacpExample of the port-channel-protocol lacp CommandDell(conf)#interfa

Partner System ID: Priority 32768, Address 0001.e801.45a5Actor Admin Key 1, Oper Key 1, Partner Oper Key 1LACP LAG 1 is an aggregatable linkA - Active

3Getting StartedThis chapter describes how you start configuring your Z9500 operating software.When you power up the chassis, the system performs a po

To avoid packet loss, redirect traffic through the next lowest-cost link (R3 to R4). the system has the ability to bring LAG 2 down if LAG 1 fails, so

Figure 47. Configuring Shared LAG State TrackingThe following are shared LAG state tracking console messages:• 2d1h45m: %SYSTEM-P:CP %IFMGR-5-OSTATE_D

LACP Basic Configuration ExampleThe screenshots in this section are based on the following example topology. Two routers are named ALPHA and BRAVO, an

Input statistics: 132 packets, 163668 bytes 0 Vlans 0 64-byte pkts, 12 over 64-byte pkts, 120 over 127-byte pkts 0 over 255-byte pkts,

Figure 50. Inspecting Configuration of LAG 10 on ALPHA434Link Aggregation Control Protocol (LACP)

Figure 51. Verifying LAG 10 Status on ALPHA Using the show lacp CommandSummary of the LAG Configuration on AlphaAlpha(conf-if-po-10)#int tengig 2/31Al

interface TengigabitEthernet 2/31no ip addressSummary of the LAG Configuration on BravoBravo(conf-if-te-3/21)#int port-channel 10Bravo(conf-if-po-10)#

Figure 52. Inspecting a LAG Port on BRAVO Using the show interface CommandLink Aggregation Control Protocol (LACP)437

Figure 53. Inspecting LAG 10 Using the show interfaces port-channel Command438Link Aggregation Control Protocol (LACP)

Figure 54. Inspecting the LAG Status Using the show lacp commandThe point-to-point protocol (PPP) is a connection-oriented protocol that enables layer

Accessing the Console PortTo access the console port, follow these steps:For the console port pinout, refer to Accessing the RJ-45 Console Port with a

25Layer 2This chapter describes the Layer 2 features supported on the Z9500.Manage the MAC Address TableYou can perform the following management tasks

The range is from 10 to 1000000.Configuring a Static MAC AddressA static entry is one that is not subject to aging. Enter static entries manually.To c

interface) before the system verifies that sufficient CAM space exists. If the CAM check fails, a message is displayed:%E90MH:5 %ACL_AGENT-2-ACL_AGENT

To save all sticky MAC addresses into a configuration file that can be used as a startup configuration file, use the write config command. If the numb

Learning Limit Violation ActionsLearning limit violation actions are user-configurable.To configure the system to take an action when the MAC learning

NOTE: Alternatively, you can reset the interface by shutting it down using the shutdown command and then re-enabling it using the no shutdown command.

address-table station-move refresh-arp command on the switch at the time that NIC teaming is being configured on the server.NOTE: If you do not config

Figure 57. Configuring Redundant Layer 2 Pairs without Spanning TreeYou configure a redundant pair by assigning a backup interface to a primary interf

To ensure that existing network applications see no difference when a primary interface in a redundant pair transitions to the backup interface, be su

00:24:55: %SYSTEM-P:CP %IFMGR-5-ACTIVE: Changed Vlan interface state to active: Vl 100:24:55: %SYSTEM-P:CP %IFMGR-5-STATE_STBY_ACT: Changed interface

• Characters within the string can be letters, digits, and hyphens.To create a host name, use the following command.• Create a host name.CONFIGURATION

Figure 58. Configuring Far-End Failure DetectionThe report consists of several packets in SNAP format that are sent to the nearest known MAC address.I

4. If the FEFD enabled system is configured to use FEFD in Normal mode and neighboring echoes are not received after three intervals, (you can set eac

To report interval frequency and mode adjustments, use the following commands.1. Setup two or more connected interfaces for Layer 2 or Layer 3.INTERFA

To set up and activate two or more connected interfaces, use the following commands.1. Setup two or more connected interfaces for Layer 2 or Layer 3.I

inactive: Vl 12w1d22h : FEFD state on Te 4/0 changed from Bi-directional to UnknownThe following example shows the debug fefd packets command.Dell#deb

26Link Layer Discovery Protocol (LLDP)This chapter describes how to configure and use the link layer discovery protocol (LLDP) on the Z9500 switch.802

Table 17. Type, Length, Value (TLV) TypesType TLV Description0 End of LLDPDU Marks the end of an LLDPDU.1 Chassis ID An administratively assigned name

Figure 61. Organizationally Specific TLVIEEE Organizationally Specific TLVsEight TLV types have been defined by the IEEE 802.1 and 802.3 working group

Type TLV Description127 Protocol Identity Indicates the protocols that the port can process. The Dell Networking OS does not currently support this TL

Regarding connected endpoint devices, LLDP-MED provides network connectivity devices with the ability to:• manage inventory• manage Power over Etherne

no shutdownConfigure a Management RouteDefine a path from the Z9500 to the network from which you are accessing the system remotely. Management routes

Type SubType TLV DescriptionNone or all TLVs must be supported. The Dell Networking OS does not currently support these TLVs.127 5 Inventory — Hardwar

Figure 62. LLDP-MED Capabilities TLVTable 20. LLDP-MED CapabilitiesBit Position TLV Supported?0 LLDP-MED Capabilities Yes1 Network Policy Yes2 Locatio

NOTE: As shown in the following table, signaling is a series of control packets that are exchanged between an endpoint device and a network connectivi

Extended Power via MDI TLVThe extended power via MDI TLV enables advanced PoE management between LLDP-MED endpoints and network connectivity devices.A

Important Points to Remember• LLDP is enabled by default.• Dell Networking systems support up to eight neighbors per interface.• Dell Networking syste

Enabling LLDPLLDP is disabled by default. Enable and disable LLDP globally or per interface. If you enable LLDP globally, all UP interfaces send perio

3. Enter the disable command.LLDP-MANAGEMENT-INTERFACE mode.To undo an LLDP management port configuration, precede the relevant command with the keywo

Figure 65. Configuring LLDPViewing the LLDP ConfigurationTo view the LLDP configuration, use the following command.• Display the LLDP configuration.CO

Viewing Information Advertised by Adjacent LLDP AgentsTo view brief information about adjacent devices or to view all the information that neighbors a

Configuring LLDPDU IntervalsLLDPDUs are transmitted periodically; the default interval is 30 seconds.To configure LLDPDU intervals, use the following

– encryption-type: specifies how you are inputting the password, is 0 by default, and is not required.* 0 is for inputting the password in clear text.

• Return to the default setting.CONFIGURATION mode or INTERFACE modeno modeExample of Configuring a Single ModeR1(conf)#protocol lldpR1(conf-lldp)#sho

advertise dot1-tlv port-protocol-vlan-id port-vlan-id advertise dot3-tlv max-frame-size advertise management-tlv system-capabilities system-descri

Figure 66. The debug lldp detail Command — LLDPDU Packet DissectionRelevant Management ObjectsThe system supports all IEEE 802.1AB MIB objects.The fol

MIB Object CategoryLLDP Variable LLDP MIB Object DescriptionmsgTxInterval lldpMessageTxInterval Transmit Interval value.rxInfoTTL lldpRxInfoTTL Time t

Table 24. LLDP System MIB ObjectsTLV Type TLV Name TLV Variable System LLDP MIB Object1 Chassis ID chassis ID subtype Local lldpLocChassisIdSubtypeRem

TLV Type TLV Name TLV Variable System LLDP MIB Objectinterface numbering subtypeLocal lldpLocManAddrIfSubtypeRemote lldpRemManAddrIfSubtypeinterface n

Table 26. LLDP-MED System MIB ObjectsTLV Sub-Type TLV Name TLV Variable System LLDP-MED MIB Object1 LLDP-MED CapabilitiesLLDP-MED CapabilitiesLocallld

TLV Sub-Type TLV Name TLV Variable System LLDP-MED MIB Object3 Location Identifier Location Data FormatLocal lldpXMedLocLocationSubtypeRemote lldpXMed

27Microsoft Network Load BalancingNetwork Load Balancing (NLB) is a clustering functionality that is implemented by Microsoft on Windows 2000 Server a

With NLB, the data frame is forwarded to all servers in the cluster for the servers to perform load-balancing.NLB Multicast Mode ExampleConsider a sam

• To copy a local file to a remote system, combine the file-origin syntax for a local file location with the file-destination syntax for a remote file

NLB VLAN FloodingTo preserve Microsoft server failover and load-balancing, configure a switch to forward the traffic destined for a server cluster on

28Multicast Source Discovery Protocol (MSDP)This chapter describes how to configure and use the multicast source discovery protocol (MSDP) on the Z950

Figure 67. Multicast Source Discovery Protocol (MSDP)RPs advertise each (S,G) in its domain in type, length, value (TLV) format. The total number of T

Anycast RPUsing MSDP, anycast RP provides load sharing and redundancy in PIM-SM networks. Anycast RP allows two or more rendezvous points (RPs) to sha

• Accept Source-Active Messages that Fail the RFP Check• Specifying Source-Active Messages• Limiting the Source-Active Cache• Preventing MSDP from Cac

Figure 70. Configuring OSPF and BGP for MSDPMulticast Source Discovery Protocol (MSDP)485

