Management Commands

C H A P T E R 9

Management Commands

This chapter describes the management commands available in the FASTPATH® CLI.

The commands in this chapter are divided into three groups:

Show commands display switch settings, statistics, and other information.

Configuration commands configure features and options of the switch. For every configuration command, there is a show command that displays the configuration setting.

Copy commands transfer or save configuration and informational files to and from the switch.

This chapter contains the following sections:

Network Interface Commands

Console Port Access Commands

Telnet Commands

Secure Shell (SSH) Command

Hypertext Transfer Protocol (HTTP) Commands

User Account Commands

SNMP Commands

CLI Command Logging Command

RADIUS Commands

TACACS+ Commands

Configuration Scripting Commands

Pre-login Banner and System Prompt Commands

Network Interface Commands

This section describes the commands you use to configure a logical interface for management access. To configure the management VLAN, see network mgmt_vlan

enable (Privileged EXEC access)

This command gives you access to the Privileged EXEC mode. From the Privileged EXEC mode, you can configure the network interface.

Format	enable
Mode	User EXEC

serviceport ip

This command sets the IP address, the netmask and the gateway of the network management port.

Format	serviceport ip <ipaddr> <netmask> [gateway]
Mode	Privileged EXEC

serviceport protocol

This command specifies the network management port configuration protocol. If you modify this value, the change is effective immediately. If you use the bootp parameter, the switch periodically sends requests to a BootP server until a response is received. If you use the dhcp parameter, the switch periodically sends requests to a DHCP server until a response is received. If you use the none parameter, you must configure the network information for the switch manually.

Format	serviceport protocol {none \| bootp \| dhcp}
Mode	Privileged EXEC

network parms

This command sets the IP Address, subnet mask and gateway of the device. The IP Address and the gateway must be on the same subnet.

Format	network parms <ipaddr> <netmask> [<gateway>]
Mode	Privileged EXEC

network protocol

This command specifies the network configuration protocol to be used. If you modify this value, change is effective immediately. If you modify this value, the change is effective immediately. If you use the bootp parameter, the switch periodically sends requests to a BootP server until a response is received. If you use the dhcp parameter, the switch periodically sends requests to a DHCP server until a response is received. If you use the none parameter, you must configure the network information for the switch manually.

Default	none
Format	network protocol {none \| bootp \| dhcp}
Mode	Privileged EXEC

network mac-address

This command sets locally administered MAC addresses. The following rules apply:

Bit 6 of byte 0 (called the U/L bit) indicates whether the address is universally administered (b'0') or locally administered (b'1').

Bit 7 of byte 0 (called the I/G bit) indicates whether the destination address is an individual address (b'0') or a group address (b'1').

The second character, of the twelve character macaddr, must be 2, 6, A or E.

A locally administered address must have bit 6 On (b'1') and bit 7 Off (b'0').

Format	network mac-address <macaddr>
Mode	Privileged EXEC

network mac-type

This command specifies whether the switch uses the burned in MAC address or the locally-administered MAC address.

Default	burnedin
Format	network mac-type {local \| burnedin}
Mode	Privileged EXEC

no network mac-type

This command resets the value of MAC address to its default.

Format	no network mac-type
Mode	Privileged EXE

network javamode

This command specifies whether or not the switch should allow access to the Java applet in the header frame of the Web interface. When access is enabled, the Java applet can be viewed from the Web interface. When access is disabled, the user cannot view the Java applet.

Default	enabled
Format	network javamode
Mode	Privileged EXEC

no network javamode

This command disallows access to the Java applet in the header frame of the Web interface. When access is disabled, the user cannot view the Java applet.

Format	no network javamode
Mode	Privileged EXEC

show network

This command displays configuration settings associated with the switch's network interface. The network interface is the logical interface used for in-band connectivity with the switch via any of the switch's front panel ports. The configuration parameters associated with the switch's network interface do not affect the configuration of the front panel ports through which traffic is switched or routed.

Format	show network
Modes	Privileged EXEC User EXEC

TABLE 9-1 Entry Definitions for *show network*
Entry	Definition
IP Address	The IP address of the interface. The factory default value is 0.0.0.0
Subnet Mask	The IP subnet mask for this interface. The factory default value is 0.0.0.0
Default Gateway	The default gateway for this IP interface. The factory default value is 0.0.0.0
Burned In MAC Address	The burned in MAC address used for in-band connectivity.
Locally Administered MAC Address	If desired, a locally administered MAC address can be configured for in-band connectivity. To take effect, 'MAC Address Type' must be set to 'Locally Administered'. Enter the address as twelve hexadecimal digits (6 bytes) with a colon between each byte. Bit 1 of byte 0 must be set to a 1 and bit 0 to a 0, i.e. byte 0 should have the following mask 'xxxx xx10'. The MAC address used by this bridge when it must be referred to in a unique fashion. It is recommended that this be the numerically smallest MAC address of all ports that belong to this bridge. However it is only required to be unique. When concatenated with dot1dStpPriority a unique BridgeIdentifier is formed which is used in the Spanning Tree Protocol.
MAC Address Type	Specifies which MAC address should be used for in-band connectivity. The choices are the burned in or the Locally Administered address. The factory default is to use the burned in MAC address.
Network Configuration Protocol Current	Indicates which network protocol is being used. The options are bootp \| dhcp \| none.
Java Mode	Specifies if the switch should allow access to the Java applet in the header frame. Enabled means the applet can be viewed. The factory default is disabled.
Web Mode	Specifies if the switch should allow access to the Web Interface.

show serviceport

This command displays service port configuration information.

Format	show serviceport
Mode	Privileged EXEC

TABLE 9-2 Entry Definitions for *show serviceport*
Entry	Definition
IP Address	The IP address of the interface. The factory default value is 0.0.0.0
Subnet Mask	The IP subnet mask for this interface. The factory default value is 0.0.0.0
Default Gateway	The default gateway for this IP interface. The factory default value is 0.0.0.0
ServPort Configuration Protocol Current	Indicates what network protocol was used on the last, or current power-up cycle, if any.
Burned in MAC Address	The burned in MAC address used for in-band connectivity.

Console Port Access Commands

This section describes the commands you use to configure the console port. You can use a serial cable to connect a management host directly to the console port of the switch.

configuration

This command gives you access to the Global Config mode. From the Global Config mode, you can configure a variety of system settings, including user accounts. From the Global Config mode, you can enter other command modes, including Line Config mode.

Format	configuration
Mode	Privileged EXEC

lineconfig

This command gives you access to the Line Config mode, which allows you to configure various Telnet settings and the console port.

