Cisco SG300 or SF300 Procedure to Change from Layer2 to Layer3

This process will default any configurations you already have on the switch so you want to take a copy of the config first.

Connect with the serial cable to the Console port.

Set your serial port speed to 115200

Login:

username=cisco
password=cisco

The above are default values.

Run the following command at the prompt:

#menu

This will bring up the Switch Main Menu

Select -> System Mode -> Edit ->Hit Spacebar to toggle mode from Layer 2 to Layer 3 -> Save

*sometimes, depending on your terminal emulation, you may not be able to get to the 'Save' option. Hit Esc, when you are at the top most parameter.

Your switch will reboot after another prompt to which you answer yes.

There will be no IP address when the switch boots up. 

Configure an IP address on the default VLAN 1 so you can http to the switch as follows:

Same process as above to bring up the menu, then

System Configuration Menu -> Ip Configuration -> IPv4 Address Configuration ->IPv4 Address Settings -> Edit ->

Enter the IP address for the switch

Eg. 

IPv4 Address: 10.16.1.1
Subnet Mask: 255.255.255.0

Save

Now you can connect to any of the ethernet ports and then http://10.16.1.1

Cisco 3560X License Update

We initially received wrong licenses from Cisco to upgrade the feature on our 3560X switches from ipbase to ipservices - we only realize this when we installed the .lic file. This is what we got:

Switch#sh license udi
Device#   PID                   SN              UDI
-----------------------------------------------------------------------------
*0        WS-C3560X-48T-S       FDO1520P0KG     WS-C3560X-48T-S:FDO1520P0KG

A wrongly generated .lic file from Cisco:

Switch#license install flash:FDO1520P0KG_20110622144858347.lic
Installing licenses from "flash:FDO1520P0KG_20110622144858347.lic"
% Error: Install failed. UDI L-C3560X-LIC=:FDO1520P0KG on license does not match any device
0/1 licenses were successfully installed
0/1 licenses were existing licenses
1/1 licenses were failed to install

In order to correct this just send an email to licensing@cisco.com with the PID and UDI to have them correct this. Then install as follows:

Copy the license to the flash and run the license install command.

Switch#copy tftp flash:
Address or name of remote host [10.10.1.200]?
Source filename [FDO1520P0KG_20110622144858347.lic]? FDO1520P0KG_20110622174501853.lic
Destination filename [FDO1520P0KG_20110622174501853.lic]?
Accessing tftp://10.10.1.200/FDO1520P0KG_20110622174501853.lic...
Loading FDO1520P0KG_20110622174501853.lic from 10.10.1.200 (via Vlan1): !
[OK - 1160 bytes]

1160 bytes copied in 8.204 secs (141 bytes/sec)

Switch#license install flash:FDO1520P0KG_20110622174501853.lic
Installing licenses from "flash:FDO1520P0KG_20110622174501853.lic"
Installing...Feature:ipservices...Successful:Supported
1/1 licenses were successfully installed
0/1 licenses were existing licenses
0/1 licenses were failed to install

Switch#
*Mar  1 00:10:29.657: %IOS_LICENSE_IMAGE_APPLICATION-6-LICENSE_LEVEL: Module name = c3560x Next reboot level = ipservices and License = ipservices
*Mar  1 00:10:30.118: %LICENSE-6-INSTALL: Feature ipservices 1.0 was installed in this device. UDI=WS-C3560X-48T-S:FDO1520P0KG; StoreIndex=1:Primary License Storage
Switch#

Switch#sh license feature
Feature name      Enforcement  Evaluation  Clear Allowed  Enabled
ipservices               yes             yes                yes            yes
ipbase                   yes              no                 yes            no
lanbase                  no               no                 yes            no

Switch#sh license all
License Store: Primary License Storage
StoreIndex: 0   Feature: ipbase                            Version: 1.0
        License Type: Permanent
        License State: Active, Not in Use
        License Priority: Medium
        License Count: Non-Counted

StoreIndex: 1   Feature: ipservices                        Version: 1.0
        License Type: Permanent
        License State: Active, In Use
        License Priority: Medium
        License Count: Non-Counted

License Store: Evaluation License Storage
StoreIndex: 0   Feature: ipservices                        Version: 1.0
        License Type: Evaluation
        License State: Inactive
            Evaluation total period: 8  weeks 4  days
            Evaluation period left: 8  weeks 4  days
        License Priority: None
        License Count: Non-Counted

WOL Directed Broadcast Configuration on Cisco Layer 3 Switches

Use directed broadcast to configure the Wake On LAN (WOL) application on Cisco L3 switches. In our case we had the WOL servers connected to VLAN 1 (10.1.20.64 and .65). They are used to wake client computers on all other private VLANs. Here's the working example for our test case with clients on VLAN2:

access-list 180 permit udp host 10.1.20.64 any 

access-list 180 permit udp host 10.1.20.65 any

interface Vlan1 

ip address 10.1.0.10 255.255.0.0 

ip helper-address 10.2.255.255 

! 

interface Vlan2 

ip address 10.2.0.10 255.255.0.0 

ip directed-broadcast 180 

Note that the helper address sends the WOL broadcast to all destination subnets that are specified there (in our case to the 10.2.0.0/16 subnet) but you control what lands up on the destination VLAN with the directed broadcast command and an acl. It works if you use a supernet in the helper address command to cover all your destination networks.

