# Cisco - Walkthroughs

# InterVLAN Routing

# Configuring InterVLAN Routing with a Layer 3 Switch and pfSense

<header class="entry-header" id="bkmrk-posted-on%C2%A0august-19%2C"><div class="entry-meta"><span class="sep">Posted on </span>[<time class="entry-date updated" datetime="2019-08-19T22:47:21+01:00">August 19, 2019</time>](https://greigmitchell.co.uk/2019/08/configuring-intervlan-routing-with-a-layer-3-switch-and-pfsense/ "22:47")<span class="by-author"> <span class="sep">by </span><span class="author vcard">[Greig Mitchell](https://greigmitchell.co.uk/author/laurenr/ "View all posts by Greig Mitchell")</span></span> <span class="sep sep-comment">— </span><span class="comments-link">[24 Comments ↓](https://greigmitchell.co.uk/2019/08/configuring-intervlan-routing-with-a-layer-3-switch-and-pfsense/#comments)</span></div></header>Recently I was tasked with deploying a Layer 3 managed network switch alongside an existing pfSense firewall appliance for a relatively small network.

As a quick bit of a background the network consisted of around 10 VLANs which were all being terminated and routed on a pfSense firewall connected to an existing Layer 2 switch via a single 1Gbps trunk link (Router on a stick). There was then a requirement to swap out the existing Layer 2 switch and put a Layer 3 switch in its place to handle interVLAN routing between the VLANs to save resources on the firewall whilst increasing performance.

So to start this off I began documenting and making a high-level list of the steps:

<div class="entry-content" id="bkmrk-remove-the-vlan-inte">1. Remove the VLAN interfaces off PfSense
2. Create the SVIs for each VLAN interface on the Layer 3 switch
3. Enable IP Routing on the Layer 3 switch
4. Configure the uplink port to pfSense LAN interface as a Routed Port
5. Add static routes on pfSense back to the Layer 3 switch for each network
6. Add firewall/NAT rules on pfSense for each network
7. Add a default route on Layer 3 switch to PfSense

</div>**Note:** I’m not going go into detail on removing interfaces on PfSense or creating VLANs, I already assume you are familar with this. In this example the switch configuration is based off a Cisco Catalyst 3560X, the steps may be different for other switch vendors. For Cisco you will need an IOS image and/or license which enables routing features.

First is to create the SVIs for each VLAN interface on Layer 3 switch:

*Switch(config)# interface Vlan3  
Switch(config-if)# ip address 172.16.3.1 255.255.255.0*

*Switch(config)# interface Vlan4  
Switch(config-if)# ip address 172.16.4.1 255.255.255.0*  
  
Then we enable IP Routing globally on the switch:

*Switch(config)# ip routing*

The next stage is to configure the physical uplink going from the switch to the pfSense LAN interface. This can be referred to as a “Transit” network for traffic leaving the Layer 3 switch i.e. to the Internet. There a few ways this can be achieved, either by creating a dedicated VLAN interface with an SVI or configuring a physical switch port as a Routed Port using the “no switchport” command then giving it a dedicated IP address – I will be using this method but in most cases it is normally recommended to use a small subnet mask such as a /30 for the transit network.

In this example 172.16.1.1 will be the routed port IP address and 172.16.1.2 will be the pfSense LAN interface address.

*Switch(config)# interface GigabitEthernet1/4  
Switch(config-if)# description Routed Port to pfSsense LAN Interface  
Switch(config-if)# no switchport  
Switch(config-if)# ip address 172.16.1.1 255.255.255.252*

For pfSense to know about the networks we need add static routes back to Layer 3 switch. First to go System &gt; Routing &gt; Gateways and click “Add” and enter the IP address of the Layer 3 switch routed port.

<div class="entry-content" id="bkmrk-"><figure class="wp-block-image is-resized">[![](https://i0.wp.com/greigmitchell.co.uk/blog/wp-content/uploads/2019/08/pfsense_01.png?resize=530%2C354&ssl=1)](https://i0.wp.com/greigmitchell.co.uk/blog/wp-content/uploads/2019/08/pfsense_01.png?ssl=1)</figure></div>Under System &gt; Routing &gt; Static Routes click “Add” and add each of the networks for the various VLANs on the Layer 3 switch, selecting the Layer 3 Switch as the gateway.

<div class="entry-content" id="bkmrk--1"><figure class="wp-block-image">[![](https://i0.wp.com/greigmitchell.co.uk/blog/wp-content/uploads/2019/08/pfsense_03.png?resize=530%2C153&ssl=1)](https://i0.wp.com/greigmitchell.co.uk/blog/wp-content/uploads/2019/08/pfsense_03.png?ssl=1)</figure></div>For hosts in each of the various VLANs to get out to the internet Firewall and Outbound NAT rules must be created for each network on pfSense. Firstly, navigate to Firewall &gt; NAT &gt; Outbound and check the existing rules – if using automatic outbound NAT pfSense will have already added in the required rules for the networks otherwise these will need to be added manually.

<div class="entry-content" id="bkmrk--2"><figure class="wp-block-image">[![](https://i0.wp.com/greigmitchell.co.uk/blog/wp-content/uploads/2019/08/pfsense_05.png?resize=530%2C112&ssl=1)](https://i0.wp.com/greigmitchell.co.uk/blog/wp-content/uploads/2019/08/pfsense_05.png?ssl=1)</figure></div>Next navigate to Firewall &gt; Rules &gt; LAN and add pass rules for the various networks.

<div class="entry-content" id="bkmrk--3"><figure class="wp-block-image">[![](https://i0.wp.com/greigmitchell.co.uk/blog/wp-content/uploads/2019/08/pfsense_04.png?resize=530%2C153&ssl=1)](https://i0.wp.com/greigmitchell.co.uk/blog/wp-content/uploads/2019/08/pfsense_04.png?ssl=1)</figure></div>At this point pfSense is now aware of each of the networks on the Layer 3 switch and is configured to route their traffic outbound to the Internet. The last and final stage is to add a default route for all traffic not destined for the Layer 3 switch to pfSense – this will provide each of the VLANs with Internet access.

To do this login to the Layer 3 Switch and enter the following command:

*Switch(config)# ip route 0.0.0.0 0.0.0.0 172.16.1.2*

Now InterVLAN routing should be working successfully on the Layer 3 switch and the hosts on each of those networks should have Internet access through the pfSense firewall.

With this setup there are couple of things to keep in mind…

<div class="entry-content" id="bkmrk-restricting-traffic-">- Restricting traffic between each of the VLANs must be performed by creating ACLs (Access Control Lists) on the Layer 3 switch as opposed to using Firewall rules on pfSense – this can be less flexible and user friendly.

- Adding additional VLAN SVIs on the Layer 3 switch will require adding the appropriate static routes and Firewall/NAT rules to pfSense for those networks to enable Internet access if needed.

</div>I hope this helps anyone looking to configure InterVLAN routing with a Layer 3 switch and pfSense.

# Configuring Port ACLs and VLAN ACLs

## Configuring Port ACLs and VLAN ACLs

---

This chapter describes how to configure port ACLs (PACLs) and VLAN ACLs (VACLs) in Cisco IOS Software Release 12.2SX.

<div class="Note1B" id="bkmrk--1">  
</div>---

<p class="callout info">**Note**![](https://www.cisco.com/en/US/i/templates/blank.gif): For complete syntax and usage information for the commands used in this chapter, see the Cisco IOS Software Releases 12.2SX Command References at this URL:</p>

[http://www.cisco.com/en/US/docs/ios/mcl/122sx\_mcl.html](http://www.cisco.com/en/US/docs/ios/mcl/122sx_mcl.html)

<p class="callout warning">OAL and VACL capture are incompatible. Do not configure both features on the switch. With OAL configured (see the ["Optimized ACL Logging" section on page 42-7](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/acl.html#wpxref71949)), use SPAN to capture traffic.</p>

<p class="callout warning">Port ACLs do not support the access-list keywords **log** or **reflexive**. These keywords in the access list are ignored. Optimized ACL logging (OAL) does not support PACLs.</p>

<p class="callout warning">PACLs are not supported on Private VLANs.</p>

---

This chapter consists of these sections:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Understanding ACLs](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1097393)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Configuring PACLs](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1039754)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Configuring VACLs](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1097863)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Configuring VACL Logging](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1041783)

## Understanding ACLs

The following sections describe ACLs in Cisco IOS Software Release 12.2SX:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Understanding ACLs](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1097408)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Understanding VACLs](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1097462)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Understanding Port ACLs](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1119764)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[PACL and VACL Interactions](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1099767)

### Understanding ACLs

Access control lists (ACLs) provide the ability to filter ingress and egress traffic based on conditions specified in the ACL.

Cisco IOS Software Release 12.2SX supports the following types of ACLs:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Cisco IOS ACLs are applied to Layer 3 interfaces. They filter traffic routed between VLANs. For more information about Cisco IOS ACLs, see [Chapter 42, "Understanding Cisco IOS ACL Support."](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/acl.html#wpxref80176)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)VACLs control access to the VLAN of all packets (bridged and routed). Packets can either enter the VLAN through a Layer 2 port or through a Layer 3 port after being routed. You can also use VACLs to filter traffic between devices in the same VLAN.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Port ACLs perform access control on all traffic entering the specified Layer 2 port.

PACLs and VACLs can provide access control based on the Layer 3 addresses (for IP protocols) or Layer 2 MAC addresses (for non-IP protocols).

You can apply only one IP access list and one MAC access list to a Layer 2 interface.

### Understanding VACLs

VLAN ACLs (VACLs) can provide access control for <span class="cCp_CmdPlain">all packet</span>s that are bridged within a VLAN or that are routed into or out of a VLAN or a WAN interface for VACL capture. Unlike Cisco IOS ACLs that are applied on routed packets only, VACLs apply to all packets and can be applied to any VLAN or WAN interface. VACLs are processed in the ACL TCAM hardware. VACLs use the same configuration commands as Cisco IOS ACLs. VACLs ignore any Cisco IOS ACL fields that are not supported in hardware.

You can configure VACLs for IP, IPX, and MAC-Layer traffic. VACLs applied to WAN interfaces support only IP traffic for VACL capture.

If a VACL is configured for a packet type, and a packet of that type does not match the VACL, the default action is to deny the packet.

---

<p class="callout info">**Note**![](https://www.cisco.com/en/US/i/templates/blank.gif):TCP Intercepts and Reflexive ACLs take precedence over a VACL action if these features are configured on the same interface as a VACL.</p>

<p class="callout warning">VACLs and CBAC cannot be configured on the same interface.</p>

<p class="callout warning">IGMP packets are not checked against VACLs.</p>

---

### Understanding Port ACLs

The port ACL (PACL) feature provides the ability to perform access control on specific Layer 2 ports. A Layer 2 port is a physical LAN or trunk port that belongs to a VLAN. Port ACLs are only applied on the ingress traffic. The port ACL feature is supported only in hardware (port ACLs are not applied to any packets routed in software).

When you create a port ACL, an entry is created in the ACL TCAM. You can use the **show tcam counts** command to see how much TCAM space is available.

The PACL feature does not affect Layer 2 control packets received on the port.

You can use the **access-group mode** command to change the way that PACLs interact with other ACLs.

PACLs use the following modes:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Prefer port mode—If a PACL is configured on a Layer 2 interface, the PACL takes effect and overwrites the effect of other ACLs (Cisco IOS ACL and VACL). If no PACL feature is configured on the Layer 2 interface, other features applicable to the interface are merged and are applied on the interface.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Merge mode—In this mode, the PACL, VACL, and Cisco IOS ACLs are merged in the ingress direction following the logical serial model shown in [Figure 43-2](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1097515). This is the default access group mode.

You configure the access-group mode command on each interface. The default is merge mode.

---

<p class="callout info">**Note:** ![](https://www.cisco.com/en/US/i/templates/blank.gif)A PACL can be configured on a trunk port. Trunk ports do not support merge mode.</p>

---

To illustrate access group mode, assume a physical port belongs to VLAN100, and the following ACLs are configured:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Cisco IOS ACL R1 is applied on routed interface VLAN100.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)VACL (VLAN filter) V1 is applied on VLAN100.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)PACL P1 is applied on the physical port.

In this situation, the following ACL interactions occur:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)In prefer port mode, Cisco IOS ACL R1 and VACL V1 are ignored.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)In merge mode, Cisco IOS ACL R1, VACL V1 and PACL P1 are merged and applied on the port.

---

<p class="callout info">**Note:** ![](https://www.cisco.com/en/US/i/templates/blank.gif)The CLI syntax for creating a PACL is identical to the syntax for creating a Cisco IOS ACL. An instance of an ACL that is mapped to a Layer 2 port is called a PACL. An instance of an ACL that is mapped to a Layer 3 interface is called a Cisco IOS ACL. The same ACL can be mapped to both a Layer 2 port and a Layer 3 interface.</p>

---

The PACL feature supports MAC ACLs and IPv4 ACLs. The PACL feature does not support ACLs for IPV6, ARP, or MPLS traffic.