Format	lineconfig
Mode	Global Config

serial location

This command specifies whether the serial management port goes out the front or the RTM.

Default	front
Format	serial location {front \| rtm}
Mode	Line Config

serial baudrate

This command specifies the communication rate of the terminal interface. The supported rates are 1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200.

Default	9600
Format	serial baudrate {1200 \| 2400 \| 4800 \| 9600 \| 19200 \| 38400 \| 57600 \| 115200}
Mode	Line Config

no serial baudrate

This command sets the communication rate of the terminal interface.

Format	no serial baudrate
Mode	Line Config

serial timeout

This command specifies the maximum connect time (in minutes) without console activity. A value of 0 indicates that a console can be connected indefinitely. The time range is 0 to 160.

Default	5
Format	serial timeout <0-160>
Mode	Line Config

no serial timeout

This command sets the maximum connect time (in minutes) without console activity.

Format	no serial timeout
Mode	Line Config

show serial

This command displays serial communication settings for the switch.

Format	show serial
Modes	Privileged EXEC User EXEC

TABLE 9-3 Entry Definitions for *show serial*
Entry	Definition
Serial Port Login Timeout (minutes)	Specifies the time, in minutes, of inactivity on a Serial port connection, after which the Switch will close the connection. Any numeric value between 0 and 160 is allowed, the factory default is 5. A value of 0 disables the timeout.
Baud Rate (bps)	The default baud rate at which the serial port will try to connect. The available values are 1200, 2400, 4800, 9600, 19200, 38400,57600, and 115200 baud. The factory default is 9600 baud.
Character Size (bits)	The number of bits in a character. The number of bits is always 8.
Flow Control	Whether Hardware Flow-Control is enabled or disabled. Hardware Flow Control is always disabled.
Stop Bits	The number of Stop bits per character. The number of Stop bits is always 1.
Parity Type	The Parity Method used on the Serial Port. The Parity Method is always None.

Telnet Commands

This section describes the commands you use to configure and view Telnet settings. You can use Telnet to manage the device from a remote management host.

ip telnet server enable

Use this command to enable Telnet connections to the system and to enable the Telnet Server Admin Mode. This command opens the Telnet listening port.

Default	enabled
Format	ip telnet server enable
Mode	Privileged EXEC

no ip telnet server enable

Use this command to disable Telnet access to the system and to disable the Telnet Server Admin Mode. This command closes the Telnet listening port and disconnects all open Telnet sessions.

Format	no ip telnet server enable
Mode	Privileged EXEC

telnet

This command establishes a new outbound Telnet connection to a remote host. The host value must be a valid IP address. Valid values for port should be a valid decimal integer in the range of 0 to 65535, where the default value is 23. If [debug] is used, the current Telnet options enabled is displayed. The optional line parameter sets the outbound Telnet operational mode as ‘linemode’, where by default, the operational mode is ‘character mode’. The noecho option disables local echo.

Format	telnet <host> <port> [debug] [line] [noecho]
Modes	Privileged EXEC User EXEC

transport input telnet

This command regulates new Telnet sessions. If enabled, new Telnet sessions can be established until there are no more sessions available. An established session remains active until the session is ended or an abnormal network error ends the session.

Note - If the Telnet Server Admin Mode is disabled, Telnet sessions cannot be established. Use the ip telnet server enable command to enable Telnet Server Admin Mode.

Default	enabled
Format	transport input telnet
Mode	Line Config

no transport input telnet

Use this command to prevent new Telnet sessions from being established.

Format	no transport input telnet
Mode	Line Config

transport output telnet

This command regulates new outbound Telnet connections. If enabled, new outbound Telnet sessions can be established until the system reaches the maximum number of simultaneous outbound Telnet sessions allowed. An established session remains active until the session is ended or an abnormal network error ends it.

Default	enabled
Format	transport output telnet
Mode	Line Config

no transport output telnet

Use this command to prevent new outbound Telnet connection from being established.

Format	no transport output telnet
Mode	Line Config

session-limit

This command specifies the maximum number of simultaneous outbound Telnet sessions. A value of 0 indicates that no outbound Telnet session can be established.

Default	5
Format	session-limit <0-5>
Mode	Line Config

no session-limit

This command sets the maximum number of simultaneous outbound Telnet sessions to the default value.

Format	no session-limit
Mode	Line Config

session-timeout

This command sets the Telnet session timeout value.The timeout value unit of time is minutes. A value of 0 indicates that a session remains active indefinitely.

Default	0
Format	session-timeout <0-160>
Mode	Line Config

no session-timeout

This command sets the Telnet session timeout value to the default. The timeout value unit of time is minutes.

Format	no session-timeout
Mode	Line Config

telnetcon maxsessions

This command specifies the maximum number of Telnet connection sessions that can be established. A value of 0 indicates that no Telnet connection can be established. The range is 0-5.

Default	5
Format	telnetcon maxsessions <0-5>
Mode	Privileged EXEC

no telnetcon maxsessions

This command sets the maximum number of Telnet connection sessions that can be established to the default value.

Format	no telnetcon maxsessions
Mode	Privileged EXEC

telnetcon timeout

This command sets the Telnet connection session timeout value, in minutes. A session is active as long as the session has not been idle for the value set. The time is a decimal value from 1 to 160.

Note - When you change the timeout value, the new value is applied to all active and inactive sessions immediately. Any sessions that have been idle longer than the new timeout value are disconnected immediately.

Default	5
Format	telnetcon timeout <1-160>
Mode	Privileged EXEC

no telnetcon timeout

This command sets the Telnet connection session timeout value to the default.

Note - Changing the timeout value for active sessions does not become effective until the session is reaccessed. Also, any keystroke activates the new timeout duration.

Format	no telnetcon timeout
Mode	Privileged EXEC

disconnect

Use the disconnect command to close Telnet or SSH sessions. Use all to close all Telnet and SSH sessions, or use <session-id> to specify the session ID to close. To view the possible values for <session-id>, use the show loginsession command.

Format	disconnect {<session_id> \| all}
Mode	Privileged EXEC

show telnet

This command displays the current outbound Telnet settings. In other words, these settings apply to Telnet connections initiated from the switch to a remote system.

Format	show telnet
Modes	Privileged EXEC User EXEC

TABLE 9-4 Entry Definitions for *show telnet*
Entry	Definition
Outbound Telnet Login Timeout	Indicates the number of minutes an outbound Telnet session is allowed to remain inactive before being logged off.
Maximum Number of Outbound Telnet Sessions	Indicates the number of simultaneous outbound Telnet connections allowed.
Allow New Outbound Telnet Sessions	Indicates whether outbound Telnet sessions will be allowed.

show telnetcon

This command displays the current inbound Telnet settings. In other words, these settings apply to Telnet connections initiated from a remote system to the switch.