Figure 71. Configuring PIM in Multiple Routing Domains486Multicast Source Discovery Protocol (MSDP)

Figure 72. Configuring MSDPEnable MSDPEnable MSDP by peering RPs in different administrative domains.1. Enable MSDP.CONFIGURATION modeip multicast-msd

Example of Configuring MSDPExample of Viewing Peer Information R3(conf)#ip multicast-msdp R3(conf)#ip msdp peer 192.168.0.1 connect-source Loopb

Limiting the Source-Active CacheSet the upper limit of the number of active sources that the system caches.The default active source limit is 500K mes

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!26292881 bytes successfully copiedSave the Running-ConfigurationThe running-configurat

Figure 73. MSDP Default Peer, Scenario 1490Multicast Source Discovery Protocol (MSDP)

Figure 74. MSDP Default Peer, Scenario 2Multicast Source Discovery Protocol (MSDP)491

Figure 75. MSDP Default Peer, Scenario 3492Multicast Source Discovery Protocol (MSDP)

Figure 76. MSDP Default Peer, Scenario 4Specifying Source-Active MessagesTo specify messages, use the following command.• Specify the forwarding-peer

Dell(conf)#ip access-list standard fiftyDell(conf)#seq 5 permit host 200.0.0.50Dell#ip msdp sa-cacheMSDP Source-Active Cache - 3 entriesGroupAddr So

Example of Verifying the System is not Caching Local SourcesWhen you apply this filter, the SA cache is not affected immediately. When sources that ar

R3(conf)#do show ip msdp sa-cacheR3(conf)#R3(conf)#do show ip msdp peerPeer Addr: 192.168.0.1 Local Addr: 0.0.0.0(639) Connect Source: Lo 0 Stat

Logging Changes in Peership StatesTo log changes in peership states, use the following command.• Log peership state changes.CONFIGURATION modeip msdp

Example of the clear ip msdp peer Command and Verifying Statistics are ClearedR3(conf)#do show ip msdp peerPeer Addr: 192.168.0.1 Local Addr: 192.1

technique is less effective as traffic increases because preemptive load balancing requires prior knowledge of traffic distributions.• lack of scalabl

5 802.1X... 75The Port-Authentication

• View a list of files on an external flash.EXEC Privilege modedir usbflash:• View the running-configuration.EXEC Privilege modeshow running-config• V

Configuring Anycast RPTo configure anycast RP:1. In each routing domain that has multiple RPs serving a group, create a Loopback interface on each RP

CONFIGURATION modeip msdp originator-idExample of R1 Configuration for MSDP with Anycast RPExample of R2 Configuration for MSDP with Anycast RPExample

ip address 10.11.0.23/24 no shutdown!interface Loopback 0 ip pim sparse-mode ip address 192.168.0.1/32 no shutdown!interface Loopback 1 ip addr

neighbor 192.168.0.22 ebgp-multihop 255 neighbor 192.168.0.22 update-source Loopback 0 neighbor 192.168.0.22 no shutdown!ip multicast-msdpip msdp

interface TenGigabitEthernet 2/1 ip pim sparse-mode ip address 10.11.4.1/24 no shutdown!interface TenGigabitEthernet 2/11 ip pim sparse-mode ip a

redistribute connected redistribute bgp 200!router bgp 200 redistribute ospf 1 neighbor 192.168.0.2 remote-as 100 neighbor 192.168.0.2 ebgp-mult

29Multiple Spanning Tree Protocol (MSTP)Multiple spanning tree protocol (MSTP) — specified in IEEE 802.1Q-2003 — is a rapid spanning tree protocol (RS

Spanning Tree VariationsThe Dell Networking OS supports four variations of spanning tree, as shown in the following table.Table 27. Spanning Tree Vari

• Enabling SNMP Traps for Root Elections and Topology ChangesEnable Multiple Spanning Tree GloballyMSTP is not enabled by default. To enable MSTP glob

Examples of Creating and Viewing MSTP InstancesThe following example shows using the msti command.Dell(conf)#protocol spanning-tree mstpDell(conf-mstp

!redundancy auto-synchronize fullredundancy disable-auto-reboot!service timestamps log datetime!logging coredump!hostname pt-z9500-11!enable password

Influencing MSTP Root SelectionMSTP determines the root bridge, but you can assign one bridge a lower priority to increase the probability that it bec

NOTE: Some non-Dell equipment may implement a non-null default region name, such as the Bridge ID or a MAC address.Changing the Region Name or Revisio

The default is 15 seconds.2. Change the hello-time parameter.PROTOCOL MSTP modehello-time secondsNOTE: With large configurations (especially those con

• Port priority influences the likelihood that a port is selected to be a forwarding port in case that several ports have the same port cost.The follo

• Enable EdgePort on an interface.INTERFACE modespanning-tree mstp edge-port [bpduguard | shutdown-on-violation]Dell Networking OS Behavior: Regarding

Figure 79. MSTP with Three VLANs Mapped to Two Spanning Tree InstancesRouter 1 Running-ConfigurationThis example uses the following steps:1. Enable MS

no shutdown!interface Vlan 300 no ip address tagged TenGigabitEthernet 1/21,31 no shutdownRouter 2 Running-ConfigurationThis example uses the fol

name Tahiti revision 123 MSTI 1 VLAN 100 MSTI 2 VLAN 200,300!(Step 2)interface TenGigabitEthernet 3/11 no ip address switchport no shutdown!in

(Step 3)interface vlan 100 tagged 1/0/31 tagged 1/0/32exitinterface vlan 200 tagged 1/0/31 tagged 1/0/32exitinterface vlan 300 tagged 1/0/31 tag

– Are there “extra” MSTP instances in the Sending or Received logs? This may mean that an additional MSTP instance was configured on one router but no

The verify {md5 | sha256} command calculates and displays the hash of any file on the specified local flash drive. You can compare the displayed hash

INST 2: Flags: 0x70, Reg Root: 32768:0001.e8d5.cbbd, Int Root Cost Brg/Port Prio: 32768/128, Rem Hops: 20520Multiple Spanning Tree Protocol (MSTP)

30Multicast FeaturesThe Dell Networking OS supports the following multicast protocols:• PIM Sparse-Mode (PIM-SM)• Internet Group Management Protocol (

Figure 80. Multicast with ECMPImplementation InformationBecause protocol control traffic is redirected using the MAC address, and multicast control tr

Protocol Ethernet AddressPIM-SM 01:00:5e:00:00:0d• The Dell Networking OS implementation of MTRACE is in accordance with IETF draft draft-fenner-trace

When the multicast route limit is reached, the following message is displayed: 3w1d13h: %RPM0-P:RP2 %PIM-3-PIM_TIB_LIMIT: PIM TIB limit reached.

Figure 81. Preventing a Host from Joining a GroupTable 29. Preventing a Host from Joining a Group — DescriptionLocation Description1/21• Interface Gig

Location Description• no shutdown2/1• Interface GigabitEthernet 2/1• ip pim sparse-mode• ip address 10.11.1.1/24• no shutdown2/11• Interface GigabitEt

Rate Limiting IGMP Join RequestsIf you expect a burst of IGMP Joins, protect the IGMP process from overload by limiting that rate at which new groups

Figure 82. Preventing a Source from Transmitting to a GroupTable 30. Preventing a Source from Transmitting to a Group — DescriptionLocation Descriptio

Location Description• no shutdown2/1• Interface GigabitEthernet 2/1• ip pim sparse-mode• ip address 10.11.1.1/24• no shutdown2/11• Interface GigabitEt

4Switch ManagementThis chapter describes the switch management tasks supported on the Z9500.Configuring Privilege LevelsPrivilege levels restrict acce

Preventing a PIM Router from Processing a JoinTo permit or deny PIM Join/Prune messages on an interface using an extended IP access list, use the foll

31Open Shortest Path First (OSPFv2 and OSPFv3)This chapter describes how to configure and use Open Shortest Path First (OSPFv2 for IPv4) and OSPF vers

size of the routing tables on all routers. An area within the AS may not see the details of another area’s topology. AS areas are known by their area

In the previous example, Routers A, B, C, G, H, and I are the Backbone.• A stub area (SA) does not receive external route information, except for the

Figure 84. OSPF Routing ExamplesBackbone Router (BR)A backbone router (BR) is part of the OSPF Backbone, Area 0.This includes all ABRs. It can also in

An ABR can connect to many areas in an AS, and is considered a member of each area it connects to.Autonomous System Border Router (ASBR)The autonomous

available. An ABR floods the information for the router (for example, the ASBR where the Type 5 advertisement originated. The link-state ID for Type 4

Virtual LinksIn the case in which an area cannot be directly connected to Area 0, you must configure a virtual link between that area and Area 0.The t

OSPF ImplementationThe Dell Networking OS supports up to 10,000 OSPF routes for OSPFv2. Within the 10,000 routes, you can designate up to 8,000 routes

Processing SNMP and Sending SNMP TrapsThough there are may be several OSPFv2 processes, only one process can process simple network management protoco

Allowing Access to CONFIGURATION Mode CommandsTo allow access to CONFIGURATION mode, use the privilege exec level level configure command from CONFIGU

To confirm that you enabled RFC-2328–compliant OSPF flooding, use the show ip ospf command.Dell#show ip ospfRouting Process ospf 1 with ID 2.2.2.2Supp

Configuration InformationThe interfaces must be in Layer 3 mode (assigned an IP address) and enabled so that they can send and receive traffic. The OS

If implementing multi-process OSPF, create an equal number of Layer 3 enabled interfaces and OSPF process IDs. For example, if you create four OSPFv2

• Reset the OSPFv2 process.EXEC Privilege modeclear ip ospf process-id• View the current OSPFv2 status.EXEC modeshow ip ospf process-idExample of View

If you try to enable more OSPF processes than available Layer 3 interfaces, the following message displays:Dell(conf)#router ospf 1% Error: No router

Dell(conf)#router ospf 1Dell(conf-router_ospf-1)#network 1.2.3.4/24 area 0Dell(conf-router_ospf-1)#network 10.10.10.10/24 area 1Dell(conf-router_ospf-

Loopback 0 is up, line protocol is up Internet Address 10.168.253.2/32, Area 0.0.0.1 Process ID 1, Router ID 10.168.253.2, Network Type LOOPBACK, Co

Configuring LSA Throttling TimersConfigured link-state advertisement (LSA) timers replace the standard transmit and acceptance times for LSAs.The LSA

To enable both receiving and sending routing updates, use the no passive-interface interface command.Example of Viewing Passive InterfacesWhen you con

NOTE: A higher convergence level can result in occasional loss of OSPF adjacency. Generally, convergence level 1 meets most convergence requirements.