PACLs are explained in more detail in the following sections:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[EtherChannel and PACL Interactions](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1106813)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Dynamic ACLs (Applies to Merge Mode Only)](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1106820)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Trunk Ports](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1106825)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Port-VLAN Association Changes](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1106835)

### EtherChannel and PACL Interactions

This section describes the guidelines for the EtherChannel and PACL interactions:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)PACLs are supported on the main Layer 2 channel interface, but not on the port members. When a port is added to the EtherChannel, any PACL present on the port becomes inactive (but kept in the configuration). If the port is removed from the EtherChannel, any PACL configured on the port becomes active again.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Changing the configuration on the logical port affects all the ports in the channel. When an ACL is mapped to the logical port belonging to a channel, it is mapped to all ports in the channel.

### Dynamic ACLs (Applies to Merge Mode Only)

Dynamic ACLs are VLAN-based and are used by two features: CBAC and GWIP. The merge mode *does not* support the merging of the dynamic ACLs with the PACLs. In merge mode, the following configurations are not allowed:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Attempting to apply a PACL on a port where its corresponding VLAN has a dynamic ACL mapped. In this case, the PACL is not applied to traffic on the port.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Configuring a dynamic ACL on a VLAN where one of its constituent ports has a PACL installed. In this case, the dynamic ACL is not applied.

### Trunk Ports

A PACL can be configured on a trunk port in merge mode only.

### Layer 2 to Layer 3 Port Conversion

If you reconfigure a port from Layer 2 to Layer 3, any PACL configured on the port becomes inactive but remains in the configuration. If you subsequently configure the port as Layer 2, any PACL configured on the port becomes active again.

### Port-VLAN Association Changes

You can enter port configuration commands that alter the port-VLAN association, which triggers an ACL remerge.

Unmapping and then mapping a PACL, VACL, or Cisco IOS ACL automatically triggers a remerge.

In merge mode, online insertion or removal of a switching module also triggers a remerge, if ports on the module have PACLs configured.

### PACL and VACL Interactions

The following sections describe interactions between the different types of ACL:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[PACL Interaction with VACLs and Cisco IOS ACLs](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1102077)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Bridged Packets](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1117948)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Routed Packets](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1109462)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Multicast Packets](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1097523)

### PACL Interaction with VACLs and Cisco IOS ACLs

This section describes the guidelines for the PACL interaction with the VACLs and Cisco IOS ACLs.

For an incoming packet on a physical port, the PACL is applied first. If the packet is permitted by the PACL, the VACL on the ingress VLAN is applied next. If the packet is Layer 3 forwarded and is permitted by the VACL, it is filtered by the Cisco IOS ACL on the same VLAN. The same process happens in reverse in the egress direction. However, there is currently no hardware support for output PACLs.

The PACLs override both the VACLs and Cisco IOS ACLs when the port is configured in prefer port mode. The one exception to this rule is when the packets are forwarded in the software by the route processor (RP). The RP applies the ingress Cisco IOS ACL regardless of the PACL mode. Two examples where the packets are forwarded in the software are as follows:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Packets that are egress bridged (due to logging or features such as NAT)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Packets with IP options

### Bridged Packets

[Figure 43-1](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1109432) shows a PACL and a VACL applied to bridged packets. In merge mode, the ACLs are applied in the following order:

**1.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)PACL for the ingress port

**2.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)VACL for the ingress VLAN

**3.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)VACL for the egress VLAN

Figure 43-1 Applying ACLs on Bridged Packets

<div align="left" id="bkmrk--11">![](https://www.cisco.com/i/100001-200000/180001-190000/182001-183000/182042.jpg)</div>In prefer port mode, only the PACL is applied to the ingress packets (the input VACL is not applied).

### Routed Packets

[Figure 43-2](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1097515) shows how ACLs are applied on routed and Layer 3-switched packets. In merge mode, the ACLs are applied in the following order:

**1.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)PACL for the ingress port

**2.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)VACL for the ingress VLAN

**3.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)Input Cisco IOS ACL

**4.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)Output Cisco IOS ACL

**5.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)VACL for the egress VLAN

In prefer port mode, only the PACL is applied to the ingress packets (the input VACL and Cisco IOS ACL are not applied).

Figure 43-2 Applying ACLs on Routed Packets

<div align="left" id="bkmrk--13">![](https://www.cisco.com/i/100001-200000/180001-190000/182001-183000/182043.jpg)</div>### Multicast Packets

[Figure 43-3](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1097536) shows how ACLs are applied on packets that need multicast expansion. For packets that need multicast expansion, the ACLs are applied in the following order:

**1.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)Packets that need multicast expansion:

**a.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)PACL for the ingress port

**b.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)VACL for the ingress VLAN

**c.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)Input Cisco IOS ACL

**2.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)Packets after multicast expansion:

**a.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)Output Cisco IOS ACL

**b.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)VACL for the egress VLAN

**3.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)Packets originating from router:

**a.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)Output Cisco IOS ACL

**b.** ![](https://www.cisco.com/en/US/i/templates/blank.gif)VACL for the egress VLAN

In prefer port mode, only the PACL is applied to the ingress packets (the input VACL and Cisco IOS ACL are not applied).

Figure 43-3 Applying ACLs on Multicast Packets

<div align="left" id="bkmrk--15">![](https://www.cisco.com/i/100001-200000/180001-190000/182001-183000/182044.jpg)</div>## Configuring PACLs

Release 12.2(33)SXH and later releases support PACLs. This section describes how to configure PACLs. PACLs filter incoming traffic on Layer 2 interfaces, using Layer 3 information, Layer 4 header information, or non-IP Layer 2 information.

The PACL feature uses existing Cisco IOS **access-list** commands to create the standard or extended IP ACLs or named MAC-extended ACLs that you want to apply to the port.

Use the ip access-group or mac access-group interface command to apply an IP ACL or MAC ACL to one or more Layer 2 interfaces.

This section contains the following topics:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[PACL Configuration Guidelines](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1110645)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Configuring IP and MAC ACLs on a Layer 2 Interface](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1110659)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Configuring Access-group Mode on Layer 2 Interface](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1110713)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Applying ACLs to a Layer 2 Interface](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1110759)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Applying ACLs to a Port Channel](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1117968)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Displaying an ACL Configuration on a Layer 2 Interface](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1110786)

### PACL Configuration Guidelines

Consider the following guidelines when configuring PACLs:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)There can be at most one IP access list and one MAC access list applied to the same Layer 2 interface per direction.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)An IP access list filters only IPv4 packets, For IP access lists, you can define a standard, extended or named access-list.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)A MAC access list filters all ingress packets based on Layer 2 information. You can define only named MAC access lists.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)The number of ACLs and ACEs that can be configured as part of a PACL are bounded by the hardware resources on the switch. Those hardware resources are shared by various ACL features (such as Cisco IOS ACL or VACL) that are configured on the system. If there are insufficient hardware resources to program a PACL in hardware, the PACL is not applied.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)PACL does not support the access-list **log** and **reflect/evaluate** keywords. These keywords are ignored if you add them to the access list for a PACL.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Optimized ACL logging (OAL) does not support PACLs.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)PACLs are not applied to IPv6, MPLS, or ARP messages.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)The access group mode can change the way PACLs interact with other ACLs. To maintain consistent behavior across Cisco platforms, use the default access group mode (merge mode).

### Configuring IP and MAC ACLs on a Layer 2 Interface

IP and MAC ACLs can be applied to Layer 2 physical interfaces. Standard (numbered, named) and Extended (numbered, named) IP ACLs, and Extended Named MAC ACLs are supported.

To apply IP or MAC ACLs on a Layer 2 interface, perform this task:

<div align="left" id="bkmrk-%C2%A0-%C2%A0-command-purpose-"><table border="1" cellpadding="3" cellspacing="0" class="steptable" id="bkmrk-%C2%A0-%C2%A0-command-purpose--1" width="80%"><caption> </caption><tbody><tr align="left" valign="bottom"><th scope="col"> </th><th scope="col">  
<div class="pCH1_CellHead1">Command</div></th><th scope="col">  
<div class="pCH1_CellHead1">Purpose</div></th></tr><tr align="left" valign="top"><td>Step 1

</td><td>  
```
Switch# <strong class="cBold">configure terminal</strong> 
```

</td><td>Enters global configuration mode.

</td></tr><tr align="left" valign="top"><td>Step 2

</td><td>  
```
Switch(config)#<strong class="cBold"> interface</strong> <em class="cEmphasis">interface</em> 
```

</td><td>Enters interface configuration mode for a Layer 2 port.

</td></tr><tr align="left" valign="top"><td>Step 3

</td><td>  
```
Switch(config-if)#<strong class="cBold"> </strong>{<strong class="cBold">ip</strong> | <strong class="cBold">mac</strong> } <strong class="cBold">access-group</strong> 
{<strong class="cBold">name</strong> | <strong class="cBold">number</strong> | <strong class="cBold">in</strong> | <strong class="cBold">out</strong>}
```

</td><td>Applies a numbered or named ACL to the Layer 2 interface.

</td></tr><tr align="left" valign="top"><td>Step 4

</td><td>  
```
Switch(config)#<strong class="cBold"> </strong><strong class="cBold">show running-config
</strong>
```

</td><td>Displays the access list configuration.

</td></tr></tbody></table>

</div>The following example shows how to configure the Extended Named IP ACL simple-ip-acl to permit all TCP traffic and implicitly deny all other IP traffic:

```
Switch(config)# ip access-list extended simple-ip-acl 
```

```
Switch(config-ext-nacl)# permit tcp any any
```

```
Switch(config-ext-nacl)# end
```

```
<a name="wp1110699"></a><br></br>
```

The following example shows how to configure the Extended Named MAC ACL simple-mac-acl to permit source host 000.000.011 to any destination host:

```
Switch(config)# mac access-list extended simple-mac-acl
```

```
Switch(config-ext-macl)# permit host 000.000.011 any
```

```
Switch(config-ext-macl)# end
```

### Configuring Access-group Mode on Layer 2 Interface

To configure the access mode on a Layer 2 interface, perform this task:

<div align="left" id="bkmrk-%C2%A0-%C2%A0-command-purpose--2"><table border="1" cellpadding="3" cellspacing="0" class="steptable" id="bkmrk-%C2%A0-%C2%A0-command-purpose--3" width="80%"><caption> </caption><tbody><tr align="left" valign="bottom"><th scope="col"> </th><th scope="col"><div class="pCH1_CellHead1">Command</div></th><th scope="col"><div class="pCH1_CellHead1">Purpose</div></th></tr><tr align="left" valign="top"><td>Step 1

</td><td>  
```
Switch# <strong class="cBold">configure t
</strong>
```

</td><td>Enters global configuration mode.

</td></tr><tr align="left" valign="top"><td>Step 2

</td><td>  
```
Switch(config)#<strong class="cBold"> interface </strong>interface
```

</td><td>Enters interface configuration mode for a Layer 2 port.

</td></tr><tr align="left" valign="top"><td>Step 3

</td><td>  
```
Switch(config-if)# [<strong class="cBold">no</strong>] <strong class="cBold">access-group mode</strong> 
{<strong class="cBold">prefer port</strong> | <strong class="cBold">merge</strong>}
```

</td><td>Sets the mode for this Layer 2 interface. The **no** prefix sets the mode to the default value (which is merge).

</td></tr><tr align="left" valign="top"><td>Step 4

</td><td>  
```
Switch(config)#<strong class="cBold"> </strong><strong class="cBold">show running-config
</strong>
```

</td><td>Displays the access list configuration.

</td></tr></tbody></table>

</div>This example shows how to configure an interface to use prefer port mode:

```
Switch# <strong class="cBold">configure terminal
</strong>
```

```
Switch(config)#<strong class="cBold"> interface </strong>gigabitEthernet 6/1
```

```
Switch(config-if)# access-group mode prefer port
```

```
<a name="wp1110753"></a><br></br>
```

This example shows how to configure an interface to use merge mode:

```
Switch# <strong class="cBold">configure terminal
</strong>
```

```
Switch(config)#<strong class="cBold"> interface </strong>gigabitEthernet 6/1
```

```
Switch(config-if)# access-group mode merge
```

<span style="color: rgb(187, 187, 187); font-family: var(--font-heading, var(--font-body)); font-size: 2.333em; font-weight: 400;">Applying ACLs to a Layer 2 Interface</span>

To apply IP and MAC ACLs to a Layer 2 interface, perform one of these tasks:

<div align="left" id="bkmrk-%C2%A0-command-purpose-sw"><table border="1" cellpadding="3" cellspacing="0" class="steptable" id="bkmrk-%C2%A0-command-purpose-sw-1" width="80%"><caption> </caption><tbody><tr align="left" valign="bottom"><th scope="col"><div class="pCH1_CellHead1">Command</div></th><th scope="col"><div class="pCH1_CellHead1">Purpose</div></th></tr><tr align="left" valign="top"><td>  
```
Switch(config-if)# ip access-group ip-acl {in | out}
```

</td><td>Applies an IP ACL to the Layer 2 interface.

</td></tr><tr align="left" valign="top"><td>  
```
Switch(config-if)# mac access-group mac-acl {in | out}
```

</td><td>Applies a MAC ACL to the Layer 2 interface.