Format	show telnetcon
Modes	Privileged EXEC User EXEC

TABLE 9-5 Entry Definitions for *show telnetcon*
Entry	Definition
Remote Connection Login Timeout (minutes)	This object indicates the number of minutes a remote connection session is allowed to remain inactive before being logged off. May be specified as a number from 1 to 160. The factory default is 5.
Maximum Number of Remote Connection Sessions	This object indicates the number of simultaneous remote connection sessions allowed. The factory default is 5.
Allow New Telnet Sessions	Indicates that new Telnet sessions will not be allowed when set to no. The factory default value is yes.

Secure Shell (SSH) Command

This section describes the commands you use to configure SSH access to the switch. Use SSH to access the switch from a remote management host.

Note - The system allows a maximum of 5 SSH sessions.

ip ssh

Use this command to enable SSH access to the system.

Default	disabled
Format	ip ssh
Mode	Privileged EXEC

no ip ssh

Use this command to disable SSH access to the system.

Format	no ip ssh
Mode	Privileged EXEC

ip ssh protocol

This command is used to set or remove protocol levels (or versions) for SSH. Either SSH1 (1), SSH2 (2), or both SSH 1 and SSH 2 (1 and 2) can be set.

Default	1 and 2
Format	ip ssh protocol [1] [2]
Mode	Privileged EXEC

ip ssh server enable

This command enables the IP secure shell server.

Default	disabled
Format	ip ssh server enable
Mode	Privileged EXEC

no ip ssh server enable

This command disables the IP secure shell server.

Format	no ip ssh server enable
Mode	Privileged EXEC

sshcon maxsessions

This command specifies the maximum number of SSH connection sessions that can be established. A value of 0 indicates that no ssh connection can be established. The range is 0 to 5.

Default	5
Format	sshcon maxsessions <0-5>
Mode	Privileged EXEC

no sshcon maxsessions

This command sets the maximum number of allowed SSH connection sessions to the default value.

Format	no sshcon maxsessions
Mode	Privileged EXEC

sshcon timeout

This command sets the SSH connection session timeout value, in minutes. A session is active as long as the session has been idle for the value set. The time is a decimal value from 1 to 160.

Changing the timeout value for active sessions does not become effective until the session is re accessed. Also, any keystroke activates the new timeout duration.

Default	5
Format	sshcon timeout <1-160>
Mode	Privileged EXEC

no sshcon timeout

This command sets the SSH connection session timeout value, in minutes, to the default.

Changing the timeout value for active sessions does not become effective until the session is re accessed. Also, any keystroke activates the new timeout duration.

Format	no sshcon timeout
Mode	Privileged EXEC

show ip ssh

This command displays the ssh settings.

Format	show ip ssh
Mode	Privileged EXEC

TABLE 9-6 Entry Definitions for *show ip ssh*
Entry	Definition
Administrative Mode	This field indicates whether the administrative mode of SSH is enabled or disabled.
Protocol Level	The protocol level may have the values of version 1, version 2 or both versions 1 and version 2.
Connections	This field specifies the current SSH connections.

Hypertext Transfer Protocol (HTTP) Commands

This section describes the commands you use to configure HTTP access to the switch. Access to the switch by using a Web browser is enabled by default. Everything you can view and configure by using the CLI is also available by using the Web.

ip http secure-port

This command is used to set the SSL port where port can be 1-65535 and the default is port 443.

Default	443
Format	ip http secure-port <portid>
Mode	Privileged EXEC

no ip http secure-port

This command is used to reset the SSL port to the default value.

Format	no ip http secure-port
Mode	Privileged EXEC

ip http secure-protocol

This command is used to set protocol levels (versions). The protocol level can be set to TLS1, SSL3 or to both TLS1 and SSL3.

Default	SSL3 and TLS1
Format	ip http secure-protocol [SSL3] [TLS1]
Mode	Privileged EXEC

ip http secure-server

This command is used to enable the secure socket layer for secure HTTP.

Default	disabled
Format	ip http secure-server
Mode	Privileged EXEC

no ip http secure-server

This command is used to disable the secure socket layer for secure HTTP.

Format	no ip http secure-server
Mode	Privileged EXEC

ip http server

This command enables access to the switch through the Web interface. When access is enabled, the user can login to the switch from the Web interface. When access is disabled, the user cannot login to the switch's Web server.

Disabling the Web interface takes effect immediately. All interfaces are effected.

Default	enabled
Format	ip http server
Mode	Privileged EXEC

no ip http server

This command disables access to the switch through the Web interface. When access is disabled, the user cannot login to the switch's Web server.

Format	no ip http server
Mode	Privileged EXEC

show ip http

This command displays the http settings for the switch.

Format	show ip http
Mode	Privileged EXEC

TABLE 9-7 Entry Definitions for *show ip http*
Entry	Definition
Secure-Server Administrative Mode	Indicates whether the administrative mode of secure HTTP is enabled or disabled.
Secure Protocol Level	Possible values are SSL3, TSL1, or both SSL3 and TSL1.
Secure Port	This field specifies the port configured for SSLT.
HTTP Mode	This field indicates whether the HTTP mode is enabled or disabled.

User Account Commands

This section describes the commands you use to add, manage, and delete system users. FASTPATH has two default users: admin and guest. The admin user can view and configure system settings, and the guest user can view settings.

Note - You cannot delete the admin user, and there is only one user allowed with read/write privileges. You can configure up to five read-only users on the system.

users name

This command adds a new user account, if space permits. The account <username> can be up to eight characters in length. You can use alphanumeric characters as well as the dash (‘-’) and underscore (‘_’). You can define up to six user names.

Note - The <username> is not case sensitive when you add and delete users, and when the user logs in. However, when you use the <username> to set the user password, authentication, or encryption, you must enter the <username> in the same case you used when you added the user. To see the case of the <username>, enter the show users command.

Format	users name <username>
Mode	Global Config

no users name

This command removes a user account.

Format	no users name <username>
Mode	Global Config

Note - You cannot delete the “admin” user account.

users passwd

Use this command to change a password. Passwords are a maximum of eight alphanumeric characters. If a user is authorized for authentication or encryption is enabled, the password length must be at least eight alphanumeric characters. The password is case sensitive. When you change a password, a prompt asks for the old password. If there is no password, press enter. You must enter the <username> in the same case you used when you added the user. To see the case of the <username>, enter the show users command.