• Allow access to a CONFIGURATION, INTERFACE, LINE, ROUTE-MAP, and/or ROUTER mode command.CONFIGURATION modeprivilege {configure |interface | line | r

The dead interval must be the same on all routers in the OSPF network.• Change the time interval between hello-packet transmission.CONFIG-INTERFACE mo

The bold lines in the example show the change on the interface. The change is reflected in the OSPF configuration.Dell(conf-if)#ip ospf cost 45Dell(co

• retransmit-interval — LSA retransmit interval• transmit-delay — LSA transmission delay• dead-interval — dead router detection time• authentication-k

ip prefix-list prefix-nameYou are in PREFIX LIST mode.• Create a prefix list with a sequence number and a deny or permit action.CONFIG- PREFIX LIST mo

Example of Viewing OSPF Configuration after Redistributing RoutesTo view the current OSPF configuration, use the show running-config ospf command in E

• View the configuration of OSPF neighbors connected to the local router.EXEC Privilege modeshow ip ospf neighbor• View the LSAs currently in the queu

Sample Configurations for OSPFv2The following configurations are examples for enabling OSPFv2.These examples are not comprehensive directions. They ar

OSPF Area 0 — Te 3/1 and 3/2router ospf 33333 network 192.168.100.0/24 area 0 network 10.0.13.0/24 area 0 network 10.0.23.0/24 area 0!interface Loo

NOTE: The OSPFv2 network area command enables OSPF on multiple interfaces with the single command. Use the OSPFv3 ipv6 ospf area command on each inter

ipv6 ospf process-id area area-id– process-id: the process ID number assigned.– area-id: the area ID for this interface.Assigning OSPFv3 Process ID an

Dell(conf)#line vty 0Dell(config-line-vty)#?exit Exit from line configuration modeDell(config-line-vty)#Applying a Privilege Level to a

• Specify whether some or all some of the interfaces are passive.CONF-IPV6-ROUTER-OSPF modepassive-interface {type slot/port}Interface: identifies the

default-information originate [always [metric metric-value] [metric-type type-value]] [route-map map-name]Configure the following required and optiona

You decide the set of IPsec protocols that are employed for authentication and encryption and the ways in which they are employed. When you correctly

– Configuring IPsec Encryption for an OSPFv3 Area– Displaying OSPFv3 IPsec Security PoliciesConfiguring IPsec Authentication on an InterfaceTo configu

• Enable IPsec encryption for OSPFv3 packets on an IPv6-based interface.INTERFACE modeipv6 ospf encryption {null | ipsec spi number esp encryption-alg

• Enable IPSec authentication for OSPFv3 packets in an area.CONF-IPV6-ROUTER-OSPF modearea-id authentication ipsec spi number {MD5 | SHA1} [key-encryp

– key: specifies the text string used in the encryption. All neighboring OSPFv3 routers must share the same key to decrypt information. The required l

Policy name : OSPFv3-1-502Policy refcount : 1Inbound ESP SPI : 502 (0x1F6)Outbound ESP SPI : 502 (0x1F6)Inbound ESP

Interface: TenGigabitEthernet 0/1 Link Local address: fe80::201:e8ff:fe40:4d11 IPSecv6 policy name: OSPFv3-1-600 inbound ah sas outbound ah sas i

• View the summary information for the OSPFv3 database.EXEC Privilege modeshow ipv6 ospf database• View the configuration of OSPFv3 neighbors.EXEC Pri

Audit and Security LogsThis section describes how to configure, display, and clear audit and security logs.The following is the configuration task lis

32Pay As You Grow The Pay As You Grow (PAYG) software feature allows you to purchase a Z9500 switch with 36 40G ports (144 10G ports) and upgrade to a

To install a license on a Z9500 switch:1. Check the currently installed port license.show licenseEXEC Privilege modeIn the command output, System Serv

Enter Yes at the prompt to continue the installation; for example:Dell# install license tftp://10.11.8.12/132.lic!3594 bytes successfully copiedRetrie

unmounting /usr/pkg (/dev/wd0i)...unmounting /boot (/dev/wd0b)...unmounting /usr (mfs:30)...unmounting /force10 (mfs:25)...unmounting /lib (mfs:22)...

-- Power Supplies --Unit Bay Status Type FanStatus FanSpeed(rpm) Power Usage (W)---------------------------------------------------

33PIM Sparse-Mode (PIM-SM)Protocol-independent multicast sparse-mode (PIM-SM) is a multicast protocol that forwards multicast traffic to a subnet only

is added to the outgoing interface list associated with the (*,G) entry, and the message is not (and does not need to be) forwarded towards the RP.Ref

Configuring PIM-SMConfiguring PIM-SM is a three-step process.1. Enable multicast routing (refer to the following step).2. Select a rendezvous point.3.

To display PIM neighbors for each interface, use the show ip pim neighbor command EXEC Privilege mode.Dell#show ip pim neighborNeighbor Interface

ip access-list extended access-list-name3. Specify the source and group to which the timer is applied using extended ACLs with permit rules only.CONFI

• The network administrator and network operator user roles can view system events.NOTE: If extended logging is disabled, you can only view system eve

Dell#sh run pim!ip pim rp-address 1.1.1.1 group-address 224.0.0.0/4Overriding Bootstrap Router UpdatesPIM-SM routers must know the address of the RP f

Creating Multicast Boundaries and DomainsA PIM domain is a contiguous set of routers that all implement PIM and are configured to operate within a com

34PIM Source-Specific Mode (PIM-SSM)PIM source-specific mode (PIM-SSM) is a multicast protocol that forwards multicast traffic from a single source to

Configure PIM-SMMConfiguring PIM-SSM is a two-step process.1. Configure PIM-SMM.2. Enable PIM-SSM for a range of addresses.Related Configuration Tasks

• You may enter multiple ssm-map commands for different access lists. You may also enter multiple ssm-map commands for the same access list, as long a

Uptime 00:00:05Expires NeverRouter mode INCLUDELast reporter 10.11.4.2Last reporter mode INCLUDELast

35Policy-based Routing (PBR)Policy-based Routing (PBR) allows a switch to make routing decisions based on policies applied to an interface.This chapte

To enable a PBR, you create a redirect list. Redirect lists are defined by rules, or routing policies. The following parameters can be defined in the

Implementing Policy-based Routing with Dell Networking OS• Non-contiguous bitmasks for PBR• Hot-Lock PBRNon-contiguous bitmasks for PBRNon-contiguous

The following example creates a redirect list by the name of “xyz.”Dell(conf)#ip redirect-list ?WORD Redirect-list name (max 16 chars) Dell(co

Setting Up a Secure Connection to a Syslog ServerYou can use reverse tunneling with the port forwarding to securely connect to a syslog server.Pre-req

Dell(conf-redirect-list)#redirect 3.3.3.3 ?<0-255> An IP protocol number icmp

PBR Exceptions (Permit)Use the command permit to create an exception to a redirect list. Exceptions are used when a forwarding decision should be base

Applying a Redirect-list to an Interface Example:Dell(conf-if-te-2/0)#ip redirect-group xyz Dell(conf-if-te-2/0)#Applying a Redirect-list to an Interf

NOTE: If, the redirect-list is applied to an interface, the output of show ip redirect-list redirect-list-name command displays reachability and ARP s

Create the Redirect-List GOLDEDGE_ROUTER(conf-if-Te-2/23)#ip redirect-list GOLDEDGE_ROUTER(conf-redirect-list)#description Route GOLD traffic to ISP_G

View Redirect-List GOLDEDGE_ROUTER#show ip redirect-listIP redirect-list GOLD: Defined as: seq 5 redirect 10.99.99.254 ip 192.168.1.0/24 any, Next-ho

36Port MonitoringPort monitoring (also referred to as mirroring) allows you to monitor ingress and/or egress traffic on specified ports. The mirrored

------ ------ ----------- --- ---- --------- -------- 1 Te 0/0 Te 0/1 both Port N/A

6/0 destination TenGig 6/1 direction tx, if the MD port TenGig 6/0 is an untagged member of any VLAN, all monitored frames that the MG port TenGig 6/1

Figure 88. Port Monitoring ExampleRemote Port MirroringWhile local port monitoring allows you to monitor traffic from one or more source ports by dire

Configuration Task List for Prefix Lists... 105ACL Resequencing...