</td></tr></tbody></table>

</div>This example applies the extended named IP ACL simple-ip-acl to interface GigabitEthernet 6/1 ingress traffic:

```
Switch# <strong class="cBold">configure t
</strong>
```

```
Switch(config)# interface gigabitEthernet 6/1
```

```
Switch(config-if)# ip access-group simple-ip-acl in
```

```
<a name="wp1110780"></a><br></br>
```

This example applies the extended named MAC ACL simple-mac-acl to interface GigabitEthernet 6/1 ingress traffic:

```
Switch# <strong class="cBold">configure t
</strong>
```

```
Switch(config)# interface gigabitEthernet 6/1
```

```
Switch(config-if)# mac access-group simple-mac-acl in
```

### Applying ACLs to a Port Channel

To apply IP and MAC ACLs to a port channel logical interface, perform this task:

<div align="left" id="bkmrk-%C2%A0-command-purpose-sw-2"><table border="1" cellpadding="3" cellspacing="0" class="steptable" id="bkmrk-%C2%A0-command-purpose-sw-3" width="80%"><caption> </caption><tbody><tr align="left" valign="bottom"><th scope="col"><div class="pCH1_CellHead1">Command</div></th><th scope="col"><div class="pCH1_CellHead1">Purpose</div></th></tr><tr align="left" valign="top"><td>  
```
Switch(config-if)# interface port-channel number
```

</td><td>Enters configuration mode for the port channel.

</td></tr><tr align="left" valign="top"><td>  
```
Switch(config-if)# ip access-group ip-acl {in | out}
```

</td><td>Applies an IP ACL to the port channel interface.

</td></tr><tr align="left" valign="top"><td>  
```
Switch(config-if)# mac access-group mac-acl {in | out}
```

</td><td>Applies a MAC ACL to the port channel interface.

</td></tr></tbody></table>

</div>This example applies the extended named IP ACL simple-ip-acl to port channel 3 ingress traffic:

```
Switch# <strong class="cBold">configure t
</strong>
```

```
Switch(config)# interface port-channel 3
```

```
Switch(config-if)# ip access-group simple-ip-acl in
```

### Displaying an ACL Configuration on a Layer 2 Interface

To display information about an ACL configuration on Layer 2 interfaces, perform one of these tasks:

<div align="left" id="bkmrk-%C2%A0-command-purpose-sw-4"><table border="1" cellpadding="3" cellspacing="0" class="steptable" id="bkmrk-%C2%A0-command-purpose-sw-5" width="80%"><caption> </caption><tbody><tr align="left" valign="bottom"><th scope="col"><div class="pCH1_CellHead1">Command</div></th><th scope="col"><div class="pCH1_CellHead1">Purpose</div></th></tr><tr align="left" valign="top"><td>  
```
Switch# show ip access-lists [interface interface-name]
```

</td><td>Shows the IP access group configuration on the interface.

</td></tr><tr align="left" valign="top"><td>  
```
Switch# show mac access-group [interface interface-name]
```

</td><td>Shows the MAC access group configuration on the interface.

</td></tr><tr align="left" valign="top"><td>  
```
Switch# show access-group mode [interface interface-name]
```

</td><td>Shows the access group mode configuration on the interface.

</td></tr></tbody></table>

</div>This example shows that the IP access group simple-ip-acl is configured on the inbound direction of interface fa6/1:

```
Switch# show ip interface fast 6/1
```

```
FastEthernet6/1 is up, line protocol is up
```

```
  Inbound  access list is simple-ip-acl
```

```
  Outgoing access list is not set
```

```
<a name="wp1110811"></a><br></br>
```

This example shows that MAC access group simple-mac-acl is configured on the inbound direction of interface fa6/1:

```
Switch# show mac access-group interface fast 6/1
```

```
Interface FastEthernet6/1:
```

```
   Inbound access-list is simple-mac-acl   
```

```
   Outbound access-list is not set
```

This example shows that access group merge is configured on interface fa6/1:

```
Switch# show access-group mode interface fast 6/1
```

```
Interface FastEthernet6/1:
```

```
   Access group mode is: merge
```

<span style="color: rgb(187, 187, 187); font-family: var(--font-heading, var(--font-body)); font-size: 2.8275em; font-weight: 400;">Configuring VACLs</span>

These sections describe how to configure VACLs:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[VACL Configuration Overview](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1054144)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Defining a VLAN Access Map](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1053799)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Configuring a Match Clause in a VLAN Access Map Sequence](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1054164)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Configuring an Action Clause in a VLAN Access Map Sequence](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1054941)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Applying a VLAN Access Map](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1055516)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Verifying VLAN Access Map Configuration](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1055813)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[VLAN Access Map Configuration and Verification Examples](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1055968)

•![](https://www.cisco.com/en/US/i/templates/blank.gif)[Configuring a Capture Port](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1089072)

<span style="color: rgb(187, 187, 187); font-family: var(--font-heading, var(--font-body)); font-size: 2.333em; font-weight: 400;">VACL Configuration Overview</span>

VACLs use standard and extended Cisco IOS IP and IPX ACLs, and MAC Layer-named ACLs (see the ["Configuring MAC ACLs" section on page 36-63](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/qos.html#wpxref36764)) and VLAN access maps.

VLAN access maps can be applied to VLANs or to WAN interfaces for VACL capture. VACLs attached to WAN interfaces support only standard and extended Cisco IOS IP ACLs.

Each VLAN access map can consist of one or more map sequences, each sequence with a match clause and an action clause. The match clause specifies IP, IPX, or MAC ACLs for traffic filtering and the action clause specifies the action to be taken when a match occurs. When a flow matches a permit ACL entry, the associated action is taken and the flow is not checked against the remaining sequences. When a flow matches a deny ACL entry, it will be checked against the next ACL in the same sequence or the next sequence. If a flow does not match any ACL entry and at least one ACL is configured for that packet type, the packet is denied.

To apply access control to both bridged and routed traffic, you can use VACLs alone or a combination of VACLs and ACLs. You can define ACLs on the VLAN interfaces to apply access control to both the ingress and egress routed traffic. You can define a VACL to apply access control to the bridged traffic.

The following caveats apply to ACLs when used with VACLs:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Packets that require logging on the outbound ACLs are not logged if they are denied by a VACL.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)VACLs are applied on packets before NAT translation. If the translated flow is not subject to access control, the flow might be subject to access control after the translation because of the VACL configuration.

The action clause in a VACL can be forward, drop, capture, or redirect. Traffic can also be logged. VACLs applied to WAN interfaces do not support the redirect or log actions.

<div class="Note1B" id="bkmrk--21">  
</div>---

<p class="callout info">**Note**![](https://www.cisco.com/en/US/i/templates/blank.gif): VACLs have an implicit deny at the end of the map; a packet is denied if it does not match any ACL entry, and at least one ACL is configured for the packet type.</p>

<p class="callout info">If an empty or undefined ACL is specified in a VACL, any packets will match the ACL and the associated action is taken.</p>

---

<span style="color: rgb(187, 187, 187); font-family: var(--font-heading, var(--font-body)); font-size: 2.333em; font-weight: 400;">Defining a VLAN Access Map</span>

To define a VLAN access map, perform this task:

<div align="left" id="bkmrk-%C2%A0-command-purpose-ro"><table border="1" cellpadding="2" cellspacing="0" id="bkmrk-%C2%A0-command-purpose-ro-1" width="80%"><caption> </caption><tbody><tr align="left" valign="bottom"><th scope="col"><div class="pCH1_CellHead1">Command</div></th><th scope="col"><div class="pCH1_CellHead1">Purpose</div></th></tr><tr align="left" valign="top"><td>Router(config)# **vlan access-map** *map\_name* \[**0-65535**\]

</td><td>Defines the VLAN access map. Optionally, you can specify the VLAN access map sequence number.

</td></tr><tr align="left" valign="top"><td>Router(config)# **no** **vlan access-map** *map\_name* **0-65535**

</td><td>Deletes a map sequence from the VLAN access map.

</td></tr><tr align="left" valign="top"><td>Router(config)# **no** **vlan access-map** *map\_name*

</td><td>Deletes the VLAN access map.

</td></tr></tbody></table>

</div>When defining a VLAN access map, note the following information:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)To insert or modify an entry, specify the map sequence number.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)If you do not specify the map sequence number, a number is automatically assigned.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)You can specify only one match clause and one action clause per map sequence.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Use the **no** keyword with a sequence number to remove a map sequence.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Use the **no** keyword without a sequence number to remove the map.

See the ["VLAN Access Map Configuration and Verification Examples" section](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1055968).

### Configuring a Match Clause in a VLAN Access Map Sequence

To configure a match clause in a VLAN access map sequence, perform this task:

<div align="left" id="bkmrk-%C2%A0-command-purpose-ro-2"><table border="1" cellpadding="2" cellspacing="0" id="bkmrk-%C2%A0-command-purpose-ro-3" width="80%"><caption> </caption><tbody><tr align="left" valign="bottom"><th scope="col"><div class="pCH1_CellHead1">Command</div></th><th scope="col"><div class="pCH1_CellHead1">Purpose</div></th></tr><tr align="left" valign="top"><td>Router(config-access-map)# **match** {**ip address** {**1-199** | **1300-2699** | *acl\_name*} | **ipx address** {**800-999** | *acl\_name*}| **mac** **address** *acl\_name*}

</td><td>Configures the match clause in a VLAN access map sequence.

</td></tr><tr align="left" valign="top"><td>Router(config-access-map)# **no** **match** {**ip address** {**1-199** | **1300-2699** | *acl\_name*} | **ipx address** {**800-999** | *acl\_name*}| **mac** **address** *acl\_name*}

</td><td>Deletes the match clause in a VLAN access map sequence.

</td></tr></tbody></table>

</div>When configuring a match clause in a VLAN access map sequence, note the following information:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)You can select one or more ACLs.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)VACLs attached to WAN interfaces support only standard and extended Cisco IOS IP ACLs.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Use the no keyword to remove a match clause or specified ACLs in the clause.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)For information about named MAC-Layer ACLs, see the ["Configuring MAC ACLs" section on page 36-63](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/qos.html#wpxref36764).

•![](https://www.cisco.com/en/US/i/templates/blank.gif)For information about Cisco IOS ACLs, see the *Cisco IOS Security Configuration Guide*, Release 12.2, "Traffic Filtering and Firewalls," at this URL:

[http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur\_c/ftrafwl/index.htm](http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur_c/ftrafwl/index.htm)

See the ["VLAN Access Map Configuration and Verification Examples" section](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1055968).

### Configuring an Action Clause in a VLAN Access Map Sequence

To configure an action clause in a VLAN access map sequence, perform this task:

<div align="left" id="bkmrk-%C2%A0-command-purpose-ro-4"><table border="1" cellpadding="2" cellspacing="0" id="bkmrk-%C2%A0-command-purpose-ro-5" width="80%"><caption> </caption><tbody><tr align="left" valign="bottom"><th scope="col"><div class="pCH1_CellHead1">Command</div></th><th scope="col"><div class="pCH1_CellHead1">Purpose</div></th></tr><tr align="left" valign="top"><td>Router(config-access-map)# **action** {**drop** \[**log**\]} | {**forward** \[**capture**\]} | {**redirect** {{ethernet | fastethernet | gigabitethernet | tengigabitethernet} slot/port} | {port-channel channel\_id}}

</td><td>Configures the action clause in a VLAN access map sequence.

</td></tr><tr align="left" valign="top"><td>Router(config-access-map)# **no** **action** {**drop** \[**log**\]} | {**forward** \[**capture**\]} | {**redirect** {{ethernet | fastethernet | gigabitethernet | tengigabitethernet} slot/port} | {port-channel channel\_id}}

</td><td>Deletes the action clause in from the VLAN access map sequence.

</td></tr></tbody></table>

</div>When configuring an action clause in a VLAN access map sequence, note the following information:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)You can set the action to drop, forward, forward capture, or redirect packets.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)VACLs applied to WAN interfaces support only the forward capture action. VACLs applied to WAN interfaces do not support the drop, forward, or redirect actions.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Forwarded packets are still subject to any configured Cisco IOS security ACLs.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)The **capture** action sets the capture bit for the forwarded packets so that ports with the capture function enabled can receive the packets. Only forwarded packets can be captured. For more information about the **capture** action, see the ["Configuring a Capture Port" section](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1089072).

•![](https://www.cisco.com/en/US/i/templates/blank.gif)VACLs applied to WAN interfaces do not support the log action.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)When the log action is specified, dropped packets are logged in software. Only dropped IP packets can be logged.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)The redirect action allows you to specify up to five interfaces, which can be physical interfaces or EtherChannels. You cannot specify packets to be redirected to an EtherChannel member or a VLAN interface.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)The redirect interface must be in the VLAN for which the VACL access map is configured.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)If a VACL is redirecting traffic to an egress SPAN source port, SPAN does not copy the VACL-redirected traffic.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)SPAN and RSPAN destination ports transmit VACL-redirected traffic.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Use the no keyword to remove an action clause or specified redirect interfaces.

See the ["VLAN Access Map Configuration and Verification Examples" section](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1055968).

<span style="color: rgb(187, 187, 187); font-family: var(--font-heading, var(--font-body)); font-size: 2.333em; font-weight: 400;">Applying a VLAN Access Map</span>

To apply a VLAN access map, perform this task:

<div align="left" id="bkmrk-%C2%A0-command-purpose-ro-6"><table border="1" cellpadding="2" cellspacing="0" id="bkmrk-%C2%A0-command-purpose-ro-7" width="80%"><caption> </caption><tbody><tr align="left" valign="bottom"><th scope="col"><div class="pCH1_CellHead1">Command</div></th><th scope="col"><div class="pCH1_CellHead1">Purpose</div></th></tr><tr align="left" valign="top"><td>Router(config)# **vlan filter** *map\_name* {**vlan-list** *vlan\_list* | **interface** *type*<sup>[1](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wpxref1089175) </sup>*number*<sup>[2](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wpxref1089179) </sup>}

</td><td>Applies the VLAN access map to the specified VLANs or WAN interfaces.

