Troubleshoot LEDs In order to troubleshoot switches on the basis of LED information,       refer to the documentation on these devices: Catalyst           2900XL Catalyst           3500XL Troubleshoot and Understand POST Failure Messages Each time you power up the switch, eight Power-On Self Tests (POSTs)       run automatically. POSTs check the most important system components before the       switch begins to forward packets. When the switch begins the POST, the port       status LEDs display amber for two seconds, and then display green. As each test       runs, the port status LEDs go out. 1x is the first to go out. The port status       LEDs for ports 2x through 8x go out sequentially as the system completes a       test. When the POST completes successfully, the port status LEDs go out. This       indicates that the switch is operational. If a test fails, the port status LED       associated with the test displays amber. The system LED also displays       amber. Note: From Cisco IOS Software Release 11.2(8.5)SA6 onwards, the port and           system LEDs both remain amber after a POST failure. In the earlier Cisco IOS           Software Releases, only the LEDs of failed linked ports remained amber. This table shows the LED and the component of the switch to which the       LED corresponds: LED Components Tested 1x DRAM 2x Flash memory 3x Switch CPU 4x System board 5x CPU interface Application-Specific Integrated Circuit                     (ASIC) 6x Switch core ASIC 7x Ethernet controller ASIC 8x Ethernet interfaces At the time of the switch bootup sequence (cold start or through the       reload command), monitor the POST tests as they run       through a console connection to the switch. Here is an example:    !--- Output is suppressed.  C2900 POST: System Board Test: Passed   C2900 POST: CPU Buffer Test: Passed   C2900 POST: CPU Notify RAM Test: Passed   C2900 POST: CPU Interface Test: Passed   C2900 POST: Testing Switch Core: Passed   C2900 POST: Testing Buffer Table: Passed   C2900 POST: Data Buffer Test: Passed   C2900 POST: Configuring Switch Parameters: Passed   C2900 POST: Ethernet Controller Test: Passed   C2900 POST FAILURE: front-end post: FastEthernet0/2:   C2900 POST FAILURE: looped-back packet not received   C2900 POST FAILURE: front-end post: FastEthernet0/4:   C2900 POST FAILURE: looped-back packet not received  C2900 POST: MII Test: Passed   !--- Output is suppressed. This output shows one example of a failure on a Catalyst 2900XL switch       at the time of the bootup sequence. Alternatively, you can issue the show post command when the system runs, in order to see if any port had failed a POST       test. This command, available in Cisco IOS Software Release 11.2(8.5)SA6,       checks if the POST tests passed. If there is a failure, this command determines       which POST test failed. This command is useful when you are able to get a link       on a particular port, or the port LED is amber. For example, here is an output       from a Catalyst 2900XL which failed a POST test on FastEthernet interface       0/19: 2900XL# show postPOST FAILED: FastEthernet0/19 failed front-end loopback test When there is no POST failure, you see this output. This output is       captured from a Catalyst 3500XL switch: 3512xl#show postPassed See the Common Reasons and Solutions section for more information on POST failure messages. Common Reasons and Solutions A POST failure usually indicates physical damage to the interface. If       an Ethernet Controller that controls four interfaces fails, those ports fail       too. A common cause of such damage is ESD. For Catalyst 2900XL switches, the       issue is documented in Cisco bug ID       CSCdm13915 (registered customers only)         . Failure of any of these diagnostic tests is normally fatal and usually       requires a Return Material Authorization (RMA) to resolve the problem. In order       to verify this, reset the switch with a console connection established and       capture the actual bootup diagnostic information. Then open a service request       with       Cisco       Technical Support. Troubleshoot Fan Failures Perform these actions if you suspect a fan failure: Check the LEDs. If all of the LEDs are off, check the power to the             switch. The fan can fail due to a power problem. Check the system LED. The system LED is amber if the system detects             a problem, and can indicate a fan problem if you cannot hear the fan in             operation. If you use a Catalyst 3524-PWR-XL, issue the show env             fan command to check the fan for failure. Troubleshoot System Error Messages System messages report any errors that the switch encounters. System       messages can appear in the command line interface (CLI) while you are connected       to the switch (through the console or Telnet). Syslogs are also recorded in the       system message log of the switch. In order to view the system message log,       issue the show logging command. Refer to       System       Messages for syslog error message explanations and actions. Troubleshoot High CPU After you issue the show processes cpu command, the Catalyst 2900XL and Catalyst 3500XL switches report a high value       for CPU utilization when idle. With other Cisco devices, high CPU utilization       when idle is a cause for concern. However, such utilization is normal for       Catalyst 2900XL and 3500XL switches. Refer to       High       CPU Utilization on Catalyst 2900XL/3500XL Switches for more       information. Troubleshoot high Memory utilization High process Memory utilization High process memory utilization occurs when you connect the Catalyst       switch to IP phones on a port through the dot1q trunks. The switch can be       configured with a number of VLANs. The switch sends spanning-tree BPDUs for all       VLANs to the IP phone connected through trunk to the switch. This causes the       memory utilization to increase on the switch. When memory utilization increases, you can see an error message in the       tracebacks, which is similar to this: Dec  5 15:51:31 MET: %SYS-2-MALLOCFAIL: Memory allocation of 568 bytes failed from 0x192C20, pool Processor, alignment 0 -Process= "STP Queue Handler", ipl= 6, pid= 56 As a workaround, configure only an allowed VLAN list on the ports       through the switchport trunk allowed vlan {add       vlan-list | all | except vlan-list | remove       vlan-list} command. The allowed VLAN list must include only the VLANs that are necessary on       that port, which are usually the voice and data VLANs. Refer to Cisco bug ID       CSCdw22282 (registered customers only)          for more information. Troubleshoot Expansion Slots in the Catalyst 2900XL Expansion Slot Module Does Not Work Perform these actions to troubleshoot possible expansion slot       problems: Issue the show version command to ensure that the switch recognizes the module ports. In order to ensure that the software you run supports the module, refer to the Release             Notes for the Catalyst 2900 Series XL and Catalyst 3500 Series XL Switches,             Cisco IOS Release 12.0(5)WC2. If you run the appropriate level of software, and the LED is still             amber, make sure that the module is seated properly and that the thumb screws             are tightened on the front pane of the module. If the module still does not appear to be operational, try the             module in another slot in the same switch. Alternatively, try the module in             another switch, if available. ATM Module  Fails POST Tests Refer to       Understanding       ATM Module POST Results for information on how to troubleshoot POST test       failure on the ATM module. ATM Module Has Corrupt Module Software Refer to       Recovering       from Corrupted Module Software. Password Recovery for the ATM Module Refer to       Recovering       from a Lost or Forgotten Password. Troubleshoot  Interface Issues Workstation cannot Log into the Network During Startup and cannot Obtain a DHCP Address When you power up or reboot a client machine, if you observe one of       these symptoms, the problem can be due to an initial connectivity delay that       the switch introduces: Microsoft networking client displays No Domain           Controllers Available . Dynamic Host Configuration Protocol (DHCP) reports No           DHCP Servers Available . A Novell Internetwork Packet Exchange (IPX) networking workstation           does not have the Novell Login Screen upon bootup. An AppleTalk networking client displays Access to your           AppleTalk network has been interrupted. To re-establish your connection, open           and close the AppleTalk control panel . Sometimes, the chooser           application of the AppleTalk client either does not display a zone list, or           displays an incomplete zone list. IBM network stations can display one of these messages: NSB83619--Address resolution             failed NSB83589--Failed to boot after 1             attempt NSB70519--Failed to connect to a             server See the Common Reasons and Solutions section for information on common reasons for this problem, and the solutions       to recover from the problem. Common Reasons and Solutions The reasons for these symptoms can be: An interface delay caused by Spanning Tree Protocol           (STP) EtherChannel, Trunking, or auto-negotiation           delay Refer to       Using       Portfast and Other Commands to Fix Workstation Startup Connectivity       Delays for more information about these delays and their       solutions. Contact       Cisco       Technical Support if you still face issues after you review and follow       the procedure in this document. Troubleshoot NIC Compatibility Issues When a server or client connection to the switch does not come up, look       for an autonegotiation issue. If you see errors on the port, check for a       Network Interface Card (NIC) compatibility issue, or an improper configuration       on the switch. See the Common Reasons and Solutions section for more information. Common Reasons and Solutions The reasons for these symptoms can be: A known NIC driver issue A speed and duplex mismatch Autonegotiation issues Cabling problems Refer toTroubleshooting       Cisco Catalyst Switches to NIC Compatibility Issues for more information       on how to troubleshoot these problems. Troubleshoot Interface Errors If you experience slow performance or intermittent connectivity, check       for interface errors. Issue the show controllers       ethernet-controller command in order to check for interface       errors for the port you troubleshoot. The Diagnostic       Commands section of this document explains this command. Also issue the show interface command. The       Diagnostic Commands section explains this       command also. Refer to       Understanding       Data Link Errors for additional information on each counter and possible       causes. This table lists some of the known issues with counters on the       Catalyst 2900XL and 3500XL series switches. Symptom Description Fix or Workaround Runts on a 802.1Q trunk port. A Catalyst 2900XL or 3500XL switch that receives a 64 or 66                     byte 802.1Q encapsulated frame on a trunk port counts the frame as a runt.                     