Default	no password
Format	users passwd <username>
Mode	Global Config

no users passwd

This command sets the password of an existing user to blank. When you change a password, a prompt asks for the old password. If there is no password, press enter.

Format	no users passwd <username>
Mode	Global Config

users snmpv3 accessmode

This command specifies the snmpv3 access privileges for the specified login user. The valid accessmode values are readonly or readwrite. The <username> is the login user name for which the specified access mode applies. The default is readwrite for the “admin” user and readonly for all other users. You must enter the <username> in the same case you used when you added the user. To see the case of the <username>, enter the show users command.

Default	admin - readwrite other - readonly
Format	users snmpv3 accessmode <username> {readonly \| readwrite}
Mode	Global Config

no users snmpv3 accessmode

This command sets the snmpv3 access privileges for the specified user as readwrite for the “admin” user and readonly for all other users. The <username> value is the user name for which the specified access mode will apply.

Format	no users snmpv3 accessmode <username>
Mode	Global Config

users snmpv3 authentication

This command specifies the authentication protocol to be used for the specified user. The valid authentication protocols are none, md5 or sha. If you specify md5 or sha, the login password is also used as the snmpv3 authentication password and therefore must be at least eight characters in length. The <username> is the user name associated with the authentication protocol. You must enter the <username> in the same case you used when you added the user. To see the case of the <username>, enter the show users command.

Default	no authentication
Format	users snmpv3 authentication <username> {none \| md5 \| sha}
Mode	Global Config

no users snmpv3 authentication

This command sets the authentication protocol to be used for the specified user to none. The <username> is the user name for which the specified authentication protocol is used.

Format	no users snmpv3 authentication <username>
Mode	Global Config

users snmpv3 encryption

This command specifies the encryption protocol used for the specified user. The valid encryption protocols are des or none.

If you select des, you can specify the required key on the command line. The encryption key must be 8 to 64 characters long. If you select the des protocol but do not provide a key, the user is prompted for the key. When you use the des protocol, the login password is also used as the snmpv3 encryption password, so it must be a minimum of eight characters. If you select none, you do not need to provide a key.

The <username> value is the login user name associated with the specified encryption. You must enter the <username> in the same case you used when you added the user. To see the case of the <username>, enter the show users command.

Default	no encryption
Format	users snmpv3 encryption <username> {none \| des[key]}
Mode	Global Config

no users snmpv3 encryption

This command sets the encryption protocol to none. The <username> is the login user name for which the specified encryption protocol will be used.

Format	no users snmpv3 encryption <username>
Mode	Global Config

show loginsession

This command displays current Telnet and serial port connections to the switch.

Format	show loginsession
Mode	Privileged EXEC

TABLE 9-8
Entry	Definition
ID	Login Session ID
User Name	The name the user will use to login using the serial port or Telnet.
Connection From	IP address of the Telnet client machine or EIA-232 for the serial port connection.
Idle Time	Time this session has been idle.
Session Time	Total time this session has been connected.

show users

This command displays the configured user names and their settings. This command is only available for users with Read/Write privileges. The SNMPv3 fields will only be displayed if SNMP is available on the system.

Format	show users
Mode	Privileged EXEC

TABLE 9-9 Entry Definitions for *show users*
Entry	Definition
User Name	The name the user enters to login using the serial port, Telnet or Web.
Access Mode	Shows whether the user is able to change parameters on the switch (Read/Write) or is only able to view them (Read Only). As a factory default, the “admin” user has Read/Write access and the “guest” has Read Only access. There can only be one Read/Write user and up to five Read Only users.
SNMPv3 Access Mode	This field displays the SNMPv3 Access Mode. If the value is set to ReadWrite, the SNMPv3 user is able to set and retrieve parameters on the system. If the value is set to ReadOnly, the SNMPv3 user is only able to retrieve parameter information. The SNMPv3 access mode may be different than the CLI and Web access mode.
SNMPv3 Authentication	This field displays the authentication protocol to be used for the specified login user.
SNMPv3 Encryption	This field displays the encryption protocol to be used for the specified login user.

SNMP Commands

This section describes the commands you use to configure Simple Network Management Protocol (SNMP) on the switch. You can configure the switch to act as an SNMP agent so that it can communicate with SNMP managers on your network.

snmp-server

This command sets the name and the physical location of the switch, and the organization responsible for the network. The range for <name>, <loc> and <con> is from 1 to 31 alphanumeric characters.

Default	none
Format	snmp-server {sysname <name> \| location <loc> \| contact <con>}
Mode	Global Config

snmp-server community

This command adds (and names) a new SNMP community. A community <name> is a name associated with the switch and with a set of SNMP managers that manage it with a specified privileged level. The length of <name> can be up to 16 case-sensitive characters.

Note - Community names in the SNMP Community Table must be unique. When making multiple entries using the same community name, the first entry is kept and processed and all duplicate entries are ignored.

Default	public and private, which you can rename default values for the remaining four community names are blank
Format	snmp-server community <name>
Mode	Global Config

no snmp-server community

This command removes this community name from the table. The <name> is the community name to be deleted.

Format	no snmp-server community <name>
Mode	Global Config

snmp-server community ipaddr

This command sets a client IP address for an SNMP community. The address is the associated community SNMP packet sending address and is used along with the client IP mask value to denote a range of IP addresses from which SNMP clients may use that community to access the device. A value of 0.0.0.0 allows access from any IP address. Otherwise, this value is ANDed with the mask to determine the range of allowed client IP addresses. The name is the applicable community name.

Default	0.0.0.0
Format	snmp-server community ipaddr <ipaddr> <name>
Mode	Global Config

no snmp-server community ipaddr

This command sets a client IP address for an SNMP community to 0.0.0.0. The name is the applicable community name.

Format	no snmp-server community ipaddr <name>
Mode	Global Config

snmp-server community ipmask

This command sets a client IP mask for an SNMP community. The address is the associated community SNMP packet sending address and is used along with the client IP address value to denote a range of IP addresses from which SNMP clients may use that community to access the device. A value of 255.255.255.255 will allow access from only one station, and will use that machine's IP address for the client IP Address. A value of 0.0.0.0 will allow access from any IP address. The name is the applicable community name.

Default	0.0.0.0
Format	snmp-server community ipmask <ipmask> <name>
Mode	Global Config

no snmp-server community ipmask

This command sets a client IP mask for an SNMP community to 0.0.0.0. The name is the applicable community name. The community name may be up to 16 alphanumeric characters.