</td></tr></tbody></table>

<table><tbody><tr><td><sup>[1](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wpxref1059325) </sup>*type* = **pos**, **atm**, or **serial**

<sup>[2](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wpxref1059325) </sup>number = *slot*/*port* or *slot*/*port\_adapter*/*port*; can include a subinterface or channel group descriptor

</td></tr></tbody></table>

</div>When applying a VLAN access map, note the following information:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)You can apply the VLAN access map to one or more VLANs or WAN interfaces.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)The *vlan\_list* parameter can be a single VLAN ID or a comma-separated list of VLAN IDs or VLAN ID ranges (*vlan\_ID*-*vlan\_ID*).

•![](https://www.cisco.com/en/US/i/templates/blank.gif)If you delete a WAN interface that has a VACL applied, the VACL configuration on the interface is also removed.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)You can apply only one VLAN access map to each VLAN or WAN interface.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)VACLs applied to VLANs are active only for VLANs with a Layer 3 VLAN interface configured. Applying a VLAN access map to a VLAN without a Layer 3 VLAN interface creates an administratively down Layer 3 VLAN interface to support the VLAN access map.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)VACLs applied to VLANs are inactive if the Layer 2 VLAN does not exist or is not operational.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)You cannot apply a VACL to a secondary private VLAN. VACLs applied to primary private VLANs also apply to secondary private VLANs.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Use the **no** keyword to clear VLAN access maps from VLANs or WAN interfaces.

See the ["VLAN Access Map Configuration and Verification Examples" section](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1055968).

<span style="color: rgb(187, 187, 187); font-family: var(--font-heading, var(--font-body)); font-size: 2.333em; font-weight: 400;">Verifying VLAN Access Map Configuration</span>

To verify VLAN access map configuration, perform this task:

<div align="left" id="bkmrk-%C2%A0-command-purpose-ro-8"><table border="1" cellpadding="2" cellspacing="0" id="bkmrk-%C2%A0-command-purpose-ro-9" width="80%"><caption> </caption><tbody><tr align="left" valign="bottom"><th scope="col"><div class="pCH1_CellHead1">Command</div></th><th scope="col"><div class="pCH1_CellHead1">Purpose</div></th></tr><tr align="left" valign="top"><td>Router# **show vlan access-map** \[*map\_name*\]

</td><td>Verifies VLAN access map configuration by displaying the content of a VLAN access map.

</td></tr><tr align="left" valign="top"><td>Router# **show vlan filter** \[**access-map** *map\_name* | **vlan** *vlan\_id* | **interface** *type*<sup>[1](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wpxref1089163) </sup> *number*<sup>[2](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wpxref1089166) </sup>\]

</td><td>Verifies VLAN access map configuration by displaying the mappings between VACLs and VLANs.

</td></tr></tbody></table>

<table><tbody><tr><td><sup>[1](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wpxref1069935) </sup>*type* = **pos**, **atm**, or **serial**

<sup>[2](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wpxref1069935) </sup>number = *slot*/*port* or *slot*/*port\_adapter*/*port*; can include a subinterface or channel group descriptor

</td></tr></tbody></table>

</div><span style="color: rgb(187, 187, 187); font-family: var(--font-heading, var(--font-body)); font-size: 2.333em; font-weight: 400;">VLAN Access Map Configuration and Verification Examples</span>

Assume IP-named ACL **net\_10** and **any\_host** are defined as follows:

```
Router# show ip access-lists net_10
```

```
Extended IP access list net_10
```

```
    permit ip 10.0.0.0 0.255.255.255 any
```

```
<a name="wp1057256"></a><br></br>
```

```
Router# show ip access-lists any_host
```

```
Standard IP access list any_host
```

```
    permit any
```

```
<a name="wp1057267"></a><br></br>
```

This example shows how to define and apply a VLAN access map to forward IP packets. In this example, IP traffic matching net\_10 is forwarded and all other IP packets are dropped due to the default drop action. The map is applied to VLAN 12 to 16.

```
Router(config)# <strong class="cBold">vlan access-map thor 10
</strong>
```

```
Router(config-access-map)# <strong class="cBold">match ip address net_10
</strong>
```

```
Router(config-access-map)# <strong class="cBold">action forward</strong> 
```

```
Router(config-access-map)# <strong class="cBold">exit</strong> 
```

```
Router(config)# <strong class="cBold">vlan filter thor vlan-list 12-16</strong> 
```

```
<a name="wp1129446"></a><br></br>
```

This example shows how to define and apply a VLAN access map to drop and log IP packets. In this example, IP traffic matching net\_10 is dropped and logged and all other IP packets are forwarded:

```
Router(config)# <strong class="cBold">vlan access-map ganymede 10
</strong>
```

```
Router(config-access-map)# <strong class="cBold">match ip address net_10
</strong>
```

```
Router(config-access-map)# <strong class="cBold">action drop log
</strong>
```

```
Router(config-access-map)# <strong class="cBold">exit
</strong>
```

```
Router(config)# <strong class="cBold">vlan access-map ganymede 20
</strong>
```

```
Router(config-access-map)# <strong class="cBold">match ip address any_host
</strong>
```

```
Router(config-access-map)# <strong class="cBold">action forward
</strong>
```

```
Router(config-access-map)# <strong class="cBold">exit
</strong>
```

```
Router(config)# <strong class="cBold">vlan filter ganymede vlan-list 7-9</strong> 
```

```
<a name="wp1049869"></a><br></br>
```

This example shows how to define and apply a VLAN access map to forward and capture IP packets. In this example, IP traffic matching net\_10 is forwarded and captured and all other IP packets are dropped:

```
Router(config)# <strong class="cBold">vlan access-map mordred 10</strong> 
```

```
Router(config-access-map)# <strong class="cBold">match ip address net_10
</strong>
```

```
Router(config-access-map)# <strong class="cBold">action forward capture
</strong>
```

```
Router(config-access-map)# <strong class="cBold">exit
</strong>
```

```
Router(config)# <strong class="cBold">vlan filter mordred vlan-list 2, 4-6</strong> 
```

<span style="color: rgb(187, 187, 187); font-family: var(--font-heading, var(--font-body)); font-size: 2.333em; font-weight: 400;">Configuring a Capture Port</span>

A port configured to capture VACL-filtered traffic is called a capture port.

---

<p class="callout info">**Note:** To apply IEEE 802.1Q or ISL tags to the captured traffic, configure the capture port to trunk unconditionally (see the ["Configuring the Layer 2 Switching Port as an ISL or 802.1Q Trunk" section on page 13-9](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/layer2.html#wpxref42266) and the ["Configuring the Layer 2 Trunk Not to Use DTP" section on page 13-10](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/layer2.html#wpxref41245)).</p>

---

To configure a capture port, perform this task:

<div align="left" id="bkmrk-%C2%A0-%C2%A0-command-purpose--4"><table border="1" cellpadding="3" cellspacing="0" class="steptable" id="bkmrk-%C2%A0-%C2%A0-command-purpose--5" width="80%"><caption> </caption><tbody><tr align="left" valign="bottom"><th scope="col"> </th><th scope="col"><div class="pCH1_CellHead1">Command</div></th><th scope="col"><div class="pCH1_CellHead1">Purpose</div></th></tr><tr align="left" valign="top"><td>Step 1

</td><td>Router(config)# **interface** {{*type*<sup>[1](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wpxref1089094) </sup> slot/port}

</td><td>Specifies the interface to configure.

</td></tr><tr align="left" valign="top"><td colspan="1" rowspan="2">Step 2

</td><td>Router(config-if)# **switchport capture allowed vlan** {**add** | **all** | **except** | **remove**} *vlan\_list*

</td><td>(Optional) Filters the captured traffic on a per-destination-VLAN basis. The default is **all**.

</td></tr><tr align="left" valign="top"><td>Router(config-if)# **no switchport capture allowed vlan**

</td><td>Clears the configured destination VLAN list and returns to the default value (**all**).

</td></tr><tr align="left" valign="top"><td colspan="1" rowspan="2">Step 3

</td><td>Router(config-if)# **switchport capture**

</td><td>Configures the port to capture VACL-filtered traffic.

</td></tr><tr align="left" valign="top"><td>Router(config-if)# **no switchport capture**

</td><td>Disables the capture function on the interface.

</td></tr></tbody></table>

<table><tbody><tr><td><sup>[1](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wpxref1089095) </sup>*type* = **fastethernet**, **gigabitethernet**, or **tengigabitethernet**

</td></tr></tbody></table>

</div>When configuring a capture port, note the following information:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)You can configure any port as a capture port.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)The *vlan\_list* parameter can be a single VLAN ID or a comma-separated list of VLAN IDs or VLAN ID ranges (*vlan\_ID*-*vlan\_ID*).

•![](https://www.cisco.com/en/US/i/templates/blank.gif)To encapsulate captured traffic, configure the capture port with the **switchport trunk encapsulation** command (see the ["Configuring a Layer 2 Switching Port as a Trunk" section on page 13-9](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/layer2.html#wpxref68429)) before you enter the **switchport capture** command.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)For unencapsulated captured traffic, configure the capture port with the **switchport mode access** command (see the ["Configuring a LAN Interface as a Layer 2 Access Port" section on page 13-15](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/layer2.html#wpxref61391)) before you enter the **switchport capture** command.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)The capture port supports only egress traffic. No traffic can enter the switch through a capture port.

This example shows how to configure a Fast Ethernet interface 5/1 as a capture port:

```
Router(config)# <strong class="cBold">interface gigabitEthernet 5/1</strong> 
```

```
Router(config-if)# <strong class="cBold">switchport capture</strong> 
```

```
Router(config-if)# end
```

```
<a name="wp1089143"></a><br></br>
```

This example shows how to display VLAN access map information:

```
Router# <strong class="cBold">show vlan access-map mordred</strong> 
```

```
Vlan access-map "mordred"  10
```

```
        match: ip address net_10
```

```
        action: forward capture
```

```
Router# 
```

```
<a name="wp1089150"></a><br></br>
```

This example shows how to display mappings between VACLs and VLANs. For each VACL map, there is information about the VLANs that the map is configured on and the VLANs that the map is active on. A VACL is not active if the VLAN does not have an interface.

```
Router# <strong class="cBold">show vlan filter</strong> 
```

```
VLAN Map mordred:
```

```
        Configured on VLANs:  2,4-6
```

```
            Active on VLANs:  2,4-6
```

```
Router# 
```

## Configuring VACL Logging

When you configure VACL logging, IP packets that are denied generate log messages in these situations:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)When the first matching packet is received

•![](https://www.cisco.com/en/US/i/templates/blank.gif)For any matching packets received during the last 5-minute interval

•![](https://www.cisco.com/en/US/i/templates/blank.gif)If the threshold is reached before the 5-minute interval

Log messages are generated on a per-flow basis. A flow is defined as packets with the same IP addresses and Layer 4 (UDP or TCP) port numbers. When a log message is generated, the timer and packet count is reset.

These restrictions apply to VACL logging:

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Because of the rate-limiting function for redirected packets, VACL logging counters may not be accurate.

•![](https://www.cisco.com/en/US/i/templates/blank.gif)Only denied IP packets are logged.

To configure VACL logging, use the **action drop log** command action in VLAN access map submode (see the ["Configuring PACLs" section](https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/vacl.html#wp1039754) for configuration information) and perform this task in global configuration mode to specify the global VACL logging parameters:

<div align="left" id="bkmrk-%C2%A0-%C2%A0-command-purpose--6"><table border="1" cellpadding="3" cellspacing="0" class="steptable" id="bkmrk-%C2%A0-%C2%A0-command-purpose--7" width="80%"><caption> </caption><tbody><tr align="left" valign="bottom"><th scope="col"> </th><th scope="col"><div class="pCH1_CellHead1">Command</div></th><th scope="col"><div class="pCH1_CellHead1">Purpose</div></th></tr><tr align="left" valign="top"><td>Step 1

</td><td>Router(config)# **vlan access-log maxflow** *max\_number*

</td><td>Sets the log table size. The content of the log table can be deleted by setting the maxflow number to 0. The default is 500 with a valid range of 0 to 2048. When the log table is full, logged packets from new flows are dropped by the software.

</td></tr><tr align="left" valign="top"><td>Step 2

</td><td>Router(config)# **vlan access-log ratelimit** *pps*

</td><td>Sets the maximum redirect VACL logging packet rate. The default packet rate is 2000 packets per second with a valid range of 0 to 5000. Packets exceeding the limit are dropped by the hardware.

</td></tr><tr align="left" valign="top"><td>Step 3

</td><td>Router(config)# **vlan access-log threshold** *pkt\_count*

</td><td>Sets the logging threshold. A logging message is generated if the threshold for a flow is reached before the 5-minute interval. By default, no threshold is set.

</td></tr><tr align="left" valign="top"><td>Step 4

</td><td>Router(config)# **exit**

</td><td>Exits VLAN access map configuration mode.