However, the switch continues to forward the frame. This issue is commonly seen                     when you connect Cisco 7960 IP phones to the switch when you use auxiliary                     (voice) VLANs.                  This issue is cosmetic, and is due to an ASIC limitation. This                     issue does not cause any degradation in the performance of the switch. Refer to                     Cisco bug ID                     CSCds32999 (registered customers only)          for more information. Cisco IOS Software Release 12.0(5.4)WC1 or later Cyclic Redundancy Check (CRC) on an Inter-Switch Link (ISL)                     trunk port. A Catalyst 3500XL or 2900XL Enterprise switch, with ISL                     trunking to the Fast Ethernet interface of a 7200-I/O-FE, 7500 PA-FE-TX, 3600                     or 2600, or KeepAlive Link State Packets (LSP) marked as CRC/Input errors on                     the switch. These errors do not cause any performance impact.                  Refer to Cisco bug ID                     CSCdr22809 (registered customers only)          for more                     information. The workaround is to disable KeepAlive on the router or use                     802.1Q trunking. No fix is available. CRC on an ISL trunk port that connects to a Catalyst 5500/5000                     or 6500/6000 series switch. Trunking between a Catalyst 2900XL and a Catalyst 5500/5000 or                     6500/6000, with trunking negotiation through Dynamic Trunking Protocol (DTP)                     enabled on the Catalyst 5500/5000, causes CRC errors on the 2900XL due to the                     reception of non-ISL (DTP) packets. DTP or Dynamic Inter-Switch Link Protocol                     (DISL) sends out Protocol Data Units (PDUs) with both ISL and non-ISL                     encapsulated frames in order to speed up recovery from an out-of-sync situation                     for the hardware. An out-of-sync situation occurs when one side is trunk, and                     the other is not.                  Refer to Cisco bug ID                     CSCdm31600 (registered customers only)          for more information.                     Also, refer to Cisco bug ID                     CSCdr72128 (registered customers only)          for a variation of this                     issue. The workaround is to use the nonegotiate trunk mode on the                     Catalyst 5500/5000, so that DTP does not run . No fix is available. Giants on ISL or 802.1Q trunk ports. When a Catalyst 2900XL switch receives a legal max-size                     Ethernet frame encapsulated or tagged for ISL or 802.1Q, and the packet is not                     forwarded to any other ports, the frame is counted as an oversize frame in the                     statistics counters. Note: There are many valid reasons for a packet to be received and                       not forwarded to any other ports. For example, packets received in a port that                       STP blocks, are not forwarded. Refer to Cisco bug ID                     CSCdm34557 (registered customers only)          for more information. There is no workaround for this bug. This issue is cosmetic                     only and you can ignore this issue with switch performance problems. No fix is                     available. The CDP-4-DUPLEX_MISMATCH Error Message on an ISL Trunk Port on a C3524-PWR-XL If you receive a CDP-4-DUPLEX_MISMATCH error message on an ISL trunk port on a Catalyst 3524-PWR-XL, see the       Common Reasons and Solutions section for common       reasons for this problem, and the relevant solutions. Common Reasons and Solutions Make sure you have configured both sides with the same duplex.           Typically, trunk ports are configured as full duplex links. Make sure both           sides auto-negotiate correctly. If you hardcode on one side and set           auto-negotiation on the other side, a half-duplex configuration arises on the           auto-negotiate side of the link. Issue the show interface           interface id command to check the duplex           status. You can encounter Cisco bug ID           CSCdx85015 (registered customers only)         . The workaround for this           bug is to issue the no power inline never interface           configuration command. The fix for the bug is available in Cisco IOS Software           Release 12.0(5)WC5a or later. Support for Loopback Interfaces The loopback interfaces are not supported in Cisco Catalyst       2900XL/3500XL Series Switches. Loopback interfaces are not supported in these       Cisco devices as they are purely Layer 2 switches and there is no need for any       lookback interfaces. The interface loopback command is a       carry-over from the mainline Cisco IOS software releases and is not applicable       to these device platforms. When you enter the CLI commands that refer to a       loopback interface, it might trigger these messages to be displayed in the       log: Assert failure in ../src-l2-les-common/stp_les_shim.c line 2524 Assert failure in ../src-l2-les-common/stp_les_shim.c line 2592 Assert failure in ../src-l2-les-common/stp_les_cli_cfg.c line 1261 Assert failure in ../src-l2-les-common/stp_les_cli_cfg.c line 1358 Assert failure in ../src-l2-les-common/stp_les_shim.c line 2558 Assert failure in ../src-l2-les-common/stp_les_shim.c line 2748 This issue is documented in Cisco bug ID       CSCsc43453 (registered customers only)         . Troubleshoot  GBIC Issues 1000BASE-T GBIC is not Recognized or does not Work If you have a 1000Base-T Gigabit Interface Converter (GBIC), and the           GBIC is not recognized or does not work, refer to           1000BASE-T           GBIC Switch Compatibility Matrix to verify software support for the           GBIC. If you run the appropriate level of software but the link still does           not work, refer to           Connector           and Cable Specifications. GigaStack GBIC is not Recognized or does not Work Properly If you have a GigaStack GBIC, which is not recognized or does not           work, refer to           Catalyst           GigaStack Gigabit Interface Converter Switch Compatibility Matrix to           verify software support for the GBIC. If you run the appropriate level of software but the link still does           not work, refer to           Troubleshooting           GigaStack to troubleshoot further on the basis of the LED           status: GigaStack GBIC Link Flaps and Never Stabilizes If your GigaStack GBIC link flaps and never stabilizes, refer to the       Link Flaps and Never Stabilizes section of       Catalyst       Switch GigaStack Configuration and Implications. Troubleshoot GigaStack GBIC Based on LED Status If your GigaStack GBIC Interface LED is not solid green (which       indicates normal function), refer to       Troubleshooting       GigaStack to troubleshoot on the basis of your LED status. Troubleshoot GigaStack GBIC Loop Configuration Software releases earlier than Cisco IOS Software Release 12.0(5)XU do       not support the GigaStack GBIC loop configuration. Earlier releases cause       excessive collision errors on the port and can cause the link to become       unstable. This instability decreases performance on the links. Communication       between the switches in the stack is adversely affected. Therefore, the loop       configuration is supported only if every device in the stack runs Cisco IOS       Software Release 12.0(5)XU or later. Refer to the Cabling Configuration section of       Catalyst       Switch GigaStack Configuration and Implications. Refer to       GBIC       Loop Configurations not Supported Before IOS Software Release 12.0(5)XU for a visual description of valid and invalid configurations. The GigaStack GBIC module enables you to create a 1 Gbps stack       configuration of up to nine supported switches. The GigaStack GBIC supports one       full-duplex link (in a point-to-point configuration) or up to nine half-duplex       links (in a stack configuration) to other GigaStack-compatible Ethernet       devices. If you use the required Cisco proprietary signaling and cabling, the       GigaStack GBIC-to-GigaStack GBIC connection does not exceed three feet (or one       meter). NO_LOOP_DETECT System Error Message with GigaStack GBIC If you receive the NO_LOOP_DETECT, GIGASTACK, LOG_ALERT,       0, The link neighbor of link %d of GigaStack system message,       and want to understand or troubleshoot, refer to the Error Message:       NO_LOOP_DETECT section of       Catalyst       Switch GigaStack Configuration and Implications. GIGASTACK-6-LOOP_DETECTED System Error Message with GigaStack GBIC If you receive the %GIGASTACK-6-LOOP_DETECTED: Gigastack       GBIC in is selected as Master Loop Breaker system message,       refer to the Message: %GIGASTACK-6-LOOP_DETECTED section       of       Catalyst       Switch GigaStack Configuration and Implications. Troubleshoot Console Connectivity Problems This section explains strategies to troubleshoot console connectivity       problems. Unreadable Characters on the Management Console An incorrect baud rate setting on the management console typically       causes unreadable characters. In order to resolve this problem, reset the emulation software on the       management console to 9600 baud (the default console baud rate of the switch).       