3. Configure logging to a local host. locahost is “127.0.0.1” or “::1”.If you do not, the system displays an error when you attempt to enable role-ba

The reserved VLANs transport the mirrored traffic in sessions (blue pipes) to the destination analyzers in the local network. Two destination sessions

• You cannot configure a private VLAN or a GVRP VLAN as the reserved RPM VLAN.• The L3 interface configuration should be blocked for the reserved VLAN

• You can configure the same source port to be used in multiple source sessions.• You cannot configure a source port channel or source VLAN in a sourc

Step Command Description1configure terminal Enter global configuration mode.2monitor session id type rpm Specify a unique session ID number and RPM a

Dell(conf-if-po-10)#no shutdownDell(conf-if-po-10)#exitDell(conf)#monitor session 3 type rpmDell(conf-mon-sess-3)#source port-channel 10 dest remote-v

------ ------ ----------- --- ---- --------- -------- 1 remote-vlan 10 Te 0/3 N/A N/A N/A

Encapsulated Remote-Port MonitoringEncapsulated Remote Port Monitoring (ERPM) copies traffic from source ports/port-channels or source VLANs and forwa

6flow-based enableSpecify ERPM to be performed on a flow-by-flow basis or if you configure a VLAN source interface. Enter no flow-based disable to dis

37Private VLANs (PVLAN)Private VLANs (PVLANs) extend Dell Networking OS security suite by providing Layer 2 isolation between ports within the same vi

– A primary VLAN and each of its secondary VLANs decrement the available number of VLAN IDs in the switch.– A primary VLAN has one or more promiscuous

no logging consoleSending System Messages to a Syslog ServerTo send system messages to a specified syslog server, use the following command. The follo

[no] private-vlan mapping secondary-vlan vlan-list• Display type and status of PVLAN interfaces.EXEC mode or EXEC Privilege modeshow interfaces privat

4. Select the PVLAN mode.INTERFACE modeswitchport mode private-vlan {host | promiscuous | trunk}• host (isolated or community VLAN port)• promiscuous

INTERFACE VLAN modeprivate-vlan mapping secondary-vlan vlan-listThe list of secondary VLANs can be:• Specified in comma-delimited (VLAN-ID,VLAN-ID) or

INTERFACE VLAN modetagged interface or untagged interfaceYou can enter the interfaces singly or in range format, either comma-delimited (slot/port,por

Private VLAN Configuration ExampleThe following example shows a private VLAN topology.Figure 89. Sample Private VLAN TopologyThe following configurati

• All the ports in the secondary VLANs (both community and isolated VLANs) can only communicate with ports in the other secondary VLANs of that PVLAN

show vlan private-vlan mappingThis command is specific to the PVLAN feature.Examples of Viewing a Private VLANsThe show arp and show vlan commands are

switchport switchport mode private-vlan host no shutdown!interface TengigabitEthernet 0/5 no ip address switchport switchport mode private-vlan

38Per-VLAN Spanning Tree Plus (PVST+)Per-VLAN spanning tree plus (PVST+) is a variation of spanning tree — developed by a third party — that allows yo

Table 31. Spanning Tree Versions SupportedDell Networking Term IEEE SpecificationSpanning Tree Protocol (STP) 802 .1dRapid Spanning Tree Protocol (RST

Jan 21 04:11:02: %SYSTEM:CP %IFMGR-5-OSTATE_DN: Changed interface state to down: Te 0/0Jan 21 03:12:54: %SYSTEM:LP %CHMGR-2-PSU_FAN_SPEED_CHANGE: PSU_

PROTOCOL PVST modeno disableDisabling PVST+To disable PVST+ globally or on an interface, use the following commands.• Disable PVST+ globally.PROTOCOL

Figure 91. Load Balancing with PVST+The bridge with the bridge value for bridge priority is elected root. Because all bridges use the default priority

Root Identifier has priority 4096, Address 0001.e80d.b6d6Root Bridge hello time 2, max age 20, forward delay 15Bridge Identifier has priority 4096, Ad

PROTOCOL PVST modevlan max-ageThe range is from 6 to 40.The default is 20 seconds.The values for global PVST+ parameters are given in the output of th

The range is from 0 to 240, in increments of 16.The default is 128.The values for interface PVST+ parameters are given in the output of the show spann

PVST+ in Multi-Vendor NetworksSome non-Dell Networking systems which have hybrid ports participating in PVST+ transmit two kinds of BPDUs: an 802.1D B

Example of Viewing the Extend System ID in a PVST+ ConfigurationDell(conf-pvst)#do show spanning-tree pvst vlan 5 briefVLAN 5Executing IEEE compatible

interface Vlan 100 no ip address tagged TengigabitEthernet 2/12,32 no shutdown!interface Vlan 200 no ip address tagged TengigabitEthernet 2/12,32

39Quality of Service (QoS)This chapter describes how to use and configure Quality of Service (QoS) features on the switch.Differentiated service is ac

• RFC 2597, Assured Forwarding PHB Group• RFC 2598, An Expedited Forwarding PHBYou cannot configure port-based and policy-based QoS on the same interf

NOTE: When you decrease the buffer size, the operating system deletes all messages stored in the buffer. Increasing the buffer size does not affect me

Honoring dot1p Priorities on Ingress TrafficBy default, the system does not honor dot1p priorities on ingress traffic.You can configure this feature o

Example of Configuring and Viewing Rate PolicingThe following example shows configuring rate policing.Dell#config tDell(conf)#interface tengigabitethe

Policy-Based QoS ConfigurationsPolicy-based QoS configurations consist of the components shown in the following example.Figure 94. Constructing Policy

Creating a Layer 3 Class MapA Layer 3 class map differentiates ingress packets based on the DSCP value, IP precedence, VLANs, or characteristics defin

The following example matches IPv6 traffic with a DSCP value of 40.Dell(conf)# class-map match-all test Dell(conf-class-map)# match ipv6 dscp 40The fo

Dell(conf)# interface fo 0/0 INTERFACE modeDell(conf-if-fo-0/0)# ip address 90.1.1.1/16 2. Configure a Layer 2 QoS policy with Layer 2 (Dot1p or sourc

6. Create an input policy map.CONFIGURATION modeDell(conf)#policy-map-input pp_policmap 7. Create a service queue to associate the class map and QoS p

class-map match-any ClassAF1 match ip access-group AF1-FB1 set-ip-dscp 10 match ip access-group AF1-FB2 set-ip-dscp 12 match ip dscp 10 set-ip-dscp

Create a QoS PolicyThere are two types of QoS policies — input and output.Input QoS policies regulate Layer 3 and Layer 2 ingress traffic. The regulat

to which you should apply the QoS policy (using the service-queue from POLICY-MAP-IN mode). If you apply the QoS policy to a queue other than the one

– uucp (UNIX to UNIX copy protocol)Example of the show running-config logging CommandTo view non-default settings, use the show running-config logging

Configuring Policy-Based Rate ShapingTo configure policy-based rate-shaping, use the rate-shape command.• Configure rate-shaping on egress traffic.QOS

Queue Default Bandwidth Percentage for 4–Queue SystemDefault Bandwidth Percentage for 8–Queue System7 — 50%When you assign a percentage to one queue,

Applying a Class-Map or Input QoS Policy to a QueueTo apply a class-map or input QoS policy to a queue, use the following command.• Assign an input Qo

Table 36. Default dot1p to Queue Mappingdot1p Queue ID0 21 02 13 34 45 56 67 7The dot1p value is also honored for frames on the default VLAN. For more

• You cannot apply a class-map and QoS policies to the same interface.• You cannot apply an input Layer 2 QoS policy on an interface you also configur

You can apply the same policy map to multiple interfaces, and you can modify a policy map after you apply it.DSCP Color MapsThis section describes how

qos dscp-color-policy color-map-name Example: Create a DSCP Color MapThe following example creates a DSCP color map profile, color-awareness policy, a

TE 0/10 mapONETE0/11 mapTWODisplay summary information about a color policy for a specific interface.Dell# show qos dscp-color-policy summa

Enabling Strict-Priority QueueingIn strict-priority queuing, the system de-queues all packets from the assigned queue before servicing any other queue

Figure 95. Packet Drop Rate for WREDYou can create a custom WRED profile or use one of the five pre-defined profiles.Table 37. Pre-Defined WRED Profil

• Add timestamp to syslog messages.CONFIGURATION modeservice timestamps [log | debug] [datetime [localtime] [msec] [show-timezone] | uptime]Specify th

Applying a WRED Profile to TrafficAfter you create a WRED profile, you must specify on which traffic the system applies the profile.The system assigns

Explicit Congestion NotificationExplicit Congestion Notification (ECN) enhances and extends WRED functionality by marking packets for later transmissi

• match ip vlanBy default, all packets are marked for green handling if the rate-police and trust-diffserv commands are not used in an ingress policy

ip access-list standard dscp_40 seq 5 permit any dscp 40ip access-list standard dscp_50_non_ecn seq 5 permit any dscp 50 ecn 0ip access-list standard

thresholds. You can configure different weights for WRED and ECN operation to finely tune how different types of traffic are handled when a WRED thres

Global Service-Pools for WRED with ECNYou can enable WRED with ECN to work with global service-pools. Global service pools that function as shared buf