</td></tr><tr align="left" valign="top"><td>Step 5

</td><td>Router# **show vlan access-log config**

</td><td>(Optional) Displays the configured VACL logging properties.

</td></tr><tr align="left" valign="top"><td>Step 6

</td><td>Router# show vlan access-log flow *protocol* {{*src\_addr src\_mask*} | any | {host {*hostname* | *host\_ip*}}} {{*dst\_addr dst\_mask*} | any | {host {*hostname* | *host\_ip*}}}

\[vlan *vlan\_id*\]

</td><td>(Optional) Displays the content of the VACL log table.

</td></tr><tr align="left" valign="top"><td>Step 7

</td><td>Router# **show vlan access-log statistics**

</td><td>(Optional) Displays packet and message counts and other statistics.

</td></tr></tbody></table>

</div>This example shows how to configure global VACL logging in hardware:

```
Router(config)# <strong class="cBold">vlan access-log maxflow 800</strong> 
```

```
Router(config)# <strong class="cBold">vlan access-log ratelimit 2200</strong> 
```

```
Router(config)# <strong class="cBold">vlan access-log threshold 4000</strong> 
```

# Device Specific Configuration

# Cisco Nexus 3000 Series NX-OS Fundamentals Configuration Guide, Release 9.3(x)

<article aria-labelledby="ariaid-title2" class="topic concept nested1" id="bkmrk-information-about-ba" lang="en-US">## Information About Basic Device Management

<section class="body conbody"><section class="section" id="bkmrk-this-section-provide">This section provides information about basic device management.

</section></section><nav class="related-links" role="navigation">- [Device Hostname](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/fundamentals/93x/configuration/guide/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x_chapter_0100.html#con_1229065)
- [Message-of-the-Day Banner](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/fundamentals/93x/configuration/guide/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x_chapter_0100.html#con_1229038)
- [Device Clock](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/fundamentals/93x/configuration/guide/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x_chapter_0100.html#con_1237088)
- [Clock Manager](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/fundamentals/93x/configuration/guide/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x_chapter_0100.html#concept_AEC2F5C13F9A4476AEB03B1B1A076C7F)
- [Time Zone and Summer Time (Daylight Saving Time)](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/fundamentals/93x/configuration/guide/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x_chapter_0100.html#con_1237210)
- [User Sessions](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/fundamentals/93x/configuration/guide/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x_chapter_0100.html#con_1230258)

</nav><article aria-labelledby="ariaid-title3" class="topic concept nested2" id="bkmrk-device-hostname-you-" lang="en-US">### Device Hostname

<section class="body conbody"><section class="section" id="bkmrk-you-can-change-the-d">You can change the device hostname displayed in the command prompt from the default (switch) to another character string. When you give the device a unique hostname, you can easily identify the device from the command-line interface (CLI) prompt.

</section></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title4" class="topic concept nested2" id="bkmrk-message-of-the-day-b" lang="en-US">### Message-of-the-Day Banner

<section class="body conbody"><section class="section" id="bkmrk-the-message-of-the-d">The message-of-the-day (MOTD) banner displays before the user login prompt on the device. This message can contain any information that you want to display for users of the device.

</section></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title5" class="topic concept nested2" id="bkmrk-device-clock-if-you-" lang="en-US">### Device Clock

<section class="body conbody"><section class="section" id="bkmrk-if-you-do-not-synchr">If you do not synchronize your device with a valid outside timing mechanism, such as an NTP clock source, you can manually set the clock time when your device boots.

</section></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title6" class="topic concept nested2" id="bkmrk-clock-manager-the-ci" lang="en-US">### Clock Manager

<section class="body conbody"><section class="section" id="bkmrk-the-cisco-nexus-chas">The Cisco Nexus chassis may contain clocks of different types that may need to be synchronized. These clocks are a part of various components (such as the supervisor, LC processors, or line cards) and each may be using a different protocol.

The clock manager provides a way to synchronize these different clocks.

</section></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title7" class="topic concept nested2" id="bkmrk-time-zone-and-summer" lang="en-US">### Time Zone and Summer Time (Daylight Saving Time)

<section class="body conbody"><section class="section" id="bkmrk-you-can-configure-th">You can configure the time zone and summer time (daylight saving time) setting for your device. These values offset the clock time from Coordinated Universal Time (UTC). UTC is International Atomic Time (TAI) with leap seconds added periodically to compensate for the Earth's slowing rotation. UTC was formerly called Greenwich Mean Time (GMT).

</section></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title8" class="topic concept nested2" id="bkmrk-user-sessions-you-ca" lang="en-US">### User Sessions

<section class="body conbody"><section class="section" id="bkmrk-you-can-display-the-">You can display the active user session on your device. You can also send messages to the user sessions. For more information about managing user sessions and accounts, see the Cisco Nexus security configuration guide for your device.

</section></section><nav class="related-links" role="navigation"></nav></article></article><article aria-labelledby="ariaid-title9" class="topic task nested1" id="bkmrk-changing-the-device-" lang="en-US">## Changing the Device Hostname

<section class="body taskbody"><section class="section context" id="bkmrk-you-can-change-the-d-1">You can change the device hostname displayed in the command prompt from the default (switch) to another character string.

</section>### SUMMARY STEPS

1. <span class="ph synph"><span class="keyword kwd">configure terminal</span></span>
2. <span class="ph synph"><kbd class="ph delim">{ </kbd><span class="keyword kwd">hostname</span> <kbd class="ph sep">| </kbd><span class="keyword kwd">switchname</span><kbd class="ph delim">} </kbd><var>name</var></span>
3. <span class="ph synph"><span class="keyword kwd">exit</span></span>
4. (Optional) <span class="ph synph"><span class="keyword kwd">copy running-config startup-config</span></span>

### DETAILED STEPS

<div class="tableContainer"><table class="ol steps" id="bkmrk-%C2%A0-command-or-action-" style="width: 100%;"><thead><tr><th align="left" style="width: 3.21384%;"> </th><th align="left" style="width: 49.1993%;">Command or Action</th><th align="left" style="width: 47.5869%;">Purpose</th></tr></thead><tbody><tr class="li step"><td align="left" id="bkmrk-step%C2%A01" style="width: 3.21384%;" valign="top">**Step 1**</td><td align="left" class="step--command" style="width: 49.1993%;" valign="top"><span class="ph synph"><span class="keyword kwd">configure terminal</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch# configure terminal
switch(config)#
```

</section></td><td align="left" class="step--purpose" style="width: 47.5869%;" valign="top"><section class="itemgroup info">Enters global configuration mode.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A02" style="width: 3.21384%;" valign="top">**Step 2**</td><td align="left" class="step--command" style="width: 49.1993%;" valign="top"><span class="ph synph"><kbd class="ph delim">{ </kbd><span class="keyword kwd">hostname</span> <kbd class="ph sep">| </kbd><span class="keyword kwd">switchname</span><kbd class="ph delim">} </kbd><var>name</var></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>Using the <span class="ph synph"><span class="keyword kwd">hostname</span> </span>command:

```
switch(config)# hostname Engineering1
Engineering1(config)#
```

Using the <span class="ph synph"><span class="keyword kwd">switchname</span> </span>command:

```
Engineering1(config)# switchname Engineering2
Engineering2(config)#
```

</section></td><td align="left" class="step--purpose" style="width: 47.5869%;" valign="top"><section class="itemgroup info">Changes the device hostname. The <span class="ph synph"><var>name</var> </span>argument is alphanumeric, case sensitive, and has a maximum length of 32 characters. The default is switch.

<p class="callout info">The <span class="ph synph"><span class="keyword kwd">switchname</span> </span>command performs the same function as the <span class="ph synph"><span class="keyword kwd">hostname</span> </span>command.</p>

<div class="tableContainer">  
</div></section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A03" style="width: 3.21384%;" valign="top">**Step 3**</td><td align="left" class="step--command" style="width: 49.1993%;" valign="top"><span class="ph synph"><span class="keyword kwd">exit</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
Engineering2(config)# exit
Engineering2#
```

</section></td><td align="left" class="step--purpose" style="width: 47.5869%;" valign="top"><section class="itemgroup info">Exits global configuration mode.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A04" style="width: 3.21384%;" valign="top">**Step 4**</td><td align="left" class="step--command" style="width: 49.1993%;" valign="top">(Optional) <span class="ph synph"><span class="keyword kwd">copy running-config startup-config</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
Engineering2# copy running-config startup-config
```

</section></td><td align="left" class="step--purpose" style="width: 47.5869%;" valign="top">(Optional) <section class="itemgroup info">Copies the running configuration to the startup configuration.

</section></td></tr></tbody></table>

</div></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title10" class="topic task nested1" id="bkmrk-configuring-the-motd" lang="en-US">## Configuring the MOTD Banner

<section class="body taskbody"><section class="section context" id="bkmrk-you-can-configure-th-1">You can configure the MOTD to display before the login prompt on the terminal when a user logs in. The MOTD banner has the following characteristics:

- Maximum of 80 characters per line
- Maximum of 40 lines

</section>### SUMMARY STEPS

1. <span class="ph synph"><span class="keyword kwd">configure terminal</span></span>
2. <span class="ph synph"><span class="keyword kwd">banner motd</span> <var>delimiting-character message delimiting-character</var></span>
3. <span class="ph synph"><span class="keyword kwd">exit</span></span>
4. (Optional) <span class="ph synph"><span class="keyword kwd">show banner motd</span></span>
5. (Optional) <span class="ph synph"><span class="keyword kwd">copy running-config startup-config</span></span>

### DETAILED STEPS

<div class="tableContainer"><table class="ol steps" id="bkmrk-%C2%A0-command-or-action--1" style="width: 100%;"><thead><tr><th align="left" style="width: 3.33776%;"> </th><th align="left" style="width: 51.9156%;">Command or Action</th><th align="left" style="width: 44.7466%;">Purpose</th></tr></thead><tbody><tr class="li step"><td align="left" id="bkmrk-step%C2%A01-1" style="width: 3.33776%;" valign="top">**Step 1**</td><td align="left" class="step--command" style="width: 51.9156%;" valign="top"><span class="ph synph"><span class="keyword kwd">configure terminal</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch# configure terminal
switch(config)#
```

</section></td><td align="left" class="step--purpose" style="width: 44.7466%;" valign="top"><section class="itemgroup info">Enters global configuration mode.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A02-1" style="width: 3.33776%;" valign="top">**Step 2**</td><td align="left" class="step--command" style="width: 51.9156%;" valign="top"><span class="ph synph"><span class="keyword kwd">banner motd</span> <var>delimiting-character message delimiting-character</var></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch(config)# banner motd #Welcome to the Switch#
switch(config)# 
```

</section></td><td align="left" class="step--purpose" style="width: 44.7466%;" valign="top"><section class="itemgroup info">Configures the MOTD banner. Do not use the <var class="keyword varname">delimiting-character</var> in the <var class="keyword varname">message</var> text.

<p class="callout warning">Do not use " or % as a delimiting character.</p>

<div class="tableContainer">  
</div></section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A03-1" style="width: 3.33776%;" valign="top">**Step 3**</td><td align="left" class="step--command" style="width: 51.9156%;" valign="top"><span class="ph synph"><span class="keyword kwd">exit</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch(config)# exit
switch#
```

</section></td><td align="left" class="step--purpose" style="width: 44.7466%;" valign="top"><section class="itemgroup info">Exits global configuration mode.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A04-1" style="width: 3.33776%;" valign="top">**Step 4**</td><td align="left" class="step--command" style="width: 51.9156%;" valign="top">(Optional) <span class="ph synph"><span class="keyword kwd">show banner motd</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch# show banner motd
```

</section></td><td align="left" class="step--purpose" style="width: 44.7466%;" valign="top">(Optional) <section class="itemgroup info">Displays the configured MOTD banner.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A05" style="width: 3.33776%;" valign="top">**Step 5**</td><td align="left" class="step--command" style="width: 51.9156%;" valign="top">(Optional) <span class="ph synph"><span class="keyword kwd">copy running-config startup-config</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch# copy running-config startup-config
```

</section></td><td align="left" class="step--purpose" style="width: 44.7466%;" valign="top">(Optional) <section class="itemgroup info">Copies the running configuration to the startup configuration.

</section></td></tr></tbody></table>

</div></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title11" class="topic task nested1" id="bkmrk-configuring-the-time" lang="en-US">## Configuring the Time Zone

<section class="body taskbody"><section class="section context" id="bkmrk-you-can-configure-th-2">You can configure the time zone to offset the device clock time from UTC.