If this action does not help, cycle through the various baud rate options on       the management console until you find one that works. The switch baud rate may       have been changed from the default. No Connectivity Through the Console Check this connectivity equipment. Make sure that the management console line is connected to the           console port on the switch. Make sure that the correct cable and connector are used. Refer to           Connecting           a Terminal to Catalyst 2900/3500 XL Switches for more           information. Cisco Telnet Denial of Service A specifically crafted TCP connection to a Telnet or reverse Telnet       port of a Cisco device that runs Internetwork Operating System (IOS)® can block       further access to the device through Telnet, reverse Telnet, Remote Shell       (RSH), Secure Shell (SSH), and in some cases Hypertext Transport Protocol       (HTTP). Data Link Switching (DLSw) and protocol translation connections can       also be affected. However, any Telnet, reverse Telnet, RSH, SSH, DLSw and       protocol translation sessions established before exploitation are not       affected. All other device services operate normally. Services like packet       forwarding (excluding DLSw and protocol translation), routing protocols and all       other communication to and through the device are not affected. Refer to Cisco bug ID       CSCef46191 (registered customers only)         . This bug tracks this problem. Also refer       to the related Security Advisory at       Cisco       Telnet Denial of Service Vulnerability. Troubleshoot General Software Issues Recover from Missing or Corrupted Software or Switch: Prompt You need to recover the switch in these scenarios: If your switch misses software If your switch has a corrupt software image If your switch is in Switch: prompt mode If you receive the Error Loading Flash error message Refer to       Recovery       From Corrupt or Missing Software Image on Cisco Catalyst 2900XL and 3500XL       Series Switches. Troubleshoot Cisco Visual Switch Manager or Cluster Management Suite If you have problems with your Cisco Visual Switch Manager or Cluster       Management Suite, refer to       Troubleshooting       Cisco Visual Switch Manager or Cluster Management Suite Access on the Catalyst       2900XL/3500XL/2950 Switch for procedures to troubleshoot (including Java       and browser requirements). Hardware and Software Compatibility or Software Feature Support Refer to these documents to identify the necessary software level to       support a certain hardware or software feature: 1000BASE-T           GBIC Switch Compatibility Matrix Catalyst           GigaStack Gigabit Interface Converter Switch Compatibility           Matrix Minimum           Cisco IOS Release for Major Features Recover Lost Password Refer to       Password       Recovery Procedure for the Catalyst Layer 2 Fixed Configuration and 3550 Series       Switches to recover a lost password. Diagnostic Commands show           interface show controllers           ethernet-controller show env           fan show           logging show platform port-asic           stats drop show interface Enter the show interface command to check       for speed and duplex settings, error counters, input and output queues, input       and output rates, and to display the administrative and operational status of       the interface. Use the packets input and       packets output fields (from the output) to       determine whether traffic enters or leaves the interface. switch#show interface    FastEthernet0/1 is down, line protocol is down   Hardware is Fast Ethernet, address is 00d0.5868.f181 (bia 00d0.5868.f181)   MTU 1500 bytes, BW 0 Kbit, DLY 0 usec,   reliability 255/255, txload 1/255, rxload 1/255   Encapsulation ARPA, loopback not set   Keepalive not set   Full-duplex, 100Mb/s, 100BaseTX/FX   ARP type: ARPA, ARP Timeout 04:00:00   Last input never, output 3w6d, output hang never   Last clearing of "show interface" counters 2w6d   Queueing strategy: fifo   Output queue 0/40, 0 drops; input queue 0/75, 0 drops   5 minute input rate 0 bits/sec, 0 packets/sec   5 minute output rate 0 bits/sec, 0 packets/sec   0 packets input, 0 bytes   Received 0 broadcasts, 0 runts, 0 giants, 0 throttles   0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored   0 watchdog, 0 multicast   0 input packets with dribble condition detected   0 packets output, 0 bytes, 0 underruns   0 output errors, 0 collisions, 0 interface resets   0 babbles, 0 late collision, 0 deferred   0 lost carrier, 0 no carrier   0 output buffer failures, 0 output buffers swapped out Here are the counters that help you troubleshoot a problem on the       interface: Input Errors Input errors provide a count of any       errors that occurred during an attempt to receive packets from this port. The       counter includes both CRC and frame errors. However, this counter does not       include ignored packets. This is a list of input errors: CRC Errors—These errors occur when the           received packets fail the CRC check. Frame Errors—Frame errors occur when           the receiving frame is not complete. Ignored Counter—This counter counts           the number of frames dropped on input due to resource exhaustion in the switch           fabric. Overruns Counter—Overruns occur when           Inter-Frame Gaps (IFG) are too short. In this case, a new Ethernet frame           arrives before the previous one is completely stored in shared           memory. Output Errors Output errors provide a count of any       error that occurred while during an attempt to transmit packets from this port. Collisions Counter—This counter shows           the number of times a collision occurred during an attempt to transmit a packet           from this port. This counter must be 0 for a port that operates in full-duplex           mode. Interface Resets Counter— This counter           counts the number of times the port resets, generally due to link up or link           down transitions. Underruns Counter—Underruns occur when           packets are not retrieved quickly enough from shared memory to be           transmitted. Babbles and Late Collisions Babble errors occur due to the       transmission of frames in excess of 1518 bytes in size. A late       collision occurs outside of the collision window and occurs due       to a duplex mismatch or a wire that exceeds the distance limitations (100       meters for 10/100 ports). The deferred counter       tabulates the number of times the port waits to transmit due to traffic on the       wire. Lost Carrier and No Carrier A carrier is an electrical signal that Ethernet devices use to detect       whether another transmitting station uses the wire currently. The       lost carrier counter increases when the carrier       sense loss occurs when the hardware transmits a frame onto the wire and does       not see its own carrier wave on the Ethernet. Absence of the carrier signal       increments the no carrier counter. show controllers ethernet-controller The show controllers ethernet-controller command provides in-depth information about a specific interface as shown       here: Switch# show controllers ethernet-controller fa0/4     Transmit                     Receive    26869777 Bytes               402753236 Bytes    460 Unicast frames           1 Unicast frames    45408 Multicast frames       198165 Multicast frames    12207 Broadcast frames       0 Broadcast frames    Discarded frames             0 No bandwidth frames    Too old frames               0 No buffers frames    Deferred frames              0 No dest, unicast    0 1 collision frames         0 No dest, multicast    0 2 collision frames         0 No dest, broadcast    0 3 collision frames         1 Alignment errors    0 4 collision frames         0 FCS errors    0 5 collision frames         0 Collision fragments    0 6 collision frames    0 7 collision frames         0 Undersize frames    0 8 collision frames         198166 Minimum size frames    0 9 collision frames         65 to 127 byte frames    0 10 collision frames        28 to 255 byte frames    0 11 collision frames        256 to 511 byte frames    0 12 collision frames        512 to 1023 byte frames    0 13 collision frames        1024 to 1518 byte frames    0 14 collision frames        0 Oversize frames    0 15 collision frames    0 16 Excessive collisions    1102 Late collisions Most of the fields in the output are self-explanatory. This table       explains platform-specific counters: Fields Explanation Action Discarded frames The total number of frames whose transmission attempt is                     abandoned due to insufficient resources (such as underrun). This total includes                     frames of all destination types. Reduce the traffic load destined to that interface if you see a                     rise in the number of packets in this field. Too old frames Number of frames that took longer than two seconds to travel                     through the switch, and the switch discarded the frames. This situation only                     occurs under extreme, high stress conditions. Reduce the switch load if you see a rise in the number of                     packets in this field. Deferred frames The total number of frames whose first transmission attempt had                     to be delayed due to traffic on the network media. This total includes only                     those frames that are subsequently transmitted without error and without a                     collision. Reduce the switch load if you see a rise in the number of                     packets in this field. No bandwidth frames and                      No buffers frames The number of times a port received a packet from the network.                     However, the switch does not have the resources to receive the packet. This                     situation occurs only under stress conditions, but can occur with bursts of                     traffic on several ports. So, a small number in the No bandwidth                     frames field is not a cause for concern. Ensure that this value                     is far less than 1 percent of the frames received. Reduce the traffic load on the particular                     interface. No dest, unicast Number of times that a unicast packet is received. The port                     determines that the packet must not be forwarded to any other                     ports. See below. No dest,                     multicast Number of times that a multicast packet is received. The port                     determines that the multicast packet must not be forwarded to any other                     ports. See below. No dest,                     broadcast Number of times that a broadcast packet is received. The port                     determines that the broadcast packet must not be forwarded to any other                     ports. See below. This is a brief description of example scenarios to receive an       increase in the No dest counter. If STP blocks a port, most packets are not forwarded. This results in            No dest packets. If a port just acquired a link, there is a very brief (less than one           second) period where incoming packets are not forwarded. If a port is an access port, and the port is connected to an ISL           trunk port, the No dest counter shows a very           large value. All the incoming ISL packets are not forwarded. This is an invalid           configuration. If a lone port is in a VLAN, and no other ports on the switch belong           to that VLAN, the port drops incoming packets. Port A receives a packet with destination MAC address X. The switch           has already learned that the MAC address X resides on port A. This situation           arises if a hub is connected to port A. One workstation connected to the hub           transmits packets to another workstation connected to the hub. This scenario is           also possible if a switch is connected to port A, and the other switch           temporarily floods packets to all ports while it learns the addresses. If a static address is set up on another port in the same VLAN, and           no static address is set up for the receiving port, the packet is dropped. For           example, if a static address is set up to specify that if the destination MAC           address X is received on port f0/2, the packet must be forwarded to port f0/3.           