Queue ConfigurationService-Pool ConfigurationWRED Threshold RelationshipQ threshold = Q-TService-pool threshold = SP-TExpected FunctionalityEnabled En

modeDell(conf)#service-pool wred green pool0 thresh-1 pool1 thresh-2Dell(conf)#service-pool wred yellow pool0 thresh-3 pool1 thresh-4Dell(conf)#servic

– Allowed — indicates that the policy-map can be applied because the estimated number of CAM entries is less or equal to the available number of CAM e

40Routing Information Protocol (RIP)The Routing Information Protocol (RIP) tracks distances or hop counts to nearby routers when establishing network

ftp-server username nairobi password 0 zanzibarDell#Configuring FTP Server ParametersAfter you enable the FTP server on the system, you can configure

Implementation InformationThe Dell Networking OS supports both versions of RIP and allows you to configure one version globally and the other version

Enabling RIP GloballyBy default, RIP is disabled on the switch.To enable RIP globally, use the following commands.1. Enter ROUTER RIP mode and enable

192.162.2.0/24 [120/1] via 29.10.10.12, 00:01:21, Fa 0/0192.162.2.0/24 auto-summary192.161.1.0/24 [120/1] via 29.10.10.12, 00:00:27, Fa 0/019

distribute-list prefix-list-name in• Assign a configured prefix list to all outgoing RIP routes.ROUTER RIP modedistribute-list prefix-list-name outTo

• Set the RIP versions received on that interface.INTERFACE modeip rip receive version [1] [2]• Set the RIP versions sent out on that interface.INTERF

Outgoing filter for all interfaces is Incoming filter for all interfaces is Default redistribution metric is 1 Default version control: receive v

Controlling Route MetricsAs a distance-vector protocol, RIP uses hop counts to determine the best route, but sometimes the shortest hop count is a rou

Dell#debug ip ripRIP protocol debug is ONDell#To disable RIP, use the no debug ip rip command.RIP Configuration ExampleThe examples in this section sh

Core 2 RIP OutputThe examples in the section show the core 2 RIP output.Examples of the show ip Command with Core 2 Output• To display Core 2 RIP data

To view the RIP configuration activity on Core 2, use the show ip protocols command.Core2#show ip protocolsRouting Protocol is "RIP" Sendin

ip ftp username nameTo view the FTP configuration, use the show running-config ftp command in EXEC privilege mode, as shown in the example for Enable

Examples of the show ip Command with Core 3 OutputTo view learned RIP routes on Core 3, use the show ip rip database command.Core3#show ip rip databas

10.11.20.0 10.11.30.0 192.168.2.0 192.168.1.0Routing Information Sources: Gateway Distance Last Update 10.11.20.2 120

!router ripversion 2network 10.11.20.0network 10.11.30.0network 192.168.1.0network 192.168.2.0672Routing Information Protocol (RIP)

41Remote Monitoring (RMON)Remote monitoring (RMON) is an industry-standard implementation that monitors network traffic by sharing network monitoring

Setting the RMON AlarmTo set an alarm on any MIB object, use the rmon alarm or rmon hc-alarm command in GLOBAL CONFIGURATION mode.• Set an alarm on an

is configured with the RMON event command. Possible events include a log entry or an SNMP trap. If the 1.3.6.1.2.1.2.2.1.20.1 value changes to 0 (fall

– integer: a value from 1 to 65,535 that identifies the RMON Statistics Table. The value must be unique in the RMON Statistic Table.– owner: (Optional

42Rapid Spanning Tree Protocol (RSTP)The Rapid Spanning Tree Protocol (RSTP) is a Layer 2 protocol — specified by IEEE 802.1w — that is essentially th

• All interfaces in virtual local area networks (VLANs) and all enabled interfaces in Layer 2 mode are automatically added to the RST topology.• Addin

Dell(conf-if-te-1/1)#show config!interface TenGigabitEthernet 1/1 no ip address switchportno shutdownEnabling Rapid Spanning Tree Protocol GloballyE

localPrompt for the system username and password.noneDo not authenticate the user.radiusPrompt for a username and password and use a RADIUS server to

Figure 97. Rapid Spanning Tree Enabled GloballyTo view the interfaces participating in RSTP, use the show spanning-tree rstp command from EXEC privile

BPDU : sent 121, received 2The port is not in the Edge port modePort 379 (TengigabitEthernet 2/3) is designated ForwardingPort path cost 20000, Port p

Modifying Global ParametersYou can modify RSTP parameters.The root bridge sets the values for forward-delay, hello-time, and max-age and overwrites th

• Change the max-age parameter.PROTOCOL SPANNING TREE RSTP modemax-age secondsThe range is from 6 to 40.The default is 20 seconds.To view the current

Influencing RSTP Root SelectionRSTP determines the root bridge, but you can assign one bridge a lower priority to increase the likelihood that it is s

– Disable the shutdown-on-violation command on the interface (the no spanning-tree stp-id portfast [bpduguard | [shutdown-on-violation]] command).– Di

NOTE: The hello time is encoded in BPDUs in increments of 1/256ths of a second. The standard minimum hello time in seconds is 1 second, which is encod

43SecurityThis chapter describes several ways to provide access security to the Dell Networking system.For details about all the commands described in

allows you to change permissions based on the role. You can modify the permissions specific to that command and/or command option. For more informatio

For consistency, the best practice is to define the same authorization method list across all lines, in the same order of comparison; for example VTY

• Return to the default time-out values.LINE modeno exec-timeoutExample of Setting the Time Out Period for EXEC Privilege ModeThe following example sh

Role Modes netoperator netadmin

Example of Creating a User RoleThe configuration in the following example creates a new user role, myrole, which inherits the security administrator (

The following example denies the netadmin role from using the show users command and then verifies that netadmin cannot access the show users command

Dell(conf)#role configure deleterole secadmin line Dell(conf)#do show role mode ?configure Global configuration mode

This section contains the following AAA Authentication and Authorization for Roles configuration tasks:• Configuring AAA Authentication for Roles• Con

Examples of Applying a Method List The following configuration example applies a method list: TACACS+, RADIUS and local:!radius-server host 10.16.150.

accounting commands role netadmin ucraaa!Configuring TACACS+ and RADIUS VSA Attributes for RBACFor RBAC and privilege levels, the Dell Networking OS R

Configuring AAA Accounting for RolesTo configure AAA accounting for roles, use the aaa accounting command in CONFIGURATION mode.aaa accounting {system

• Displaying Active Accounting Sessions for RolesDisplaying User RolesTo display user roles using the show userrole command in EXEC Privilege mode, us

AAA AccountingAccounting, authentication, and authorization (AAA) accounting is part of the AAA security model.For details about commands related to A

Weight...153Loc

Lock CONFIGURATION ModeThe system allows multiple users to make configurations at the same time. You can lock CONFIGURATION mode so that only one user

Suppressing AAA Accounting for Null Username SessionsWhen you activate AAA accounting, the system issues accounting records for all users on the syste

Monitoring AAA AccountingThe system does not support periodic interim accounting because the periodic command can cause heavy congestion when many use

For a complete list of all commands related to login authentication, refer to the Security chapter in the Dell Networking OS Command Reference Guide.C

Enabling AAA AuthenticationTo enable AAA authentication, use the following command.• Enable AAA authentication.CONFIGURATION modeaaa authentication en

Server-Side ConfigurationUsing AAA authentication, the switch acts as a RADIUS or TACACS+ client to send authentication requests to a TACACS+ or RADIU

enable command. If you move between privilege levels, you are prompted for a password if you move to a higher privilege level.Configuration Task List

– level level: Specify a level from 0 to 15. Level 15 includes all levels.– encryption-type: Enter 0 for plain text or 7 for encrypted text.– password

CONFIGURATION modeprivilege mode {level level command | reset command}Configure the following required and optional parameters:• mode: enter a keyword

Dell#?configure Configuring from terminaldisable Turn off privileged commandsenable Turn on privileged commandsexit Exit

– level-number: The level-number you wish to set.If you enter disable without a level-number, your security level is 1.Resetting a PasswordTo reset a

Recovering from a Forgotten Password on the Z9500If you configure authentication for the console and you exit out of EXEC mode or your console session

Idle TimeEvery session line has its own idle-time. If the idle-time value is not changed, the default value of 30 minutes is used.RADIUS specifies idl

• Specifying a RADIUS Server Host (mandatory)• Setting Global Communication Parameters for all RADIUS Server Hosts (optional)• Monitoring RADIUS (opti

authorization exec methodlistSpecifying a RADIUS Server HostWhen configuring a RADIUS server host, you can set different communication parameters, suc

– seconds: the range is from 0 to 2147483647. The default is 0 seconds.• Configure a key for all RADIUS communications between the system and RADIUS s

Choosing TACACS+ as the Authentication MethodOne of the login authentication methods available is TACACS+ and the user’s name and password are sent fo

aaa authorization commands 15 default tacacs+ noneaaa accounting exec default start-stop tacacs+aaa accounting commands 1 default start-stop tacacs+aa

Dell(conf)#aaa authentication exec tacacsauthorization tacacs+Dell(conf)#tacacs-server host 25.1.1.2 key Force10Dell(conf)#Dell(conf)#line vty 0 9Dell

If rejected by the AAA server, the command is not added to the running config, and a message displays:04:07:48: %SYSTEM-P:CP %SEC-3-SEC_AUTHORIZATION_