</section>### SUMMARY STEPS

1. <span class="ph synph"><span class="keyword kwd">configure terminal</span></span>
2. <span class="ph synph"><span class="keyword kwd">clock timezone</span> <var>zone-name offset-hours offset-minutes</var></span>
3. <span class="ph synph"><span class="keyword kwd">exit</span></span>
4. (Optional) <span class="ph synph"><span class="keyword kwd">show clock</span></span>
5. (Optional) <span class="ph synph"><span class="keyword kwd">copy running-config startup-config</span></span>

### DETAILED STEPS

<div class="tableContainer"><table class="ol steps" id="bkmrk-%C2%A0-command-or-action--2" style="width: 100%;"><thead><tr><th align="left" style="width: 3.21674%;"> </th><th align="left" style="width: 46.3506%;">Command or Action</th><th align="left" style="width: 50.5562%;">Purpose</th></tr></thead><tbody><tr class="li step"><td align="left" id="bkmrk-step%C2%A01-2" style="width: 3.21674%;" valign="top">**Step 1**</td><td align="left" class="step--command" style="width: 46.3506%;" valign="top"><span class="ph synph"><span class="keyword kwd">configure terminal</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch# configure terminal
switch(config)#
```

</section></td><td align="left" class="step--purpose" style="width: 50.5562%;" valign="top"><section class="itemgroup info">Enters global configuration mode.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A02-2" style="width: 3.21674%;" valign="top">**Step 2**</td><td align="left" class="step--command" style="width: 46.3506%;" valign="top"><span class="ph synph"><span class="keyword kwd">clock timezone</span> <var>zone-name offset-hours offset-minutes</var></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch(config)# clock timezone EST -5 0
```

</section></td><td align="left" class="step--purpose" style="width: 50.5562%;" valign="top"><section class="itemgroup info">Configures the time zone. The <var class="keyword varname">zone-name</var> argument is a 3-character string for the time zone acronym (for example, PST or EST). The <var class="keyword varname">offset-hours</var> argument is the offset from the UTC and the range is from –23 to 23 hours. The range for the <var class="keyword varname">offset-minutes</var> argument is from 0 to 59 minutes.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A03-2" style="width: 3.21674%;" valign="top">**Step 3**</td><td align="left" class="step--command" style="width: 46.3506%;" valign="top"><span class="ph synph"><span class="keyword kwd">exit</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch(config)# exit
switch#
```

</section></td><td align="left" class="step--purpose" style="width: 50.5562%;" valign="top"><section class="itemgroup info">Exits global configuration mode.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A04-2" style="width: 3.21674%;" valign="top">**Step 4**</td><td align="left" class="step--command" style="width: 46.3506%;" valign="top">(Optional) <span class="ph synph"><span class="keyword kwd">show clock</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch# show clock
```

</section></td><td align="left" class="step--purpose" style="width: 50.5562%;" valign="top">(Optional) <section class="itemgroup info">Displays the time and time zone.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A05-1" style="width: 3.21674%;" valign="top">**Step 5**</td><td align="left" class="step--command" style="width: 46.3506%;" valign="top">(Optional) <span class="ph synph"><span class="keyword kwd">copy running-config startup-config</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch# copy running-config startup-config
```

</section></td><td align="left" class="step--purpose" style="width: 50.5562%;" valign="top">(Optional) <section class="itemgroup info">Copies the running configuration to the startup configuration.

</section></td></tr></tbody></table>

</div></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title12" class="topic task nested1" id="bkmrk-configuring-summer-t" lang="en-US">## Configuring Summer Time (Daylight Saving Time)

<section class="body taskbody"><section class="section context" id="bkmrk-you-can-configure-wh">You can configure when summer time, or daylight saving time, is in effect for the device and the offset in minutes.

</section>### SUMMARY STEPS

1. <span class="ph synph"><span class="keyword kwd">configure terminal</span></span>
2. <span class="ph synph"><span class="keyword kwd">clock</span><kbd class="ph sep"> </kbd><span class="keyword kwd">summer-time</span> <kbd class="ph sep"></kbd><var>zone-name start-week start-day start-month start-time end-week end-day end-month end-time offset-minutes</var></span>
3. <span class="ph synph"><span class="keyword kwd">exit</span></span>
4. (Optional) <span class="ph synph"><span class="keyword kwd">show clock detail</span></span>
5. (Optional) <span class="ph synph"><span class="keyword kwd">copy running-config startup-config</span></span>

### DETAILED STEPS

<div class="tableContainer"><table class="ol steps" id="bkmrk-%C2%A0-command-or-action--3" style="width: 100%;"><thead><tr><th align="left" style="width: 3.33745%;"> </th><th align="left" style="width: 43.9041%;">Command or Action</th><th align="left" style="width: 52.7585%;">Purpose</th></tr></thead><tbody><tr class="li step"><td align="left" id="bkmrk-step%C2%A01-3" style="width: 3.33745%;" valign="top">**Step 1**</td><td align="left" class="step--command" style="width: 43.9041%;" valign="top"><span class="ph synph"><span class="keyword kwd">configure terminal</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch# configure terminal
switch(config)#
```

</section></td><td align="left" class="step--purpose" style="width: 52.7585%;" valign="top"><section class="itemgroup info">Enters global configuration mode.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A02-3" style="width: 3.33745%;" valign="top">**Step 2**</td><td align="left" class="step--command" style="width: 43.9041%;" valign="top"><span class="ph synph"><span class="keyword kwd">clock</span><kbd class="ph sep"> </kbd><span class="keyword kwd">summer-time</span> <kbd class="ph sep"></kbd><var>zone-name start-week start-day start-month start-time end-week end-day end-month end-time offset-minutes</var></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch(config)# clock summer-time PDT 
1 Sunday March 02:00 1 Sunday 
November 02:00 60
```

</section></td><td align="left" class="step--purpose" style="width: 52.7585%;" valign="top"><section class="itemgroup info">Configures summer time or daylight saving time.

The <var class="keyword varname">zone-name</var> argument is a three character string for the time zone acronym (for example, PST and EST).

The values for the <var class="keyword varname">start-day</var> and <var class="keyword varname">end-day</var> arguments are <span class="ph synph"><span class="keyword kwd">Monday</span>, <span class="keyword kwd">Tuesday</span>, <span class="keyword kwd">Wednesday</span>, <span class="keyword kwd">Thursday</span>, <span class="keyword kwd">Friday</span>, <span class="keyword kwd">Saturday</span>, and <span class="keyword kwd">Sunday</span> </span>.

The values for the <var class="keyword varname">start-month</var> and <var class="keyword varname">end-month</var> arguments are <span class="ph synph"><span class="keyword kwd">January</span>, <span class="keyword kwd">February</span>, <span class="keyword kwd">March</span>, <span class="keyword kwd">April</span>, <span class="keyword kwd">May</span>, <span class="keyword kwd">June</span>, <span class="keyword kwd">July</span>, <span class="keyword kwd">August</span>, <span class="keyword kwd">September</span>, <span class="keyword kwd">October</span>, <span class="keyword kwd">November</span>, and <span class="keyword kwd">December</span> </span>.

The value for the <var class="keyword varname">start-time</var> and <var class="keyword varname">end-time</var> arguments are in the format <span class="ph synph"><var>hh</var><span class="keyword kwd">:</span><var>mm</var> </span>.

The range for the <var class="keyword varname">offset-minutes</var> argument is from 0 to 1440 minutes.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A03-3" style="width: 3.33745%;" valign="top">**Step 3**</td><td align="left" class="step--command" style="width: 43.9041%;" valign="top"><span class="ph synph"><span class="keyword kwd">exit</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch(config)# exit
switch#
```

</section></td><td align="left" class="step--purpose" style="width: 52.7585%;" valign="top"><section class="itemgroup info">Exits global configuration mode.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A04-3" style="width: 3.33745%;" valign="top">**Step 4**</td><td align="left" class="step--command" style="width: 43.9041%;" valign="top">(Optional) <span class="ph synph"><span class="keyword kwd">show clock detail</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch(config)# show clock detail
```

</section></td><td align="left" class="step--purpose" style="width: 52.7585%;" valign="top">(Optional) <section class="itemgroup info">Displays the configured MOTD banner.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A05-2" style="width: 3.33745%;" valign="top">**Step 5**</td><td align="left" class="step--command" style="width: 43.9041%;" valign="top">(Optional) <span class="ph synph"><span class="keyword kwd">copy running-config startup-config</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch# copy running-config startup-config
```

</section></td><td align="left" class="step--purpose" style="width: 52.7585%;" valign="top">(Optional) <section class="itemgroup info">Copies the running configuration to the startup configuration.

</section></td></tr></tbody></table>

</div></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title13" class="topic task nested1" id="bkmrk-manually-setting-the" lang="en-US">## Manually Setting the Device Clock

<section class="body taskbody"><section class="section context" id="bkmrk-you-can-set-the-cloc">You can set the clock manually if your device cannot access a remote time source.

</section><section class="section prereq p" id="bkmrk-before-you-begin-con"><section class="tasklabel">### Before you begin

</section>Configure the time zone.

</section>### SUMMARY STEPS

1. <span class="ph synph"><span class="keyword kwd">clock set </span><var>time day month year</var></span>
2. (Optional) <span class="ph synph"><span class="keyword kwd">show clock</span></span>

### DETAILED STEPS

<div class="tableContainer"><table class="ol steps" id="bkmrk-%C2%A0-command-or-action--4" style="width: 100%;"><thead><tr><th align="left" style="width: 3.2143%;"> </th><th align="left" style="width: 41.5323%;">Command or Action</th><th align="left" style="width: 55.2534%;">Purpose</th></tr></thead><tbody><tr class="li step"><td align="left" id="bkmrk-step%C2%A01-4" style="width: 3.2143%;" valign="top">**Step 1**</td><td align="left" class="step--command" style="width: 41.5323%;" valign="top"><span class="ph synph"><span class="keyword kwd">clock set </span><var>time day month year</var></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch# clock set 15:00:00 30 May 2008
Fri May 30 15:14:00 PDT 2008
```

</section></td><td align="left" class="step--purpose" style="width: 55.2534%;" valign="top"><section class="itemgroup info">Configures the device clock.

The format for the <var class="keyword varname">time</var> argument is <span class="ph synph"><var>hh</var><span class="keyword kwd">:</span><var>mm</var><span class="keyword kwd">:</span><var>ss</var> </span>.

The range for the <var class="keyword varname">day</var> argument is from 1 to 31.

The values for the <var class="keyword varname">month</var> argument are <span class="ph synph"><span class="keyword kwd">January</span> </span>, <span class="ph synph"><span class="keyword kwd">February</span> </span>, <span class="ph synph"><span class="keyword kwd">March</span> </span>, <span class="ph synph"><span class="keyword kwd">April</span> </span>, <span class="ph synph"><span class="keyword kwd">May</span> </span>, <span class="ph synph"><span class="keyword kwd">June</span> </span>, <span class="ph synph"><span class="keyword kwd">July</span> </span>, <span class="ph synph"><span class="keyword kwd">August</span> </span>, <span class="ph synph"><span class="keyword kwd">September</span> </span>, <span class="ph synph"><span class="keyword kwd">October</span> </span>, <span class="ph synph"><span class="keyword kwd">November</span> </span>, and <span class="ph synph"><span class="keyword kwd">December</span> </span>.

The range for the <var class="keyword varname">year </var>argument is from 2000 to 2030.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A02-4" style="width: 3.2143%;" valign="top">**Step 2**</td><td align="left" class="step--command" style="width: 41.5323%;" valign="top">(Optional) <span class="ph synph"><span class="keyword kwd">show clock</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch(config)# show clock
```

</section></td><td align="left" class="step--purpose" style="width: 55.2534%;" valign="top">(Optional) <section class="itemgroup info">Displays the current clock value.

</section></td></tr></tbody></table>

</div></section><nav class="related-links" role="navigation"><section class="linklist relinfo reltasks">**Related Tasks**  
<section>[Configuring the Time Zone](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/fundamentals/93x/configuration/guide/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x_chapter_0100.html#task_1231769)</section></section></nav></article><article aria-labelledby="ariaid-title14" class="topic task nested1" id="bkmrk-setting-the-clock-ma" lang="en-US">## Setting the Clock Manager

<section class="body taskbody"><section class="section context" id="bkmrk-you-can-configure-th-3">You can configure the clock manager to synchronize all the clocks of the components in the Cisco Nexus chassis.

</section>### SUMMARY STEPS

1. <span class="ph synph"><span class="keyword kwd">clock protocol</span> <var>protocol</var> <span class="keyword kwd">vdc</span> <var>vdc-num</var></span>
2. (Optional) <span class="ph synph"><span class="keyword kwd">show run clock\_manager</span></span>

### DETAILED STEPS

<div class="tableContainer"><table class="ol steps" style="width: 100%;"><thead><tr><th align="left" style="width: 3.33761%;"> </th><th align="left" style="width: 30.9022%;">Command or Action</th><th align="left" style="width: 65.7602%;">Purpose</th></tr></thead><tbody><tr class="li step"><td align="left" id="bkmrk-step%C2%A01-5" style="width: 3.33761%;" valign="top">**Step 1**</td><td align="left" class="step--command" style="width: 30.9022%;" valign="top"><span class="ph synph"><span class="keyword kwd">clock protocol</span> <var>protocol</var> <span class="keyword kwd">vdc</span> <var>vdc-num</var></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
# clock protocol ptp vdc 2
```

</section></td><td align="left" class="step--purpose" style="width: 65.7602%;" valign="top"><section class="itemgroup info">Configures the clock manager.

The values for the <var class="keyword varname">protocol</var> argument are <span class="ph synph"><span class="keyword kwd">ptp</span> </span>, <span class="ph synph"><span class="keyword kwd">ntp</span> </span>, and <span class="ph synph"><span class="keyword kwd">none</span> </span>.

The following describes the values:

- <span class="ph synph"><span class="keyword kwd">ptp</span> </span>—Synchronizes clocks with Precision Time Protocol (PTP) as described by IEEE 1588.
- <span class="ph synph"><span class="keyword kwd">ntp</span> </span>— Synchronizes clocks with Network Time Protocol (NTP).
- <span class="ph synph"><span class="keyword kwd">none</span> </span>—Use <span class="ph synph"><span class="keyword kwd">clock set</span> </span>to set supervisor clocks.

<p class="callout info">When <span class="ph synph"><span class="keyword kwd">none</span> </span>is used, the clock in the specified VDC must be configured.</p>

<p class="callout info">Once the protocol is configured, the clock in the specified VDC must use that protocol. For example, if the <span class="ph synph"><span class="keyword kwd">clock protocol ptp vdc 2</span> </span>command is entered, then PTP should be configured in VDC 2.</p>

The range for the <var class="keyword varname">vdc</var> argument is 1 to 8.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A02-5" style="width: 3.33761%;" valign="top">**Step 2**</td><td align="left" class="step--command" style="width: 30.9022%;" valign="top">(Optional) <span class="ph synph"><span class="keyword kwd">show run clock\_manager</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
#show run clock_manager
```

</section></td><td align="left" class="step--purpose" style="width: 65.7602%;" valign="top">(Optional) <section class="itemgroup info">Displays the configuration of the clock manager.