If a packet with the destination MAC address X is received on any port other           than f0/2, but in the same VLAN as f0/2, the packet is           dropped. If the port is a secure port, packets with disallowed source MAC           addresses are not forwarded. show env fan The show env fan command is applicable only       to the Catalyst 3524PWR-XL switches. This command helps to identify whether the       system fan is faulty. If so, replace the switch. Switch# show env fanFAN 1 is OK FAN 2 is OK FAN 3 is OK FAN 4 is OK FAN 5 is OK show logging The show logging command helps to check the       logged system messages. Make sure logging is enabled if you do not see any       messages in the output of this command, in the console, or in the syslog       server. Enable timestamps with the service       timestamps global configuration command. 3500XL>show loggingSyslog logging: enabled (0 messages dropped, 0 flushes, 0 overruns) Console logging: level debugging, 102 messages logged Monitor logging: level debugging, 0 messages logged Buffer logging: level debugging, 102 messages logged File logging: disabled Trap logging: level informational, 108 message lines logged Log Buffer (4096 bytes): by console 00:09:55: %LINK-3-UPDOWN: Interface FastEthernet0/48, changed state to down 00:09:56: %LINEPROTO-5-UPDOWN:    Line protocol on Interface FastEthernet0/48, changed state to down 00:13:30: %SYS-5-CONFIG_I: Configured from console by console 00:50:27: %CMP-CLUSTER_MEMBER_2-5-ADD:    The Device is added to the cluster (Cluster Name:    CH-3500-8, CMDR IP Address 10.10.10.101) 1w3d: %SYS-CLUSTER_MEMBER_2-5-CONFIG_I: Configured from console by console 3500XL> show platform port-asic stats drop The show       platform port-asic stats drop command provides the real       drops and indicates towards-traffic microbursts which cause the egress buffer       to exhaust. Switch#sh platform port-asic stats drop gig1/0/1   Interface Gi1/0/1 TxQueue Drop Statistics     Queue 0       Weight 0 Frames 0       Weight 1 Frames 0       Weight 2 Frames 0     Queue 1       Weight 0 Frames 0       Weight 1 Frames 43472041       Weight 2 Frames 1     Queue 2       Weight 0 Frames 0       Weight 1 Frames 0       Weight 2 Frames 0     Queue 3       Weight 0 Frames 0       Weight 1 Frames 0       Weight 2 Frames 3631857     Queue 4       Weight 0 Frames 0       Weight 1 Frames 0       Weight 2 Frames 0     Queue 5       Weight 0 Frames 0       Weight 1 Frames 0       Weight 2 Frames 0 ... View more

Services in a Converged  WAN ... View more

This chapter describes how to configure basic settings on the wireless  device for the first time. The contents of this chapter are similar to  the instructions in the quick start guide that shipped with the wireless  device. You can configure all the settings described in this chapter  using the CLI, but it might be simplest to browse to the wireless device  web-browser interface to complete the initial configuration and then  use the CLI to enter additional settings for a more detailed  configuration. This chapter contains these sections: • Before You Start • Connecting to the 1300 Series Access Point/Bridge Locally • Default Radio Settings • Assigning Basic Settings • Configuring the 802.1X Supplicant Note In this release, the access point radio interfaces are disabled by default. Before You Start Before you install the wireless device, make sure you are using a  computer connected to the same network as the wireless device, and  obtain the following information from your network administrator: • A system name for the wireless device • The case-sensitive wireless service set identifier (SSID) for your radio network • If the wireless device is not on the same subnet as your PC, a default gateway address and subnet mask • A Simple Network Management Protocol (SNMP) community name and the SNMP file attribute (if SNMP is in use) Resetting the Device to Default Settings If you need to start over during the initial setup process, you can reset the access point to factory default settings.Resetting to Default Settings Using the MODE Button Resetting to Default Settings Using the GUI Resetting to Default Settings Using the CLI Caution You should never delete any of the system files prior to resetting defaults or reloading software. If you want to reset the access point to its default settings and a static IP address, use the write erase or erase /all nvram command. If you want to erase everything including the static IP address, in addition to the above commands, use the erase and erase boot static-ipaddr static-ipmask command. From the privileged EXEC mode, you can reset the access point/bridge  configuration to factory default values using the CLI by following these  steps: Step 1 Enter erase nvram: to erase all NVRAM files including the startup configuration. Note The erase nvram command does not erase a static IP address. Step 2 Follow the step below to erase a static IP address and subnet mask. Otherwise, go to step 3. a. Enter write default-config. Step 3 Enter Y when the following CLI message displays: Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]. Step 4 Enter reload when the following CLI message displays: Erase of nvram: complete. This command reloads the operating system. Step 5 Enter Y when the following CLI message displays: Proceed with reload? [confirm]. Caution Do  not interrupt the boot process to avoid damaging the configuration  file. Wait until the access point/bridge Install Mode LED begins to  blink green before continuing with CLI configuration changes. You can  also see the following CLI message when the load process has finished: Line protocal on Interface Dot11Radio0, changed state to up. Step 6 After the access point/bridge reboots, you can reconfigure the access point by using the Web-browser interface if you previously assigned a static IP address, or the CLI if you did not. The access point is configured with the factory default values including  the IP address (set to receive an IP address using DHCP). To obtain the  access point/bridge's new IP address, you can use the show interface bvi1 CLI command. The 1300 series access  point/bridge assumes a radio network role of a root access point. To  configure it as a bridge, you must manually place it in install mode in  order to align the antennas and establish a link. To establish the link  you must have two access point/bridges configured in the install mode.  In the install mode, one access point/bridge must be configured as a  root bridge and the other a non-root bridge. To facilitate the  configuration, an automatic option is available when the access  point/bridge is in the install mode. After the wireless link is  established and the bridge antennas are aligned, you take both access  point/bridges out of install mode and place them on your LAN as root and  non-root bridges. Note "Resetting the Device to Default Settings" sectionIf xon/xoff flow control does not work, use no flow control. Step 7 When connected, press enter or type en to access the command prompt. Pressing enter takes you to the user exec mode. entering en prompts you for a password, then takes you to the privileged exec mode. The default password is Cisco and is case-sensitive. Note If xon/xoff flow control does not work, use no flow control. Step 8 When connected, press enter or type en to access the command prompt. Pressing enter takes you to the user exec mode. Entering en prompts you for a password, then takes you to the privileged exec mode. The default password is Cisco and is case-sensitive. Note When your configuration changes are completed, you must remove the serial cable from the access point. Connecting to the 1300 Series Access Point/Bridge Locally If you need to configure the access point/bridge locally (without  connecting the access point/bridge to a wired LAN), you can connect a PC  to the Ethernet port on the long-reach power injector using a Category 5  Ethernet cable. You can use a local connection to the power injector's  Ethernet port much as you would use a serial port connection. Note You  do not need a special crossover cable to connect your PC to the power  injector; you can use either a straight-through cable or a crossover  cable. Follow these steps to connect to the bridge locally: Step 1 Make  sure that the PC you intend to use is configured to obtain an IP  address automatically, or manually assign it an IP address within the  same subnet as the access point/bridge IP address. For example, if you assigned the access point/bridge an IP address of 10.0.0.1, assign the PC an IP address of 10.0.0.20. Step 2 With  the power cable disconnected from the power injector, connect your PC  to the power injector using a Category 5 Ethernet cable. You can use  either a crossover cable or a straight-through cable. Note Communication  takes place between the power injector and the access point/bridge  using Ethernet Port 0. Do not attempt to change any of the Ethernet Port  0 settings. Step 3 Connect the power injector to the access point/bridge using dual coaxial cables. Step 4 Connect the power injector power cable and power up the access point/bridge. Step 5 Follow the steps in the "Assigning Basic Settings" section. If you make a mistake and need to start over, follow the steps in the "Resetting the Device to Default Settings" procedure. Step 6 After configuring the access point/bridge, remove the Ethernet cable from your PC and connect the power injector to your wired LAN. Note When  you connect your PC to the access point/bridge or reconnect your PC to  the wired LAN, you might need to release and renew the IP address on the  PC. On most PCs, you can perform a release and renew by rebooting your  PC or by entering ipconfig /release and ipconfig /renew commands in a command prompt window. Consult your PC operating instructions for detailed instructions. Default Radio Settings Beginning with Cisco IOS Release 12.3(8)JA, access point radios are  disabled and no default SSID is assigned. This was done in order to  prevent unauthorized users to access a customer's wireless network  through an access point having a default SSID and no security settings.  