Format	no snmp-server community ipmask <name>
Mode	Global Config

snmp-server community mode

This command activates an SNMP community. If a community is enabled, an SNMP manager associated with this community manages the switch according to its access right. If the community is disabled, no SNMP requests using this community are accepted. In this case the SNMP manager associated with this community cannot manage the switch until the Status is changed back to Enable.

Default	private and public communities - enabled other four - disabled
Format	snmp-server community mode <name>
Mode	Global Config

no snmp-server community mode

This command deactivates an SNMP community. If the community is disabled, no SNMP requests using this community are accepted. In this case the SNMP manager associated with this community cannot manage the switch until the Status is changed back to Enable.

Format	no snmp-server community mode <name>
Mode	Global Config

snmp-server community ro

This command restricts access to switch information. The access mode is read-only (also called public).

Format	snmp-server community ro <name>
Mode	Global Config

snmp-server community rw

This command restricts access to switch information. The access mode is read/write (also called private).

Format	snmp-server community rw <name>
Mode	Global Config

snmp-server enable traps violation

This command enables the sending of new violation traps designating when a packet with a disallowed MAC address is received on a locked port.

Note - For other port security commands, see Protected Ports Commands.

Default	disabled
Format	snmp-server enable traps violation
Mode	Interface Config

no snmp-server enable traps violation

This command disables the sending of new violation traps.

Format	no snmp-server enable traps violation
Mode	Interface Config

snmp-server enable traps

This command enables the Authentication Flag.

Default	enabled
Format	snmp-server enable traps
Mode	Global Config

no snmp-server enable traps

This command disables the Authentication Flag.

Format	no snmp-server enable traps
Mode	Global Config

snmp-server enable traps bcaststorm

This command enables the broadcast storm trap. When enabled, broadcast storm traps are sent only if the broadcast storm recovery mode setting associated with the port is enabled.

Default	enabled
Format	snmp-server enable traps bcaststorm
Mode	Global Config

no snmp-server enable traps bcaststorm

This command disables the broadcast storm trap. When enabled, broadcast storm traps are sent only if the broadcast storm recovery mode setting associated with the port is enabled.

Format	no snmp-server enable traps bcaststorm
Mode	Global Config

snmp-server enable traps linkmode

This command enables Link Up/Down traps for the entire switch. When enabled, link traps are sent only if the Link Trap flag setting associated with the port is enabled. snmp trap link-status

Default	enabled
Format	snmp-server enable traps linkmode
Mode	Global Config

no snmp-server enable traps linkmode

This command disables Link Up/Down traps for the entire switch.

Format	no snmp-server enable traps linkmode
Mode	Global Config

snmp-server enable traps multiusers

This command enables Multiple User traps. When the traps are enabled, a Multiple User Trap is sent when a user logs in to the terminal interface (EIA 232 or Telnet) and there is an existing terminal interface session.

Default	enabled
Format	snmp-server enable traps multiusers
Mode	Global Config

no snmp-server enable traps multiusers

This command disables Multiple User traps.

Format	no snmp-server enable traps multiusers
Mode	Global Config

snmp-server enable traps stpmode

This command enables the sending of new root traps and topology change notification traps.

Default	enabled
Format	snmp-server enable traps stpmode
Mode	Global Config

no snmp-server enable traps stpmode

This command disables the sending of new root traps and topology change notification traps.

Format	no snmp-server enable traps stpmode
Mode	Global Config

snmptrap

This command adds an SNMP trap receiver. The maximum length of <name> is 16 case-sensitive alphanumeric characters. The <snmpversion> is the version of SNMP. The version parameter options are snmpv1 or snmpv2.

Note - The <name> parameter does not need to be unique, however; the <name> and <ipaddr> pair must be unique. Multiple entries can exist with the same <name>, as long as they are associated with a different <ipaddr>. The reverse scenario is also acceptable. The <name> is the community name used when sending the trap to the receiver, but the <name> is not directly associated with the SNMP Community Table, See “snmp-server community” on page39.”

Default	snmpv2
Format	snmptrap <name> <ipaddr> [snmpversion <snmpversion>]
Mode	Global Config

no snmptrap

This command deletes trap receivers for a community.

Format	no snmptrap <name> <ipaddr>
Mode	Global Config

snmptrap snmpversion

This command modifies the SNMP version of a trap. The maximum length of <name> is 16 case-sensitive alphanumeric characters. The <snmpversion> parameter options are snmpv1 or snmpv2.

Note - This command does not support a “no” form.

Default	snmpv2
Format	snmptrap snmpversion <name> <ipaddr> <snmpversion>
Mode	Global Config

snmptrap ipaddr

This command assigns an IP address to a specified community name. The maximum length of name is 16 case-sensitive alphanumeric characters.

Note - IP addresses in the SNMP trap receiver table must be unique. If you make multiple entries using the same IP address, the first entry is retained and processed. All duplicate entries are ignored.

Format	snmptrap ipaddr <name> <ipaddrold> <ipaddrnew>
Mode	Global Config

snmptrap mode

This command activates or deactivates an SNMP trap. Enabled trap receivers are active (able to receive traps). Disabled trap receivers are inactive (not able to receive traps).

Format	snmptrap mode <name> <ipaddr>
Mode	Global Config

no snmptrap mode

This command deactivates an SNMP trap. Disabled trap receivers are inactive (not able to receive traps).

Format	no snmptrap mode <name> <ipaddr>
Mode	Global Config

snmp trap link-status

This command enables link status traps by interface.

Note - This command is valid only when the Link Up/Down Flag is enabled. snmp-server enable traps linkmode

Format	snmp trap link-status
Mode	Interface Config

no snmp trap link-status

This command disables link status traps by interface.

Note - This command is valid only when the Link Up/Down Flag is enabled. See ‘snmp-server enable traps linkmode’ command).

Format	no snmp trap link-status
Mode	Interface Config

snmp trap link-status all

This command enables link status traps for all interfaces.

Note - This command is valid only when the Link Up/Down Flag is enabled. snmp-server enable traps linkmode

Format	snmp trap link-status all
Mode	Global Config

no snmp trap link-status all

This command disables link status traps for all interfaces.

Note - This command is valid only when the Link Up/Down Flag is enabled. snmp-server enable traps linkmode

Format	no snmp trap link-status all
Mode	Global Config

show snmpcommunity

This command displays SNMP community information. Six communities are supported. You can add, change, or delete communities. The switch does not have to be reset for changes to take effect.

The SNMP agent of the switch complies with SNMP Versions 1, 2 or 3. For more information about the SNMP specification, see the SNMP RFCs. The SNMP agent sends traps through TCP/IP to an external SNMP manager based on the SNMP configuration (the trap receiver and other SNMP community parameters).