</section></td></tr></tbody></table>

</div></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title15" class="topic task nested1" id="bkmrk-configuring-the-mode" lang="en-US">## Configuring the Mode on the Cisco Nexus 3100 Series Switches

<section class="body taskbody"><section class="section context" id="bkmrk-you-can-configure-th-4">You can configure the Cisco Nexus 3100 Series switches in the N9K mode using the following commands:

</section><section class="section prereq p" id="bkmrk-before-you-begin-the"><section class="tasklabel">### Before you begin

</section><section class="p">The Cisco Nexus 3100 Series switches, except Cisco Nexus 3100-V switches, now support two system modes: the N3K mode and the N9K mode. The N3K mode is the default mode. It uses the same CLI commands as the previous Cisco Nexus 3000 Series and Cisco Nexus 3100 Series NX-OS releases. The N9K mode enables the Cisco Nexus 3100 Series switches to use the Cisco Nexus 9000 Series switches CLI commands. Refer to the Cisco Nexus 9000 Series configuration guides for the Cisco Nexus 9000 Series CLI commands. <div class="tableContainer">  
</div></section></section><p class="callout info">The N9K mode is available on the Cisco Nexus 3100 Series switches only and it is not available on the Cisco Nexus 3000 Series switches. Cisco Nexus 3100-V switches supports only N9K CLI.</p>

### SUMMARY STEPS

1. <span class="ph synph"><span class="keyword kwd">configure terminal</span></span>
2. switch(config)# <span class="ph synph"><span class="keyword kwd">system switch-mode </span><var>mode</var></span>
3. switch(config)# <span class="ph synph"><span class="keyword kwd">write erase</span></span>
4. switch(config)# <span class="ph synph"><span class="keyword kwd">reload</span></span>
5. (Optional) switch(config)# <span class="ph synph"><span class="keyword kwd">show system switch-mode</span></span>

### DETAILED STEPS

<table border="1" style="border-collapse: collapse; width: 100%;"><colgroup><col style="width: 33.3745%;"></col><col style="width: 33.3745%;"></col><col style="width: 33.3745%;"></col></colgroup><tbody><tr><td>  
</td><th align="left">Command or Action</th><td>Purpose</td></tr><tr><td>Step 1</td><td>`configure terminal`</td><td>Enters global configuration mode.</td></tr></tbody></table>

<div class="tableContainer">Example:</div>```
switch# configure terminal
switch(config)#
```

<table border="1" style="border-collapse: collapse; width: 100%;"><colgroup><col style="width: 33.3333%;"></col><col style="width: 33.3333%;"></col><col style="width: 33.3333%;"></col></colgroup><tbody><tr><td>  
</td><td>Command or Action</td><td>Purpose</td></tr><tr><td>Step 2</td><td>`switch(config)# <span class="ph synph"><span class="keyword kwd">system switch-mode </span><var>mode</var></span>`</td><td>Configures the mode as N9K.</td></tr></tbody></table>

<div class="tableContainer">Example:</div>```
switch(config)# system switch-mode n9k
!WARNING: "write erase/reload" is required before new mode is effective.
```

<table border="1" style="border-collapse: collapse; width: 100%;"><colgroup><col style="width: 33.3333%;"></col><col style="width: 33.3333%;"></col><col style="width: 33.3333%;"></col></colgroup><tbody><tr><td>  
</td><td>Command or Action</td><td>Purpose</td></tr><tr><td>Step 3</td><td>`switch(config)# <span class="ph synph"><span class="keyword kwd">write erase</span></span>`</td><td>Erases the start-up configuration.</td></tr></tbody></table>

<div class="tableContainer">Example:</div>```
switch(config)# write erase
Warning: This command will erase the startup-configuration.
Do you wish to proceed anyway? (y/n)  [n] y
```

<table border="1" style="border-collapse: collapse; width: 100%;"><colgroup><col style="width: 33.3333%;"></col><col style="width: 33.3333%;"></col><col style="width: 33.3333%;"></col></colgroup><tbody><tr><td>  
</td><td>Command or Action</td><td>Purpose</td></tr><tr><td>Step 4</td><td>`switch(config)# <span class="ph synph"><span class="keyword kwd">reload</span></span>`</td><td>Reloads the switch.</td></tr></tbody></table>

<div class="tableContainer">Example:</div>```
switch(config)# reload
This command will reboot the system. (y/n)?  [n] y
2002 Jan  9 03:57:59 Neptune-1 %$ VDC-1 %$ %PLATFORM-2-PFM_SYSTEM_RESET: Manual system restart from Command Line Interface
 
(c) Copyright 2013, Cisco Systems.
(c) Copyright 2015, Cisco Systems.
NPT3000 BIOS v.3.0.2, Tue 05/26/2015 
 
Press TAB in 1 seconds to list all boot options
Any other key to active boot...
Press  ctrl L to go to loader prompt in 2 secs
 
Booting kickstart image: bootflash:/n9000-dk9.7.0.3.I2.0.527.bin
Image valid
INIT: version 2.88 booting
Skipping ata_piix for n3k.
Unsquashing rootfs ...
 
Loading IGB driver ...
Installing SSE module ... done
Creating the sse device node ... done
Loading I2C driver ...
Installing CCTRL driver for card_type 31 ...
CCTRL driver for card_index 11081 ...
7.46: Interrupt throttling disabled. No cctrl irq detected.
 
Checking all filesystems./etc/rc.d/rcS.d/S08check-flash-noinit: line 167: sg_inq: command not found
/etc/rc.d/rcS.d/S08check-flash-noinit: line 168: sg_inq: command not found
Current boot disk sda3..
...Skipping LOGFLASH check for N3k...
.Skipping plog check for N3k...
 
Skipping installing default sprom values...
Configuring network ...
Installing LC netdev ...
Installing veobc ...
Installing OBFL driver ...
..done Wed Jan 9 03:59:36 UTC 2002
tune2fs 1.42.1 (17-Feb-2012)
Setting reserved blocks percentage to 0% (0 blocks)
Starting portmap daemon...
creating NFS state directory: done
starting 8 nfsd kernel threads: done
starting mountd: done
starting statd: done
Saving image for img-sync ...
Loading system software
Installing local RPMS
Patch Repository Setup completed successfully
Uncompressing system image: Wed Jan 9 03:59:46 UTC 2002
blogger: nothing to do.
 
..done Wed Jan 9 03:59:46 UTC 2002
Creating /dev/mcelog
Starting mcelog daemon
Removing dme lib
Moving N3K specific syslog config file
INIT: Entering runlevel: 3
Running S93thirdparty-script...
 
Populating conf files for hybrid sysmgr ...
Starting hybrid sysmgr ...
2002 Jan  9 03:59:54  %$ VDC-1 %$ Jan  9 03:59:52 %KERN-2-SYSTEM_MSG: [    9.062765] Initializing NVRAM Block 6  - kernel
2002 Jan  9 03:59:54  %$ VDC-1 %$ Jan  9 03:59:52 %KERN-2-SYSTEM_MSG: [   10.469175] hwport mode=6type 2. mod_no 0, inst_no 0 - kernel
2002 Jan  9 03:59:58  %$ VDC-1 %$ %USER-0-SYSTEM_MSG: after syslog open   - clis
2002 Jan  9 03:59:58  %$ VDC-1 %$ %USER-0-SYSTEM_MSG: after ksink_get_rsw_sched_policy  - clis
2002 Jan  9 03:59:58  %$ VDC-1 %$ %USER-0-SYSTEM_MSG: after clis_process_options   - clis
2002 Jan  9 03:59:58  %$ VDC-1 %$ %USER-0-SYSTEM_MSG:  before access to bkout_cfg  - clis
2002 Jan  9 03:59:58  %$ VDC-1 %$ %USER-2-SYSTEM_MSG: main 2348- Done with Shm..Now read commandfiles - clis
2002 Jan  9 03:59:59  %$ VDC-1 %$ %PLATFORM-2-PS_FAIL: Power supply 1 failed or shut down (Serial number N/A)
2002 Jan  9 03:59:59  %$ VDC-1 %$ %PLATFORM-2-PS_OK: Power supply 2 ok (Serial number )
2002 Jan  9 03:59:59  %$ VDC-1 %$ %PLATFORM-2-PS_FANOK: Fan in Power supply 2 ok
2002 Jan  9 03:59:59  %$ VDC-1 %$ %PLATFORM-2-PS_ABSENT: Power supply 1 is absent/shutdown, ps-redundancy might be affected
2002 Jan  9 03:59:59  %$ VDC-1 %$ %PLATFORM-2-PS_RED_MODE_CHG: Power supply operational redundancy mode changed to non-redundant
2002 Jan  9 03:59:59  %$ VDC-1 %$ %PLATFORM-2-FANMOD_FAN_OK: Fan module 1 (Fan1(sys_fan1) fan) ok
2002 Jan  9 03:59:59  %$ VDC-1 %$ %PLATFORM-2-FANMOD_FAN_OK: Fan module 2 (Fan2(sys_fan2) fan) ok
2002 Jan  9 03:59:59  %$ VDC-1 %$ %PLATFORM-2-FANMOD_FAN_OK: Fan module 3 (Fan3(sys_fan3) fan) ok
2002 Jan  9 03:59:59  %$ VDC-1 %$ %PLATFORM-2-FANMOD_FAN_OK: Fan module 4 (Fan4(sys_fan4) fan) ok
2002 Jan  9 04:00:01  %$ VDC-1 %$ %USER-2-SYSTEM_MSG: IP Netlink thread init successful  - netstack
2002 Jan  9 04:00:08  %$ VDC-1 %$ %USER-2-SYSTEM_MSG: main :2355- Done with reading commandfiles - clis
2002 Jan  9 04:00:18  %$ VDC-1 %$ %USER-0-SYSTEM_MSG: end of default policer - copp
2002 Jan  9 04:00:18  %$ VDC-1 %$ %COPP-2-COPP_NO_POLICY: Control-plane is unprotected.
2002 Jan  9 04:00:27  %$ VDC-1 %$ icmpv6: IPV6 Netlink thread init successful
2002 Jan  9 04:00:28  %$ VDC-1 %$ %VDC_MGR-2-VDC_ONLINE: vdc 1 has come online
Waiting for system online status before starting POAP ...
2002 Jan  9 04:01:01 switch %$ VDC-1 %$ %ASCII-CFG-2-CONF_CONTROL: System ready
Starting Auto Provisioning ...
2002 Jan  9 04:01:02 switch %$ VDC-1 %$ %USER-0-SYSTEM_MSG: ETH_PORT_UP - port_client
Done
 
Abort Auto Provisioning and continue with normal setup ?(yes/no)[n]: 2002 Jan  9 04:01:03 switch %$ VDC-1 %$ %POAP-2-POAP_INITED: POAP process initialized
yes  
         ---- System Admin Account Setup ---- 
Do you want to enforce secure password standard (yes/no) [y]: no
 
  Enter the password for "admin":
  Confirm the password for "admin":
 
         ---- Basic System Configuration Dialog VDC: 1 ----
 This setup utility will guide you through the basic configuration of
the system. Setup configures only enough connectivity for management
of the system.
 
Please register Cisco Nexus3000 Family devices promptly with your
supplier. Failure to register may affect response times for initial
service calls. Nexus3000 devices must be registered to receive
entitled support services.
 
Press Enter at anytime to skip a dialog. Use ctrl-c at anytime
to skip the remaining dialogs. 
Would you like to enter the basic configuration dialog (yes/no): no
2015 Jan  9 04:01:26 switch %$ VDC-1 %$ %COPP-2-COPP_POLICY: Control-Plane is protected with policy copp-system-p-policy-strict.
 
User Access Verification
switch login: admin
Password:
Cisco Nexus Operating System (NX-OS) Software
TAC support: http://www.cisco.com/tac
Copyright (C) 2002-2015, Cisco and/or its affiliates.
All rights reserved.
The copyrights to certain works contained in this software are
owned by other third parties and used and distributed under their own
licenses, such as open source.  This software is provided "as is," and unless
otherwise stated, there is no warranty, express or implied, including but not
limited to warranties of merchantability and fitness for a particular purpose.
Certain components of this software are licensed under
the GNU General Public License (GPL) version 2.0 or
GNU General Public License (GPL) version 3.0  or the GNU
Lesser General Public License (LGPL) Version 2.1 or
Lesser General Public License (LGPL) Version 2.0.
A copy of each such license is available at
http://www.opensource.org/licenses/gpl-2.0.php and
http://opensource.org/licenses/gpl-3.0.html and
http://www.opensource.org/licenses/lgpl-2.1.php and
http://www.gnu.org/licenses/old-licenses/library.txt.
```

<table border="1" style="border-collapse: collapse; width: 100%;"><colgroup><col style="width: 33.3333%;"></col><col style="width: 33.3333%;"></col><col style="width: 33.3333%;"></col></colgroup><tbody><tr><td>  
</td><td>Command or Action</td><td>Purpose</td></tr><tr><td>Step 5</td><td>(Optional) `switch(config)# <span class="ph synph"><span class="keyword kwd">show system switch-mode</span></span>`</td><td>(Optional) <section class="itemgroup info">Verifies the configuration mode as N9K on the switch.