You must create an SSID before you can enable the access point radio  interfaces. See Chapter 6 "Configuring Radio Settings" for additional information. Assigning Basic Settings After you determine or assign the wireless device IP address, you can  browse to the wireless device Express Setup page and perform an initial  configuration: Step 1 Open  your Internet browser. The wireless device web-browser interface is  compatible with Microsoft Internet Explorer version 6.0, and with  Netscape version 7.0. Step 2 Enter the wireless device IP address in the browser address line and press Enter. An Enter Network Password screen appears. Step 3 Press Tab to bypass the Username field and advance to the Password field. Step 4 Enter the case-sensitive password Cisco and press Enter. Your page may differ depending on the access point model you are using. The Express Setup screen appears. Figure 4-1 and Figure 4-2 shows the Express Setup page for the 1100 series access points. Your  pages may differ depending on the access point model you are using. Figure 4-1     Express Setup Page for 1100 Series Access Points Figure 4-2     Express Setup Page for 1130, 1200, and 1240 Series Access Points Note Figure 4-2 shows the Express Setup page for an 1130 series access point. The 1200  series is similar, but does not support the universal workgroup bridge  role. Figure 4-3     Express Setup Page for the 1250 Series Access Point Figure 4-4     Express Setup Page for the 1300 Series Access Point/Bridge Step 5 Enter the configuration settings you obtained from your system administrator. The configurable settings include: • – Repeater—A  non-root device; accepts associations from clients and bridges wireless  traffic from the clients to root access point connected to the wireless  LAN. This setting can be applied to any access point. – Root Bridge—Establishes  a link with a non-root bridge. In this mode, the device also accepts  associations from clients. This setting is available only for the 1200  and 1240 series access points. – Non-Root Bridge—In  this mode, the device establishes a link with a root bridge. This  setting is available only for the 1200 and 1240 series access points. – Install Mode—Places  the 1300 series access point/bridge in auto installation mode so you  can align and adjust a bridge link for optimum efficiency. – Workgroup Bridge—Emulates  a Cisco Aironet 350 Series Workgroup Bridge. In the Workgroup bridge  mode, the access point functions as a client device that associates with  a Cisco Aironet access point or bridge. A wokgroup bridge can have a  maximum of 254 clients, presuming that no other wireless clients are  associated to the root bridge or access point. This setting is available  for the 1100, 1200, and 1300 series access points. – Universal Workgroup Bridge—Configures  the access point as a workgroup bridge capable of associating with  non-Cisco access points. This setting is available on 1130, and 1240  series access points and 1300 series access point/bridges. – Client MAC:—The Ethernet MAC address of the client connected to the universal workgroup bridge. – Scanner—Functions  as a network monitoring device. In the Scanner mode, the access point  does not accept associations from clients. It continuously scans and  reports wireless traffic it detects from other wireless devices on the  wireless LAN. All access points can be configured as a scanner. • Optimize Radio Network for—Use  this setting to select either preconfigured settings for the wireless  device radio or customized settings for the wireless device radio. – Throughput—Maximizes the data volume handled by the wireless device, but might reduce its range. – Range—Maximizes the wireless device range but might reduce throughput. – Default—Sets the default values for the access point. – Custom—The wireless device uses the settings you enter on the Network Interfaces. Clicking Custom takes you to the Network Interfaces: Radio-802.11b Settings page. Radio-802.11b Settings page. Radio-802.11n Settings page (1250). Radio-802.11n Settings page (1250) • Aironet Extensions—Enable this setting if there are only Cisco  devices on your wireless LAN. Step 6 Click Apply to save your settings. Step 7 Click Network Interfaces to browse to the Network Interfaces Summary page. Step 8 Click the radio interface to browse to the Network Interfaces: Radio Status page. Step 9 Click the Settings tab to browse to the Settings page for the radio interface. Step 10 Click Enable to enable the radio. Step 11 Click Apply. Your wireless device is now running but probably requires additional  configuring to conform to your network operational and security  requirements. Consult the chapters in this manual for the information  you need to complete the configuration. Default Settings on the Express Setup Page Table 4-1 lists the default settings for the settings on the Express Setup page. Table 4-1     Default Settings on the Express Setup Page  Setting Default Host Name ap Optimize Radio Network for Throughput Aironet Extensions Enable Configuring Basic Security Settings After you assign basic settings to the wireless device, you must  configure security settings to prevent unauthorized access to your  network. Because it is a radio device, the wireless device can  communicate beyond the physical boundaries of your worksite. Just as you use the  Express Setup page to assign basic settings, you can use the Express  Security page to create unique SSIDs and assign one of four security types to them. Figure 4-5 shows a typical Express Security page. Figure 4-5     Express Security Page The Express Security page helps you configure basic security settings.  You can use the web-browser interface main Security pages to configure  more advanced security settings. Understanding Express Security Settings SSIDs that you create appear in the SSID table at the bottom of the  page. You can create up to 16 SSIDs on the wireless device. On  dual-radio wireless devices, the SSIDs that you create are enabled on  both radio interfaces. Note In  Cisco IOS Release 12.4(10b)JA and 12.3(8)JEC, there is no default SSID.  You must configure an SSID before client devices can associate to the  access point. The SSID can consist of up to 32 alphanumeric, case-sensitive, characters. The first character can not contain the following characters: • Exclamation point • Pound sign (#) • Semicolon (;) The following characters are invalid and cannot be used in an SSID: • Plus sign • Right bracket (]) • Front slash (/) • Quotation mark (") • Tab • Trailing spaces Using VLANs If you use VLANs on your wireless LAN and assign SSIDs to VLANs, you can  create multiple SSIDs using any of the four security settings on the  Express Security page. However, if you do not use VLANs on your wireless  LAN, the security options that you can assign to SSIDs are limited  because on the Express Security page encryption settings and  authentication types are linked. Without VLANs, encryption settings (WEP  and ciphers) apply to an interface, such as the 2.4-GHz radio, and you  cannot use more than one encryption setting on an interface. For  example, when you create an SSID with static WEP with VLANs disabled,  you cannot create additional SSIDs with WPA authentication because they  use different encryption settings. If you find that the security setting  for an SSID conflicts with another SSID, you can delete one or more  SSIDs to eliminate the conflict. Express Security Types Table 4-2 describes the four security types that you can assign to an SSID. Table 4-2     Security Types on Express Security Setup Page  Security Type Description Security Features Enabled No Security This is the least secure option. You should use this option only for  SSIDs used in a public space and assign it to a VLAN that restricts  access to your network. None. Static WEP Key This option is more secure than no security. However, static WEP keys  are vulnerable to attack. If you configure this setting, you should  consider limiting association to the wireless device based on MAC  address. Mandatory WEP. Client devices cannot associate using this SSID without a WEP key that matches the wireless device key. EAP Authentication This option enables 802.1X authentication (such as LEAP, PEAP, EAP-TLS,  EAP-FAST, EAP-TTLS, EAP-GTC, EAP-SIM, and other 802.1X/EAP based  products) This setting uses mandatory encryption, WEP, open authentication + EAP,  network EAP authentication, no key management, RADIUS server  authentication port 1645. You are required to enter the IP address and shared secret for an  authentication server on your network (server authentication port 1645).  Because 802.1X authentication provides dynamic encryption keys, you do  not need to enter a WEP key. Mandatory 802.1X authentication. Client devices that associate using this SSID must perform 802.1X authentication. If radio clients are configured to authenticate using EAP-FAST, open  authentication with EAP should also be configured. If you don't  configure open authentication with EAP, the following GUI warning  message appears: WARNING: Network EAP is used for LEAP authentication only. If radio  clients are configured to authenticate using EAP-FAST, Open  Authentication with EAP should also be configured. If you are using the CLI, this warning message appears: SSID CONFIG WARNING: [SSID]: If radio clients are using EAP-FAST, AUTH OPEN with EAP should also be configured. WPA Wi-Fi Protected Access (WPA) permits wireless access to users  authenticated against a database through the services of an  authentication server, then encrypts their IP traffic with stronger  algorithms than those used in WEP. This setting uses encryption ciphers, TKIP, open authentication + EAP,  network EAP authentication, key management WPA mandatory, and RADIUS  server authentication port 1645. As with EAP authentication, you must enter the IP address and shared  secret for an authentication server on your network (server  authentication port 1645). Mandatory WPA authentication. Client devices that associate using this SSID must be WPA-capable. If radio clients are configured to authenticate using EAP-FAST, open  authentication with EAP should also be configured. If you don't  configure open authentication with EAP, the following GUI warning  message appears: WARNING: Network EAP is used for LEAP authentication