VLAN Filters Not Working On Cisco Catalyst 6000 with MSFC

What I thought was going to be a simple 5 minute procedure ended up taking 3 hours! My goal was very simple - add some security amongst a set of VLANs on a Cisco 6000 (CatOS 7-6-17) switch based on the following requirements:


-VLAN 30 cannot initiate connections to VLAN 50 and VLAN 60 but must get to the Internet
-VLAN 50, is the Admin VLAN and can get to everything
-VLAN 60 cannot initiate connections to VLAN 50 and VLAN 30 but must get to the Internet


Piece of cake, right? I quickly define the filters on the MSFC, deciding, as it should be to place the filters closest to the initiating traffic on VLANs 30 and 60 and have no filters on VLAN 50. The configuration turned out to be like this:


interface Vlan30
description Corp VLAN
ip address 10.30.0.2 255.255.0.0
ip access-group 130 in
!
interface Vlan500
description Admin VLAN
ip address 10.50.0.2 255.255.0.0

!
interface Vlan600
description Test VLAN
ip address 10.60.0.2 255.255.0.0
ip access-group 160 in

ip route 0.0.0.0 0.0.0.0 10.30.0.11

access-list 130 permit tcp any any established
access-list 130 deny ip 10.30.0.0 0.0.255.255 10.50.0.0 0.0.255.255
access-list 130 deny ip 10.30.0.0 0.0.255.255 10.60.0.0 0.0.255.255
access-list 130 permit ip any any

access-list 160 permit tcp any any established
access-list 160 deny ip any 10.50.0.0 0.0.255.255
access-list 160 deny ip any 10.30.0.0 0.0.255.255
access-list 160 permit ip any any


We begin testing this and yay, the traffic from VLAN 30 to 50 is blocked and....then... wait a minute now it's not blocked. I check the hit counter on ACL 130 and there were a couple denies from 10.30.0.0/16 to 10.60.0.0/16 but nothing more. What's going on here? We test from VLAN 30 to VLAN 50 and then from VLAN 60 to both VLAN 30 and VLAN 50 - the same result. The first packet observe the filter rules but thereafter access to each VLAN from any other VLAN is wide open. Grrrr!


At this point I know that my filters are good - there's no rocket science to setting these so I figured that it must be beyond just the filter that was causing this. The clue that led me to the solution was the result of a trace route from a source device (10.30.0.20) to 10.60.0.20. The icmp packet got there in just one hop! Now I expected the VLAN interface hop first before getting to the destination. This wreaked of a cached entry somewhere. But, how did it bypass the Layer 3 routing functionality or...did it? And then it hit me! My theories of Multilayer Switching (MLS) came flooding back and I remembered how the switch consults the router for the initial routing of the packet (Router on a Stick) and then caches the Layer 3 entry in the switch itself for subsequent routing of the paket (Layer3 switching). Of course!


Remember, I had not worked on a Cisco 6000 switch for years so I had to do some digging and found that MLS is enabled by default on this switch (with an MSFC of course). To disable it, merely add the 'no ip mls' command to each VLAN interface. So for VLAN30 it looked like this:


interface Vlan30
description Corp VLAN
ip address 10.30.0.2 255.255.0.0
ip access-group 130 in
no ip mls


I did this on all three layer 3 interfaces and the filters are now doing the work it was supposed to. You can clear the MLS cache by issuing clear mls on the switch itself.


Switch Details


WS-C6009 Software, Version NmpSW: 7.6(17)
System Bootstrap Version: 5.3(1)
System Boot Image File is 'bootflash:cat6000-supk8.7-6-17.bin'


Modules:


WS-X6K-SUP1A-2GE
WS-F6K-PFC
WS-F6K-MSFC2


MSFC:


ROM: System Bootstrap, Version 12.1(3r)E2, RELEASE SOFTWARE (fc1)
BOOTLDR: MSFC2 Software (C6MSFC2-BOOT-M), Version 12.1(8b)E9, EARLY DEPLOYMENT RELEASE SOFTWARE (fc3)


cisco Cat6k-MSFC2 (R7000) processor with 458752K/65536K bytes of memory.
Processor board ID SAD04450FV5

How to Configure RSPAN on Catalyst 6500 IOS Switches

In our example we have two Cat switches (SWa and SWb). We have a packet sniffer connected to SWa interface F5/15 and want to monitor all the traffic going in and out of interface F3/1 of SWb.

Steps

1. Both switches must be trunked together.

2. Create an RSPAN VLAN. Preferably on the switch with VTP in server mode. Pick a VLAN ID that it is not being used currently. eg 999. If you do not have VTP, just create the VLAN on both switches.

Router(config)# vlan 999
Router(config-vlan)#remote-span

3. Create an RSPAN source session on SWb. This is the traffic you want to capture. The session number can be any integer that's not being used for other sessions. All traffic (tx and rx by default) from F3/1 now gets copied onto VLAN 999

Router(config)# monitor session 2 source interface f3/1
Router(config)# monitor session 2 destination remote vlan 999

4. Create the RSPAN destination session on SWa.This session need not have the same session ID as the one on SWb.

Router(config)#monitor session 8 source remote vlan 999
Router(config)#monitor session 8 destination interface f5/15

5. And that's it! You can obviously expand to monitor source VLANs, multiple interfaces etc. The source session describe in step 3 works even if it is configured on the same switch as the destination session - but then it's technically not RSPAN!

6. Here's a network management tip. Have your packet sniffer connected permanently to an interface on the switch and set up that interface as the destination session. So whenever the need arises to monitor packets on any interface, vlan etc., all you've got to do is configure the source session. This way you will save loads of unnecessary time trying to figure out which interface your sniffer was plugged into! And, always remember to label the interfaces with the description command.