</section></td></tr></tbody></table>

<div class="tableContainer">Example:</div>```
switch(config)#  show system switch-mode 
system switch-mode n9k
switch(config)#
```

<div class="tableContainer">  
</div></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title16" class="topic concept nested1" id="bkmrk-managing-users-you-c" lang="en-US">## Managing Users

<section class="body conbody"><section class="section" id="bkmrk-you-can-display-info">You can display information about users logged into the device and send messages to those users.

</section></section><nav class="related-links" role="navigation">- [Displaying Information about the User Sessions](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/fundamentals/93x/configuration/guide/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x_chapter_0100.html#task_1173970)
- [Sending a Message to Users](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/fundamentals/93x/configuration/guide/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x_chapter_0100.html#task_1233999)

</nav><article aria-labelledby="ariaid-title17" class="topic task nested2" id="bkmrk-displaying-informati" lang="en-US">### Displaying Information about the User Sessions

<section class="body taskbody"><section class="section context" id="bkmrk-you-can-display-info-1">You can display information about the user session on the device.

</section>### SUMMARY STEPS

1. <span class="ph synph"><span class="keyword kwd">show users</span></span>

### DETAILED STEPS

<div class="tableContainer"><table class="ol steps" id="bkmrk-command-or-action-pu"><thead><tr><th align="left">Command or Action</th><th align="left">Purpose</th></tr></thead><tbody><tr class="li step"><td align="left" class="step--command" valign="top"><span class="ph synph"><span class="keyword kwd">show users</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">#### Example:

</section>```
switch# show users
```

</section></td><td align="left" class="step--purpose" valign="top"><section class="itemgroup info">Displays the user sessions.

</section></td></tr></tbody></table>

</div></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title18" class="topic task nested2" id="bkmrk-sending-a-message-to" lang="en-US">### Sending a Message to Users

<section class="body taskbody"><section class="section context" id="bkmrk-you-can-send-a-messa">You can send a message to active users currently using the device CLI.

</section>### SUMMARY STEPS

1. (Optional) <span class="ph synph"><span class="keyword kwd">show users</span></span>
2. <span class="ph synph"><span class="keyword kwd">send </span>\[<span class="keyword kwd">session</span> <var>line</var>\] <var>message-text</var></span>

### DETAILED STEPS

<div class="tableContainer"><table class="ol steps" id="bkmrk-%C2%A0-command-or-action--5" style="width: 100%;"><thead><tr><th align="left" style="width: 3.33745%;"> </th><th align="left" style="width: 50.3115%;">Command or Action</th><th align="left" style="width: 46.3511%;">Purpose</th></tr></thead><tbody><tr class="li step"><td align="left" id="bkmrk-step%C2%A01-7" style="width: 3.33745%;" valign="top">**Step 1**</td><td align="left" class="step--command" style="width: 50.3115%;" valign="top">(Optional) <span class="ph synph"><span class="keyword kwd">show users</span></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch# show users
```

</section></td><td align="left" class="step--purpose" style="width: 46.3511%;" valign="top">(Optional) <section class="itemgroup info">Displays the active user sessions.

</section></td></tr><tr class="li step"><td align="left" id="bkmrk-step%C2%A02-7" style="width: 3.33745%;" valign="top">**Step 2**</td><td align="left" class="step--command" style="width: 50.3115%;" valign="top"><span class="ph synph"><span class="keyword kwd">send </span>\[<span class="keyword kwd">session</span> <var>line</var>\] <var>message-text</var></span>

<section class="itemgroup stepxmp"><section class="tasklabel">Example:

</section>```
switch# send Reloading the device is 10 minutes!
```

</section></td><td align="left" class="step--purpose" style="width: 46.3511%;" valign="top"><section class="itemgroup info">Sends a message to all active users or to a specific user. The message can be up to 80 alphanumeric characters and is case sensitive.

</section></td></tr></tbody></table>

</div></section><nav class="related-links" role="navigation"></nav></article></article><article aria-labelledby="ariaid-title19" class="topic concept nested1" id="bkmrk-verifying-the-device" lang="en-US">## Verifying the Device Configuration

<section class="body conbody"><section class="section" id="bkmrk-to-verify-the-config">To verify the configuration, use one of the following commands:

<div class="tableContainer"><table border="1" id="bkmrk-%C2%A0-command-purpose-sh" width="100%"><caption> </caption><colgroup><col></col><col></col></colgroup><thead><tr><th id="bkmrk-command">Command

</th><th id="bkmrk-purpose">Purpose

</th></tr></thead><tbody><tr><td headers="con_1233942__table_14606C41D03D4328A10C095F39E99973__entry__1 "><span class="ph synph"><span class="keyword kwd">show running-config</span></span>

</td><td headers="con_1233942__table_14606C41D03D4328A10C095F39E99973__entry__2 ">Displays the running configuration.

</td></tr><tr><td headers="con_1233942__table_14606C41D03D4328A10C095F39E99973__entry__1 "><span class="ph synph"><span class="keyword kwd">show startup-config</span></span>

</td><td headers="con_1233942__table_14606C41D03D4328A10C095F39E99973__entry__2 ">Displays the startup configuration.

</td></tr><tr><td headers="con_1233942__table_14606C41D03D4328A10C095F39E99973__entry__1 "><span class="ph synph"><span class="keyword kwd">show time-stamp running-config last-changed</span></span>

</td><td headers="con_1233942__table_14606C41D03D4328A10C095F39E99973__entry__2 ">Displays the timestamp when the running configuration was last changed.

</td></tr></tbody></table>

</div>For detailed information about the fields in the output from these commands, see the Cisco Nexus command reference for your device.

</section></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title20" class="topic concept nested1" id="bkmrk-default-settings-for" lang="en-US">## Default Settings for Basic Device Parameters

<section class="body conbody"><section class="section" id="bkmrk-this-table-lists-the">This table lists the default settings for basic device parameters.

<div class="tableContainer"><table border="1" id="bkmrk-table-1.%C2%A0default-bas" width="100%"><caption><span class="table--title-label tabletitle">Table 1. </span><span class="tabletitle">Default Basic Device Parameters</span></caption><colgroup><col></col><col></col></colgroup><thead><tr><th id="bkmrk-parameters">Parameters

</th><th id="bkmrk-default">Default

</th></tr></thead><tbody><tr><td headers="con_1227506__tab_1227517__entry__1 ">MOTD banner text

</td><td headers="con_1227506__tab_1227517__entry__2 ">User Access Verification

</td></tr><tr><td headers="con_1227506__tab_1227517__entry__1 ">Clock time zone

</td><td headers="con_1227506__tab_1227517__entry__2 ">UTC

</td></tr></tbody></table>

</div></section></section><nav class="related-links" role="navigation"></nav></article><article aria-labelledby="ariaid-title21" class="topic reference nested1" id="bkmrk-additional-reference" lang="en-US">## Additional References for Basic Device Management

<section class="body refbody"><section class="section" id="bkmrk-you-can-find-additio">You can find additional information related to basic device management.

</section></section><nav class="related-links" role="navigation">- [Related Documents for Basic Device Management](https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/fundamentals/93x/configuration/guide/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x/b-cisco-nexus-3000-nx-os-fundamentals-configuration-guide-93x_chapter_0100.html#con_1248601)

</nav><article aria-labelledby="ariaid-title22" class="topic concept nested2" id="bkmrk-related-documents-fo" lang="en-US">### Related Documents for Basic Device Management

<section class="body conbody"><div class="tableContainer"><table border="1" id="bkmrk-%C2%A0-related-topic-docu" width="100%"><caption> </caption><colgroup><col></col><col></col></colgroup><thead><tr><th id="bkmrk-related-topic">Related Topic

</th><th id="bkmrk-document-title">Document Title

</th></tr></thead><tbody><tr><td headers="con_1248601__table_6221523D77734F08BEB96E59F007ED48__entry__1 ">Licensing

</td><td headers="con_1248601__table_6221523D77734F08BEB96E59F007ED48__entry__2 "><cite class="cite">Cisco NX-OS Licensing Guide</cite>

</td></tr><tr><td headers="con_1248601__table_6221523D77734F08BEB96E59F007ED48__entry__1 ">Command reference

</td><td headers="con_1248601__table_6221523D77734F08BEB96E59F007ED48__entry__2 "><cite class="cite"><span class="ph"><cite class="cite" id="bkmrk-cisco-nexus-7000-ser">Cisco Nexus 7000 Series NX-OS Fundamentals Command Reference</cite></span></cite>

</td></tr></tbody></table>

</div></section></article></article>

# Port Setup

# LACP Port-Channel Trunk

1\. Enter the configuration mode.

```
config t
```

2\. Enter the interface/s that you want to add to the port channel/LACP.

```
int e1/5
```

For multiples use below.

```
int e1/5-6
```

3\. Give a description of the ports.

```
desc MUT7-RACK-SWI-POE1
```

4\. Configure the port/s as a switchport.

```
switchport
```

5\. Configure the port/s as a trunk.

```
switchport mode trunk
```

6\. Configure the port as a port-channel. `Active` sets the interface to LACP Active, `Passive` sets it to LACP Passive, and not setting a mode defaults to `On`.

```
channel-group 1 mode active
```

7\. Enter the configuration for the port channel.

```
int port-channel 1
```

8\. Give a description of the port-channel.

```
desc MUT7-RACK-SWI-POE1
```

9\. Configure the port-channel as a trunk port.

```
switchport mode trunk
```

10\. Issue the command `no shutdown` to enable the port.

```
no shutdown
```

11\. Add VLANs if needed to the port-channel interface. Edit accordingly to allow only necessary VLANs.

```
switchport trunk allowed vlan add 1,2,5,20,30,49,50,60,77,79,200,243
```

# Define VLANs Allowed on Trunk Link

1\. First navigate to the interface for the port or port-channel.

```
config t
int e1/1
```

Below for a port-channel.

```
config t
int port-channel 1
```

2\. Ensure the port/port-channel is a trunk.

```
switchport mode trunk
```

3\. To add a VLAN, use the following command to add the VLANs necessary.

```
switchport trunk allowed vlan add 7,10,20
```

4\. To remove a VLAN, use the following command.

```
switchport trunk allowed vlan remove 5-10,12
```

# LACP Port-Channel Access

1\. Enter the configuration mode.

```
config t
```

2\. Enter the interface/s that you want to add to the port channel/LACP.

```
int e1/5
```

For multiples use below.

```
int e1/5-6
```

3\. Give a description of the ports.

```
desc MUT7-RACK-SWI-POE1
```

4\. Configure the port/s as a switchport.

```
switchport
```

5\. Configure the port/s as access.

```
switchport mode access
```

6\. Configure the port as a port-channel. `Active` sets the interface to LACP Active, `Passive` sets it to LACP Passive, and not setting a mode defaults to `On`.

```
channel-group 1 mode active
```

7\. Enter the configuration for the port channel.

```
int port-channel 1
```

8\. Give a description of the port-channel.

```
desc MUT7-RACK-SWI-POE1
```

9\. Configure the port-channel as an access port.

```
switchport mode access
```

10\. Issue the command `no shutdown` to enable the port.

```
no shutdown
```

11\. Add VLAN, if needed, to the port-channel interface.

```
switchport access vlan 20
```

# Troubleshooting

# Restore Config From usbflash0

```
R2#dir usbflash0:

 

Directory of usbflash0:/
 

    1  ----           0   Feb 4 2015 07:21:52 +00:00  System Volume Information

 

    2  -rw-    36326184   Feb 4 2015 08:07:24 +00:00  c1841-adventerprisek9-mz.124-15.T17.bin
 

1000062976 bytes total (963723264 bytes free)

 

R2#cop
 

R2#copy run usb
 

R2#copy run usbflash0:test.cfg
 

Destination filename [test.cfg]?
 

1419 bytes copied in 1.556 secs (912 bytes/sec)

 

R2#dir usbflash0:
 

Directory of usbflash0:/
 

    1  ----           0   Feb 4 2015 07:21:52 +00:00  System Volume Information

 

    2  -rw-    36326184   Feb 4 2015 08:07:24 +00:00  c1841-adventerprisek9-mz.124-15.T17.bin
 

    3  -rw-        1419  Feb 26 2015 15:01:22 +00:00  test.cfg
 

1000062976 bytes total (963706880 bytes free)

 

R2#
```