only. If radio  clients are configured to authenticate using EAP-FAST, Open  Authentication with EAP should also be configured. If you are using the CLI, this warning message appears: SSID CONFIG WARNING: [SSID]: If radio clients are using EAP-FAST, AUTH OPEN with EAP should also be configured. Express Security Limitations Because the Express Security page is designed for simple configuration  of basic security, the options available are a subset of the wireless  device security capabilities. Keep these limitations in mind when using  the Express Security page: • If the No VLAN option is selected, the static WEP key can be configured once. If you select Enable VLAN, the static WEP key should be disabled. • You cannot edit SSIDs. However, you can delete SSIDs and re-create them. • You  cannot assign SSIDs to specific radio interfaces. The SSIDs that you  create are enabled on all radio interfaces. To assign SSIDs to specific  radio interfaces, use the Security SSID Manager page. • You  cannot configure multiple authentication servers. To configure multiple  authentication servers, use the Security Server Manager page. • You cannot configure multiple WEP keys. To configure multiple WEP keys, use the Security Encryption Manager page. • You  cannot assign an SSID to a VLAN that is already configured on the  wireless device. To assign an SSID to an existing VLAN, use the Security  SSID Manager page. • You  cannot configure combinations of authentication types on the same SSID  (for example, MAC address authentication and EAP authentication). To  configure combinations of authentication types, use the Security SSID  Manager page. Using the Express Security Page Follow these steps to create an SSID using the Express Security page: Step 1 Type the SSID in the SSID entry field. The SSID can contain up to 32 alphanumeric characters. Step 2 To  broadcast the SSID in the wireless device beacon, check the Broadcast  SSID in Beacon check box. When you broadcast the SSID, devices that do  not specify an SSID can associate to the wireless device. This is a  useful option for an SSID used by guests or by client devices in a  public space. If you do not broadcast the SSID, client devices cannot  associate to the wireless device unless their SSID matches this SSID.  Only one SSID can be included in the wireless device beacon. Step 3 (Optional)  Check the Enable VLAN ID check box and enter a VLAN number (1 through  4095) to assign the SSID to a VLAN. You cannot assign an SSID to an  existing VLAN. Step 4 (Optional) Check the Native VLAN check box to mark the VLAN as the native VLAN. Step 5 Select  the security setting for the SSID. The settings are listed in order of  robustness, from No Security to WPA, which is the most secure setting.  If you select EAP Authentication or WPA, enter the IP address and shared  secret for the authentication server on your network. Note If you do not use VLANs on your wireless LAN, the security options that you can assign to multiple SSIDs are limited. See the "Using VLANs" section for details. Step 6 Click Apply. The SSID appears in the SSID table at the bottom of the page. CLI Configuration Examples The examples in this section show the CLI commands that are equivalent  to creating SSIDs using each security type on the Express Security page.  This section contains these example configurations: • Example: No Security • Example: Static WEP Example: No Security This example shows part of the configuration that results from using the Express Security page to create an SSID called no_security_ssid, including the SSID in the beacon, assigning it to VLAN 10, and selecting VLAN 10 as the native VLAN: ! dot11 ssid no_security_ssid authentication open vlan 10 ! interface Dot11Radio0.10 encapsulation dot1Q 10 native no ip route-cache bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding bridge-group 1 spanning-disabled ! interface Dot11Radio1 no ip address no ip route-cache ! ssid no_security_ssid ! speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0 rts threshold 2312 station-role root ! interface Dot11Radio1.10 encapsulation dot1Q 10 native no ip route-cache bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding bridge-group 1 spanning-disabled Example: Static WEP This example shows part of the configuration that results from using the Express Security page to create an SSID called static_wep_ssid, excluding the SSID from the beacon, assigning the SSID to VLAN 20, selecting 3 as the key slot, and entering a 128-bit key: ssid static_wep_ssid           vlan 20           authentication open ! interface Dot11Radio0 no ip address no ip route-cache ! encryption vlan 20 key 3 size 128bit 7 FFD518A21653687A4251AEE1230C transmit-key encryption vlan 20 mode wep mandatory ! speed basic-1.0 basic-2.0 basic-5.5 basic-11.0 rts threshold 2312 station-role root bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding bridge-group 1 spanning-disabled      ssid statuc_wep_ssid ! interface Dot11Radio0.20 encapsulation dot1Q 20 no ip route-cache bridge-group 20 bridge-group 20 subscriber-loop-control bridge-group 20 block-unknown-source no bridge-group 20 source-learning no bridge-group 20 unicast-flooding bridge-group 20 spanning-disabled ! interface Dot11Radio1 no ip address no ip route-cache ! encryption vlan 20 key 3 size 128bit 7 741F07447BA1D4382450CB68F37A transmit-key encryption vlan 20 mode wep mandatory ! ssid static_wep_ssid ! speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0 rts threshold 2312 station-role root bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding bridge-group 1 spanning-disabled ! interface Dot11Radio1.20 encapsulation dot1Q 20 no ip route-cache bridge-group 20 bridge-group 20 subscriber-loop-control bridge-group 20 block-unknown-source no bridge-group 20 source-learning no bridge-group 20 unicast-flooding bridge-group 20 spanning-disabled Note The  following warning message appears if your radio clients are using  EAP-FAST and you don't include open authentication with EAP as part of  the configuration: SSID CONFIG WARNING: [SSID]: If radio clients are using EAP-FAST, AUTH OPEN with EAP should also be configured.      vlan 30      authentication open eap eap_methods      authentication network-eap eap_methods ! ! ! Figure 4-6     Power Options on the System Software: System Configuration Page dot11 extension power native Command When enabled, the dot11 extension power native  shifts the power tables the radio uses from the IEEE 802.11 tables to  the native power tables. The radio derives the values for this table  from the NativePowerTable and NativePowerSupportedTable of the  CISCO-DOT11-1F-MIB. The Native Power tables were designed specifically  to configure powers as low as -1dBm for Cisco Aironet radios that  support these levels. Configuring the 802.1X Supplicant Traditionally, the dot1x authenticator/client relationship has always  been a network device and a PC client respectively, as it was the PC  user that had to authenticate to gain access to the network. However,  wireless networks introduce unique challenges to the traditional  authenticator/client relationship. First, access points can be placed in  public places, inviting the possibility that they could be unplugged  and their network connection used by an outsider. Second, when a  repeater access point is incorporated into a wireless network, the  repeater access point must authenticate to the root access point in the  same way as a client does. Note The  802.1X supplicant is available on 1130AG, 1240AG, 1250, and 1300 series  access points. It is not available on 1100 and 1200 series access  points. The supplicant is configured in two phases: • Create and configure a credentials profile • Apply the credentials to an interface or SSID You can complete the phases in any order, but they must be completed before the supplicant becomes operational. Creating a Credentials Profile Beginning in privileged EXEC mode, follow these steps to create an 802.1X credentials profile: Command Purpose Step 1  configure terminal Enter global configuration mode. Step 2  dot1x credentials profile Creates a dot1x credentials profile and enters the dot1x credentials configuration submode. Step 3  anonymous-id description (Optional)—Enter the anonymous identity to be used. Step 4  description description (Optional)—Enter a description for the credentials profile Step 5  username username Enter the authentication user id. Step 6  password {0 | 7 | LINE} Enter an unencrypted password for the credentials. 0—An unencrypted password will follow. 7—A hidden password will follow. Hidden passwords are used when applying a previously saved configuration. LINE—An unencrypted (clear text) password. Note Unencrypted  and clear text are the same. You can enter a 0 followed by the clear  text password, or omit the 0 and enter the clear text password. Step 7  pki-trustpoint pki-trustpoint (Optional and only used for EAP-TLS)—Enter the default pki-trustpoint. Step 8  end Return to the privileged EXEC mode. Step 9  copy running config startup-config (Optional) Save your entries in the configuration file. Use the no form of the dot1x credentials command to negate a parameter. The following example creates a credentials profile named test with the username Cisco and a the unencrypted password Cisco: ap1240AG>enable Password:xxxxxxx ap1240AG#config terminal Enter configuration commands, one per line. End with CTRL-Z. ap1240AG(config)# dot1x credentials test ap1240AG(config-dot1x-creden)#username Cisco ap1240AG(config-dot1x-creden)#password Cisco ap1240AG(config-dot1x-creden)#exit ap1240AG(config)# Applying the Credentials to an Interface or SSID Credential profiles are applied to an interface or an SSID in the same way. Applying the Credentials Profile to the Wired Port Beginning in the privileged EXEC mode, follow these steps to apply the credentials to the access point's wired port: Command Purpose Step 1  configure terminal Enter global configuration mode. Step 2  interface fastethernet 0 Enter the interface configuration mode for the access point's Fast Ethernet port. Note You can also use interface fa0 to enter the fast Ethernet configuration mode. Step 3  dot1x credentials profile name] Enter the name of a previously created credentials profile. Step 4  end Return to the privileged EXEC mode Step 5  copy running config startup-config (Optional) Save your entries in the configuration file. The following example applies the credentials profile test to the access point's Fast Ethernet port: ap1240AG>enable Password:xxxxxxx ap1240AG#config terminal Enter configuration commands, one per line. End with CTRL-Z. ap1240AG(config)#interface fa0 ap1240AG(config-if)#dot1x credentials test ap1240AG(config-if)#end ap1240AG# Applying