Format	show snmpcommunity
Mode	Privileged EXEC

TABLE 9-10 Entry Definitions for *show snmpcommunity*
Entry	Definition
SNMP Community Name	The community string to which this entry grants access. A valid entry is a case-sensitive alphanumeric string of up to 16 characters. Each row of this table must contain a unique community name.
Client IP Address	An IP address (or portion thereof) from which this device will accept SNMP packets with the associated community. The requesting entity's IP address is ANDed with the Subnet Mask before being compared to the IP Address. Note: If the Subnet Mask is set to 0.0.0.0, an IP Address of 0.0.0.0 matches all IP addresses. The default value is 0.0.0.0
Client IP Mask	A mask to be ANDed with the requesting entity's IP address before comparison with IP Address. If the result matches with IP Address then the address is an authenticated IP address. For example, if the IP Address = 9.47.128.0 and the corresponding Subnet Mask = 255.255.255.0 a range of incoming IP addresses would match, i.e. the incoming IP Address could equal 9.47.128.0 - 9.47.128.255. The default value is 0.0.0.0
Access Mode	The access level for this community string.
Status	The status of this community access entry.

show snmptrap

This command displays SNMP trap receivers. Trap messages are sent across a network to an SNMP Network Manager. These messages alert the manager to events occurring within the switch or on the network. Six trap receivers are simultaneously supported.

Format	show snmptrap
Mode	Privileged EXEC

TABLE 9-11 Entry Definitions for *show snmptrap*

SNMP Trap Name	The community string of the SNMP trap packet sent to the trap manager. The string is case sensitive and can be up to 16 alphanumeric characters.
IP Address	The IP address to receive SNMP traps from this device.
Status	Indicates the receiver's status (enabled or disabled).

show trapflags

This command displays trap conditions. Configure which traps the switch should generate by enabling or disabling the trap condition. If a trap condition is enabled and the condition is detected, the SNMP agent on the switch sends the trap to all enabled trap receivers. You do not have to reset the switch to implement the changes. Cold and warm start traps are always generated and cannot be disabled.

Format	show trapflags
Mode	Privileged EXEC

TABLE 9-12 Entry Definitions for *show trapflags*
Entry	Definition
Authentication Flag	Can be enabled or disabled. The factory default is enabled. Indicates whether authentication failure traps will be sent.
Link Up/Down Flag	Can be enabled or disabled. The factory default is enabled. Indicates whether link status traps will be sent.
Multiple Users Flag	Can be enabled or disabled. The factory default is enabled. Indicates whether a trap will be sent when the same user ID is logged into the switch more than once at the same time (either through Telnet or the serial port).
Spanning Tree Flag	Can be enabled or disabled. The factory default is enabled. Indicates whether spanning tree traps are sent.
Broadcast Storm Flag	Can be enabled or disabled. The factory default is enabled. Indicates whether broadcast storm traps are sent.
ACL Traps	May be enabled or disabled. The factory default is disabled. Indicates whether ACL traps are sent.
BGP4 Traps	Can be enabled or disabled. The factory default is disabled. Indicates whether BGP4 traps are sent.
DVMRP Traps	Can be enabled or disabled. The factory default is disabled. Indicates whether DVMRP traps are sent.
OSPF Traps	Can be enabled or disabled. The factory default is disabled. Indicates whether OSPF traps are sent.
PIM Traps	Can be enabled or disabled. The factory default is disabled. Indicates whether PIM traps are sent.

CLI Command Logging Command

This section describes the commands you use to configure CLI Command Logging.

logging cli-command

This command enables the CLI command logging feature, which enables the FASTPATH software to log all CLI commands issued on the system.

Default	enabled
Format	logging cli-command
Mode	Global Config

no logging cli-command

This command disables the CLI command Logging feature.

Format	no logging cli-command
Mode	Global Config

RADIUS Commands

This section describes the commands you use to configure the switch to use a Remote Authentication Dial-In User Service (RADIUS) server on your network for authentication and accounting.

radius accounting mode

This command is used to enable the RADIUS accounting function.

Default	disabled
Format	radius accounting mode
Mode	Global Config

no radius accounting mode

This command is used to set the RADIUS accounting function to the default value - i.e. the RADIUS accounting function is disabled.

Format	no radius accounting mode
Mode	Global Config

radius server host

This command is used to configure the RADIUS authentication and accounting server. If you use the <auth> parameter, the command configures the IP address to use to connect to a RADIUS authentication server. You can configure up to 3 servers per RADIUS client. If the maximum number of configured servers is reached, the command fails until you remove one of the servers by issuing the “no” form of the command. If you use the optional <port> parameter, the command configures the UDP port number to use when connecting to the configured RADIUS server. The <port> number range is 1 - 65535, with 1812 being the default value.

Note - To re-configure a RADIUS authentication server to use the default UDP <port>, set the <port> parameter to 1812.

If you use the <acct> token, the command configures the IP address to use for the RADIUS accounting server. You can only configure one accounting server. If an accounting server is currently configured, use the “no” form of the command to remove it from the configuration. The IP address you specify must match that of a previously configured accounting server. If you use the optional <port> parameter, the command configures the UDP port to use when connecting to the RADIUS accounting server. If a <port> is already configured for the accounting server, the new <port> replaces the previously configured <port>. The <port> must be a value in the range 1 - 65535, with 1813 being the default.

Note - To re-configure a RADIUS accounting server to use the default UDP <port>, set the <port> parameter to 1813.

Format	radius server host {auth \| acct} <ipaddr> [<port>]
Mode	Global Config

no radius server host

This command is used to remove the configured RADIUS authentication server or the RADIUS accounting server. If the 'auth' token is used, the previously configured RADIUS authentication server is removed from the configuration. Similarly, if the 'acct' token is used, the previously configured RADIUS accounting server is removed from the configuration. The <ipaddr> parameter must match the IP address of the previously configured RADIUS authentication / accounting server.

Format	no radius server host {auth \| acct} <ipaddress>
Mode	Global Config

radius server key

This command is used to configure the shared secret between the RADIUS client and the RADIUS accounting / authentication server. Depending on whether the 'auth' or 'acct' token is used, the shared secret is configured for the RADIUS authentication or RADIUS accounting server. The IP address provided must match a previously configured server. When this command is executed, the secret is prompted.

Note - The secret must be an alphanumeric value not exceeding 16 characters.

Format	radius server key {auth \| acct} <ipaddr>
Mode	Global Config

radius server msgauth

This command enables the message authenticator attribute for a specified server.