Dell(conf)#ip ssh server version 2Dell(conf)#do show ip sshSSH server : disabled.SSH server version : v2.Password Authentication

• show crypto: display the public part of the SSH host-keys.• show ip ssh client-pub-keys: display the client public keys used in host-based authentic

Recovering from a Failed Start on the Z9500A switch that does not start correctly might be trying to boot from a corrupted Dell Networking OS image or

Configuring the SSH Server Cipher ListTo configure the cipher list supported by the SSH server, use the ip ssh server ciphers cipher-list command in C

• hmac-sha2-256-96When FIPS is enabled, the default HMAC algorithm is hmac-sha1-96.Example of Configuring a HMAC AlgorithmThe following example shows

• The files known_hosts and known_hosts2 are generated when a user tries to SSH using version 1 or version 2, respectively.Enabling SSH Authentication

Your identification has been saved in /home/admin/.ssh/id_rsa.Your public key has been saved in /home/admin/.ssh/id_rsa.pub.Configuring Host-Based SSH

The following example shows creating rhosts.admin@Unix_client# lsid_rsa id_rsa.pub rhosts shostsadmin@Unix_client# cat rhosts10.16.127.201 adminUsing

VTY Line and Access-Class ConfigurationVarious methods are available to restrict VTY access in the Dell Networking OS. These depend on which authentic

Example of Configuring VTY Authorization Based on Access Class Retrieved from a Local Database (Per User)Dell(conf)#user gooduser password abc privile

Dell(config-line-vty)#access-class sourcemacDell(config-line-vty)#endSecurity727

44Service Provider BridgingService provider bridging provides the ability to add a second VLAN ID tag in an Ethernet frame and is referred to as VLAN

Figure 98. VLAN Stacking in a Service Provider NetworkImportant Points to Remember• Interfaces that are members of the Default VLAN and are configured

* After restoration the unit(s) will be powercycled immediately. * * Proceed with caution ! *

Configure VLAN StackingConfiguring VLAN-Stacking is a three-step process.1. Creating Access and Trunk Ports2. Assign access and trunk ports to a VLAN

!interface TenGigabitEthernet 2/12 no ip address switchport vlan-stack trunk no shutdownEnable VLAN-Stacking for a VLANTo enable VLAN-Stacking for

To configure trunk ports, use the following commands.1. Configure a trunk port to carry untagged, single-tagged, and double-tagged traffic by making i

Example of Debugging a VLAN and its PortsThe port notations are as follows:• MT — stacked trunk• MU — stacked access port• T — 802.1Q trunk port• U —

Therefore, a mismatched TPID results in the port not differentiating between tagged and untagged traffic.Figure 99. Single and Double-Tag TPID Match73

Figure 100. Single and Double-Tag First-byte TPID MatchService Provider Bridging735

Figure 101. Single and Double-Tag TPID MismatchVLAN Stacking Packet Drop PrecedenceVLAN stacking packet-drop precedence is supported on the switch.The

Table 43. Drop Eligibility BehaviorIngress Egress DEI Disabled DEI EnabledNormal Port Normal Port Retain CFI Set CFI to 0.Trunk Port Trunk Port Retain

Marking Egress Packets with a DEI ValueOn egress, you can set the DEI value according to a different mapping than ingress.For ingress information, ref

• Option 1: Mark the S-Tag dot1p and queue the frame according to the original C-Tag dot1p. In this case, you must have other dot1p QoS configurations

2. When prompted by the system, press the Esc key to abort the boot process.You are placed in the boot-line interface (BLI) at the BOOT_USER # prompt.

service-policy input in layer2 no shutdownMapping C-Tag to S-Tag dot1p ValuesTo map C-Tag dot1p values to S-Tag dot1p values and mark the frames ac

Figure 103. VLAN Stacking without L2PTYou might need to transport control traffic transparently through the intermediate network to the other region.

Figure 104. VLAN Stacking with L2PTImplementation Information• L2PT is available for STP, RSTP, MSTP, and PVST+ BPDUs.• No protocol packets are tunnel

show cam-profile2. Enable protocol tunneling globally on the system.CONFIGURATION modeprotocol-tunnel enable3. Tunnel BPDUs the VLAN.INTERFACE VLAN mo

The range is from 64 to 320 kbps.Debugging Layer 2 Protocol TunnelingTo debug Layer 2 protocol tunneling, use the following command.• Display debuggin

45sFlowsFlow is a standard-based sampling technology embedded within switches and routers which is used to monitor network traffic. It is designed to

Important Points to Remember• The Dell Networking OS implementation of the sFlow MIB supports sFlow configuration via snmpset.• Dell Networking recomm

sFlow Show CommandsYou can display sFlow statistics at the switch, interface, and line card level.• Displaying Show sFlow Globally• Displaying Show sF

Samples rcvd from h/w :33Samples dropped for sub-sampling :6The following example shows the show running-config interface command.Dell#show

To configure the polling intervals globally (in CONFIGURATION mode) or by interface (in INTERFACE mode), use the following command.• Change the global

5802.1X802.1X is a method of port security. A device connected to a port that is enabled with 802.1X is disallowed from sending or receiving packets o

Examples of Verifying Extended sFlowThe bold line shows that extended sFlow settings are enabled on all three types.Dell#show sflowsFlow services are

IP SA IP DA srcAS and srcPeerASdstAS and dstPeerASDescriptioninformation for IGP.BGP static/connected/IGP—Exported—ExportedThe system allows extended

46Simple Network Management Protocol (SNMP)The Simple Network Management Protocol (SNMP) is designed to manage devices on IP networks by monitoring de

Related Configuration Tasks• Managing Overload on Startup• Reading Managed Object Values• Writing Managed Object Values• Subscribing to Managed Object

• Choose a name for the community.CONFIGURATION modesnmp-server community name {ro | rw}Example of Creating an SNMP CommunityTo view your SNMP configu

• Configure an SNMPv3 view.CONFIGURATION modesnmp-server view view-name 3 noauth {included | excluded}NOTE: To give a user read and write privileges,

Examples of Reading Managed Object ValuesIn the following example, the value “4” displays in the OID before the IP address for IPv4. For an IPv6 IP ad

snmp-server contact textYou may use up to 55 characters.The default is None.• (From a Dell Networking system) Identify the physical location of the sy

snmp-server host ip-address [traps | informs] [version 1 | 2c |3] [community-string]To send trap messages, enter the keyword traps.To send information

TASK SUSPENDED: SUSPENDED - svce:%d - inst:%d - task:%s SYSTEM-P:CP %CHMGR-2-CARD_PARITY_ERR ABNORMAL_TASK_TERMINATION: CRASH - task:%s %s CPU_TH

Figure 3. EAP Frames Encapsulated in Ethernet and RADUISThe authentication process involves three devices:• The device attempting to access the networ

%ECFM-5-ECFM_RDI_ALARM: RDI Defect detected by MEP 3 in Domain customer1 at Level 7 VLAN 1000entity Enable entity change traps Trap SNMPv2-MIB::s

MIB Object OID Object Values Descriptionand copySrcFileName.copySrcFileLocation .1.3.6.1.4.1.6027.3.5.1.1.1.1.31 = flash2 = slot03 = tftp4 = ftp5 = sc

MIB Object OID Object Values DescriptioncopyServerAddress .1.3.6.1.4.1.6027.3.5.1.1.1.1.8IP Address of the server. The IP address of the server.• If y

• -c: View the community, either public or private.• -m: View the MIB files for the SNMP command.• -r: Number of retries using the option• -t: View th

FTOS-COPY-CONFIG-MIB::copySrcFileType.7 = INTEGER: runningConfig(3)FTOS-COPY-CONFIG-MIB::copyDestFileType.7 = INTEGER: startupConfig(2)The following e

Copy a Binary File to the Startup-ConfigurationTo copy a binary file from the server to the startup-configuration on the Dell Networking system via FT

MIB Object OID Values Description7 = unknowncopyEntryRowStatus .1.3.6.1.4.1.6027.3.5.1.1.1.1.15Row status Specifies the state of the copy operation. U

Manage VLANs using SNMPThe qBridgeMIB managed objects in Q-BRIDGE-MIB, defined in RFC 2674, allows you to use SNMP to manage VLANs.Creating a VLANTo c

In the following example, Port 0/2 is added as an untagged member of VLAN 10.Example of Adding an Untagged Port to a VLAN using SNMP>snmpset -v2c -

The following OIDs are configurable through the snmpset command.The node OID is 1.3.6.1.4.1.6027.3.18F10-ISIS-MIB::f10IsisSysOloadSetOverloadF10-ISIS-

4. The authentication server replies with an Access-Challenge frame. The Access-Challenge frame requests that the supplicant prove that it is who it c

Fetch Dynamic MAC Entries using SNMPDell Networking supports the RFC 1493 dot1d table for the default VLAN and the dot1q table for all other VLANs.NOT

Example of Fetching MAC Addresses Learned on a Non-default VLAN Using SNMPIn the following example, TenGigabitEthernet 1/21 is moved to VLAN 1000, a n

Starting from the least significant bit (LSB) in the preceding figure:• The first 14 bits represent the card type of a physical interface or the inter

SNMPv2-SMI::enterprises.6027.3.2.1.1.1.1.3.2 = INTEGER: 1107755010SNMPv2-SMI::enterprises.6027.3.2.1.1.1.1.4.1 = INTEGER: 1SNMPv2-SMI::enterprises.602