the Credentials Profile to an SSID Used For the Uplink If you have a repeater access point in your wireless network and are  using the 802.1X supplicant on the root access point, you must apply the  802.1X supplicant credentials to the SSID the repeater uses to  associate with and authenticate to the root access point. Beginning in the privileged EXEC mode, follow these steps to apply the credentials to an SSID used for the uplink: Command Purpose Step 1  configure terminal Enter global configuration mode. Step 2  dot11 ssid ssid Enter the 802.11 SSID. The SSID can consist of up to 32 alphanumeric characters. SSIDs are case sensitive. Note The first character cannot contain the !, #, or ; character. +, ], /, ", TAB, and trailing spaces are invalid characters for SSIDs. Step 3  dot1x credentials profile Enter the name of a preconfigured credentials profile. Step 4  end Exits the dot1x credentials configuration submode Step 5  copy running config startup-config (Optional) Save your entries in the configuration file. The following example applys the credentials profile test to the ssid testap1 on a repeater access point. repeater-ap>enable Password:xxxxxxx repeater-ap#config terminal Enter configuration commands, one per line. End with CTRL-Z. repeater-ap(config-if)#dot11 ssid testap1 repeater-ap(config-ssid)#dot1x credentials test repeater-ap(config-ssid)#end repeater-ap(config) Creating and Applying EAP Method Profiles You can optionally configure an EAP method list to enable the supplicant to recognize a particular EAP method. See "Creating and Applying EAP Method Profiles for the 802.1X Supplicant" section. ... View more

Who is this for? People who will be building networks.  If you're a manager you can go to sleep now; if you know this stuff already, take a pizza break; if you want to actually build networks some day and are not already comfortable working out appropriate sizes of subnets, please come to the front of the lecture hall - I have a few copies of this lesson but not enough for everyone in the room. Purpose of this lesson Some day you may be responsible for designing a network that connects several locations together with routers.  You'll have been given a certain number of IP addresses you can use, and you have to allocate them in chunks to each site without running out! The reason we are going to learn subnetting is simple: there are  not enough IP addresses free for you to give a whole Class C network to every site you manage.  Some upstream providers charge you for each Class C you allocate.  Others force you to justify your use of space in detail, showing that each network you allocated was fully populated. Before we go into details, there are two things you might be able to use which will avoid the need to learn any of this stuff: NAT - network address translation If it is available to you, NAT often lets you create any size of network you want, without worrying about how much IP space you have been  officially allocated.  I'm not going to explain what NAT is in detail, because it will be covered in someone else's lesson.  In short, it's a way to map large numbers of IPs on to a single IP (or to take a large sparse range such as a Class B and map each address that is actually used on to a small number of Class C's). NAT is worth taking the time to learn, because it can save you a whole lot of effort! Online tools to calculate subnets There are many web pages available that will calculate netmasks for given sizes of subnets.  These are useful as long as you understand the basics of what you're trying to do.  If you don't have 'the big picture', these tools won't help.  You can listen to this lecture to get 'the big picture' without getting distracted by the details, then use one of the online tools when you need actual numbers. IP address space in general - inference of Class A/B/C Before we start - a quick and very basic recap on IP addressing in general. Every machine on the net has an address.  Addresses are 32 bits. These 32 bits are split into two parts - a network number followed by a host address. The 'host address' part is for a number of machines on one physical network - say a bunch of machines connected with a hub or on a single thin ether wire.  The network number represents this group of hosts as a single unit, and routers need to know these network numbers to send data from one net to another. Just where the network/host split is made is arbitrary.  There's no real reason why 10.1.2.3 should be part of a class A network and 220.1.2.3 is part of a class C network - it just is.  The address space was split up as shown below, and any addresses in these ranges are deemed to be in the appropriate Class.  Why does this matter?  Well, some software will ask for an IP address but NOT a netmask - and it will infer a netmask from the address.  This is OK as long as you are staying within the class system, but if you are subnetting or supernetting, it can cause you a lot of trouble. There's actually very little difference between a Class C network, and a Class B network with a 255.255.255.0 netmask applied.  (The only time they're different is if the network address is of the form X.X.0.X or X.X.255.X) Before you start designing your subnets, you should know what it is that you've been given.  Here are three ways of finding out what class your allocation is in.  Use whichever you find easiest.   Class A addresses begin with 0xxx, or 1 to 126 decimal.  (127 is loopback) Class B addresses begin with 10xx, or 128 to 191 decimal. Class C addresses begin with 110x, or 192 to 223 decimal. Class D addresses begin with 1110, or 224 to 239 decimal. (a.k.a multicast - you'll probably never see these) Class E addresses begin with 1111, or 240 to 254 decimal. (or these) If the first bit is 0 it is a Class A address If the first two bits are 10 it is a Class B address If the first three bits are 110 it is a Class C address If the first four bits are 1110 it is a Class D multicast address If the first four bits are 1111 it is a Class E experimental address First Byte Class Network Mask (explained later) 1-126 "A" 255.0.0.0 128-191 "B" 255.255.0.0 192-223 "C" 255.255.255.0 In all the examples below we will assume we have been allocated a Class C network to work with: 192.168.1.0 192.168.1.0 is actually a special type of Class C address - it's one that is reserved never to be allocated on the real Internet.  So we'll use it in our examples because if you do configure a network using these numbers, you won't mess anybody else up.  It's amazing the number of people who create internal networks using real IP addresses chosen at random.  If you ever connect one of these networks to the internet, you will not be to route because the space belongs to someone else.  If you disguise your addresses using NAT, you'll still not be able to access those parts of the net that legitimately use those addresses. Doing subnet calculations for Class A and Class B networks works just the same way as the Class C examples we are going to cover.  If you can do a Class C from first principles, you'll be able to do Class B's in your sleep.  Very few people here will get much opportunity to design Class A or Class B subnets, but you are quite likely to be asked to work on existing Class A or B networks, so it's still worth knowing. What is Broadcast? I assume you know what a broadcast address is - the necessity to handle broadcasts is actually what makes subnetting anything less than trivial: if you have a Class C network such as 192.168.1.* (with station addresses 192.168.1.1, 192.168.1.2 etc), then a packet addressed to 192.168.1.255 will be sent to *every* station on that network.  Later we'll discover that sending to 192.168.1.0 is sort of something similar.  Or was once, anyway. In a Class C, the host part set to 255 means broadcast.  In a subnet, the subnet host part set to all ones means broadcast.  Eg in a /28, any addresses of the form N.N.N.XXXX1111 are broadcast addresses for their subnets only. Don't I need to know how to do binary arithmetic? Forgetaboutit.  If you can't do binary math in your head, just use the data in these tables below.  (On the other hand, if you can't do binary in your head by now, you probably shouldn't be looking at a career in networking.) Subnetting Class C - most typical example: /28  "all zeroes, all ones" excluded.  Mask is 11110000 This table may be all you ever need to know, for many installations.  This is a typical example and possibly the most common one.  Because it is such a useful table, this is the only large one we will list in full. Network part Subnet.host Host addresses Broadcast Address 192.168.1.0 0000xxxx 192.168.1.1 to 192.168.1.14 192.168.1.15 - UNUSABLE - NETMASK ALL 0000's 192.168.1.16 0001xxxx 192.168.1.17 to 192.168.1.30 192.168.1.31 192.168.1.32 0010xxxx 192.168.1.33 to 192.168.1.46 192.168.1.47 192.168.1.48 0011xxxx 192.168.1.49 to 192.168.1.62 192.168.1.63 192.168.1.64 0100xxxx 192.168.1.65 to 192.168.1.78 192.168.1.79 192.168.1.80 0101xxxx 192.168.1.81 to 192.168.1.94 192.168.1.95 192.168.1.96 0110xxxx 192.168.1.97 to 192.168.1.110 192.168.1.111 192.168.1.112 0111xxxx 192.168.1.113 to 192.168.1.126 192.168.1.127 192.168.1.128 1000xxxx 192.168.1.129 to 192.168.1.142 192.168.1.143 192.168.1.144 1001xxxx 192.168.1.145 to 192.168.1.158 192.168.1.159 192.168.1.160 1010xxxx 192.168.1.161 to 192.168.1.174 192.168.1.175 192.168.1.176 1011xxxx 192.168.1.177 to 192.168.1.190 192.168.1.191 192.168.1.192 1100xxxx 192.168.1.193 to 192.168.1.206 192.168.1.207 192.168.1.208 1101xxxx 192.168.1.209 to 192.168.1.222 192.168.1.223 192.168.1.224 1110xxxx 192.168.1.225 to 192.168.1.238 192.168.1.239 192.168.1.240 1111xxxx 192.168.1.241 to 192.168.1.254 192.168.1.255 - UNUSABLE - NETMASK ALL 1111's 0's/1's restriction on host part: let's take one subnet from the table above: Network part Subnet.host Host addresses Broadcast Address 192.168.1.32 0010xxxx 192.168.1.33 to 192.168.1.46 192.168.1.47 Now, let's look at the individual hosts within that subnet: Network part Subnet . Host part Host Address 192.168.1.32 0010.0000 UNUSABLE - HOST PART IS ALL 0's 192.168.1.33 0010.0001 192.168.1.34 0010.0010 192.168.1.35 0010.0011 192.168.1.36 0010.0100 192.168.1.37 0010.0101 192.168.1.38 0010.0110 192.168.1.39 0010.0111 192.168.1.40 0010.1000 192.168.1.41 0010.1001 192.168.1.42 0010.1010 192.168.1.43 0010.1011 192.168.1.44 0010.1100 192.168.1.45 0010.1101 192.168.1.46 0010.1110 192.168.1.47 0010.1111 UNUSABLE - HOST PART IS ALL 1's Although you may be familiar with the all ones broadcast addresses (typically x.x.x.255 for a Class C network) you may not realise that at some time in the past x.x.x.0 was also used as a broadcast address.  