Format	radius server msgauth <ipaddr>
Mode	Global Config

no radius server msgauth

This command disables the message authenticator attribute for a specified server.

Format	no radius server msgauth <ipaddr>
Mode	Global Config

radius server primary

This command is used to configure the primary RADIUS authentication server for this RADIUS client. The primary server handles RADIUS requests. The remaining configured servers are only used if the primary server cannot be reached. You can configure up to three servers on each client. Only one of these servers can be configured as the primary. If a primary server is already configured prior to this command being executed, the server specified by the IP address specified used in this command will become the new primary server. The IP address must match that of a previously configured RADIUS authentication server.

Format	radius server primary <ipaddr>
Mode	Global Config

radius server retransmit

This command sets the maximum number of times a request packet is re-transmitted when no response is received from the RADIUS server. The retries value is an integer in the range of 1 to 15.

Default	4
Format	radius server retransmit <retries>
Mode	Global Config

no radius server retransmit

This command sets the maximum number of times a request packet is re-transmitted, to the default value.

Format	no radius server retransmit
Mode	Global Config

radius server timeout

This command sets the timeout value (in seconds) after which a request must be retransmitted to the RADIUS server if no response is received. The timeout value is an integer in the range of 1 to 30.

Default	5
Format	radius server timeout <seconds>
Mode	Global Config

no radius server timeout

This command sets the timeout value to the default value.

Format	no radius server timeout
Mode	Global Config

show radius

This command is used to display the various RADIUS configuration items for the switch as well as the configured RADIUS servers. If the optional token 'servers' is not included, the following RADIUS configuration items are displayed.

Format	show radius [servers]
Mode	Privileged EXEC

TABLE 9-13 Entry Definitions for *show radius*
Entry	Definition
Primary Server IP Address	Shows the configured server currently in use for authentication.
Number of configured servers	The configured IP address of the authentication server.
Max number of retransmits	The configured value of the maximum number of times a request packet is retransmitted.
Timeout Duration	The configured timeout value, in seconds, for request re-transmissions.
Accounting Mode	Yes or No.

If you use the [servers] keyword, the following information displays.

IP Address	IP Address of the configured RADIUS server.
Port	The port in use by this server.

TABLE 9-14 Entry Definitions for *show radius* *servers*
Entry	Definition
Type	Primary or secondary.
Secret Configured	Yes / No.
Message Authenticator	The message authenticator attribute for the selected server, which can be enables or disables.

show radius accounting

This command is used to display the configured RADIUS accounting mode, accounting server and the statistics for the configured accounting server.

Format	show radius accounting [statistics <ipaddr>]
Mode	Privileged EXEC

If you do not specify any parameters, then only the accounting mode and the RADIUS accounting server details are displayed.

TABLE 9-15 Entry Definitions for *show radius accounting*
Entry	Definition
Mode	Enabled or disabled
IP Address	The configured IP address of the RADIUS accounting server.
Port	The port in use by the RADIUS accounting server.
Secret Configured	Yes or No.

If you use the optional statistics <ipaddr> parameter, the statistics for the configured RADIUS accounting server are displayed. The IP address parameter must match that of a previously configured RADIUS accounting server. The following information regarding the statistics of the RADIUS accounting server is displayed.

TABLE 9-16 Entry Definitions for *show radius accounting* *statistics*
Entry	Definition
Accounting Server IP Address	IP Address of the configured RADIUS accounting server
Round Trip Time	The time interval, in hundredths of a second, between the most recent Accounting-Response and the Accounting-Request that matched it from the RADIUS accounting server.
Requests	The number of RADIUS Accounting-Request packets sent to this accounting server. This number does not include retransmissions.
Retransmission	The number of RADIUS Accounting-Request packets retransmitted to this RADIUS accounting server.
Responses	The number of RADIUS packets received on the accounting port from this server.
Malformed Responses	The number of malformed RADIUS Accounting-Response packets received from this server. Malformed packets include packets with an invalid length. Bad authenticators and unknown types are not included as malformed accounting responses.
Bad Authenticators	The number of RADIUS Accounting-Response packets containing invalid authenticators received from this accounting server.
Pending Requests	The number of RADIUS Accounting-Request packets sent to this server that have not yet timed out or received a response.
Timeouts	The number of accounting timeouts to this server.
Unknown Types	The number of RADIUS packets of unknown types, which were received from this server on the accounting port.
Packets Dropped	The number of RADIUS packets received from this server on the accounting port and dropped for some other reason.

show radius statistics

This command is used to display the statistics for RADIUS or configured server. To show the configured RADIUS server statistic, the IP Address specified must match that of a previously configured RADIUS server. On execution, the following fields are displayed.

Format	show radius statistics [<ipaddr>]
Mode	Privileged EXEC

If you do not specify the IP address, then only Invalid Server Address field is displayed. Otherwise other listed fields are displayed.

TABLE 9-17 Entry Definitions for *show radius statistics*
Entry	Definition
Invalid Server Addresses	The number of RADIUS Access-Response packets received from unknown addresses.
Server IP Address	IP Address of the Server.
Round Trip Time	The time interval, in hundredths of a second, between the most recent Access-Reply, Access-Challenge and the Access-Request that matched it from the RADIUS authentication server.
Access Requests	The number of RADIUS Access-Request packets sent to this server. This number does not include retransmissions.
Access Retransmission	The number of RADIUS Access-Request packets retransmitted to this RADIUS authentication server.
Access Accepts	The number of RADIUS Access-Accept packets, including both valid and invalid packets, which were received from this server.
Access Rejects	The number of RADIUS Access-Reject packets, including both valid and invalid packets, which were received from this server.
Access Challenges	The number of RADIUS Access-Challenge packets, including both valid and invalid packets, which were received from this server.
Malformed Access Responses	The number of malformed RADIUS Access-Response packets received from this server. Malformed packets include packets with an invalid length. Bad authenticators or signature attributes or unknown types are not included as malformed access responses.
Bad Authenticators	The number of RADIUS Access-Response packets containing invalid authenticators or signature attributes received from this server.
Pending Requests	The number of RADIUS Access-Request packets destined for this server that have not yet timed out or received a response.
Timeouts	The number of authentication timeouts to this server.
Unknown Types	The number of RADIUS packets of unknown types, which were received from this server on the authentication port.
Packets Dropped	The number of RADIUS packets received from this server on the authentication port and dropped for some other reason.