Troubleshooting SNMP OperationWhen you use SNMP to retrieve management data from an SNMP agent on a Dell Networking router, take into account the foll

47Storm ControlStorm control allows you to control unknown-unicast and broadcast traffic on Layer 2 and Layer 3 physical interfaces.Dell Networking OS

48Spanning Tree Protocol (STP)The spanning tree protocol (STP) is a Layer 2 protocol — specified by IEEE 802.1d — that eliminates loops in a bridged t

• The Dell Networking OS supports only one spanning tree instance (0). For multiple instances, enable the multiple spanning tree protocol (MSTP) or pe

INTERFACE modeno ip address2. Place the interface in Layer 2 mode.INTERFACEswitchport3. Enable the interface.INTERFACE modeno shutdownExample of the s

Figure 106. Spanning Tree Enabled GloballyTo enable STP globally, use the following commands.1. Enter PROTOCOL SPANNING TREE mode.CONFIGURATION modepr

Figure 5. EAP Over RADIUSRADIUS Attributes for 802.1 SupportDell Networking systems include the following RADIUS attributes in all 802.1X-triggered Ac

To view the spanning tree configuration and the interfaces that are participating in STP, use the show spanning-tree 0 command from EXEC privilege mod

spanning-tree 0To remove a Layer 2 interface from the spanning tree topology, enter the no spanning-tree 0 command.Modifying Global ParametersYou can

the default is 2 seconds.• Change the max-age parameter (the refresh interval for configuration information that is generated by recomputing the spann

only implement bpduguard, although the interface is placed in an Error Disabled state when receiving the BPDU, the physical interface remains up and s

• If the interface to be shut down is a port channel, all the member ports are disabled in the hardware.• When you add a physical port to a port chann

• disables spanning tree on an interface• drops all BPDUs at the line card without generating a console messageExample of Blocked BPDUsDell(conf-if-te

Root Bridge hello time 2, max age 20, forward delay 15Dell#STP Root GuardUse the STP root guard feature in a Layer 2 network to avoid bridging loops

Figure 108. STP Root Guard Prevents Bridging LoopsConfiguring Root GuardEnable STP root guard on a per-port or per-port-channel basis.Dell Networking

INTERFACE mode or INTERFACE PORT-CHANNEL modespanning-tree {0 | mstp | rstp | pvst} rootguard– 0: enables root guard on an STP-enabled port assigned t

As soon as a BPDU is received on an STP port in a Loop-Inconsistent state, the port returns to a blocking state. If you disable STP loop guard on a po

• 802.1X is not supported on port-channels or port-channel members.Enabling 802.1XEnable 802.1X globally.Figure 6. 802.1X Enabled1. Enable 802.1X glob

– Rapid Spanning Tree Protocol (RSTP)– Multiple Spanning Tree Protocol (MSTP)– Per-VLAN Spanning Tree Plus (PVST+)• You cannot enable root guard and l

Te 0/2 0 LIS LoopguardTe 0/3 0 EDS (Shut) BpduguardSpanning Tree Protocol (STP)791

49System Time and DateSystem time and date settings are user-configurable and maintained through the network time protocol (NTP).System times and date

Following conventions established by the telephone industry [BEL86], the accuracy of each server is defined by a number called the stratum, with the t

Related Configuration Tasks• Configuring NTP Broadcasts• Setting the Hardware Clock with the Time Derived from NTP• Disabling NTP on an Interface• Con

R5/R8(conf)#do show calendar12:24:11 UTC Thu Mar 12 2009Configuring NTP BroadcastsThe switch can receive broadcasts of time information.You can set in

To view the configuration, use the show running-config ntp command in EXEC privilege mode (refer to the example in Configuring NTP Authentication).Con

(192.168.1.1) ref CD7F4F63.6BE8F000 (14:51:15.421 UTC Thu Apr 2 2009) org CD7F4F63.68000000 (14:51:15.406 UTC Thu Apr 2 2009) rec CD7F4F63.6BE8F000

NOTE: • Leap Indicator (sys.leap, peer.leap, pkt.leap) — This is a two-bit code warning of an impending leap second to be inserted in the NTP time sca

Time and DateYou can set the time and date in the Dell Networking OS using the CLI.Configuration Task List The following is a configuration task list

Configuring BGP Route Reflectors... 191Aggregating Routes...

Examples of Verifying that 802.1X is Enabled Globally or on an InterfaceVerify that 802.1X is enabled globally and at the interface level using the sh

– month: enter the name of one of the 12 months in English. You can enter the name of a day to change the order of the display to time day month year.

– start-month: enter the name of one of the 12 months in English. You can enter the name of a day to change the order of the display to time day month

– start-year: Enter a four-digit number as the year. The range is from 1993 to 2035.– start-time: Enter the time in hours:minutes. For the hour variab

50Tunneling Tunnel interfaces create a logical tunnel for IPv4 or IPv6 traffic. Tunneling supports RFC 2003, RFC 2473, and 4213.DSCP, hop-limits, flow

ipv6 address 2::1/64tunnel destination 90.1.1.1tunnel source 60.1.1.1tunnel mode ipv6ip no shutdownThe following sample configuration shows a tunnel c

Configuring a Tunnel InterfaceYou can configure the tunnel interface using the ip unnumbered and ipv6 unnumbered commands.To configure the tunnel inte

Configuring Tunnel source anylocal DecapsulationThe tunnel source anylocal command allows a multipoint receive-only tunnel to decapsulate tunnel packe

• IP tunnel interfaces are supported over ECMP paths to the next hop. ECMP paths over IP tunnel interfaces are supported. ARP and neighbor resolution

51Upgrade ProceduresFor detailed upgrade procedures, refer to the Dell Networking OS Release Notes for your switch. The release notes describe the req

local flash. This image contains independent images for the CPUs: Control Processor (CP), Route Processor (RP), and line-card processor (LP). Each sep

To configure re-transmissions, use the following commands.• Configure the amount of time that the authenticator waits before re-transmitting an EAP Re

52Uplink Failure Detection (UFD)Uplink failure detection (UFD) provides detection of the loss of upstream connectivity and, if used with network inter

Figure 111. Uplink Failure DetectionHow Uplink Failure Detection WorksUFD creates an association between upstream and downstream interfaces. The assoc

Figure 112. Uplink Failure Detection ExampleIf only one of the upstream interfaces in an uplink-state group goes down, a specified number of downstrea

– An uplink-state group is considered to be operationally down if it has no upstream interfaces in the Link-Up state. No uplink-state tracking is perf

• Port channel: enter port-channel {1-512 | port-channel-range}Where port-range and port-channel-range specify a range of ports separated by a dash (-

Clearing a UFD-Disabled InterfaceYou can manually bring up a downstream interface in an uplink-state group that UFD disabled and is in a UFD-Disabled

02:37:29: %SYSTEM-P:CP %IFMGR-5-ASTATE_DN: Changed interface Admin state to down: Te 0/47 02:37:29: %SYSTEM-P:CP %IFMGR-5-OSTATE_DN: Changed interf

If a downstream interface in an uplink-state group is disabled (Oper Down state) by uplink-state tracking because an upstream port is down, the messag

Interface index is 280544512Internet address is not setMTU 1554 bytes, IP MTU 1500 bytesLineSpeed 1000 Mbit, Mode autoFlowcontrol rx off tx offARP typ

• Add a text description for the group.• Verify the configuration with various show commands.Example of Configuring UFD (S50)Dell(conf)# uplink-state-

The bold lines show the new re-transmit interval, new quiet period, and new maximum re-transmissions.Dell(conf-if-range-Te-0/0)#dot1x tx-period 90Dell

53Virtual LANs (VLANs)Virtual LANs (VLANs) are a logical broadcast domain or logical grouping of interfaces in a local area network (LAN) in which all

By default, VLAN 1 is the Default VLAN. To change that designation, use the default vlan-id command in CONFIGURATION mode. You cannot delete the Defau

preserved as the frame moves through the network. The following example shows the structure of a frame with a tag header. The VLAN ID is inserted in t

• Configure a port-based VLAN (if the VLAN-ID is different from the Default VLAN ID) and enter INTERFACE VLAN mode.CONFIGURATION modeinterface vlan vl

The following example shows the steps to add a tagged interface (in this case, port channel 1) to VLAN 4. To view the interface’s status. Interface (p

INTERFACE modeuntagged interfaceThis command is available only in VLAN interfaces.Move an Untagged Interface to Another VLANThe no untagged interface

Assigning an IP Address to a VLANVLANs are a Layer 2 feature. For two physical interfaces on different VLANs to communicate, you must assign an IP add

INTERFACE mode2. Configure the interface for Hybrid mode.INTERFACE modeportmode hybrid3. Configure the interface for Switchport mode.INTERFACE modeswi

54Virtual Link Trunking (VLT)Virtual link trunking (VLT) allows physical links between two chassis to appear as a single virtual link to the network c

Figure 114. Example of VLT DeploymentVLT on Core SwitchesYou can also deploy VLT on core switches.Uplinks from servers to the access layer and from ac

-----------------------------Dot1x Status: EnablePort Control: FORCE_AUTHORIZEDPort Auth Status: UNAUTHORIZEDRe-Authentication:

Figure 115. Enhanced VLTVLT TerminologyThe following are key VLT terms.• Virtual link trunk (VLT) — The combined port channel between an attached devi

Configure Virtual Link TrunkingVLT requires that you enable the feature and then configure the same VLT domain, backup link, and VLT interconnect on b