Although this seldom is done nowadays, for historical reasons we still obey this convention.  (The last machine I owned that actually used the .0 address for broadcast was a Sun from the late 1980's) Note what happens as the room for hosts gets smaller: This is the host table for a /30: Network part Subnet . Host part Host Address 192.168.1.32 001000.00 UNUSABLE - HOST PART IS ALL 0's 192.168.1.33 001001.01 192.168.1.34 001010.10 192.168.1.35 001011.11 UNUSABLE - HOST PART IS ALL 1's A /30 is particularly wasteful - 50% of the hosts are unusable.  Similarly, a /26 is pretty bad, because 50% of the nets are unusable.  a /28 is best because it lets you have (16 - 2) * (16 - 2) = 192 hosts. This would be the host table if a /31, if it existed: Network part Subnet . Host part Host Address 192.168.1.32 0010000.0 UNUSABLE - HOST PART IS ALL 0's 192.168.1.33 0010000.1 UNUSABLE - HOST PART IS ALL 1's What's wrong with this picture???  Well, you can't have a /31.  Here's why... We can have subnets of /26,/27,/28,/29,/30  - BUT NOT /25 or /31! This is a /30 (with sections removed for brevity): Mask is 11111100 Network part Subnet.host Host addresses Broadcast Address 192.168.1.0 000000xx 192.168.1.1 to 192.168.1.2 192.168.1.3 - UNUSABLE - NETMASK ALL 000000's 192.168.1.4 000001xx 192.168.1.5 to 192.168.1.6 192.168.1.7 192.168.1.8 000010xx 192.168.1.9 to 192.168.1.10 192.168.1.11 192.168.1.12 000011xx 192.168.1.13 to 192.168.1.14 192.168.1.15 192.168.1.16 000100xx 192.168.1.17 to 192.168.1.18 192.168.1.19 192.168.1.20 000101xx 192.168.1.21 to 192.168.1.22 192.168.1.23 192.168.1.24 - 244 ... .............................. ............. 192.168.1.248 111110xx 192.168.1.249 to 192.168.1.250 192.168.1.251 192.168.1.252 111111xx 192.168.1.253 to 192.168.1.254 192.168.1.255  - UNUSABLE - NETMASK ALL 111111's So why not a /25???? Network part Subnet.host Host addresses Broadcast Address 192.168.1.0 0xxxxxxx 192.168.1.1 to 192.168.1.126 192.168.1.127 - UNUSABLE - NETMASK ALL 0's 192.168.1.128 1xxxxxxx 192.168.1.129 to 192.168.1.254 192.168.1.255  - UNUSABLE - NETMASK ALL 1's When the netmask is only one bit, it can't help but being all zeroes or all ones. And why not a /31?   Network part Subnet.host Host addresses Broadcast Addresses (0's and 1's) 192.168.1.0 0000000x 192.168.1.0? to 192.168.1.1? 192.168.1.0 - UNUSABLE - NETMASK 000000's 192.168.1.1 - UNUSABLE - NETMASK 000000's 192.168.1.2 0000001x 192.168.1.2? to 192.168.1.3? 192.168.1.2 - UNUSABLE - Broadcast 0's 192.168.1.3 - UNUSABLE - Broadcast 1's 192.168.1.4 - 250 ... .............................. ............. ............. 192.168.1.252 1111110x 192.168.1.252 to 192.168.1.253 192.168.1.252 - UNUSABLE - Broadcast 0's 192.168.1.253 - UNUSABLE - Broadcast 1's 192.168.1.254 1111111x 192.168.1.254 to 192.168.1.255 192.168.1.254  UNUSABLE - NETMASK 111111's 192.168.1.255  UNUSABLE - NETMASK 111111's Variable subnetting example 1 (insert /30 into /28 from above) Well, in the /28 example above, we've shown that the first and last subnets are unusable, because the subnet mask is either all 0's or all 1's.  This is unfortunate because each of those subnets is losing 16 (-2) IP addresses each. Is there any way we can get back some of those addresses?  Well, yes - there is. If you look at the example of a /30 subnet, you'll see these entries: Network part Subnet.host Host addresses Broadcast Address 192.168.1.0 000000xx 192.168.1.1 to 192.168.1.2 192.168.1.3 - UNUSABLE - NETMASK ALL 000000's 192.168.1.4 000001xx 192.168.1.5 to 192.168.1.6 192.168.1.7 192.168.1.8 000010xx 192.168.1.9 to 192.168.1.10 192.168.1.11 192.168.1.12 000011xx 192.168.1.13 to 192.168.1.14 192.168.1.15 192.168.1.16 - 252 ... .............................. ............. Apart from the first one, these are all perfectly valid subnets, and if we were to configure machines using them, they will look just like normal addresses in a /30 subnet.  We can do exactly the same thing for the 192.168.1.240-255 addresses. These small subnets - they only have 2 IP addresses that are usable - are actually just what you need when you are setting up a point to point link between different subnets (in different locations).  So by using the 'slop' at the end of the range, you can get your point to point links for free. Variable subnetting example 2 (insert /28 from above into /26) Here we have a different and possibly more useful example of variable subnetting. Let's say we have a central office with 50 workstations, one remote office with 10, and another remote office with 9 workstations. The following table tells you how many workstations and how many offices you can have for each size of subnet mask:    Bit Split Subnet Mask Block Size Max Useable Subnets (number of offices) # C IPs/Subnet (number of workstations) 2/6 192 (/26) 64 2 62 3/5 224 (/27) 32 6 30 4/4 240 (/28) 16 14 14 5/3 248 (/29) 8 30 6 6/2 252 (/30) 4 62 2 You see, with one office of size 50, we're forced with a simple subnet scheme to use a /26 (2 bits subnet, 6 bits host).  However, we have three offices, so this won't work. With offices of size 9 or 10 (which we round up to 16 - 2), we could use a /28 (16 - 2 subnets of 16 - 2 stations) - but then we couldn't fit in our 50 station office. Well, the solution is simple: Treat it as a /26, allocate the large office, then extract from a table of /28's enough smaller subnets to fit in the one remaining /26 slot.  Like this: Network part Subnet.host Host addresses Broadcast Address 192.168.1.0 00xxxxxx 192.168.1.1 to 192.168.1.62 192.168.1.63   UNUSABLE - NETMASK ALL 00's 192.168.1.64 01xxxxxx 192.168.1.65 to 192.168.1.126 192.168.1.127  ALLOCATE THIS TO BE FURTHER SUBNETTED 192.168.1.128 10xxxxxx 192.168.1.129 to 192.168.1.190 192.168.1.191  ALLOCATE THIS ONE TO THE 50-STATION OFFICE 192.168.1.192 11xxxxxx 192.168.1.193 to 192.168.1.254 192.168.1.255  UNUSABLE - NETMASK ALL 11's (note: with a simple /26, you lose HALF of your potential IP addresses to the broadcast network addresses) And guess what ... if we look at the earlier table for a /28, you'll find exactly the section we need to extract and fit in here: 192.168.1.63  Network part Subnet.host Host addresses Broadcast Address 192.168.1.64 0100xxxx 192.168.1.65 to 192.168.1.78 192.168.1.79 192.168.1.80 0101xxxx 192.168.1.81 to 192.168.1.94 192.168.1.95 192.168.1.96 0110xxxx 192.168.1.97 to 192.168.1.110 192.168.1.111 192.168.1.112 0111xxxx 192.168.1.113 to 192.168.1.126 192.168.1.127 Now we simply put the two tables together, and we have a variable subnet solution for our three offices.  Plus some spares! Network part Subnet.host Host addresses Broadcast Address 192.168.1.0 00xxxxxx 192.168.1.1 to 192.168.1.62 192.168.1.63   UNUSABLE - NETMASK ALL 00's 192.168.1.64 0100xxxx 192.168.1.65 to 192.168.1.78 192.168.1.79  ALLOCATE THIS TO THE 10-PC OFFICE 192.168.1.80 0101xxxx 192.168.1.81 to 192.168.1.94 192.168.1.95  ALLOCATE THIS TO THE 9-PC OFFICE 192.168.1.96 0110xxxx 192.168.1.97 to 192.168.1.110 192.168.1.111  SPARE 192.168.1.112 0111xxxx 192.168.1.113 to 192.168.1.126 192.168.1.127  SPARE 192.168.1.128 10xxxxxx 192.168.1.129 to 192.168.1.190 192.168.1.191  ALLOCATE THIS ONE TO THE 50-STATION OFFICE 192.168.1.192 11xxxxxx 192.168.1.193 to 192.168.1.254 192.168.1.255  UNUSABLE - NETMASK ALL 11's and don't forget the trick of grabbing the end IP's for the point to point networks to link these offices together. Preference to finer resolution routes - don't need to fully enumerate Let's say you have variably subnetted a network, and of the 30 subnets available, 29 of them are in one office, but the 30th is in the other.  To route this properly you would issue 29 routing commands to one address and 1 to the other.  This is wasteful of router table space.  The thing to do is to issue ONE router command that covers all 30 subnets and send them to the one office, but issue a second router command which is MORE SPECIFIC to extract that one subnet from the block, and route it elsewhere.  More specific routes take precedence in most routers.  Occasionally you will find some brand of router which does require non-overlapping routes, and if this happens to you, just issue all 30 explicit commands. "Supernetting", aka CIDR (Classless InterDomain Routing) The world has a big problem with too many route table entries in the big backbone routers.  To solve that problem, people realised they could aggregate network routing commands, eg a network 192.168.2.0/24 and a neighboring network 192.168.3.0/24 could be represented by merging them like this: 192.168.2.0/23 This would be fine, except we know the problems of subnetting and all-zeroes and all-ones masks.  The same problems would start showing up here.  The solution is simple: someone just issued an edict saying "forget everything you learned, we won't bother with those rules any more".  There's even a command to tell the routers themselves that they should ignore the rules - " ip classless " When you break the rules like this, and allow netmasks that end in all 0's or all 1's, it's called "CIDR" - Classless InterDomain Routing. That's really all you need to know about CIDR.  It's trivial, it's easy, and the details work just the same as subnetting but you merge up instead of splitting down. Calculators Once you understand subnetting as described above, you'll probably be able to do it in your head.  However sometimes you want to check your work, or are in a hurry, and if so, there are many web pages on the net which offer "subnet calculator"s. Just be warned - often they do not check for the special conditions such as all-one's subnets, and will let you do something stupid like ask for a /25 subnet.  The one referred to below does appear to make an effort at checking for this sort of thing, so it may be a good one to bookmark. ... View more

How do I configure QoS for C2960 Software (C2960-LANLITEK9-M), Version 12.2(55)SE5 ... View more

I have a cisco 2801 router, and this is the message on the route : 107221: *Oct  2 12:40:01.039: %SYS-2-MALLOCFAIL: Memory allocation of 925456 bytes failed from 0x600B61C4, alignment 4 Pool: Processor  Free: 81839452  Cause: Memory fragmentation Alternate Pool: None  Free: 0  Cause: No Alternate pool -Process= "DSL State Machine", ipl= 0, pid= 55 -Traceback= 0x611AF4F8 0x6022C0AC 0x602340D8 0x600B61CC 0x6063DC10 0x606403C0 107222: *Oct  2 12:40:31.527: %SYS-2-MALLOCFAIL: Memory allocation of 925456 bytes failed from 0x600B61C4, alignment 4 Pool: Processor  Free: 81840928  Cause: Memory fragmentation Alternate Pool: None  Free: 0  Cause: No Alternate pool -Process= "DSL State Machine", ipl= 0, pid= 55 -Traceback= 0x611AF4F8 0x6022C0AC 0x602340D8 0x600B61CC 0x6063DC10 0x606403C0 What is the problem with my router? ... View more

I need the configuration of the Cisco 7912 SIP phone ... View more