TACACS+ Commands

TACACS+ provides access control for networked devices via one or more centralized servers. Similar to RADIUS, this protocol simplifies authentication by making use of a single database that can be shared by many clients on a large network. TACACS+ is based on the TACACS protocol (described in RFC1492) but additionally provides for separate authentication, authorization, and accounting services. The original protocol was UDP based with messages passed in clear text over the network; TACACS+ uses TCP to ensure reliable delivery and a shared key configured on the client and daemon server to encrypt all messages.

tacacs-server host

Use the tacacs-server host command in Global Configuration mode to configure a TACACS+ server. This command enters into the TACACS+ configuration mode. The <ip-address> parameter is the IP address of the TACACS+ server. To specify multiple hosts, multiple tacacs-server host commands can be used.

Format	tacacs-server host <ip-address>
Mode	Global Config

no tacacs-server host

Use the no tacacs-server host command to delete the specified hostname or IP address. The <ip-address> parameter is the IP address of the TACACS+ server.

Format	no tacacs-server host <ip-address>
Mode	Global Config

tacacs-server key

Use the tacacs-server key command to set the authentication and encryption key for all TACACS+ communications between the switch and the TACACS+ daemon. The <key-string> parameter has a range of 0 - 128 characters and specifies the authentication and encryption key for all TACACS communications between the switch and the TACACS+ server. This key must match the key used on the TACACS+ daemon.

Format	tacacs-server key <key-string>
Mode	Global Config

no tacacs-server key

Use the no tacacs-server key command to disable the authentication and encryption key for all TACACS+ communications between the switch and the TACACS+ daemon. The <key-string> parameter has a range of 0 - 128 characters This key must match the key used on the TACACS+ daemon.

Format	no tacacs-server key <key-string>
Mode	Global Config

tacacs-server timeout

Use the tacacs-server timeout command to set the timeout value for communication with the TACACS+ servers. The <timeout> parameter has a range of 1-30 and is the timeout value in seconds.

Default	5
Format	tacacs-server timeout <timeout>
Mode	Global Config

no tacacs-server timeout

Use the no tacacs-server timeout command to restore the default timeout value for all TACACS servers.

Format	no tacacs-server timeout
Mode	Global Config

key

Use the key command in TACACS Configuration mode to specify the authentication and encryption key for all TACACS communications between the device and the TACACS server. This key must match the key used on the TACACS daemon. The <key-string> parameter specifies the key name. For an empty string use “ ”. (Range: 0 - 128 characters).

Format	key <key-string>
Mode	TACACS Config

port

Use the port command in TACACS Configuration mode to specify a server port number. The server <port-number> range is 0 - 65535.

Default	49
Format	port <port-number>
Mode	TACACS Config

priority

Use the priority command in TACACS Configuration mode to specify the order in which servers are used, where 0 (zero) is the highest priority. The <priority> parameter specifies the priority for servers. The highest priority is 0 (zero), and the range is 0 - 65535.

Default	0
Format	priority <priority>
Mode	TACACS Config

timeout

Use the timeout command in TACACS Configuration mode to specify the timeout value in seconds. If no timeout value is specified, the global value is used. The <timeout> parameter has a range of 1-30 and is the timeout value in seconds.

Format	timeout <timeout>
Mode	TACACS Config

show tacacs

Use the show tacacs command to display the configuration and statistics of a TACACS+ server.

Format	show tacacs [<ip-address>]
Mode	Privileged EXEC

TABLE 9-18 Entry Definitions for *show tacacs*
Entry	Definition
IP address	Shows the IP address of the configured TACACS+ server.
Port	Shows the configured TACACS+ server port number.
TimeOut	Shows the timeout in seconds for establishing a TCP connection.
Priority	Shows the preference order in which TACACS+ servers are contacted. If a server connection fails, the next highest priority server is contacted.

Configuration Scripting Commands

Configuration Scripting allows you to generate text-formatted script files representing the current configuration of a system. You can upload these configuration script files to a PC or UNIX system and edit them. Then, you can download the edited files to the system and apply the new configuration. You can apply configuration scripts to one or more switches with no or minor modifications.

Use the show running-config command (see show running-config) to capture the running configuration into a script. Use the copy command (see copy) to transfer the configuration script to or from the switch.

You should use scripts on systems with default configuration; however, you are not prevented from applying scripts on systems with non-default configurations.

Scripts must conform to the following rules:

The file extension must be “.scr”.

A maximum of ten scripts are allowed on the switch.

The combined size of all script files on the switch shall not exceed 2048 KB.

The maximum number of configuration file command lines is 2000.

You can type single-line annotations at the command prompt to use when you write test or configuration scripts to improve script readability. The exclamation point (!) character flags the beginning of a comment. The comment flag character can begin a word anywhere on the command line, and all input following this character is ignored. Any command line that begins with the “!” character is recognized as a comment line and ignored by the parser.

The following lines show an example of a script:

! Script file for displaying management access
show telnet !Displays the information about remote connections
! Display information about direct connections 
show serial
! End of the script file!

script apply

This command applies the commands in the script to the switch. The <scriptname> parameter is the name of the script to apply.

Format	script apply <scriptname>
Mode	Privileged EXEC

script delete

This command deletes a specified script where the <scriptname> parameter is the name of the script to delete. The <all> option deletes all the scripts present on the switch.

Format	script delete {<scriptname> \| all}
Mode	Privileged EXEC

script list

This command lists all scripts present on the switch as well as the remaining available space.

Format	script list
Mode	Global Config

TABLE 9-19

Configuration Script	Name of the script.
Size	Privileged EXEC

script show

This command displays the contents of a script file, which is named <scriptname>.

Format	script show <scriptname>
Mode	Privileged EXEC

The output format is as follows:

line <number>: <line contents>

script validate

This command validates a script file by parsing each line in the script file where <scriptname> is the name of the script to validate.The validate option is intended to be used as a tool for script development. Validation identifies potential problems. It might not identify all problems with a given script on any given device.

Format	script validate <scriptname>
Mode	Privileged EXEC

Pre-login Banner and System Prompt Commands

This section describes the commands you use to configure the pre-login banner and the system prompt. The pre-login banner is the text that displays before you login at the User prompt.

copy (pre-login banner)

The copy command includes the option to upload or download the CLI Banner to or from the switch. You can specify local URLs by using TFTP, Xmodem, Ymodem, or Zmodem.

Default

none

Format

copy <tftp://<ipaddr>/<filepath>/<filename>> nvram:clibanner

copy nvram:clibanner <tftp://<ipaddr>/<filepath>/<filename>>

Mode

Privileged EXEC

set prompt

This command changes the name of the prompt. The length of name may be up to 64 alphanumeric characters.

Format	set prompt <prompt_string>
Mode	Privileged EXEC