If this scenario occurs, use the clear mac-address-table sticky all command on the primary or secondary peer to correctly sync the MAC addresses.• If

– ARP entries configured across the VLTi are the same on both VLT peer nodes.– If you shut down the port channel used in the VLT interconnect on a pee

– VLT supports port-channel links with LACP between access switches and VLT peer switches. Dell Networking recommends using static port channels on VL

master and backup roles. Each peer actively forwards L3 traffic, reducing the traffic flow over the VLT interconnect.– VRRP elects the router with the

associated with the VLT domain. If heartbeat messages are not received, the Secondary Peer forwards traffic assumes the role of the Primary Peer. If t

VLT and IGMP SnoopingWhen configuring IGMP Snooping with VLT, ensure the configurations on both sides of the VLT trunk are identical to get the same b

Figure 116. PIM-Sparse Mode Support on VLTOn each VLAN where the VLT peer nodes act as the first hop or last hop routers, one of the VLT peer nodes is

To route traffic to and from the multicast source and receiver, enable PIM on the L3 side connected to the PIM router using the ip pim sparse-mode com

Port Control: FORCE_AUTHORIZEDPort Auth Status: UNAUTHORIZEDRe-Authentication: EnableUntagged VLAN id: NoneTx Period:

Layer 3 on the other node. Configuration mismatches are logged in the syslog and display in the show vlt mismatch command output.If you enable VLT uni

Important Points to Remember• You cannot configure a VLT node as a rendezvous point (RP), but any PIM-SM compatible VLT node can serve as a designated

RSTP ConfigurationRSTP is supported in a VLT domain.Before you configure VLT on peer switches, configure RSTP in the network. RSTP is required for ini

In the case of a primary VLT switch failure, the secondary switch starts sending BPDUs with its own bridge ID and inherits all the port states from th

no ip address3. Add one or more port interfaces to the port channel.INTERFACE PORT-CHANNEL modechannel-member interfaceinterface: specify one of the f

lacp ungroup member-independent {vlt | port-channel port-channel-id}LACP on VLT ports (on a VLT switch or access device), which are members of the vir

Reconfiguring the Default VLT Settings (Optional) To reconfigure the default VLT settings, use the following commands.1. Enter VLT-domain configuratio

Connecting a VLT Domain to an Attached Access Device (Switch or Server)To connect a VLT domain to an attached access device, use the following command

Configuring a VLT VLAN Peer-Down (Optional)To configure a VLT VLAN peer-down, use the following commands.1. Enter VLT-domain configuration mode for a

vlt domain domain-idThe range of domain IDs is from 1 to 1000.4. Enter the port-channel number that acts as the interconnect trunk.VLT DOMAIN CONFIGUR

Guest VLAN: DisableGuest VLAN id: NONEAuth-Fail VLAN: DisableAuth-Fail VLAN id: NONEAuth-Fail Max-Attempts: NON

9. Place the interface in Layer 2 mode.INTERFACE PORT-CHANNEL modeswitchport10. Associate the port channel to the corresponding port channel in the VL

interface port-channel port-channel idNOTE: To benefit from the protocol negotiations, Dell Networking recommends configuring VLTs used as facing host

Configure the VLT domain with the same ID in VLT peer 1 and VLT peer 2.Dell-2(conf)#vlt domain 5Dell-2(conf-vlt-domain)#Dell-4(conf)#vlt domain 5Dell-

! port-channel-protocol LACP port-channel 2 mode active no shutdownDell-2#show running-config interface port-channel 2!interface Port-channel 2

Role Priority: 32768 ICL Link Status: Up HeartBeat Status: Up VLT Peer Status: Up Local System MAC addr

eVLT Configuration Step ExamplesIn Domain 1, configure the VLT domain and VLTi on Peer 1.Domain_1_Peer1#configureDomain_1_Peer1(conf)#interface port-c

In Domain 2, configure the VLT domain and VLTi on Peer 3.Domain_2_Peer3#configureDomain_2_Peer3(conf)#interface port-channel 1Domain_2_Peer3(conf-if-p

PIM-Sparse Mode Configuration ExampleThe following sample configuration shows how to configure the PIM Sparse mode designated router functionality on

EXEC modeshow vlt brief• Display detailed information about the VLT-domain configuration, including local and peer port-channel IDs, local VLT switch

VLT Backup Link-----------------Destination: 10.11.200.20Peer HeartBeat status: UpHeartBeat Timer Interval: 1HeartBeat Timeou

Figure 7. Dynamic VLAN Assignment1. Configure 8021.x globally (refer to Enabling 802.1X) along with relevant RADIUS server configurations (refer to th

The following example shows the show vlt role command.Dell_VLTpeer1# show vlt roleVLT Role----------VLT Role: PrimarySystem MAC addr

The bold section displays the RSTP state of port channels in the VLT domain. Port channel 100 is used in the VLT interconnect trunk (VLTi) to connect

Configure the backup link.Dell_VLTpeer1(conf)#interface ManagementEthernet 0/0Dell_VLTpeer1(conf-if-ma-0/0)#ip address 10.11.206.23/Dell_VLTpeer1(conf

Configure the VLT interconnect (VLTi).Dell_VLTpeer2(conf)#interface port-channel 100Dell_VLTpeer2(conf-if-po-100)#no ip addressDell_VLTpeer2(conf-if-p

Table 50. Troubleshooting VLTDescription Behavior at Peer Up Behavior During Run TimeAction to TakeBandwidth monitoring A syslog error message and an

Description Behavior at Peer Up Behavior During Run TimeAction to TakeA syslog error message is generated.A syslog error message is generated.if Peer

identified by a primary and secondary VLAN pair. With VLT being a Layer 2 redundancy mechanism, support for configuration of VLT nodes in a PVLAN enab

validated to cause the VLTi to be a member of that VLAN. Whenever a change in the VLAN mode on one of the peers occurs, the information is synchronize

port mode mismatches occur. Also, you can view these discrepancies if any occur by using the show vlt mismatch command.Interoperation of VLT Nodes in

VLT LAG Mode PVLAN Mode of VLT VLAN ICL VLAN MembershipMac SynchronizationPeer1 Peer2 Peer1 Peer2- Secondary (Community)- Secondary (Isolated)No NoAcc

If the supplicant fails authentication, the authenticator typically does not enable the port. In some cases this behavior is not appropriate. External

Configuring a VLT VLAN or LAG in a PVLANYou can configure the VLT peers or nodes in a private VLAN (PVLAN). Because the VLT LAG interfaces are termina

VLT DOMAIN CONFIGURATION modepeer-link port-channel id-numberThe range is from 1 to 128.8. (Optional) To configure a VLT LAG, enter the VLAN ID number

INTERFACE VLAN modeprivate-vlan mapping secondary-vlan vlan-listThe list of secondary VLANs can be:• Specified in comma-delimited (VLAN-ID,VLAN-ID) or

performed only when the VLT peer's MAC address is installed in the database. Proxy ARP is stopped when the VLT peer's MAC address is removed

synchronized from the VLT peer, after the RP starts receiving multicast traffic via these routes, these (S, G) routes are considered valid and are dow

55VLT Proxy GatewayYou can configure a proxy gateway in VLT domains. A proxy gateway enables you to locally route the packets that are destined to a L

When the routing table across DCs is not symmetrical, there is a possibility of a routing miss by a DC that do not have the route for the L3 traffic.

8. LLDP port channel interface can’t be changed to legacy lag when proxy gateway is enabled.9.“vlt-peer-mac transmit” is recommended only for square V

• There are only a couple of MACs for each unit to be transmitted so that all current active MACs can definitely be carried on the newly defined TLV.•

2. Trace route across VLT domains may show extra hops.3. IP route symmetry must be maintained across the VLT domains. Assume if the route to a destina

!interface TenGigabitEthernet 2/1 switchport dot1x authentication dot1x guest-vlan 200no shutdownDell(conf-if-Te-2/1)#Dell(conf-if-Te-2/1)#dot1x au

8. Packet duplication – Assume exclude-vlan (say VLAN 10) is configured on C2/D2 for C1’s MAC. If packets for VLAN 10 with C1’s MAC get a hit at C2, t

56Virtual Router Redundancy Protocol (VRRP)Virtual router redundancy protocol (VRRP) is designed to eliminate a single point of failure in a staticall

Figure 118. Basic VRRP ConfigurationVRRP BenefitsWith VRRP configured on a network, end-station connectivity to the network is not subject to a single

decreases based on the dynamics of the network, the advertisement intervals may increase or decrease accordingly.CAUTION: Increasing the advertisement

• Create a virtual router for that interface with a VRID.INTERFACE modevrrp-group vridThe VRID range is from 1 to 255.NOTE: The interface must already

You can use the version both command in INTERFACE mode to migrate from VRRPv2 to VRRPv3. When you set the VRRP version to both, the switch sends only

group and the interface’s physical MAC address is changed to that of the owner VRRP group’s MAC address.• If you configure multiple VRRP groups on an

Virtual MAC address: 00:00:5e:00:01:6fVirtual IP address: 10.10.10.1 10.10.10.2 10.10.10.3 10.10.10.10Authentication: (none)------------------TenGig

TenGigabitEthernet 1/2, VRID: 111, Net: 10.10.2.1State: Master, Priority: 125, Master: 10.10.2.1 (local)Hold Down: 0 sec, Preempt: TRUE, AdvInt: 1 sec